## What changed
Expose `InheritedSessionId` so a host can supply a root session ID through `ExtensionDataInit` when starting a fresh child thread. The child retains its distinct thread ID, and the inherited session ID is persisted in rollout metadata and restored on resume.
Reject inherited session IDs for resumed, forked, or native agent threads, and reject an inherited session ID that equals the child thread ID.
## Testing
Add an integration test covering distinct child identity, inherited session metadata, and restoration after shutdown and resume.
GitOrigin-RevId: e3462433f9d8a0bba24251ee2b6d5329557ddb31
## Why
Hosts need to apply subagent-style capability restrictions without changing a thread's session attribution, agent lineage, or permission profile.
## What changed
Add the public `RestrictRootCapabilities` marker to thread startup extension data. Capture the restriction once at startup and apply it alongside the restrictions native subagents already receive. Hosts must supply the marker again when cold-resuming a restricted thread.
Use the restriction to gate user-input and plugin-install requests, async user messaging, legacy MCP tool approvals, and Full Access MCP form input. Exclude inherited user messages from Guardian's retained authorization context for restricted threads, including after cold resume.
## Testing
Add coverage for host-restricted tool registration, MCP approval rejection, Full Access form-input handling, and inherited instruction authorization after cold resume. Update handler tests to exercise the shared restriction flag.
GitOrigin-RevId: 4d6d7102a20dc747431c7511a74a204c773e8420
## Why
Host-owned runtimes skip controller rollout-budget accounting. Give hosts an optional callback to account for inference spending and signal budget exhaustion.
## What changed
- Add `AgentUsageAccounting`, `AgentUsageReport`, and `UsageAccountingDecision`, captured at startup and supported by host child spawn reservations.
- Await per-response usage reports with thread and turn attribution, including provider budget units and foreground and background compaction usage.
- Map host exhaustion to `SessionBudgetExceeded` and accounting failures to fatal errors without retrying inference. Preserve the original error for incomplete responses.
- Keep controller accounting unchanged and leave accounting disabled for host-owned runtimes without a provider.
## Testing
Add coverage for usage attribution, child accounting, budget exhaustion, nonretryable accounting failures, incomplete responses, and compaction reporting, including background usage charged once to its originating turn.
GitOrigin-RevId: 887703f50fe882497e4e8cb33259072935ec82e0
## What changed
Add `AgentRuntimeOwnership::Host` and an `AgentTurnAdmission` provider so hosts can acquire execution capacity before runtime tasks run, including root turns. Require the provider at startup and retain its execution guard for the task lifetime. Controller ownership remains the default; host ownership skips controller rollout-budget accounting, budget reminders, and subagent roster context.
Keep pending admission interruptible without blocking input submission. Report admission failures through the turn lifecycle, record accepted input before exposing the error, and unwind task setup such as review mode. Preserve recoverable input during suspension. On interruption, skip prompts that still require a `UserPromptSubmit` hook rather than recording them without inspection.
## Testing
Add integration tests for missing-provider startup cleanup, denial and immediate retry, steering during admission, cancellation, execution guard lifetime, submit-hook handling, suspension recovery, and review-mode cleanup. Add a context snapshot verifying retained input reaches the next admitted turn.
GitOrigin-RevId: 9ee85fad2ecfbfb38735bac8ef88888fb179a967
## What changed
Replace `thread_store_from_config` with `ThreadStoreBuilder`, exported through `codex_core` and `codex_core_api`, and migrate callers to the builder.
Allow hosts to register `with_additional_cleanup` for permanent deletion in local stores. The callback runs after successful agent-board cleanup and before rollout deletion, under the existing deletion locks. Document that cleanup must be idempotent and must avoid thread-store operations that reacquire those locks. In-memory stores do not invoke the callback.
Preserve the existing backend selection, startup rollout migration, and compression behavior.
GitOrigin-RevId: f2853d7de06fe12ef29451b204cf9fcbb349c359
## Why
Host-owned tools need to wait for agent messages or steering input with the same behavior as native `wait_agent`, including when native multi-agent support is disabled.
## What changed
- Add `CodexThread::wait_for_input_activity` and export `InputWaitOutcome` through core and core-api, sharing the wait implementation with `wait_agent`.
- Distinguish notifying agent messages from steering input, with steering taking precedence when both are pending. Passive response items do not wake waits.
- Observe input without consuming it. Waits remain active after the original turn ends, support independent observers, and can be cancelled by dropping the future.
## Testing
Add coverage for pending and incoming input, agent-message classification, cancellation, independent observers, timeouts, and input arriving after the original turn completes or is interrupted.
