## Why
Setting granular `sandbox_approval` to `false` also blocked approval requests for dangerous commands such as `rm -f`, even when they requested no additional permissions. Reviewing a dangerous command should remain possible within the existing permission profile.
## What changed
Allow heuristic dangerous-command approval requests with `sandbox_approval = false` when execution stays within current permissions. Do not propose reusable execution-policy amendments for these approvals, since reusable allow rules can bypass the sandbox on later calls.
Keep escalation requests, explicit policy rules, and Windows execution without required sandbox protection subject to their existing approval restrictions. Clarify the meaning of `sandbox_approval` in the protocol and generated schemas.
## Testing
Add coverage for POSIX and Windows approval decisions, approval and denial of deletion commands, preservation of read-only restrictions, and separate dangerous-command approval after turn-scoped or session-scoped write grants.
GitOrigin-RevId: 90adc137c7b7d3f3ee68efb1f6bea531229e7834
## Why
A timeout during denial reconsideration replaced an already completed Guardian denial with a timeout outcome, losing the original assessment.
## What changed
Keep the original denial when reconsideration times out, including its risk level, user authorization, and rationale. Discard the review session while preserving cancellation behavior.
## Testing
Add a reconsideration timeout scenario that verifies the original assessment and denial rationale are preserved and the requested file write remains blocked.
GitOrigin-RevId: 448a6d2d1e779c58076091384fe1215b8c02bde2
## Why
Waking an evicted worker from a sibling should preserve the worker's effective permissions, including runtime grants, denials, and network restrictions that a profile name alone cannot reconstruct.
## What changed
Retain the worker's effective configuration during eviction. On sender-driven reloads, restore its permissions and approvals reviewer while keeping the current wake configuration for other settings.
## Testing
Add regression coverage comparing loaded and reloaded workers with read-only, named, and legacy permission settings. Verify that worker permissions, active profiles, and network policies survive sibling wakeups and that parent and sender permissions remain unchanged.
GitOrigin-RevId: ffc353154535362cfbfbbe2b7fc43e08b42cf9b9
## Why
Existing chats can retain reasoning effort and service tier selections that a refreshed provider catalog no longer supports.
## What changed
- Apply fresh provider catalogs to saved settings in open and resumed chats, and normalize incoming settings before capturing the next turn.
- Replace unsupported ranked reasoning efforts with the highest supported level at or below the selection. For unsupported `ultra` or `persistent` selections, use the model's supported default when available. Reset unsupported `priority` and `ultrafast` service tiers to `default`.
- Retire incompatible reasoning effort pins using each step's captured model metadata, preserving running steps and the live pin during compaction.
- Publish catalog updates only from successful provider responses for the current identity, and refresh retained originator catalogs through the periodic refresh worker.
## Testing
Add coverage for setting correction, reasoning effort pins, resumed chats, stale queued settings, retained history, refresh failures, identity changes, and isolated originator notifications.
GitOrigin-RevId: 2ef4605c4acba98db3fe9d0328e2752084e900a2
## What changed
Add the disabled-by-default `guardian_denial_reconsideration` feature to reconsider a synchronous Guardian denial once before publishing the final decision. The follow-up uses the same review session, evidence, model settings, and original deadline, without compacting the retained context.
Only a valid second assessment replaces the denial. Invalid or failed follow-ups keep the original denial and discard the review session; cancellation and timeout retain their normal outcomes.
Allow a custom developer message through `auto_review.experimental_denial_reconsideration_prompt`, limited to 1,000 UTF-8 bytes. Omitted or blank values use the built-in prompt, which grants no new authorization and preserves the security policy.
## Testing
Add scenario coverage for feature gating, unchanged approvals, reconsidered approvals and denials, invalid assessments, failed follow-ups, custom prompts, and retained context. Extend cancellation coverage to reconsideration and config tests to prompt normalization and byte-limit validation.
GitOrigin-RevId: 61c45d5a948e3e5684c4b4048d6e90fd3f1f2476
## What changed
- Gate GIF output behind `features.image_generation_animation`, disabled by default.
- Accept `gif` options for generation and editing, with optional `frame_count` and `frame_duration_ms` controls. Use `gif: {}` for API defaults.
