## Why
PTY launches need to establish a controlling terminal and reset signal state. Extend the Linux process setup helper to perform this work in a fresh, single-threaded process image without forking the application when the native helper is available.
## What changed
- Add a PTY setup mode and support caller-owned stdout and stderr descriptors so all three standard streams use the PTY slave.
- Use the helper for eligible Linux PTY launches, including launches with explicitly preserved descriptors, and wait for child exit asynchronously.
- Preserve portable PTY behavior for `PATH` lookup, custom `argv[0]`, missing working directories, default `SHELL`, stdin EOF, and signal exit status.
- Retain compatibility fallbacks and release the initial PTY descriptors before allocating a portable replacement.
## Testing
Add regression tests for controlling-terminal setup without forking, portable signal exit status, and successful fallback under file-descriptor pressure. Resolve the Python test executable to an absolute path to exercise the helper path.
GitOrigin-RevId: 4b07ce68aa33c5b79548581e221caf5953b0eda1
## What changed
Add real-child tests for parent-death signaling, large environment transfers, explicit file descriptor inheritance, and fallback when the helper exits before acknowledgement.
Introduce test-only pause points during environment transfer, reporting, and exec to verify that cancelling startup kills and reaps the helper. Cover cancellation after runtime shutdown and verify that the fallback reaper can reap an exited child while an earlier child remains alive.
Probe an actual helper launch before asserting native-helper behavior, and skip fixtures when their required procfs or pidfd support is unavailable.
GitOrigin-RevId: 5136dc242a91efd0596171266965f29903c6c970
## Why
Linux pipe launches need session, parent-death signal, and descriptor setup. Move this work into a fresh, single-threaded executable image to avoid forking the app-server for child setup.
## What changed
- Register an early setup helper and launch it through `posix_spawn` for Linux pipe processes.
- Start the helper with an empty environment, then transfer the target environment over a control socket so loader settings cannot interfere with helper startup.
- Await target execution asynchronously, propagate setup and execution errors, and kill incomplete launches on cancellation.
- Preserve direct spawning as a fallback when the helper is unavailable or fails before target execution.
## Testing
Add coverage for launch semantics, avoiding fork, loader environment isolation, early argument dispatch, closed standard descriptors, and fallback under bootstrap failure or descriptor pressure. Add an app-server regression test that reuses a process handle after an execution failure.
GitOrigin-RevId: 079c673f0f22ebd531f8c57e5338095cc98acfdc
## What changed
Launch Unix shell snapshot commands through `codex_utils_pty::Command` with `ProcessMode::NewSession`, replacing the custom `pre_exec` hook. Pass the complete, scrubbed child environment and preserve the original command arguments so NUL bytes are rejected before execution.
## Testing
Add a Unix regression test asserting that a snapshot script containing a NUL byte returns `InvalidInput` without creating the file it would otherwise write.
GitOrigin-RevId: ef68a6c9f64d7a541498d3ecc4113fad8ff7ed14
## Why
Unix command hooks use a `pre_exec` callback to detach from the controlling terminal, forcing the launcher to fork. Native spawn attributes can create the detached session without that callback.
## What changed
- Route Unix hooks through `codex_utils_pty::Command` with `ProcessMode::NewSession`.
- Extend the native `posix_spawn` launcher to detached Linux sessions, retaining compatibility fallbacks for unsupported libc features and executable handling.
- Preserve the session environment snapshot, hook overrides, and restricted-variable filtering.
## Testing
Add regression coverage for launches without parent forks, terminal detachment, environment and argument handling, Linux `PATH` lookup, and executable compatibility. Cover process-group cleanup on cancellation and timeout, including descendants holding output pipes open, and preservation of background descendants after completed hooks.
GitOrigin-RevId: dbe2cf12d84aa79868cfb55ace40c7d5b5282703
## Why
Pipe spawning installs Unix `pre_exec` hooks, forcing a fork on macOS even though the shared child launcher supports native spawning.
## What changed
- Use the shared `Command` for pipe processes, enabling native macOS spawning while preserving session isolation, explicit descriptor inheritance, and Linux parent-death handling.
- Select `ReapOnly` so the pipe adapter retains ownership of process-tree termination.
- Track embedded NUL bytes in original Unix command inputs and reject them before spawning, including when invalid `current_dir` or `arg0` values are later replaced.
