## What changed
- Add the `codex.code_mode.v1` protobuf API for managing code-mode sessions, executions, waits, tool callbacks, notifications, and content results.
- Generate and export the Rust client/server bindings with `tonic` under Cargo.
- Add Bazel protobuf targets and a `prost` toolchain that uses the workspace's Rust runtime versions.
GitOrigin-RevId: 51d9d044e01dab2f4d25ab79aa7a52585485eee3
## What changed
- Add the effective permission profile as `sandbox_mode` in turn metadata for regular, prewarm, compaction, and detached memory requests.
- Reserve `sandbox_mode` so client-provided metadata cannot override the computed value.
## Testing
- Cover metadata headers and request bodies for read-only and danger-full-access modes.
GitOrigin-RevId: 13c690cc99bc2691023f281ca527af049bb1286f
## What changed
- Move `SkillLoadOutcome` and its implicit-path indexing into
`codex-skills-extension`.
- Import shared skill types directly from `codex-skills` and keep the skill
prompt size limit with the extension renderer that uses it.
- Remove `codex-core-skills` from the Cargo workspace and dependent crates.
GitOrigin-RevId: 4e9e84909fa2f692bcc94af990bb4671affd776f
## Why
Code-mode WebSocket connections are latency-sensitive, so buffering small TCP
writes can delay request and response traffic.
## What changed
- Enable `TCP_NODELAY` on outbound remote-session WebSocket connections.
- Enable `TCP_NODELAY` on sockets accepted by the code-mode host, logging a
warning if the socket option cannot be set.
## Testing
- Add a listener test that connects to the host and verifies the accepted
socket has `TCP_NODELAY` enabled.
GitOrigin-RevId: e51c781c4b47c6a4ae1c32c93cd79768719a68d9
## What changed
- Add `HostSkillsSnapshot::load_skill_prompts` so the skills extension owns reading and rendering selected host skills.
- Keep explicit invocation telemetry, unreadable-skill warnings, plugin prompt ordering, and suppression of host prompts superseded by provider prompts.
- Remove the legacy prompt injection and fragment implementation from `codex-core-skills`.
## Testing
- Cover prompt truncation without an installed skills extension, skill/plugin ordering, selective provider supersession, unreadable skills, and contextual fragment detection.
GitOrigin-RevId: 9c8b84ad54b90d174abc287ab49cc5a231e9e1aa
## What changed
- Stop adding `code_mode_tool_names` to Responses Lite turn metadata.
- Keep `code_mode_tool_names` reserved so client metadata cannot reintroduce the removed, unbounded inventory.
- Use the opt-in `tool_namespaces_info` metadata, including each function's `code_mode_name`, when authoritative tool details are requested.
## Testing
- Update Responses Lite and code-mode tests to verify the opt-in namespace metadata and normalized code-mode names.
GitOrigin-RevId: cbfb9af984de71c7cc175d0cd47ae799a5275309
## Why
Aborting the child waiter during termination can leave an exited PTY child
unreaped and prevent the session from recording its exit status.
## What changed
- Detach the child waiter instead of aborting it when terminating or dropping a
`ProcessHandle`, while continuing to abort the I/O helper tasks.
- Cover explicit termination and handle drops for pipe processes, plus queued
PTY waiters and PTY process-group termination on Unix.
GitOrigin-RevId: 313787f4edec80b30cf5a78f0cc6733f1520d9a4
## Why
High-volume request and streamed-response payloads can overwhelm the SQLite log database and diagnostic ring buffer used for reports.
## What changed
- Limit HTTP transport, SSE, and WebSocket diagnostics to `DEBUG` in persistent log sinks while leaving unrelated trace diagnostics available.
- Log known unhandled response events and delta events at `TRACE`, and surface unexpected event kinds at `DEBUG` without including their payloads.
- Report structured parse-error metadata instead of logging an unparseable SSE payload.
## Testing
- Cover filtering for transport, SSE, WebSocket, and unrelated trace records in both report and SQLite log sinks.
- Cover unknown and unsupported delta response events.
GitOrigin-RevId: 6d9121e093ddadf6834da394df544d9c09d8aeb9
## What changed
- Expose hosted Plugin Runtime event definitions through `McpResourceClient::list_events`.