- Preserve animated output with `.gif` filenames and `image/gif` data URLs while providing a still preview to the model.
- Add guidance for simple animations and spritesheet-based GIF edits.
## Testing
Add integration coverage for GIF generation and editing, explicit frame controls and API defaults, saved animation bytes, and still-preview replay across follow-up turns.
GitOrigin-RevId: 08afa0316ae3675921652157836191a649f563cf
## What changed
Restore `code_mode_only_strict_3p_tools` as an opt-in feature under development. When the effective tool mode is Code Mode Only, keep eligible MCP/app and client-supplied dynamic tools deferred and callable through `exec`, regardless of `deferLoading`, `omit_tools_from`, or namespace exclusion and direct-only settings.
Preserve hidden tools, tool policy restrictions, and built-in tool classification. Log conflicting exposure settings without adding warnings to the model prompt. Leave other effective tool modes unaffected.
## Testing
Add coverage for exposure overrides, model mode overrides, built-in name collisions, and hidden or denied tools. Update integration coverage for app access restrictions and MCP catalog refreshes that preserve the cached prompt prefix while `exec` uses the current tools.
GitOrigin-RevId: 0cb085ba9d23bebc48dbc3fa298b982de0a66c47
## What changed
- Remove automatic BuildBuddy configuration and credential forwarding from Bazel CI, release, SDK, and voice builds. Strip remote execution CI configs in the shared wrapper while retaining explicit remote configurations for local use.
- Use native Windows host tools and audio dependencies for Windows Bazel actions, forwarding the required toolchain and environment settings.
- Initialize message-board MCP servers through a per-session `OnceCell` so server startup does not hold the shared registry lock across an await.
- Expose the message-board test helper to the core Bazel package and update the runtime-auth test call for the `reauth` argument.
GitOrigin-RevId: 5d5c1f4d71fa841090dea8eec8006380981fb65b
## Why
Removing an executor must detach its selection even when older turn snapshots still reference it. Connection events queued for a removed attachment must not leak into a later selection of the same executor.
## What changed
- Introduce `EnvironmentAttachment` with a detach signal shared by turn snapshots and a guard owned by the selection.
- Preserve attachments across workspace and configuration changes, while giving reselections and child threads independent attachment lifetimes.
- Stop forwarding connection events on detach and discard buffered events from detached attachments.
- Activate initial attachments after `SessionConfigured`, using configured bindings for startup discovery.
## Testing
Add coverage for discarding buffered connection events on reselection and extend snapshot tests to verify immediate detachment, fresh attachments on reselection, and independent parent and child lifetimes.
GitOrigin-RevId: 6cf882e0d17a296030c13d80c6e2866c80e04638
## What changed
Add optional `contentTokenCount` metadata to `item/completed` notifications, carrying the producer-supplied token count for each completed assistant message in default and plan modes. Counts include any sampled footer and are `null` when unavailable.
Keep this telemetry separate from stored thread items and omit it from subsequent model requests. Update the protocol schemas and generated TypeScript and Python types.
## Testing
Add coverage for per-message counts, including zero, in default and plan modes; missing and malformed metadata; backward-compatible notification decoding; and exclusion from subsequent model requests.
GitOrigin-RevId: 35973037a42650fa2d7569da8e88cb81215cf971
## Why
Search discovery must account for the active model's supported tools while honoring host search restrictions. Automatic fallback must also preserve the provider that owns existing browsing references.
## What changed
- Resolve search from model metadata, client configuration, and managed requirements, exposing the selected provider's tools.
- Discover hosted search with the model's supported tools and carry the discovered invocation context into calls.
- Allow native fallback for eligible discovery failures only when search policy permits it and hosted search has not already been used. Do not replay failed hosted invocations through native search.
- Keep native fallback references on native search across later turns, discovery recovery, and resume. Release unused fallback offers and coordinate background calls to prevent conflicting provider use.
## Testing
Add app-server and core scenario coverage for provider selection, discovery failures, search restrictions, reference continuity, resume, and concurrent background search. Include a snapshot covering discovery and call history across a model switch.
GitOrigin-RevId: 0f22605722daaa424c4fa34660654cde5a6db049
## What changed
- Add optional `ModelInfo.web_search_provider` metadata with `standalone` and `search_mcp` values.