## Testing
Add macOS integration coverage verifying fork avoidance, executable path lookup, pipe I/O, session isolation, and descriptor inheritance. Add Unix regression tests for pipe and PTY fallback under descriptor pressure and for rejecting NUL inputs without running the child.
GitOrigin-RevId: f4fa2c1d3c1aee2c4ffa1dc2ff946f9f0b08eb20
## What changed
- Add `ProcessMode::NewSession`, null stdin, and opt-in Linux parent-death termination to the shared child command API.
- Replace `DescriptorPolicy::StdioOnly` with `Explicit` and add `preserve_fds` to allow selected inheritable Unix descriptors alongside stdio. Preserve descriptor numbers without duplicating or closing the parent's descriptors, keeping POSIX record locks intact.
- Support session creation and preserved descriptors in the native macOS backend, with a compatible fallback for high descriptor numbers rejected by native file actions.
## Testing
Add regression coverage for process groups and sessions, descriptor preservation across native and executable-text launches, the last descriptor slot below the file limit, and retention of parent record locks.
GitOrigin-RevId: 29ecd859d3b673da6ae6412cc06a32fa10d11346
## What changed
Add a crate-private `ChildDropPolicy` to choose whether dropping a child kills it or only reaps it after exit. Keep `KillAndReap` as the default.
For `ReapOnly` on Unix, transfer dropped children to a shared reaper thread that operates independently of the Tokio runtime. Support both Tokio children and native macOS children, without blocking drop or letting a live child delay reaping others.
## Testing
Add an isolated regression test verifying that reap-only children survive handle drop after runtime shutdown, are reaped after exit, and do not prevent other exited children from being reaped.
GitOrigin-RevId: 5ec639597dba7f3b61694d6d465991e054ae3397
## What changed
Expose the shared `--ws-auth` options on `codex exec-server` for direct WebSocket listeners. Support capability tokens configured by token file or SHA-256 digest, and signed JWT bearer tokens. Validate `Authorization: Bearer TOKEN` before each WebSocket upgrade, rejecting missing or invalid credentials with HTTP 401 when authentication is enabled.
Reject listener authentication with stdio, `--remote`, or `forward`. Document the options and connection-time authentication behavior.
## Testing
Add CLI integration tests for all three credential configurations, unauthorized upgrade rejection, authenticated RPC initialization and reconnects, invalid configuration, and incompatible transports.
GitOrigin-RevId: 941fbd3d43e732c910d29b6f8137077b7c332835
## Why
Publishing a hotfix for an older release line or alpha can replace a newer prerelease pointer. Release pointers should advance according to version order.
## What changed
- Share release version validation and numeric comparison across publishing scripts, including alpha hotfix suffixes and alpha, beta, and stable ordering.
- Read the prerelease pointer directly from R2 and update it only for a newer version or missing or invalid version metadata.
- Restrict `latest-alpha-cli` updates to alpha releases with successful R2 and npm publishing, and compare against the branch's Cargo version before advancing it. Allow replacement when the manifest version cannot be parsed or validated.
## Testing
Add 15 passing unit tests covering version validation, older release lines and alphas, numeric hotfix ordering, prerelease precedence, equal versions, and missing or invalid versions.
GitOrigin-RevId: 6bee3906a47f613b662ef2b2224cfcbd1b56650c
## Why
A realtime call can start or end while a text turn is still running. Using call activity captured at turn creation leaves subsequent model requests with stale realtime context.
## What changed
Capture realtime activity and mode instructions together in a `StepContext` snapshot for each model request. Use that snapshot to build realtime instructions and persist `realtime_active` in the request's turn context. Store the conversation and mode instructions under one mutex so they are installed together when a call starts.
## Testing
Extend the realtime handoff integration test to start and close a call during one text turn, verifying that successive requests include the appropriate start and end instructions.
GitOrigin-RevId: 4c5c2b47b7c0c06ae28167013218dc2e3cd72c42
## Why
Debug executables can be hundreds of megabytes. Computing their identity previously loaded the entire file into memory and hashed it on an async runtime thread.
## What changed
Stream executable contents into the BLAKE3 hasher using `tokio::task::spawn_blocking`, preserving the existing digest format while avoiding whole-file allocation and moving hashing off the async runtime.