- Add cancellable `events/stream` subscriptions that route lifecycle notifications to the matching request and cancel when the stream is dropped.
- Bound event notification and queue sizes, time out stalled response headers, and close streamable HTTP responses locally on cancellation.
## Testing
- Add streamable HTTP integration coverage for isolated concurrent subscriptions, local cancellation, and stalled response-header timeouts.
GitOrigin-RevId: 98c6fffa8f004eb2638c1b0705f659222cbbdfdb
## What changed
- Add opt-in `tool_namespaces_info` metadata for Responses Lite turns when
`tool_registry.turn_metadata_includes_tool_info` is enabled.
- Describe each model-visible function's namespace, direct and deferred
exposure, Code Mode name, and harness or MCP ownership.
- Reject visible namespaces shared by different owners when strict collision
checking and tool inventory metadata are enabled.
- Keep tool inventories out of compatibility headers and metadata sent to MCP
servers.
## Testing
- Cover opt-in behavior, MCP exposure details, namespace ownership collisions,
reserved metadata handling, and Responses Lite request serialization.
GitOrigin-RevId: 6a6965d2ba98e29444fdfbb4ccec6aafcf0391e6
## Why
Long executor and orchestrator resource identifiers can consume enough of the
skills context budget to omit otherwise available skills.
## What changed
- Add source-aware root aliases for executor, orchestrator, and host skill
catalogs, including catalogs with a single shared root.
- Select the best combination of aliased catalogs under the shared metadata
budget while accounting for root tables and alias usage instructions.
- Explain how to expand shortened `skill://` locators and accept the resulting
description-shortening warning in app-server coverage.
## Testing
- Add rendering and production-turn coverage for singleton, executor,
orchestrator, host, and combined catalog aliases.
GitOrigin-RevId: c1bc1f3d371eae9526232674060235272cc28f16
## What changed
- Compact executor and orchestrator skill locators under metadata pressure, using provider-specific `e` and `o` aliases alongside host `r` aliases.
- Derive alias roots from executor discovery paths and orchestrator namespaces while preserving host plugin root handling.
- Centralize alias ordering, deduplication, and longest-prefix matching across skill providers.
## Testing
- Cover alias planning, cross-platform executor roots, and host plugin discovery.
GitOrigin-RevId: e7d15bd3891c08ae20170e96c4ad45c76d353707
## What changed
- Add lifecycle-backed gauges for in-flight and queued app requests, pending server requests and mailbox messages, active turns, and live MCP connections.
- Register each gauge on first use and decrement it when the tracked work or resource is dropped.
- Document the new `server/diagnostics` gauge names and account for the diagnostics request itself in the response example and test.
GitOrigin-RevId: 4bb82a3918af0b502d149b5d761ad669b2083f39
## What changed
- Classify HTTP connection failures separately from other network errors without exposing request URLs.
- For sampling requests, retry connection failures with exponential delays from 5 to 60 seconds and show a `Reconnecting... waiting for network` stream error.
- Preserve the normal stream retry budget while waiting for the provider to become reachable. Keep the existing bounded retry behavior for other retryable errors.
## Testing
- Verify connection errors are classified without leaking URL contents.
- Verify a turn recovers after its provider becomes reachable and still applies the configured retry limit to a subsequent incomplete stream.
GitOrigin-RevId: 646553290c865a1332abd30c4a64ed9266bbfc6f
## Why
Interrupting a turn should also stop code-mode work that the turn left running.
## What changed
- Add the disabled-by-default `code_mode_interrupt` feature.
- When an interrupted turn has the feature enabled, terminate all active code-mode cells and propagate cancellation through nested tool calls.
- Keep the reusable code-mode session alive so its stored state remains available to later turns.
## Testing
Add an integration test that interrupts a long-running nested tool, verifies that active and background cells are removed, and confirms that session state is preserved.
GitOrigin-RevId: 2b8634776a89b636318a39b9e9ad2eefc07cead8
## What changed
- Preserve executor-native working directories, workspace roots, and permission profiles when preparing remote `exec_command` requests instead of resolving them through the host platform.
- Send sandbox intent to the remote executor, including a restricted-token default for Windows executors and `-NoProfile` for elevated PowerShell commands.
- Reject intercepted cross-platform `apply_patch` commands when filesystem writes are restricted, while continuing to allow them for unsandboxed or full-disk-write profiles.