GitOrigin-RevId: d0c0bd776c3b6fd4ba3021603d87eaaf1d93976f
## What changed
Replace `PreparedThreadSpawn` with `PreparedChildContext`. `CodexThread::prepare_child` now captures parent inputs from a live tool invocation without requiring a child request. Hosts choose the child's name, role, and history, bind destination services, and apply child settings.
Expose captured instructions, environments, permissions, approval settings, disabled plugins, current inheritable dynamic tools, and an execution-policy snapshot with its original managed requirements. Retain those requirements across MCP configuration refreshes so hosts can assess policy-source compatibility.
Remove `ThreadManager::create_prepared_child`; `CodexThread::create_child` handles reserved child startup on the parent's manager with invocation-bound cancellation and cleanup.
## Testing
Add coverage for execution-policy snapshots and managed requirements after MCP refresh. Update child-spawn tests to verify captured instructions and permissions, current dynamic-tool declarations, and fresh versus forked history.
GitOrigin-RevId: f15b595b44997fa70cd0c9be0e92f470e1f333e1
## What changed
Add `AgentMcpMetadataRecipient` as a thread extension that lets the host select which MCP plugin registration receives `x-codex-root-turn-id` and `x-codex-cyber-access-program` in tool-call metadata.
Require an exact match on the plugin ID, installed root, server name, and transport configuration in the `local` MCP environment. Omit both keys without host opt-in or when the registration does not match, including same-name user overrides. Send JSON null for unset values on matching registrations.
## Testing
Add unit tests for registration matching and integration coverage for host opt-in, same-name user overrides, and an unset access program.
GitOrigin-RevId: eaa44e17b29aa0bdec6f6ed9faa86b8fc931faad
## What changed
- Match final serving assessments to their response and output item, then retain them with tool invocations and code cells across waits.
- Use matching assessments instead of asynchronous scoring for adaptive review: low-risk actions can skip synchronous review, while elevated-risk actions require it.
- Revalidate captured authorization and policy before approval. Require fresh review for stale or incomplete authorization, preserve explicit review requirements, and discard assessments when hooks rewrite tool input.
- Keep asynchronous scoring as the fallback when an assessment is missing or does not match.
## Testing
Add integration coverage for direct and nested tool calls, hook rewrites, explicit escalation, interrupted responses, catalog-driven policy, incomplete authorization, and assessment retention across code-cell yields and waits.
GitOrigin-RevId: 4346a227204137f018c03c34b302d6f1e9592c96
## Why
A thread runtime can shut down while listener setup is awaiting I/O, and a cold resume can start before the previous listener forwards `ShutdownComplete`. Listener replacement must preserve those buffered terminal events.
## What changed
- Coordinate listener installation and connection subscriptions with pending unloads, and reject closing or replaced runtimes.
- Allow a newly created runtime that has already shut down to drain its queued events, while enforcing one event reader per runtime.
- Track shutdown draining with a shared watch channel so cold resume and runtime replacement wait for terminal events to be processed.
- Serialize idle unloading with goal edits and cold resume, and recheck thread state after acquiring the lock.
GitOrigin-RevId: d05e348b0a81bddb2defa963d0cfd3fde08dbd03
## What changed
- Add `CodexThread::create_child` to create an idle child from a live tool invocation using a host-reserved thread ID and controller.
- Add `prepare_child` and `ThreadManager::create_prepared_child` to capture inherited settings and fresh or forked history, then start the child on another manager even after the parent shuts down. Reject detached preparation when live bindings cannot be transferred.
- Add opt-in `HostToolInvocationLookup` to track live calls and reject duplicate active call IDs within a turn. Revoke invocation access when dispatch ends and clean up provisional children when startup fails or is cancelled.
## Testing
Add tests for invocation lifetime and call ID reservation, inherited policy and live bindings, detached startup with fresh and full history, and cancellation cleanup.
GitOrigin-RevId: 71f17ecb4cd7636517e675df59289a8e8c7105b8
## What changed
- Include ready environments' configured hooks in lifecycle events and execute command hooks using each owner's shell, working directory, shell environment policy, and managed network policy.
- Resolve tool environments before `PreToolUse` and use those targets for tool hooks, execution, and permission review. Route MCP hooks by server ownership and file-copy hooks to both endpoints.
- Preserve environment, MCP server, and terminal session selectors across hook input rewrites, rejecting attempts to switch targets.
## Testing
Add regression coverage for permission-request selector preservation, MCP resource hook ownership, and file-copy hooks that rewrite paths while preserving source and target environments.