## Testing
Expand the executable identity test to verify compatibility with whole-file hashing for a file spanning multiple reads with a partial final buffer and for an empty file, and to confirm that changing a byte changes the identity.
GitOrigin-RevId: 528103397395313d170ec720fefc8c5ab3676956
## What changed
Serialize custom reasoning effort values that parse as `u64` as JSON numbers in API requests. For example, `model_reasoning_effort = "64"` now sends `reasoning.effort` as `64`. Keep named values and custom values that cannot parse as `u64` as strings.
## Testing
Expand the request integration test to cover configured named effort, zero, a positive integer, an unknown name, a negative value, and an integer exceeding `u64`.
GitOrigin-RevId: 18ad03a1cd97dfa3f1a3cc49a43b3f7ca7d9b657
## Why
An unfinished Markdown link can display its destination across multiple preview rows, then collapse when the closing parenthesis arrives.
## What changed
Keep the link label visible while withholding the opening parenthesis and destination until the link closes. Scan incoming text incrementally, accounting for nested parentheses, escapes, angle-bracket destinations, titles, and inline code. Apply this holdback only to rich prose previews; newline commitment and finalization still render the original source.
## Testing
Add regression tests for character-by-character input, long Unicode destinations, resizing, raw-mode switching, and flushing unfinished links on newline or completion, plus a snapshot of the label-only preview.
GitOrigin-RevId: 9cea680a93dfcd0aea21f0fc12006b27400d4dab
## Why
Guardian authorization reviews need the assistant message that prompted a user’s approval, even when a post-tool hook blocks the messaging result or compaction removes the original tool call.
## What changed
Retain confirmed delivered assistant text from tool-output metadata at the original call’s position in thread-owned Guardian context. Recover these messages when restoring checkpoints and respect the call’s inherited-context status.
## Testing
Extend authorization coverage to verify that a delivered message remains in the Guardian root snapshot after a blocked tool result, compaction, and resume, and update checkpoint expectations to preserve assistant/approval ordering.
GitOrigin-RevId: df30ec8a3ef21443210a937ab6db119de8a5fd51
## Why
A user can reply to a streamed question before its completed message is recorded. Assigning the assistant message's order at completion can place the reply before the question in retained context.
## What changed
Reserve an assistant message's order when its source stream starts in thread-owned Guardian context, then reuse that reservation when recording the message. Reserve completion-only messages before publishing their text, and give text and plan output from the same source message a single order.
## Testing
Add streaming regression coverage that accepts a reply before the question completes and verifies question-before-reply ordering both live and after resume. Cover server-provided and generated message IDs, plan output, and text combined with a plan.
GitOrigin-RevId: cb67e7459c804df7beb0841908244202448c655a
## Why
Ordinary user replies can depend on preceding assistant messages. Losing those messages during compaction can leave Guardian without the context needed to interpret a reply's scope.
## What changed
- Retain original assistant messages, including commentary, with their recorded order across checkpoints and resume. Exclude compaction output from this evidence.
- Include assistant context in local and delegated reviews as untrusted context, with separate storage limits and lower budget priority than user instructions.
- Prefer assistant context preceding ordinary replies when selecting bounded root evidence, and report unavailable context without inferring what a reply refers to.
- Preserve inherited context scope and remove assistant evidence beyond rollback boundaries, including during rollout migration.
## Testing
Extend coverage for compaction and resume, checkpoint migration, queued-input ordering and rollback, role labeling, and evidence budgets that preserve user restrictions while dropping assistant context.
GitOrigin-RevId: 886189b0be29ffc3d324b56f5d0b673d6b8d84da
## Why
Mermaid diagrams that cannot be rendered currently fall back to source without
explaining why the preview is unavailable.
## What changed
Show a dimmed notice above the preserved source when a completed Mermaid block
uses unsupported syntax, exceeds renderer size limits, or does not fit the
terminal width. Wrap the notice to the available width and preserve indentation
inside lists and blockquotes. Leave unfinished fences and disabled Mermaid
rendering without notices.
## Testing
Add coverage for fallback reasons, dimmed styling, source preservation, nested
indentation, and suppression of notices for unfinished fences and disabled
rendering. Update the streaming resize snapshot to include the width notice.
GitOrigin-RevId: 6ac7914b398c855e7aed3775ee0de70fb4484b78
## Why
Turn completion precedes active-turn cleanup, so the remote compaction test must wait for the thread to become idle before injecting its history fixture.