## Testing
Extended remote unified-exec coverage for foreign Windows workspaces, elevated PowerShell, sandbox metadata, and restricted and unrestricted intercepted patches.
GitOrigin-RevId: 9fd328879fa2c15594fd58e40b6b32e8ba0847e7
## What changed
- Add optional `temporaryDirectories` file URIs to `EnvironmentInfo` so clients can resolve `:tmpdir` against executor-local defaults.
- Populate local environment info from `TMPDIR` on Unix and `TEMP`/`TMP` on Windows, resolving relative Unix paths against the working directory and removing duplicates.
- Cover protocol round trips, platform environment discovery, relative Unix paths, and the exec-server response.
GitOrigin-RevId: a41580f783b004011c064c7a4f9fdc7adf4fba10
## Why
Windows runs the state crate's database-heavy Rust tests serially within each
shard.
## What changed
Configure `state-unit-tests` to run across four Bazel shards.
GitOrigin-RevId: f540f3c157734a2b9944bae9af554ad9dbc4a69b
## What changed
- Add the tool call ID to `_meta.callId` for every MCP tool request.
- Rename `features.tool_registry.include_tool_metadata` to
`features.tool_registry.turn_metadata_includes_tool_info` to clarify that the
setting controls authoritative tool information in per-turn metadata.
- Update config parsing, schema generation, and session config locking for the
renamed setting.
## Testing
- Cover `callId` metadata for custom, plugin, and Codex Apps MCP calls.
- Update strict-config, config-loading, feature-config, and config-lock tests for
the renamed setting.
GitOrigin-RevId: ac0e58c489b03bd9b55a356f545de86c8ecaf865
## What changed
- Add the experimental `server/diagnostics` request, returning the app-server process ID, resident memory, platform-dependent physical footprint, and registered diagnostic gauges.
- Export the new protocol types in the generated JSON and TypeScript schemas and document the request.
## Testing
- Verify the response includes process measurements and the registered live-thread gauge.
- Verify the request is rejected unless `capabilities.experimentalApi` is enabled.
GitOrigin-RevId: 099d60a9c421a74ff1a72fe524e0dfeb89cf1057
## What changed
- Define skill config selectors, ordered rules, and layer-stack parsing in `codex-config`.
- Resolve disabled skill paths from generic skill name/path pairs, so configuration logic no longer depends on `SkillMetadata`.
- Update plugin and host skill consumers to use the `codex-config` API and consolidate the rule tests with the skill config tests.
GitOrigin-RevId: 3fe67869708df2652befe28d58cdeba933256f84
## What changed
- Remove the unused `core-skills` client for listing and exporting remote
skills.
- Remove its `codex-core-skills` and `codex-core` exports and dependencies that
are no longer needed.
GitOrigin-RevId: 747f760dc97da3d4dea10d619a2341f43410d0bf
## What changed
- Use `HostSkillRoot` throughout host root resolution and loading, including plugin roots.
- Remove the duplicate loader, root snapshot, and product-filtering implementation from `core-skills` now that loading is owned by the skills extension.
- Move and expand loader coverage for discovery, namespaces, filesystem routing, root merging, symlinks, and frontmatter parsing.
## Testing
- Added focused unit and integration tests under `ext/skills` and `skills` for the consolidated loader behavior.
GitOrigin-RevId: 214d06d59bf3033ee0f220ea5959ee4feff66782
## What changed
- Route plugin inventory loading and capability summaries through the injected
`SkillRootLoader`.
- Preserve recursive discovery for legacy plugins while restricting agent-plugin
skill discovery to direct children of the skills root.
## Testing
- Verify `plugin/read` excludes nested agent-plugin skills.
- Verify installed agent-plugin telemetry reports skills only for portable,
direct-child layouts.
GitOrigin-RevId: 9e78dd0c70a632d510c780963a6ceb3ad4bc2522
## Why
Plugin suggestions should report skills only when the plugin has an enabled skill.
## What changed
- Load suggestion metadata through the shared plugin skill-root loader.
- Apply skill configuration when setting `has_skills` on suggestion candidates.
## Testing
Added coverage for local plugin suggestions with the plugin skill both enabled and disabled.