GitOrigin-RevId: 31a3a6830523965285dab451cfc866c620ef6c83
## What changed
Add `MessageLifecycleContributor` hooks to capture extension state when local agent control publishes a message and notify contributors when the recipient commits it to history, before sampling.
Carry shared delivery state through submissions, input queues, and mailbox eviction with `PendingAgentMessage`. Notify consumption at most once per delivery, release captured state when consumed or abandoned, and drop pending mail outside queue locks. Preserve the serialized message format without republishing restored history.
## Testing
Extend the mailbox eviction test to verify that publication state survives eviction and retained messages are consumed before the first resumed model sample.
GitOrigin-RevId: 9a1f6832bd48ec646a3fd179485c095e8dcc72cc
## What changed
Expose `PromptCacheKey` through `StartThreadOptions` with three policies: retain the default session-derived key, send a custom key, or omit `prompt_cache_key` from model requests. Keep session identity headers independent of this policy.
Propagate the policy to child agents, delegated sessions, and guardian review sessions. Hosts must reapply the policy when resuming a thread from storage.
## Testing
Add coverage for all three policies across turns, including unchanged session and thread headers. Extend subagent coverage to verify inheritance of the default and omitted-key policies.
GitOrigin-RevId: f9e8ab31fcf568636f9712726760e4e9a4672428
## What changed
Add `experimentalDisablePredictionMcp` to `thread/fork` and `disableMcp` to `thread/sample`. Disable MCP servers when requested and the inherited history contains incremental tools on Responses Lite. The fork option requires `experimentalPredictionMode: true`.
Apply disablement through a thread-local policy that excludes configured MCP servers and runtime contributions, including after MCP refresh. Preserve the inherited history prefix and append tool-removal instructions without changing the parent's tools.
## Testing
Add coverage for prediction forks with legacy and paginated history, flag validation, conditional disablement, MCP refresh, and sample/fork request parity. Add a request-history snapshot covering preserved history, tool removal across child turns, and unchanged parent tools.
GitOrigin-RevId: e31d602480e6550ed130d8152f538b8668280fa0
## Why
A remote primary environment could supply its working directory and workspace roots to host plugins and MCP processes, breaking relative MCP executable resolution and applying the wrong workspace permissions.
## What changed
- Build host configuration from the local environment, falling back to the session's host working directory and runtime workspace roots when no local environment is selected. Preserve explicitly empty local roots.
- Use the same host configuration for MCP startup and refresh, and refresh MCP state when runtime workspace roots change.
- Keep repository skill discovery paired with the primary executor's working directory and filesystem.
- Box skill warmup and turn context construction futures to reduce enclosing future sizes.
## Testing
Extend the MCP integration test to cover a remote primary with populated, empty, or absent local roots; relative executable resolution before and after refresh; workspace-root revocation; and remote repository skill discovery.
GitOrigin-RevId: 21a73c90507b55fd94261e7bf348695ff8466a24
## What changed
Move child configuration, task path construction, fork usage hints, and backend spawning into `core::thread_spawn`. Add request, result, and error types that distinguish preparation failures from backend errors.
Route the v2 `spawn_agent` handler through the shared helper while retaining tool-specific telemetry, activity events, and response formatting in the handler.
GitOrigin-RevId: a09a8f66beb41c1403220750d236a12717dbfc6c
## Why
Client-supplied tool outputs can carry task instructions. Even when marked with `retain: true`, these instructions could be trimmed before compaction and disappear from the compacted history.
## What changed
Add the disabled-by-default `retain_client_tool_outputs` feature to honor retention for explicitly marked, named `function_call_output` items without a `call_id`.
- Preserve eligible outputs in remote compaction v2 and when starting a new context window, keeping their original role.
- Stop emergency tool-output trimming at a retained output.
- Share the existing 64,000-token retention budget, keeping outputs whole and dropping an oversized output and older items rather than partially truncating it.
- Place initial context before retained standalone outputs and account for their images in retained-image counts.
## Testing
Add a scenario covering enabled and disabled retention, emergency trimming, oversized-output handling, and preservation of the latest instruction after compaction and cold resume. Verify that retention annotations stay out of model requests.
GitOrigin-RevId: 449179670e4d2be2623928700738758e43b5dc1a
## What changed
- Add `grpc+stdio://` as a host transport and the disabled-by-default `code_mode_host_grpc` feature flag to select it.
- Share a lazy HTTP/2 channel and host process across code-mode sessions while keeping session state isolated.