## What changed
Register the `ThreadIdle` lifecycle contributor and wait after the initial turn in `remote_compact_v2_rewrites_multiple_trailing_function_call_outputs`, covering both manual and automatic compaction cases.
GitOrigin-RevId: 1593b212db0e07b1457f090b5ac7ba2313a28360
## Why
Command execution analytics lack the observed sandbox backend. Older execution servers may omit this information, so an unknown backend must remain distinguishable from an explicitly unsandboxed process.
## What changed
- Carry optional `sandbox_type` metadata through command execution items and emit its metric tag as `sandbox_backend` in analytics.
- Propagate the observed backend through unified execution completion and failure events, including asynchronous exits.
- Preserve missing backend information as `None` and mark executed user shell commands as `Some(SandboxType::None)`.
- Exclude the metadata from serialized command items and generated schemas and TypeScript types.
## Testing
Extend tests for missing and explicit executor backends, backend propagation on failed execution, and analytics payloads, including platform-specific backend tags in app-server integration coverage.
GitOrigin-RevId: 178fe46824a6194910802ec02168ed40ee0b2019
## Why
Rollout read metrics record the failure stage and I/O error kind, but these do not distinguish specific zstd failures, task join failures, or a busy reader, nor indicate whether any line was read before failure.
## What changed
Add bounded `reason` and `read_progress` labels to rollout read counters and duration metrics, captured at the first failure. Distinguish OS errors, reader-busy and task-join failures, and known zstd error categories, with `stream_error` as the fallback.
Record whether the failure occurred before or after the first line. Classify blocking-task join failures during both open and read. Keep error messages, file paths, and rollout contents out of metric labels.
GitOrigin-RevId: 6db302900f504bc2860504d81c18017adcef3efc
## What changed
Add `features.multi_agent_v2.disable_direct_message`, defaulting to `false`. When enabled, omit `send_message` and `followup_task` while preserving spawning, automatic child results, and the remaining agent management tools.
Require an available message-board `post` tool when this option is enabled for sessions using multi-agent v2 collaboration tools, exempting internal worker sessions.
## Testing
Extend configuration parsing tests and run the message-board subscription/resume scenario with direct messaging both enabled and disabled. Verify post search, subscription behavior, and which collaboration tools are exposed.
GitOrigin-RevId: 72ec22ef0b92fa81e02cdeb058d8b4f93aca3be6
Add a regression test that fails `exec_command` with a missing working directory, pauses command completion, and interrupts the turn before releasing completion.
Verify that the command emits exactly one start and completion, retains its failure status and launch diagnostic, and persists the completion in the rollout. Check that reconstructed history includes the failed command in the interrupted turn.
GitOrigin-RevId: 5962f0791b298ebb05e752138d02b0e0b3af4c63
## Why
V2 tools and model context need to use the controller's agent tree even when the session's local runtime has no registry entries.
## What changed
- Add target resolution and direct-child path lookup to `AgentControl`.
- Move lazy root registration into the controller's resolution and listing methods.
- Build V2 subagent context from controller-provided paths, keeping formatting and size limits in the session layer and preserving loaded-first ordering.
## Testing
Extend the V2 spawn and messaging test with an empty session-local registry to cover relative-path resolution, message delivery, and subagent environment context through the controller.
GitOrigin-RevId: c935b34a6d3314e968ba451ff981cf2a223bbfa8
## Why
When unified exec cannot create a process, command lifecycle events are missing, leaving clients without a command failure notification.
## What changed
Emit start and failure events for terminal process-creation errors in both regular and zsh-fork execution. Report no process ID, an exit code of `-1`, zero duration, and the launch diagnostic, while retaining plugin attribution. Once event publication starts, let it finish even if the caller is cancelled.
Preserve approval rejection handling and retryable sandbox denials.
## Testing
Extend app-server tests to cover pipe and PTY launch failures, plugin attribution on failed launches, and zsh-fork launch failures after approval. Assert failure metadata and check for duplicate lifecycle notifications while retaining approval-decline coverage.
GitOrigin-RevId: 26ed191fc69b903ea4710dd1a6c3b031e8caa4eb
## What changed
- Store `Arc<dyn AgentControl>` in session services and route agent tools, turn admission, usage accounting, completion notifications, and shared settings through the trait.