GitOrigin-RevId: bceb14528c9042b474eaad6efaf919bef72e0ca4
## Why
Persisted base instructions need to retain whether they were explicitly customized or generated from a model template. Without that distinction, forks and config-lock replays can treat model-generated instructions as custom and keep the wrong template after a model or personality change.
## What changed
- Record custom or model provenance with base instructions in rollouts and config locks.
- Preserve custom instructions across model changes, while allowing model-generated instructions to follow the selected model and personality.
- Keep legacy rollouts without provenance compatible and propagate provenance through forks and spawned agents.
## Testing
- Cover provenance serialization and legacy rollout decoding.
- Cover role personality changes, forked model changes, config-lock replay, and multi-agent configuration.
GitOrigin-RevId: 801c26559835f558027ce5112700c0cd31fcb21b
## What changed
- Inject the host skill loader into `PluginsManager` so plugin discovery and agent turns use the same loading and product-policy behavior.
- Share plugin skill snapshots across those paths, preserving a consistent view of skills across workspaces.
- Apply migrated-command precedence after product filtering, allowing an eligible migrated command to replace a filtered native skill with the same name.
## Testing
- Add coverage for product-restricted plugin skills, native-versus-migrated command precedence, and the skills exposed to agent turns.
GitOrigin-RevId: f5ef0d0766ebeeb30d73ffaf044d003c2906ea4d
## What changed
- Add `SkillRootLoader` and its request/result types to `codex-skills` so skill roots can be loaded through a shared, object-safe interface.
- Add owner-managed snapshot cache handles that support reuse and use cache allocation identity for equality and hashing.
- Move `SkillError` into `codex-skills` and re-export the new loading API.
## Testing
- Verify snapshot sharing and identity semantics.
- Verify loaders can be used as shared trait objects.
GitOrigin-RevId: a26a8101008a6c862824a7346cdbe6d05f4bcc01
## What changed
- Add a `codex-diagnostics` crate that snapshots the process ID, available
resident-memory measurements, and registered process-wide gauges.
- Provide guards that update gauges for the lifetime of measured objects.
- Track live `CodexThread` instances with the `core.threads.live` gauge.
## Testing
- Add unit coverage for gauge registration, guard lifetimes, process memory
snapshots, and live-thread reporting.
GitOrigin-RevId: 3236b086bd4ebe31ed4768ab87a5fa288b0891b0
## What changed
- Add nullable `multiAgentVersion` metadata to v2 `model/list` responses.
- Represent supported values as `disabled`, `v1`, or `v2` in the Rust API and generated JSON Schema and TypeScript exports.
- Forward the value from model catalog presets through app-server responses.
## Testing
- Extend the remote model catalog test fixture with a `v2` multi-agent version.
GitOrigin-RevId: bd3b2bbe0a3b562b4d1f03df7da2a73a35713978
## Why
Applying `project_doc_max_bytes` independently to every selected environment
allows the total project instruction payload to grow with the number of
environments.
## What changed
Treat `project_doc_max_bytes` as one shared byte budget. Consume it in selected
environment order, truncate the entry that reaches the remaining limit, and
skip later environments once the budget is exhausted.
Update the configuration descriptions to document the aggregate limit.
## Testing
Add unit and integration coverage for partial and exhausted budgets across
multiple environments.
GitOrigin-RevId: 4664bdf1f23b66986349d503f44cf51560b9024f
## What changed
- Add the `environmentConfig/read` RPC for selecting literal TOML paths from executor-local config and requirements layers.
- Return layer precedence, cloud insertion points, source and base-directory metadata, and executor home and hostname context without normalizing path-bearing values.
- Expose the operation through both remote clients and local `Environment` instances, with invalid selectors reported as invalid parameters.
## Testing
- Cover projected remote config reads and rejection of empty selectors.
GitOrigin-RevId: fee15bf833de6bcb2058d405ed5b1d5d928d7218
## What changed
- Add `load_local_config_layers` to return raw configuration and requirements layers with their sources, base directories, precedence order, and cloud insertion positions.
- Support projecting layer stacks to selected TOML paths while preserving non-table override blockers and adjusting cloud insertion positions when empty layers are removed.
- Reuse project discovery and trust handling for local reads, including linked-worktree hooks, without resolving relative paths or including profiles, session flags, thread layers, or cloud-provided values.