- Use HTTP/2 keepalives to detect unresponsive hosts, kill and reap disconnected children, and spawn a fresh host on reconnect. Exit the host when its stdio connection closes.
## Testing
Add coverage for shared-host session isolation, host exit on stdin EOF, and recovery after an unresponsive host is reaped. Exercise nested tool calls with both legacy stdio and gRPC stdio, asserting that the feature flag selects the expected transport.
GitOrigin-RevId: 31389d8540de236b8e0571d3c24e29e117b75c4a
## What changed
Pass the parent turn's `cyber_access_program` to Guardian reviewers and asynchronous classifiers. Use `daybreak_blue` for either Daybreak selection, preserve `standard`, and omit `access_programs` when no program is selected.
Capture the selection with the owning turn so asynchronous observations retain it across later turns. Resolve classifier programs using current authentication and the same provider and API-key feature policy as ordinary model requests.
## Testing
Add regression tests for program changes across reused reviewer sessions with API-key and ChatGPT authentication, snapshot and conversation classifiers at low and high risk, and enabled, disabled, and unsupported-provider API-key policies. Verify parent requests retain their selected program.
GitOrigin-RevId: 447f306df3a6bd6805464b819950690c751b04b4
## What changed
- Route app-server idle unloading of multi-agent v2 children through local eviction that preserves unread mail and environment selections for reload.
- Hold residency pins through input submission so newly reloaded children cannot be evicted before receiving their work.
- Guard listener cleanup against replacement runtimes and subscriptions, and reject local eviction of host-controlled threads.
## Testing
Add coverage for unsubscribe-driven eviction followed by `followup_task`, verifying restored conversation context and exactly-once delivery of queued mail. Extend tests to check that residency pins block eviction and that rejected host eviction preserves the thread and mailbox.
GitOrigin-RevId: e36723730af683d2081e495e637f0e6d23548b8d
## Why
Agent tree shutdown previously returned a generic error without identifying which operation or thread failed, making cleanup failures difficult to diagnose.
## What changed
- Add `AgentTreeShutdown::wait_detailed()` and public report types while preserving the existing `wait()` result and error message.
- Record operation, optional thread ID, and either an abandoned teardown guard or a failed phase with a payload-free error category across session cleanup, child spawn cleanup, and resident eviction.
- Give each tree a correlation ID, log each failure, and retain up to 64 failures with a count of additional failures omitted. Record failures before releasing tree membership so all completed waiters observe the same report.
## Testing
Add unit coverage for aborted and completed teardown, cloned guard context, concurrent and repeated waiters, omitted failure counts, and report formatting without raw error payloads. Extend integration coverage for successful tree shutdown and persistence writer failures, including compatibility with `wait()`.
GitOrigin-RevId: 68784af28b63e875b00a55d78729f0cc5b01ac15
## What changed
Add `turn_extension_init` to thread startup and settings, and expose `WithTurnExtensionData` for turn input, recovery, and settings requests. Accept or reject data updates together with the request that supplies them.
Each new turn captures the configured data, including automatically started turns. Accepted steering updates the data for future turns while preserving the running turn's capture. Plain requests preserve the configured data; an empty initializer clears it. The data is not persisted and must be supplied again on cold resume.
Expose `current_turn_extension_data` to retrieve typed data only when the requested turn is still running and has not been cancelled.
## Testing
Add an integration test covering initial capture, accepted and rejected steering, inheritance by an automatic turn, clearing future data without changing the active capture, and rejection of lookups for an earlier turn.
GitOrigin-RevId: dd81eda3e32c7b62d783c772221858f4c0e68264
## What changed
Expose `ThreadManager::request_agent_tree_shutdown` and an `AgentTreeShutdown::wait` handle. Requests reject new starts in the shared runtime, cancel pending startup, and signal every session in that tree, including delegates outside the thread registry. Waiting covers admitted operations and session teardown, and reports cleanup or persistence writer failures. Other root trees remain unaffected; registry removal and persistence handoff remain caller responsibilities.
Retain tree membership through startup, cancelled spawn cleanup, residency eviction, and completion watchers. Release persistence resources before returning startup failures, and stop completion watchers during tree shutdown without reporting shutdown as a child result.
## Testing
Add coverage for tree isolation, children removed from the registry, delegate teardown, cancellation during required MCP initialization, aborted teardown, persistence writer failures, and successful retry after a failed resume releases its writer.
GitOrigin-RevId: a109e25adf23d20baf7595891099947050c6b6b5
## Why
Configuration reloads must honor current managed restrictions without granting new enterprise MCP authority to existing sessions or overwriting newer configuration with stale snapshots.