- Add `AgentControlInit` so delegated and guardian sessions inherit the parent's controller and local runtime.
- Move local registry and context helpers to `LocalAgentRuntime`, keep resume, close, inspection, and status subscriptions on the local controller, and simplify synchronous and infallible trait methods.
GitOrigin-RevId: ad3f213eb483ac524bde56d769f20a78f20989a0
## What changed
Add the boolean `transparent_background` argument to `image_gen.imagegen` for generation and editing. Map `true` to `transparent` and `false` or omission to `opaque`, replacing the previous `auto` background setting.
Update tool guidance to request transparency for background removal and cutouts, and to preserve existing transparency during edits unless the user asks to change it.
## Testing
Add integration coverage for transparent, opaque, and omitted background arguments across generation, editing, and code-mode generation. Verify that `null`, string, and numeric values return a validation error without dispatching an image request.
GitOrigin-RevId: b10ac200a619c72cc1787da41b49d65d0cde05dd
## What changed
Run `AGENTS.md` and thread-instruction refresh concurrently with capability discovery, MCP setup, and tool construction. Box both preparation futures to keep them off caller stacks while they are live together.
Finish delivering returned instruction warnings even when tool preparation fails or is cancelled. Preserve instruction-error precedence and publish the selected-plugin snapshot only after both branches succeed and cancellation is checked.
## Testing
Add tests covering concurrent preparation, warning delivery on tool failure and cancellation, instruction-error precedence, and plugin snapshot publication. Verify that cancellation does not repeat consumed warnings on the next capture.
GitOrigin-RevId: 6b2d7b091aae2dba67ad154a19bdb0ed0f96f6f7
## What changed
Move WebSocket authentication arguments, settings, credential loading, and upgrade authorization into a shared crate using `http` types. Update the app server, transport, and CLI to consume it directly, and remove the `AppServer` prefix from the shared types.
Hide token digests and JWT verification secrets from authentication policy `Debug` output.
## Testing
Move the existing argument validation, capability-token authorization, and signed bearer-token verification tests into the new crate.
GitOrigin-RevId: 1dd20043a3f8efbca55af7eda338b62a62e8fd68
Apply `secondary_text_style()` to the shortcut hint separator and label
so they use a readable foreground color instead of terminal-dependent dimming.
GitOrigin-RevId: 6cd9ced75deca9353c1224d3e5fefc6c4ad6ae8f
## Why
Retry timing assertions can fail if the test is descheduled before retry telemetry is emitted, and parallel tests can leave shared tracing callsites disabled for the test subscriber.
## What changed
- Measure retry intervals from the failed request, filter HTTP observations to `/responses`, and track WebSocket stream requests as well as connections.
- Keep a tracing interest-cache guard alive and rebuild callsite interest when installing the telemetry capture.
- Reserve the connection-failure test's port with a bound socket until the recovery server starts listening.
- Wait for the WebSocket warmup request and assert `generate: false` before submitting user input in connection-limit, rate-limit, and overload tests.
GitOrigin-RevId: bba39ea2ac29ac8553ae6184139382f1e6cdc7ac
## What changed
- Add `environments` to `TurnSettingsUpdate` to replace the selection for subsequent steps without changing future turns.
- Capture model settings and environments together so combined updates apply or reject atomically, while existing steps retain their captured selection.
- Validate environment IDs, working directories, configuration ownership, and permission requirements against the running turn's selections.
- Preserve executor startup behavior when switching environments and use the step's local working directory for tool hooks.
## Testing
Add coverage for workspace switching and restoration on the next turn, atomic model and environment updates, permission validation, executor connection waits, and replacement of pending environment selections.
GitOrigin-RevId: 02b5c57a78fd594b2aed84fc09d9e99eb97be28c
## Why
Thread permission updates could affect later steps of a running turn. Keep inherited environment settings consistent throughout the turn and apply saved updates when the next turn starts.
## What changed
Store active thread defaults alongside selected environments and refresh them when activating a new turn, even when its environment selections are unchanged. Resolve new selections from those active defaults while preserving owner-provided configuration, selection workspace roots, and the local Windows sandbox type.
## Testing
Add a regression test that changes permissions during a paused turn and verifies that both steps retain restricted filesystem access while the next turn receives unrestricted access. Update session and MCP elicitation tests to check that permission changes take effect on the next turn.