## Testing
- Cover layer ordering, raw relative paths, legacy requirements, trust filtering, projection semantics, and untrusted linked-worktree hook handling.
GitOrigin-RevId: a1098af5650ac44e5a230ba9a5fe918927986d05
## What changed
Rename `features.tool_registry.include_tool_namespaces_info` to
`features.tool_registry.include_tool_metadata` across configuration parsing,
schema generation, resolved configuration locking, and tests. Update its
description to cover authoritative tool information in request metadata.
GitOrigin-RevId: 93b404483b71fed04031d767a41ac2bb70b836b2
## What changed
- Add `features.tool_registry.include_tool_namespaces_info` to the TOML model,
generated schema, and resolved runtime configuration. The setting defaults to
`false` and controls whether per-turn request metadata includes the resolved
tool namespace inventory.
- Preserve the resolved setting in session configuration locks.
- Cover top-level and profile-scoped strict configuration, deserialization,
resolution, and lock-file persistence.
GitOrigin-RevId: 74124086c0d7de30094b411001f0ec0af490935d
## What changed
- Add an Active/Archived status control to the resume picker and use it when listing sessions.
- Restore an archived session before resuming it, with inline error handling and duplicate-request prevention while restoration is pending.
- Keep directory filtering available for archived sessions and hide the archive shortcut while viewing them.
## Testing
- Add coverage for archived-session filtering, successful restoration, failure and retry behavior, toolbar rendering, and keyboard navigation.
GitOrigin-RevId: db3f5935e0f0bba12a110ba9c7aaf9d40abd4a4f
## What changed
- Add a `Ctrl+A` action and footer hint for archiving the selected session in the resume picker.
- Send archive requests through the app server, remove successfully archived sessions from the picker, and surface failures inline.
- Prevent duplicate actions while an archive is pending, preserve configured keybindings, and direct users to `/archive` when they select the current session.
- Ignore archive notifications for untracked side threads so they do not appear in agent navigation.
## Testing
- Cover successful, repeated, rejected, and failed archive requests, shortcut conflicts, footer rendering, and untracked-thread notifications.
GitOrigin-RevId: 20ea21c804a9685e46484d67df967859f9be4651
## What changed
- On cold `thread/resume`, restore the latest approval policy from persisted
thread settings instead of falling back to the current configured default.
- Preserve the precedence of an explicit request override over the persisted
policy.
- Account for settings applied during a turn when the subsequent compacted turn
context contains a stale policy.
## Testing
- Add unit coverage for selecting the latest persisted policy.
- Add app-server tests for legacy and paginated history, including explicit
resume overrides.
GitOrigin-RevId: 9127a3c53a90f16d67957ded9e7430e79180fc60
## What changed
- Add `codex exec fork <SESSION_ID> [PROMPT]` for creating a new thread from
an existing session ID or thread name.
- Allow creating the fork without starting a turn, or immediately continue it
with a prompt and optional images.
- Preserve the source thread ID in the emitted session configuration while
leaving the source session unchanged.
## Testing
- Add CLI parsing coverage and an end-to-end test for promptless and prompted
forks, thread naming, copied history, and unsupported promptless options.
GitOrigin-RevId: b8f28b238a1526cc486c5beb886a63f68b8e7986
## Why
A local stdio MCP server can exit while its descendants remain alive. Cleaning up
only the server process can therefore leak processes after client shutdown.
## What changed
- Contain locally launched MCP servers in non-breakaway Windows job objects and
terminate the job during shutdown so descendants exit with the server.
- Preserve compatibility when job creation or assignment is unavailable by
retrying without containment and terminating an owned process handle instead.
- Use the process-group member fallback when terminating piped processes on
macOS.
## Testing
- Cover descendant cleanup and breakaway prevention for both local MCP protocol
modes on Windows.
- Cover the Windows nested-job assignment fallback and verify the suspended
process resumes before handle-based termination.
GitOrigin-RevId: 33d3cc122de8f7ce0ae69a649b12ea0ff64b7c6f
## What changed
- Parse `mcp_tool` hook handlers with a server, tool, JSON input, and optional timeout and status message.
- Return managed MCP tool hooks from `configRequirements/read` and include the handler in the generated protocol schemas.
- Skip MCP tool hooks during discovery with an explicit warning until execution is supported.