## What changed
- Allow enterprise managed authentication only for configured MCP servers. Remove plugin `ema_auth` overlays from the schema and disable servers that still use them.
- Refresh ordinary MCP settings while preserving session settings and initially admitted enterprise registrations. Disable enterprise MCP when its registration changes, policy revokes access, or configuration loading or resolution fails; require a new session to restore enterprise authority.
- Publish refreshes only when their captured configuration is still current, with bounded retries in app-server reloads. Preserve updated managed restrictions even when a refresh is rejected.
- Finish processing other thread refreshes before `config/mcpServer/reload` reports a rejection, and document that an error can accompany partially applied changes.
## Testing
Add regression coverage for stale refreshes, bounded retries, managed-policy revocation, persistent enterprise disablement, ordinary MCP transport changes, and rejection of plugin enterprise authentication. Verify that denied enterprise servers receive no requests.
GitOrigin-RevId: 34429cd339c1ec152a2ee8697cb29f0cff5d9e5f
## Why
A previously used WebSocket can close while a thread is idle. Hosts need a way to prepare the connection before the next turn without repeating warmup on a healthy connection.
## What changed
- Expose `CodexThread::prewarm()` using the existing startup warmup and next-turn handoff.
- Reuse healthy connections and pending warmups, retry failed warmups, and repair closed connections. Treat a finished WebSocket reader task as a closed connection.
- Skip scheduling during an active turn or shutdown, and stop warmup admission before shutdown takes the pending task.
- Expose `active_turn_environment_selections()` so hosts can inspect the environments captured by the active turn, including those still starting or failed, when authorizing steering.
## Testing
Add regression coverage for repeated idle prewarm calls, healthy connection reuse with preserved response continuation, reconnection with `generate: false`, and warmup rejection after shutdown. Update delayed MCP discovery coverage to verify prewarm repairs an eagerly closed socket and the first turn reuses it.
GitOrigin-RevId: aa164b91a399de2375eda3bf28397725439fce93
## What changed
Add `ModelRequestContributor` and `ModelResponseInterceptor` to the extension API. Contributors can add filtered `client_metadata` without overwriting existing or reserved fields and create interceptors for individual requests.
Wire contributors into HTTP and WebSocket requests, distinguishing generation from warmup. Apply response interceptors in registration order before tracing and response bookkeeping so transformed output is recorded consistently. Interceptors can inspect, buffer, or transform events, with stream ownership carrying request state and cancellation.
## Testing
Add tests for metadata protection, incremental event transformation, interceptor ordering, upstream cancellation, and consistency between delivered output, traces, and WebSocket bookkeeping. Integration tests cover output gating and interruption over HTTP and WebSocket, including a contributor that bypasses gating for warmup requests.
GitOrigin-RevId: d4bc1745d2cacf8636728dbc0a58ab9f250e9392
## What changed
- Store `Arc<dyn AgentControl>` in session services and route agent tools, turn admission, usage accounting, completion notifications, and shared settings through the trait.
- Add `AgentControlInit` so delegated and guardian sessions inherit the parent's controller and local runtime.
- Move local registry and context helpers to `LocalAgentRuntime`, keep resume, close, inspection, and status subscriptions on the local controller, and simplify synchronous and infallible trait methods.
GitOrigin-RevId: ad3f213eb483ac524bde56d769f20a78f20989a0
## What changed
- Add `environments` to `TurnSettingsUpdate` to replace the selection for subsequent steps without changing future turns.
- Capture model settings and environments together so combined updates apply or reject atomically, while existing steps retain their captured selection.
- Validate environment IDs, working directories, configuration ownership, and permission requirements against the running turn's selections.
- Preserve executor startup behavior when switching environments and use the step's local working directory for tool hooks.
## Testing
Add coverage for workspace switching and restoration on the next turn, atomic model and environment updates, permission validation, executor connection waits, and replacement of pending environment selections.
GitOrigin-RevId: 02b5c57a78fd594b2aed84fc09d9e99eb97be28c
## What changed
Add an adapter that delegates the shared controller interface to existing local agent operations, including lifecycle management, message delivery, status observation, budget accounting, and shared settings.
Align the trait signatures and documentation with local behavior: separate advisory capacity checks from execution tracking, preserve best-effort completion reporting, and return optional guardian evidence. Use `SessionId` for controller identity and replace paginated queries with loaded-agent listing by path prefix, removing the obsolete types and exports.
GitOrigin-RevId: 15bb7135e0f180d207390f6f2e75f63b9058816a
## What changed
- Register the existing message-board tools with the app server through a lifecycle extension, gated on `agent_message_board`, multi-agent v2, and non-ephemeral sessions. The new feature flag is disabled by default.