GitOrigin-RevId: 37ee44198fa40c138d140974dc90c4177d8c1f4c
## Why
An async question notification can outlive its unanswered question and suppress the lower-priority turn completion notification.
## What changed
Clear pending `AsyncQuestion` notifications when collecting question drafts on completion, interruption, or failure, including the error-handling path. Completed turns can then queue their completion notification.
## Testing
Add regression coverage for all three turn outcomes and assertions for error handling and completion after dropped message deltas.
GitOrigin-RevId: 647b2b37acced431fc98fd4f5334c8973a0be241
## Why
Recovering question answers or interrupted input can cancel an active `Ctrl+R` search or overwrite its preview. Recovery should preserve the search while keeping the recovered input available on cancellation.
## What changed
- Apply background updates to the saved draft without changing the search query or visible preview, including when a query has no match.
- Restore the updated draft on `Esc` or `Ctrl+C`; discard it when accepting a history match. Keep search open when `Enter` has no match to accept.
- Capture the saved draft rather than the preview in draft snapshots, preserving attachments, mention bindings, and pending pastes.
- End search on an explicit fresh draft replacement so cancellation cannot resurrect discarded input.
## Testing
Add regression coverage for recovery on turn completion, failure, and interruption; accepting and canceling search after recovery; Vim undo/redo; pending paste preservation; and clearing drafts after a misalignment policy failure.
GitOrigin-RevId: d3de19bbbcdab2e461c19d47b2b7dca0b28f6ff3
## What changed
Clear pending asynchronous questions when a live turn completes, is interrupted, or fails, and append nonblank typed answers to the main composer in question order without submitting them. Preserve existing composer content and input restored after interruption, and retain large answers as paste placeholders.
Cancel history previews and pending Vim commands during recovery while preserving undo grouping and dot-repeat behavior. Skip recovery during replay and keep input cleared after a misalignment policy violation.
## Testing
Add regression tests and snapshots for open and collapsed drafts, buffered typing, answer ordering, repeated completion notifications, large pastes, interrupted queued input, and Vim undo/redo behavior. Update coverage for terminal errors and realtime question expiration.
GitOrigin-RevId: fec109fe8aecb0735a3a5410fbb063b5c5c6e9a1
## What changed
- Detect Terminal.app from primary and secondary device attributes during startup on Unix SSH sessions without a detected multiplexer. Ignore signatures inside bracketed paste and leave incomplete replies unknown.
- Use inline mode when Terminal.app is detected and `tui.alternate_screen` is `auto`. Apply the decision before the first startup frame and retain it for later configuration loads. Preserve explicit `always`, `never`, and `--no-alt-screen` overrides.
- Update the `crossterm` dependency revision and lockfiles.
## Testing
Add coverage for terminal signatures, fragmented and pasted replies, probe completion and timeout behavior, screen-mode overrides, and an inline startup snapshot.
GitOrigin-RevId: 9b937824b080f9bd6de29df1d9e84f42a698af46
## What changed
Extend an existing transcript selection with Shift-click while preserving its original anchor and selection unit. Allow continued dragging and repeated extension in either direction, including whole-word selections made by double-clicking. An ordinary click still starts a fresh selection.
## Testing
Add tests for extension in both directions, preservation of selection units, continued dragging, and ordinary-click reset, plus a snapshot of word-selection highlighting.
GitOrigin-RevId: e6208c1bc6260ac26e7cd1f81c752b2c0b375f36
## Why
Repeated gateway OAuth credential reads decrypt and deserialize the same unchanged secrets file each time.
## What changed
Add a single-entry cache shared by clones of `LocalSecretsBackend` for `GatewayOAuth`. Reuse decrypted secrets only when the file path, ciphertext hash, and keyring passphrase hash match, and invalidate the cache after writes. Omit cached credentials from the backend's `Debug` output.
GitOrigin-RevId: 91fa03655f5e233d1649f4c2571c5465dfe57f35
## Why
Application network restrictions need to cover clients created by the TUI and `codex exec` before embedded app-server startup, and remain effective when configuration is rebuilt.
## What changed
- Introduce `EmbeddedNetworkPolicy` to share live policy between caller-owned transports and the embedded app-server.
- Apply loaded requirements before creating telemetry, background HTTP clients, and executor connections. Limit authentication and cloud configuration bootstrap requests to exact endpoints under local policy.