- Add `tools.client_search_provider` and expose its value as `client_search_provider` in app-server configuration responses, with updated JSON schemas, TypeScript types, and Python bindings.
- Register the `hosted_search_policy` feature flag as under development and disabled by default.
GitOrigin-RevId: 263c3f81a61b50f8bb53ff338b9de8186db316e0
## Why
An MCP server's environment permissions can change after a tool step captures its context. Guardian reviews of direct MCP calls could therefore miss denied paths present in the permissions used to prepare the call.
## What changed
Pass the prepared server environment's sandbox context through MCP approvals and use it to build Guardian's permission evidence, including denied paths and globs resolved for that environment. Keep the sandbox context out of serialized approval actions.
## Testing
Add a regression test that updates a remote MCP owner's permissions after the step starts and verifies that Guardian sees the owner's denied temporary directory. Extend the approval JSON test to verify that supplying sandbox context preserves the serialized action shape.
GitOrigin-RevId: cab0d7c60112a97adf98e5548cdc066b260bb073
## What changed
Mark `code_mode_only_strict_3p_tools` as removed and stop overriding MCP/app and dynamic tool exposure settings. Code Mode Only now honors `omit_tools_from`, namespace exclusions, direct-only namespaces, and dynamic tool deferral settings without strict-mode exceptions.
## Testing
Update coverage for exposure settings, hidden and policy-denied tools, app access restrictions, and deferred MCP catalog refreshes that preserve the cached prefix while `exec` uses the current tools.
GitOrigin-RevId: 356ccd572f952b5a80ff9a0c31085330b9fe6e8b
## Why
Resolving an existing installation ID takes an exclusive file lock, unnecessarily serializing readers.
## What changed
Read `installation_id` under a shared lock. If its contents are missing or invalid, acquire an exclusive lock and reread the file before generating a UUID, so an ID initialized by another process is reused.
## Testing
Extend the existing UUID reuse test to verify that resolution completes while another shared lock is held on Unix and still restores file permissions to `0o644`.
GitOrigin-RevId: e787d775eddb4d05653d42e809816be9536a94a3
## Why
MCP permission profiles need the directory context used to interpret them. Prepared calls must retain that context alongside their captured permissions across runtime refreshes.
## What changed
- Store each server's permission source as thread permissions or a captured environment `FileSystemSandboxContext`.
- Capture environment working directories, home and temporary directories, and materialized workspace roots. Retain the host working directory for thread permissions.
- Expose the captured source through `PreparedMcpCall::permission_source()`, while keeping hosted Apps on thread permissions even when a local environment is attached.
## Testing
Extend binding tests to verify that prepared calls retain environment sandbox paths across refreshes and expose the host working directory for thread permissions. Update elicitation coverage to include hosted Apps with an attached local environment.
GitOrigin-RevId: 87e94605daece324786eebc07b62a507d35e5ced
## What changed
- Record connection attempts and durations as `codex.websocket.connect` and `codex.websocket.connect.duration_ms`, labeled with `success`, `reauth`, and the configured `product_sku` when present.
- Detect reauthentication by comparing the current auth revision with the last successful connection, preserving that revision across connection resets. Include `auth.reauth` in connection logs and traces.
- Populate session telemetry with the configured product SKU.
## Testing
Extend tests to check reauthentication labels after account switches, product SKU labels for restored sessions, and failed-handshake counts, durations, and labels.
GitOrigin-RevId: 53a38b4460ab9021058dfe2fe104d0441993b18a
## What changed
- With multi-backend support enabled, show the current host before the first submission and use `leader b` to cycle through available connections. Expose the shortcut as `tui.keymap.global.change_host`.
- Preserve the conversation name and composer draft, including cursor position, attachments, pending pastes, and literal versus shell-command interpretation of `!`.
- Save explicit host choices in user-only `tui.default_hosts`, scoped to the local project and user identity. Use the saved host for new conversations, falling back to the first available connection when it is unavailable.
- Prepare the destination and check directory trust before replacing the current conversation. Block switching during voice calls and active turns, and remove replaced blank conversations from the session overview.