- Bind tools to each agent's identity and share the SQLite-backed board across the agent tree and runtime resumes.
- Use the runtime clock for posts and deliver ID-only notifications to running agents, with tools to retrieve post contents. Skip inactive recipients without starting them or queuing notices.
- Emit a warning and leave board tools unavailable if initialization fails.
## Testing
Add runtime scenarios and a context snapshot covering feature gating without creating storage, posting and searching, active-only notifications, sharing with child agents, persistence across resume, and clock failure without channel creation.
GitOrigin-RevId: a81bd85cd372b0d122ba375ed1a1bfd3ba3a3b7c
## What changed
Add a public, object-safe `AgentControl` trait and request/response types for coordinating an agent tree independently of where its threads run. Define contracts for lifecycle operations, message delivery, status observation, execution admission, usage accounting, shared configuration, and guardian evidence.
Move shared agent types out of the local controller and export them from `codex-core`. Let `AgentExecutionGuard` own a backend-provided reservation while preserving the local limiter's release-on-drop behavior. Include `root_thread_id` in `GuardianRootSnapshot` to identify the source of authorization evidence.
## Testing
Add tests for reservation release when a guard is dropped or a turn is cancelled, and extend the guardian authorization test to assert the root thread identity. Check trait object safety at compile time.
GitOrigin-RevId: 9385c9fbfd189f08429539fd89061ef8c9efe0d9
## What changed
- Record an explicit allowlist of scalar configuration values and individual boolean feature tags for each sampling request, replacing the combined enabled-feature list.
- Distinguish configured context-window overrides from the effective model limit, and emit `unset` for absent values so earlier overrides do not linger.
- Expand `tags_json` into report metadata and raise the tag limit from 64 to 512, while allowing existing values to update at capacity.
## Testing
Add tests for configured and effective context windows, clearing overrides, feature toggles, dynamic tag upload serialization, and updates at the tag limit.
GitOrigin-RevId: 57608fac936d8ce315e36d452a2950e46370b39b
## Why
`CodexThread` retained the full `SessionConfiguredEvent`, including initial replay messages, and cloned it even for callers that only needed thread or session IDs.
## What changed
Store `ThreadStartupMetadata` without replay history and expose it by reference through `startup_metadata()`. Update callers to read IDs from this metadata. When rejoining a running thread, rebuild the startup response using the supplied resume history for `initial_messages`.
## Testing
Extend the resume test to verify that rejoining reuses the loaded thread, preserves startup metadata, and still returns the original replay messages as a prefix.
GitOrigin-RevId: 9d656063088c28f091d29e5862e4b9d894b7642c
## What changed
- Replace dedicated Guardian endpoints with `/responses`, sending `x-codex-guardian: reviewer` or `x-codex-guardian: classifier` for eligible Codex backend requests over HTTP and WebSocket.
- Add model-scoped thread headers, recheck backend authentication on each request attempt, and reconnect WebSockets when the applicable headers change.
- Retain `features.guardianv2.free_guardian` for configuration compatibility while removing its routing gate; the backend now controls Guardian billing.
## Testing
Update tests for reviewer and classifier headers, model and authentication scoping, HTTP fallback, WebSocket reuse, and parent-response metadata across retries.
GitOrigin-RevId: 1c2b3c458ab77fb40aae4ee6784f6d827c60e76c
## Why
Inline delegates have no entry in the thread registry, so reviewer creation cannot depend on looking up the parent or waiting for its thread-ready notification.
## What changed
- Capture parent identity, authentication, shared agent control, originator, and inherited instructions in `StartThreadOptions` so `ThreadManager` can start a child without a registered parent.
- Route Guardian reviewer creation through this path, remove the standalone fallback and readiness gate, and require a Guardian extension host.
- Install explicit reviewer hosts in unit tests and the Guardian reviewer extension in the integration test harness, using `ExtensionRegistry::to_builder()` to preserve existing contributors.
## Testing
Extend the thread-manager regression test to remove the parent from the registry before starting a child, then verify inherited lineage, originator, session identity, and authentication, and exclusion from the public thread list.
GitOrigin-RevId: 468ded6fdce7520cb39d55c1a884dcfa5aaea2d9
## What changed
Probe the default Windows system config namespace at session start and record `codex.windows_system_config.namespace_squatting_probe` once per process when metrics are available.