- Preserve the shared policy across TUI session changes, permission-profile rebuilds, and worktree cloud loaders so existing clients observe policy reloads and failures.
- Document application network policy behavior and transport coverage.
## Testing
Add regression coverage for policy activation, reload failure and recovery, retained policy across TUI rebuilds, rejected OAuth and cloud-policy redirects, and workspace network restrictions with `CODEX_API_KEY`. Also cover retaining the caller-selected project during embedded startup.
GitOrigin-RevId: 629009f087b8cb21fc34a1ee7ea6fe95d9e0f2b5
## What changed
- Route remote-control enrollment, pairing, client management, and WebSocket connections through the authenticated HTTP client factory. Keep policy denials distinct from authentication failures and wait for policy changes before reconnecting.
- Preserve policy denials through exec-server connection failures so later connection attempts and capability discovery can recover. Keep direct executors running through temporary policy outages while rejecting permanent policy failures.
- Build cached HTTP transports on blocking workers, serialize construction, and retain successful builds after callers time out so request deadlines cover queued construction.
## Testing
Add regression coverage for policy recovery during remote startup, direct registration, accepted WebSocket reconnection, and capability discovery; queued transport construction timeouts; and remote-control WebSocket fallback with invalid custom CA files.
GitOrigin-RevId: c81db18e83de957175bb213d165281ac701089dd
## Why
AWS credential discovery, analytics, and telemetry used clients that did not share the application's network policy. These requests need to honor destination restrictions and permission revocation.
## What changed
- Route AWS credential and region HTTP requests through the shared HTTP client, and check the signing destination before loading credentials. Skip discovery for static access keys with an explicit region.
- Apply account-scoped policy to Bedrock authentication. Require unrestricted policy for credential exporters and reauthentication commands, and cancel active work when permission is revoked. Document that AWS profile `credential_process` network traffic remains outside the application's HTTP policy.
- Send analytics through the authenticated account's HTTP client factory.
- Guard OTLP log, trace, and metric exports with revocable permits, disable them under destination restrictions, and make managed HTTP exports cancellable. Suppress global Statsig settings while managed policy is active.
## Testing
Add coverage for metadata credential request cancellation, allowed and denied SigV4 destinations, AWS credential precedence and endpoint configuration, and blocked credential exporter recovery. Update telemetry tests for account transitions and managed-policy Statsig suppression.
GitOrigin-RevId: d8a2018bfbbe971ec430699b0d3f86a7a9e1e072
## What changed
- Load `application.network` requirements at startup and explicit config/account reloads, applying local policy before authentication and cloud configuration bootstrap.
- Block traffic when policy loading fails, cancel requests that a new policy no longer permits, and reject configuration loads based on superseded policy snapshots. Local requirements edits take effect on the next explicit reload or restart.
- Bind authenticated clients to the current account and revoke them when account ownership changes. Carry policy enforcement through backend requests, realtime connections, workload identity exchanges, and code-mode gRPC streams while preserving gRPC trailers.
- Treat denied credential refreshes as policy errors without retrying them or invalidating stored credentials.
## Testing
Add regression coverage for startup restrictions, reload ordering, cancellation after restrictive or malformed requirements edits, account revocation, gRPC destination denial, workload identity cancellation, and credential preservation after denied OAuth refresh.
GitOrigin-RevId: 0cb4c720a906397e9df06675f01ecf60d741101f
## Why
Codex could enable mouse capture even when the containing tmux session had mouse support turned off.
## What changed
- Probe tmux's `mouse` and `extended-keys-format` settings together, targeting `TMUX_PANE` when available.
- Suppress mouse capture when tmux explicitly reports `0` or `off`, and apply that policy across fullscreen and overlay input changes. Refresh the policy when entering or restoring the alternate screen.
- Preserve normal mouse behavior when the probe fails or the setting is unknown, and retain the keyboard-format fallback for older tmux versions.
## Testing
Add tests for pane targeting, explicit and unknown mouse settings, probe failures, keyboard fallback, and mouse-policy changes across fullscreen and overlays.
GitOrigin-RevId: 7bdd2759207b30a3877e983b489462de7c96e692
## What changed
- Switch the GPT-6, GPT-5.6, GPT-5.5, and auto-review catalog entries to `shell_command` and expand their plan availability.