## Testing
Add coverage for shortcut visibility and remapping, draft and name preservation, project/user preference isolation, unavailable-host fallback, destination trust and startup failures, and voice-call guards.
GitOrigin-RevId: def7b088951336bec8fe3962954fba9b861f91c6
## What changed
Add an integration test that verifies environment connection events follow the active turn's environment selection:
- A deselected remote environment emits no connection events for that thread.
- Thread startup and reselecting an already connected environment do not replay connection events.
- A reconnected environment notifies threads that select it without duplicate connection events.
Reuse the remote exec-server initialization helper to exercise reconnection.
GitOrigin-RevId: 7e1e630af2e3f051b3367e7cfcb4a0acc0771edc
## What changed
Expose `InheritedSessionId` so a host can supply a root session ID through `ExtensionDataInit` when starting a fresh child thread. The child retains its distinct thread ID, and the inherited session ID is persisted in rollout metadata and restored on resume.
Reject inherited session IDs for resumed, forked, or native agent threads, and reject an inherited session ID that equals the child thread ID.
## Testing
Add an integration test covering distinct child identity, inherited session metadata, and restoration after shutdown and resume.
GitOrigin-RevId: e3462433f9d8a0bba24251ee2b6d5329557ddb31
## Why
A completed environment hook can be held up by a queued output-read RPC when its executor is busy, delaying the hook's decision.
## What changed
- Race pushed process events against output polling so a complete, ordered event stream can deliver the hook's output and exit status immediately. Retain polling as a fallback when events are incomplete or unavailable.
- Include launch-parameter preparation in the hook's timeout budget.
## Testing
Extend the executor ownership test to hold the owner's RPC slot while a `PreToolUse` hook finishes. Cover both allowing and blocking commands, checking that the decision arrives before the slot is released and that only the owning executor receives the hook.
GitOrigin-RevId: bc80b99a2a32379e3c2eafefe6db66a6a20f4048
## What changed
- Add the disabled-by-default `tui_workspace` feature for the owned transcript view. At terminal widths of at least 100 columns, show the parent conversation beside its side conversation, with only the focused composer accepting input.
- Retain the inactive conversation's transcript, draft, and status, and restore reading and search state when switching focus.
- Keep drawing and input paused until history replay completes, while refreshing skills in the background.
## Testing
Add snapshots and regression tests for pane resizing and composer styling, retained streaming output, history search after replay, pending skills refreshes, and modal input protection.
GitOrigin-RevId: 68938f263353b0cd3a9e9562e06293bfc8251cc6
## What changed
Once Responses requests fall back to HTTP after exhausting WebSocket retries or receiving HTTP 426, keep subsequent requests and turns on HTTP for the remainder of the session. Clear cached WebSocket state and remove background recovery probes, recovery trials, and their acknowledgement timeout.
## Testing
Update fallback tests to verify that a second turn stays on HTTP without additional WebSocket attempts. Adjust retry and `Retry-After` request-count assertions to exclude background probes.
GitOrigin-RevId: a4f6376604527c14db8d60f79bd21c3aaf289f70
## Why
Injected agent messages need to reach active sampling before stale tool calls execute, while messages queued around a final answer must wait for the next task without requesting another response.
## What changed
- Include injected `agent_message` items in mailbox preemption checks when the matching turn still accepts mail and `DeferMailboxPreemption` is disabled.
- Treat injected agent messages as queue-only mail so they do not reopen delivery after a final answer or force a follow-up response.
## Testing
Add a streaming scenario and context snapshot covering idle injection, active sampling preemption, deferred delivery around a final answer, and preservation of message payloads and ordering before the next task.
GitOrigin-RevId: 70f49cbe5074725c11e1fcb33eea05e0e92e17f7
## What changed
Add `BoardBackend` so the core adapter selects the configured backend and supplies a `MessageBoardHost`, while the extension opens MCP, connected, remote, in-memory, and local boards at thread startup.
Move remote credential handling, HTTP client construction, and backend installation into `codex-agent-message-board-extension`, preserving existing notification delivery semantics.
GitOrigin-RevId: 98fa5525f142596c6cc6b203198fd537546c01d5
## Why
Hosts need to apply subagent-style capability restrictions without changing a thread's session attribution, agent lineage, or permission profile.