## Testing
- Cover MCP tool hook deserialization, including nested and null JSON input values.
- Extend the config requirements RPC test to verify the new handler shape.
GitOrigin-RevId: ff7e2d12b75b486c54d63469af547a29f9b31418
## What changed
- Show `Ask Codex to do anything` in the main conversation input.
- Show `Ask a follow-up question` in side conversation inputs.
- Remove randomized example prompt selection and update the side conversation snapshots.
GitOrigin-RevId: 2f6d310cf80bfa9743b7695621892a821eda4a18
## What changed
- Add `/export` with clipboard and file destinations, including a default filename prompt and support for an explicit path argument.
- Export the complete conversation history as structured Markdown, preserving user and assistant messages, plans, reasoning, activity, image labels, file changes, and MCP tool details while honoring reasoning visibility.
- Fall back to legacy history loading when pagination is unavailable, and use the visible transcript for ephemeral sessions.
- Resolve relative and home-relative paths without overwriting an existing file, and report export or copy results in the conversation.
## Testing
- Cover Markdown rendering, hidden review prompts, activity details, complete paginated and legacy history loading, destination prompts, status messages, path resolution, and overwrite protection.
GitOrigin-RevId: c2815fc2430d7a555da75d7038cc1ac08157b82e
## What changed
- Clamp `wait_agent` timeout requests below `min_wait_timeout_ms` instead of rejecting them.
- Include the timeout adjustment in the wait result message and document it in the tool output schema.
## Testing
- Update the handler test to verify the configured minimum is honored and the adjustment is reported.
- Update the schema test for the expanded result message.
GitOrigin-RevId: 2b4a770ed6d1e9c45b351b479f5ae50c9a3d5388
## What changed
- Honor `CODEX_AGENT_IDENTITY_AUTHAPI_BASE_URL` and
`CODEX_AGENT_IDENTITY_JWKS_BASE_URL` when registering and verifying agent
identities.
- Normalize override values by trimming whitespace and trailing slashes.
- Preserve ChatGPT environment validation, while allowing a custom launcher
configuration when its ChatGPT and JWKS base URLs match and an AuthAPI
override is explicitly configured.
## Testing
Added coverage for explicit staging overrides, custom launcher compatibility,
and rejection of overrides that would bypass environment validation.
GitOrigin-RevId: c557c8167ec101c2993f65aad3fcb3bf25785d51
## Why
App-server integration tests can encounter a transient `ExecutableFileBusy`
error while starting their server process.
## What changed
Retry that specific spawn failure up to twice with a 10 ms delay, while
returning all other spawn errors immediately.
GitOrigin-RevId: 0982a9fe66bae4c41f556c845d12fb515dbf752c
## What changed
- Add `features.code_mode.default_exec_yield_time_ms`, defaulting to 30 seconds.
- Apply the configured default to code-mode `exec` calls that omit `yield_time_ms` and reflect it in the tool description.
- Remove the `code_mode_buffered_exec` compatibility feature flag.
## Testing
- Cover config loading and tool descriptions for both default and custom yield timeouts.
GitOrigin-RevId: 581ffc737b04721c7b5fc81260b1da1cf7d87523
## What changed
- Add `ThreadManager::with_thread_id_generator` to configure ID allocation for new root, child, and forked threads.
- Keep the standard UUIDv7 generator as the default and preserve stored IDs when resuming threads.
- Add `ThreadId::from_u128` for constructing identifiers from UUID-compatible values.
## Testing
- Cover default allocation, custom IDs across roots, child agents, and forks, and ID preservation on resume.
GitOrigin-RevId: 6c38c862e30a50bad944a994bcbccf7d1e7ada24
## Why
Binding the full host filesystem into a network-isolated Bubblewrap sandbox also
inherits the host's device tree.
## What changed
- Overlay `/dev` with Bubblewrap's minimal device filesystem while preserving
the root bind's `nodev` behavior.
- Bind `/dev/shm` back into the sandbox when available so host and sandbox
processes can continue to share memory files.
## Testing
Add a managed-proxy integration test that verifies standard device nodes remain
usable, `/dev` is not the host directory, and `/dev/shm` writes are shared with
the host.
GitOrigin-RevId: 1d91fe44affd792d2777adae8f2cce6d85d14103