- Mark `gpt-6-astra` as supporting reasoning-effort updates and disable its experimental-context flag. Add explicit capability and instruction defaults to other entries.
- Update Astra's messaging guidance to recognize authorization from explicitly invoked skills or plugins, with attribution in the final response, and simplify its Default-mode clarification instructions.
- Revise auto-review guidance on autonomy, assumptions, and actions within the user's requested scope.
- Refresh seven scenario snapshots to reflect the updated prompts.
GitOrigin-RevId: b7ed8c413f6451008c982024506009b170e6311e
## Why
A single blob upload failure previously aborted the file upload, even for a temporary `503` response or an interrupted stream.
## What changed
- Retry `503` responses and timeout, connection, body, or request errors, with at most five attempts within a shared five-minute deadline.
- Honor `x-ms-retry-after-ms` and `Retry-After`, falling back to backoff when no valid server delay is available.
- Reopen the contents for each retry while reusing the same file record and upload URL. Preserve the initial read permission check and reopen MCP file streams under the same sandbox policy.
- Record retry, recovery, and terminal failure events with a fresh client request ID for each attempt.
## Testing
Add coverage for recovery after `503` responses and interrupted streams, attempt and deadline limits, non-retryable responses, retry delay parsing, and unique request IDs. Extend the restricted-read MCP upload test to verify that both attempts send the complete file contents.
GitOrigin-RevId: 78089ecfd5076313f5784cbbc864df12d082e3b1
## Why
Destination restrictions and policy revocation must remain effective during redirects, response body reads, and established WebSocket traffic. Policy denials must also survive error handling so callers do not retry them or report a revoked operation as successful.
## What changed
- Route managed HTTP clients through a shared `RequestBuilder` and policy-aware execution, checking each redirect destination before route resolution and retaining a network permit while consuming response bodies.
- Guard WebSocket connection setup, reads, and writes with revocable permits, including independent wakeups for split readers and writers.
- Preserve `TransportError::Policy` through HTTP, SSE, and realtime error handling, and treat policy denials as non-retryable.
- Keep the supplied network policy in plugin startup HTTP requests and propagate response body failures from backend and plugin requests.
## Testing
Add regression coverage for rejection before connecting, revocation during redirect routing and streamed body reads, split WebSocket revocation, realtime writer error propagation, and revoked plugin upload responses.
GitOrigin-RevId: fba36700444c98a8364c09b4dc5452c4d78a90fb
## Why
Selecting text can pause following while the final transcript row remains visible. Clearing that selection could leave an unnecessary `esc latest` hint in place of the composer hints.
## What changed
Only show the return-to-latest footer for paused navigation when the transcript tail is out of view. At the bottom, show selection shortcuts without the earlier-history status, then restore composer hints when the selection is cleared, even if following remains paused. Preserve loading and retry hints.
## Testing
Add regression coverage for selection, clicking away, and scrolling at the bottom with partial and complete history, plus selection above the bottom. Verify retry hints with selected text and update activity expectations and the composer-gap snapshot.
GitOrigin-RevId: aeb2109244d6c3214c945abb51cf469087d03074
## What changed
Display a `voice` badge on the task whose session owns the running voice conversation, including when a child thread owns it. Refresh the overview after voice controls and realtime conversation resets so the badge clears when background voice closes asynchronously.
## Testing
Add snapshot coverage for a child thread owning voice and a regression test for clearing the badge after an asynchronous background voice close.
GitOrigin-RevId: 815dfad4ce1a31945d2dd0d3f9cecc5abfa419d6
## Why
Switching threads stopped the active voice conversation. Users should be able to view another task while continuing the call on its original thread.
## What changed
- Retain the voice owner's live widget and subscription in the background, routing voice controls, speech, and connection callbacks to that owner.
- Restore the live call and transcript when returning to its thread, without duplicating captions or letting background UI events affect the visible task.
- Preserve undelivered speech and defer background errors until the owning thread is shown.
- Stop background voice on shutdown, disconnect, or removal of the owning session.
## Testing
Extend regression and end-to-end coverage for thread switching during delegated speech, voice control routing, transcript restoration, caption deduplication, and cleanup on disconnect or archive/delete.
GitOrigin-RevId: ce010dce6fa8cd6fa44949a131f3f16e8cb80c4d
Charlie Marsh