## What changed
Add the public `RestrictRootCapabilities` marker to thread startup extension data. Capture the restriction once at startup and apply it alongside the restrictions native subagents already receive. Hosts must supply the marker again when cold-resuming a restricted thread.
Use the restriction to gate user-input and plugin-install requests, async user messaging, legacy MCP tool approvals, and Full Access MCP form input. Exclude inherited user messages from Guardian's retained authorization context for restricted threads, including after cold resume.
## Testing
Add coverage for host-restricted tool registration, MCP approval rejection, Full Access form-input handling, and inherited instruction authorization after cold resume. Update handler tests to exercise the shared restriction flag.
GitOrigin-RevId: 4d6d7102a20dc747431c7511a74a204c773e8420
## What changed
- Add critical path capture status and duration fields to `codex.turn_profile` traces.
- Emit capture counts for complete and incomplete profiles, and total and component duration histograms for complete profiles, tagged by product SKU and reasoning effort. Record metrics once per turn timing state and skip disabled captures.
- Extend critical path histogram boundaries up to two hours to cover long turns.
## Testing
Add coverage for duplicate reporting, disabled and incomplete captures, product SKU normalization, trace fields, component durations, and extended histogram boundaries.
GitOrigin-RevId: 5b1af9255f1c4a376b61c81eb68c7a74b01ae9ae
## Why
Host-owned runtimes skip controller rollout-budget accounting. Give hosts an optional callback to account for inference spending and signal budget exhaustion.
## What changed
- Add `AgentUsageAccounting`, `AgentUsageReport`, and `UsageAccountingDecision`, captured at startup and supported by host child spawn reservations.
- Await per-response usage reports with thread and turn attribution, including provider budget units and foreground and background compaction usage.
- Map host exhaustion to `SessionBudgetExceeded` and accounting failures to fatal errors without retrying inference. Preserve the original error for incomplete responses.
- Keep controller accounting unchanged and leave accounting disabled for host-owned runtimes without a provider.
## Testing
Add coverage for usage attribution, child accounting, budget exhaustion, nonretryable accounting failures, incomplete responses, and compaction reporting, including background usage charged once to its originating turn.
GitOrigin-RevId: 887703f50fe882497e4e8cb33259072935ec82e0
## What changed
Enable `multi_agent_v2` and the new `agent_message_board_mcp` feature to automatically start a temporary, tree-scoped HTTP MCP message board without plugin or endpoint configuration. The MCP feature defaults off and takes precedence over `agent_message_board`.
Share board state across parent and child agents while retaining each caller's host binding. Keep the server alive while participating threads remain, and serialize board tool calls through the MCP server configuration.
## Testing
Extend the HTTP board integration scenario to cover automatic discovery, parent-child message sharing, child subscriptions and posts after the parent unloads, serialized mutations, and absence of a persistent board database.
GitOrigin-RevId: 613183c14b2ab67dfb1aaf3a3abf338376d1cc05
## What changed
Add `AgentRuntimeOwnership::Host` and an `AgentTurnAdmission` provider so hosts can acquire execution capacity before runtime tasks run, including root turns. Require the provider at startup and retain its execution guard for the task lifetime. Controller ownership remains the default; host ownership skips controller rollout-budget accounting, budget reminders, and subagent roster context.
Keep pending admission interruptible without blocking input submission. Report admission failures through the turn lifecycle, record accepted input before exposing the error, and unwind task setup such as review mode. Preserve recoverable input during suspension. On interruption, skip prompts that still require a `UserPromptSubmit` hook rather than recording them without inspection.
## Testing
Add integration tests for missing-provider startup cleanup, denial and immediate retry, steering during admission, cancellation, execution guard lifetime, submit-hook handling, suspension recovery, and review-mode cleanup. Add a context snapshot verifying retained input reaches the next admitted turn.
GitOrigin-RevId: 9ee85fad2ecfbfb38735bac8ef88888fb179a967
## Why
Deduplicating against optional transcript entries can remove retained instructions or required tool calls even though the optional copies may later be evicted. Elastic instruction caps can also report evidence loss for revisions already delivered in full.