When `config.toml` or `requirements.toml` exists, check the containing directories for expected ownership and broad standard-user mutation allow ACEs, including permissions inherited by child files. Report coarse results for missing files, expected directories, unexpected types or owners, mutation permissions, and check errors.
The probe is observational: it does not change configuration loading or enforce a trust decision.
GitOrigin-RevId: e1c79dca5548e16e83c7b84b44ab0de4e2643d0d
## Why
Remote compaction already uses the normal Responses API, leaving the legacy `/responses/compact` runner unused.
## What changed
- Remove the legacy runner, endpoint client, request types, analytics variant, and obsolete test helpers and snapshots.
- Move tool-output trimming and its metadata tests into `compact_remote_history` for reuse by remote compaction v2.
- Consolidate retained-history filtering in the v2 implementation and remove redundant `RemoteCompactionV2` settings from tests.
## Testing
Extend the retained-history unit test to explicitly check that hook prompts survive compaction.
GitOrigin-RevId: 999bb1391aa22c3c281d6a96f98817d6c9e46ed9
## What changed
- Route manual and automatic remote compaction through the v2 implementation.
- Retire the `remote_compaction_v2` feature toggle while continuing to advertise it in the model client beta features header.
- Migrate compaction tests from `/responses/compact` to streamed `/responses` requests with `compaction_trigger` items and remove legacy parity coverage.
## Testing
Add streamed compaction coverage for tool search output trimming and session base instruction token estimates. Update app-server tests to verify started/completed notifications for both local and streamed remote compaction.
GitOrigin-RevId: cea392a6166a9b116ff83708fd9126d5546476e4
## What changed
- Store the shared `GuardianReviewSessionManager` in thread extension data and let the Guardian extension spawn and fork reviewers through `ThreadManager`, independently of async scorer startup.
- Preserve reviewer reuse, concurrent forks, cancellation, inherited environments, and user instructions. Gate managed reviewer startup on parent registration and remove terminated reviewers from the manager.
- Retain the `guardian` subagent identity in saved conversations. Reject resume of live Guardian reviewers and reject client archive or delete of live owner-managed workers with JSON-RPC error `-32600`; allow normal access after the owner releases them.
- Keep standalone reviewer support for inline delegates and remove duplicated extension prompt and configuration code.
## Testing
Add app-server tests covering reviewer reuse and concurrent forks, inherited instructions and prompt cache keys, live resume and removal rejection, saved reviewer discovery and resume after parent shutdown, and strict Guardian assessment inside an inline review.
GitOrigin-RevId: 4f9893c1ade151eacb4c11ffeae3d9e9ec019187
## What changed
Add a public `codex_core::guardian_review` module exposing `GuardianAssessment`, the assessment parser and output schema, and the review session configuration builder for reuse by the Guardian extension.
Extract assessment handling and reviewer configuration into dedicated modules, preserving the existing parsing defaults, policy prompt, and read-only reviewer settings.
## Testing
Move the existing embedded-JSON, bare allow/deny, and output-schema tests alongside the assessment implementation.
GitOrigin-RevId: cb2aba3ccdb597e2876015e718e923d4f8f36802
## What changed
- Add the `codex-attachment-store` crate with storage-neutral attachment metadata, references, errors, and an asynchronous persistence interface.
- Provide an inline implementation that preserves attachment bytes as media-typed base64 data URLs.
- Inject the store into `ThreadManager`, expose it to consumers, and retain inline storage as the default for existing entry points.
## Testing
- Verify inline storage round-trips binary, text, PNG, and JPEG data.
- Verify attachment debug output redacts URLs while retaining file IDs.
GitOrigin-RevId: 7688dcd3c89d7540ed2398f3e7c63881fbfcda97
## Why
Realtime history should be recorded consistently for every Core host, including
when no app-server event listener is attached.
## What changed
- Move transcript segmentation, session boundaries, and backing-agent artifact
promotion into Core for paginated threads.
- Persist canonical realtime items through the thread store in event order and
emit dedicated history lifecycle events for hosts to present.
- Translate those Core events into the existing app-server realtime item
notifications without app-server persisting the items a second time.
## Testing
- Cover Core-only persistence across repeated sessions, ephemeral sessions,
accepted and rejected steering, typed input ordering, and artifact promotion.
- Verify app-server notifications correspond to the persisted timeline.
GitOrigin-RevId: 7cbef14129d77f6d6d7099b733be91f5279c55f5
## What changed
- Add the experimental `turn/start.cyberAccessProgram` option with `standard`,
`daybreakBlue`, and `daybreakRed` values.