## What changed
- Capture the review's budget policy and use it for feasibility checks, admission, and restoration after compaction.
- Prefer required and protected native messages over optional duplicates, and use only complete, required pending transcript entries as proof of instruction delivery.
- Match elastic instruction duplicates by source revision and discard truncation observations for copies already delivered in full.
## Testing
Extend coverage for compaction recovery under fixed and elastic budgets, required and protected tool-call deduplication, and capped instruction duplicates covered by complete delivery metadata.
GitOrigin-RevId: fe456e645cdba6f782fb16ad582702d3b7ed012c
## Why
Host-provided context such as budget reminders can become stale while compaction runs. Replaying a captured value or retaining its comparison snapshot can prevent the next step from emitting a fresh reminder, even when the remaining budget has changed.
## What changed
- Add `WorldStateSectionContribution::without_full_context()` to omit a section's fragment and comparison snapshot from initial and compacted context rebuilds while preserving ordinary step updates.
- Reset comparison state after prefix compaction for sections excluded at either capture or installation, including when their messages survive in the live suffix.
- Include step World State updates when building debug prompt input.
## Testing
Add regression coverage for budget reminders refreshing after remote compaction within the same threshold, unchanged request prefixes within a context window, refreshes with a retained live suffix, and step reminders in debug prompts.
GitOrigin-RevId: ea4456755e16c93b5d16e8c762b26a33f8571a86
## What changed
Replace `thread_store_from_config` with `ThreadStoreBuilder`, exported through `codex_core` and `codex_core_api`, and migrate callers to the builder.
Allow hosts to register `with_additional_cleanup` for permanent deletion in local stores. The callback runs after successful agent-board cleanup and before rollout deletion, under the existing deletion locks. Document that cleanup must be idempotent and must avoid thread-store operations that reacquire those locks. In-memory stores do not invoke the callback.
Preserve the existing backend selection, startup rollout migration, and compression behavior.
GitOrigin-RevId: f2853d7de06fe12ef29451b204cf9fcbb349c359
## What changed
Add `RealtimeSidebandTransport` and `Op::RealtimeConversationAttachStream` so callers can attach Core to an existing realtime call through bounded JSON channels without opening or reconnecting a socket.
Read events independently of outbound backpressure, enforce a 1 MiB message limit, and drain accepted input on detach or channel closure before flushing the transcript. Pending writes are never replayed.
## Testing
Add transport and Core integration tests covering delegation without a callback socket, stalled output, attachment replacement and detach, channel closure, oversized messages, and preservation of queued transcripts in history.
GitOrigin-RevId: 06b7d1dfe2388054438d72d925e510a959dfe106
## Why
A transient WebSocket failure previously kept the session on HTTP for its remaining lifetime, even if WebSocket connectivity recovered.
## What changed
- Probe WebSocket connectivity in the background during HTTP fallback, allowing a subsequent request to use a ready connection without delaying HTTP requests.
- Verify recovery with a real request and bound its first-response wait to five seconds. Keep HTTP 426 responses and recovery timeouts on HTTP for the rest of the session.
- Keep retries of an HTTP request on HTTP. If a recovered connection fails before output, replay the request over HTTP without consuming its ordinary retry budget; failures after output use normal retry accounting.
- Rate-limit recovery probes and honor `Retry-After` deadlines.
## Testing
Extend integration coverage for successful recovery within a turn, disconnects before and after output, full-context replay followed by incremental WebSocket requests, persistent HTTP 426 fallback, and retry deadlines.
GitOrigin-RevId: 1c139a4bbce1a67442db5622fd70ff0cc8056c9c
## Why
Delegation messages containing `<source_orbit_id>` fail sender provenance parsing, leaving Guardian without the sender's instructions.
## What changed
Accept an optional `<source_orbit_id>` between `<source_thread_id>` and `<input>`, rejecting values containing `<`. Continue to derive sender authority from the source thread ID.
## Testing
Update the cross-host sender context scenario and snapshot to include orbit attribution. The scenario checks that sender evidence reaches Guardian after compaction and rollback without exposing it to the receiving agent.
GitOrigin-RevId: 463b18667384d30297245eedcd0f6bcbf683634e
## Why
After provider setup, new threads could still use the models manager created for the server's startup provider, leaving their default model inconsistent with the model picker.
## What changed
- Build a models manager from the thread's configuration when its provider differs from the startup provider.
- Invalidate the model catalog after successful Amazon Bedrock setup so subsequent model listings reflect the configured provider.
## Testing
Extend Bedrock and GCP setup integration tests to verify that a new thread's model matches the refreshed model listing. The Bedrock test also checks that the thread uses `amazon-bedrock`.
GitOrigin-RevId: 1db30ad040ba97e2f4f31c9e162a2b73af1377fa
## What changed
Eligible interactive launches now start or reuse the shared daemon regardless of `features.daemon_auto_start`. Remote-control daemon eligibility also no longer checks this flag. Use `--no-daemon` to run without the shared background server.
Treat `daemon_auto_start` as removed: ignore configured values with a migration notice, ignore managed requirements with a warning, and hide the flag from experimental feature discovery. Remove its launch telemetry tag.
## Testing
Extend retired-feature requirement coverage and add a migration-notice snapshot. Update CLI and TUI integration tests for daemon startup and explicit `--no-daemon` usage.
GitOrigin-RevId: e0290e5acd4bc0169a0f71c3296c567e46269ce3
## Why
The previous histogram placed post-truncation values just over 4,000 bytes in a bucket ending at 8,000 bytes, obscuring their size near the truncation cap.
## What changed
Use logarithmic boundaries through 4 MiB for `codex.additional_context.value_bytes`, with an explicit 4 KiB boundary near the truncation cap.
## Testing
Add a regression test verifying that post-truncation samples between 4,024 and 4,043 bytes land in buckets ending at or below 4 KiB while preserving their sum and count.
GitOrigin-RevId: af268fc0de3d5ceb648ce51fced3918317f2457a
## Why
`CodexThread::call_mcp_tool` returns only the tool result, so computing attribution and creating a cached runtime binding for these calls is unnecessary.
## What changed
Add `McpRuntime::latest_call_tool_without_attribution` and use it for direct thread calls. Validate the call, wait for server startup, and dispatch through the latest connections without capturing an attribution binding.
## Testing
Extend the runtime binding cache test to verify that a successful call without attribution leaves the cached binding empty. Update the test server to return a successful tool result.
GitOrigin-RevId: 898e655d9a0174ddaf71c390757d6fc9a5a61780
## What changed
Strengthen the execution cancellation test to verify that a session approval wakes a queued request before it is polled again. Assert that the request remains unwoken while the session policy commit lock is held, then receives a wakeup after the grant completes.
Wait for the second request to hold a prompt queue reference and install a counting waker on its semaphore. Share `WakeCount` with the existing manual prompt wakeup tests.
GitOrigin-RevId: c559a7c31385000347cd1c7dace25e84d1099db9
## What changed
- Thread `ContextBudgeting` through synchronous context and image preparation. Elastic mode preserves candidates for later entry capping and allocation; existing reviewer callers continue to use `Fixed`.
- Defer transcript selection, supporting-text caps, and image budget admission in elastic mode while preserving exact planned actions. Mark host framing as protected and distinguish optional user messages from required manual approvals.
- Add `ElasticBudgetConfig` validation requiring section minimums, including fallback policies, to sum to `DEFAULT_MAX_INPUT_TOKENS`.
## Testing
Extend tests for elastic transcript preservation, deferred native tool-call limits, oversized planned actions, image allocation, and section minimum totals above and below the required budget.
GitOrigin-RevId: 46a4605e12e2bab5973097eb1caf5fd99f6640aa
## Why
Connected legacy MCP sessions and HTTP keep-alive connections can retain message-board state after shutdown. Pending board bindings also need cancellation before they can dispatch a tool call.
## What changed
Explicitly close MCP sessions after HTTP drains and track binding factories and handlers until they release their state. Cancel pending bindings during shutdown while allowing already-dispatched board operations to finish. Clarify that `LocalServer::shutdown` waits for cleanup, while dropping the server initiates it.
## Testing
Add regression coverage for shutdown with a connected legacy client, a paused board binding, and an unauthenticated keep-alive connection. Assert that shutdown releases the board host before returning.