- Forward the selection as `access_programs.cyber` on Responses, WebSocket,
and remote-compaction requests made with ChatGPT authentication, while
omitting it for API-key and custom-provider requests.
- Preserve the per-turn selection across recovery, compaction, and child-agent
turns without making it a persistent thread setting.
## Testing
- Cover app-server forwarding, authentication boundaries, WebSocket reuse,
turn recovery, compaction, and child-agent inheritance.
GitOrigin-RevId: d2eb468f365b2214c5099bc21741cf30f8bd2eb5
## Why
An active root turn needs to be stopped without marking it complete or aborted
before another runtime can recover the same turn ID.
## What changed
- Add `CodexThread::suspend_turn_and_shutdown` and `SuspendTurnOutcome`.
- Flush history, stop the active regular task, close the history writer, and
shut down the session without recording a terminal turn event.
- Reject suspension when no supported turn is active or the loaded agent
subtree still contains a live descendant.
## Testing
- Verify that suspension preserves unfinished history and allows the turn to be
recovered under its original ID after the descendant guard is cleared.
GitOrigin-RevId: 1f9b019d07c51474ec2d991d263bc15cdd4f89ad
## What changed
- Retain bounded evidence from completed synchronous Guardian allow and deny reviews and supply it to subsequent Guardian v2 async classifier samples as trusted developer context.
- Keep review evidence isolated from the conversation transcript, escape and truncate its fields, and ignore failed or incomplete reviews.
- Invalidate retained evidence after conversation history rewrites or new user messages, including authorization changes in a worker's root thread.
## Testing
- Cover approved, denied, malformed, and forged review inputs, plus root rollback and authorization-change scenarios.
GitOrigin-RevId: 27817e1fde9a136de727048c4220d148fcf72f42
## Why
MultiAgent V2 workers can be reviewed after the root conversation has received
new user authorization that is absent from the worker's own transcript. Guardian
reviews need that genuine user context without treating forwarded or
assistant-authored claims as authorization.
## What changed
- Add the bounded root conversation to Guardian prompts for worker reviews.
- Preserve user and assistant roles, and explicitly treat only root user messages
as authorization evidence.
- Exclude summaries, review artifacts, and assistant commentary from the root
conversation evidence.
- Apply the same evidence to both core Guardian prompts and Guardian V2
classification.
## Testing
Add an integration test covering late root-user authorization, forged role text,
forwarded agent claims, and filtered synthetic authorization.
GitOrigin-RevId: 8846de69ba214a88f58f70675798d324e213427c
## What changed
- Add environment-provided MCP restrictions for configured and plugin-provided servers.
- Disable attachment-scoped servers while their environment configuration is pending, failed, or unselected, while preserving selected-plugin access and the controller-owned Apps server.
- Apply the resolved policy to runtime startup, model tool exposure, telemetry, OAuth flows, and skill dependency installation.
## Testing
- Cover policy filtering for configured and plugin servers, environment state transitions, Apps ownership, and managed OAuth rejection.
GitOrigin-RevId: 7ca5d4dda14068e758497f88835d5cba685e159e
## What changed
- Execute `mcp_tool` hook handlers through the session's shared MCP runtime, including managed hook configurations.
- Restrict hook calls to already-connected, cataloged, and policy-allowed tools. Unavailable servers fail immediately without starting or reconnecting them.
- Pass session metadata to hook tools, cap hook timeouts by the server timeout, and invoke hooks without model-tool approval or recursive hook dispatch.
- Record handler type and execution mode in hook telemetry, and mark memory as externally influenced after successful or blocking MCP hooks when configured.
## Testing
- Added end-to-end coverage for prompt interpolation, hidden tools, blocking decisions, unavailable servers, thread metadata, approval bypass, and memory-mode handling.
- Added MCP runtime coverage for startup readiness, tool filters, catalog revisions, and managed connector policy.
GitOrigin-RevId: 1647cb801ebc5fa385c7bda9d9c266a389c611b8
## What changed
- Add `EnvironmentNetworkPolicy` as a serializable view of portable domain,
Unix-socket, upstream-proxy, and local-binding restrictions without exposing
controller-owned proxy runtime settings.
- Add an optional `network_policy` field to `EnvironmentConfig` and re-export
the policy and related permission types through the core APIs.
- Reject owner-provided network policies during environment preview and
readiness until runtime enforcement is implemented, while preserving the
existing controller policy when the field is absent.
## Testing
- Cover rejection through both environment preview and readiness, including
preservation of the existing environment selection.
GitOrigin-RevId: 80ad4cf4d4a45632daa7a823e6cf568eb0e8bb80
rhan-oai