GitOrigin-RevId: 7fbc9415e579a21f0c0fcf7bbb7db239b3aea886
## Why
Direct Guardian review rejected recorded `exec_command` calls intercepted as `apply_patch`, even though normal execution could review those patches.
## What changed
Share intercepted patch preparation between execution and direct review so Guardian assesses the verified patch and its approval requirement without applying it.
## Testing
Extend the direct patch review scenario to cover `exec_command` heredocs alongside native `apply_patch` calls, asserting identical live and direct review inputs and no file writes after direct approval.
GitOrigin-RevId: af62cf66a3f01c65a65c15cfad3fc9cdd1f2bf19
## What changed
- Add `currentAccountOnly` to `thread/list` and `thread/search`, defaulting to `false`, and enable it for TUI history discovery, resume pickers, and task mentions.
- Mark newly created threads as account-scoped and require each recorded creator user or account ID to match the current login. Older threads and threads without creator IDs remain shared; API-key logins continue to see all local history.
- Preserve account scope through resume and revert, including fallback to original rollout metadata when an older binary drops the marker. Forks receive new-thread scope.
- Skip unreadable rollout headers in scoped discovery and filter search candidates before reading snippets. Direct access by thread ID remains available.
## Testing
Add coverage for account matching, shared legacy history, list page refilling, search pagination, API-key visibility, and scope preservation across reverts. Extend rollout lookup coverage to compressed active and archived files.
GitOrigin-RevId: aa374f5e69165be5a71c0716ded1b105f5fb51e0
## What changed
Expose `launch_in_memory()` and `LocalServer` to run a loopback HTTP endpoint with generated bearer credentials. Runners register a shared in-memory board per session through `add_board(session_id, host)`, using `MessageBoardHost` for membership, clocks, and notifications without a SQLite registry.
The handle exposes the endpoint and authorization header for MCP configuration, including plugin endpoint overrides. Dropping it cancels HTTP and MCP sessions; `shutdown().await` also waits for completion.
## Testing
Extend the parent/child HTTP integration scenario to cover the in-memory launcher, plugin endpoint overrides, host-provided timestamps, authentication and invalid identity rejection, and operation without creating a SQLite board database.
GitOrigin-RevId: e1cae295724a35f4eded290ba8a4e19926b98c13
## What changed
Add a `message-board` plugin with connection metadata for the HTTP MCP server. It defaults to `http://127.0.0.1:7777/mcp`, uses `CODEX_MESSAGE_BOARD_TOKEN` for bearer authentication, and marks the server as required.
Document installation and endpoint overrides through `mcp_servers.codex_message_board`. Installing the plugin does not start the server.
## Testing
Extend the HTTP board integration scenario to cover both direct configuration and plugin installation, verifying that a child can post a decision and its restarted parent can discover the same board and read it. Add a plugin context snapshot and include the plugin resources in Bazel test data.
GitOrigin-RevId: d6cf797caaa4dbdcd45114c2ad0a6bd695cf056f
## What changed
- Add `codex-message-board-mcp` to serve discussion tools at `/mcp` through ordinary MCP configuration, backed by the existing SQLite board and a read-only Codex registry.
- Require bearer authentication and validate `threadId` and `sessionId` metadata against persisted agent membership. Support additional allowed HTTP hosts with `--allowed-host`.
- Expose a reusable `serve_http` library entry point and scope retry deduplication to the caller within an MCP session.
## Testing
Add integration coverage for a child posting and its restarted parent reading the persisted board, including reads while a database writer lock is held. Cover invalid tokens, disallowed hosts, missing caller metadata, invalid membership, and startup without an existing registry.
GitOrigin-RevId: 5e3d71eaaf120169e2585acd0b5f84df1b402f00
## What changed
Allow `guardian_review` to assess a final recorded `request_permissions` call without granting permissions. Build the review action using the same permission request preparation as live review, while continuing to reject earlier permission requests in the recorded history.
Return no assessment when the approval policy is `never` or granular policy disables permission requests.
## Testing
Add coverage comparing live and direct permission review inputs, plus tests that disallowed requests return no assessment without contacting the reviewer.
GitOrigin-RevId: cb5935202b0980e657b023f840a0186cea5e0b74
jif