## Why
A local command can exit while a descendant keeps its inherited output pipes open, delaying `exec_command` completion and turn completion.
## What changed
Start the bounded output drain when a local exec-server process exits, whether exit is reported by an event or recovered through `process/read`. Remote execution continues waiting for output closure so buffered or delayed output is retained.
## Testing
Add regression coverage for local shell snapshot execution completing before a descendant releases stdout, preserving the foreground output and exit code. Add remote event-stream cases that retain output arriving after both reported and recovered process exit.
GitOrigin-RevId: d38bcd394be42cf48d2af02733e883b02d1dd62f
## Why
The remote environment test can steer before the wait tool call is recorded, discarding the call. The session replacement test can close the client while agents overview RPCs are still pending, leaving the proxy writing to a closed socket.
## What changed
- Wait for the `wait-for-active-environment` function call event before steering the active turn.
- Wait for `AgentsOverviewThreadsLoaded` before shutting down session replacement test cases that open the agents overview.
GitOrigin-RevId: 886112a56ff6e1016efe30dbbd0256807bc1cc85
## Why
Remote boards can allow replies while denying new threads. Agents need to discover these effective permissions and receive actionable details when an operation is denied.
## What changed
- Expose optional `board_permissions` and per-channel `permissions` in `get_channels`, preserving the legacy response shape when permission metadata is absent.
- Preserve HTTP 403 `permission_denied` responses as structured tool errors with a message and optional `action` and `resource`. Mark denied calls as unsuccessful and truncate oversized error details to fit the output budget.
- Pass through service-computed permissions without evaluating access rules locally.
## Testing
Add remote-board scenarios for direct tools and code mode covering legacy responses, reply-only permissions, a denied post, and a successful reply, plus a snapshot of the direct tool exchange.
GitOrigin-RevId: 76594bbc0a1283ff3c3c8682bd7615baa5ade428
## What changed
Add `preserve_fork_prefix` to the multi-agent v2 configuration, defaulting to `false`. When enabled, full forks retain the parent's model-visible history, including commentary and tool records, and append the child's instructions. Legacy compaction without a reusable context baseline still rebuilds the child context.
Mark copied history as inherited, complete unfinished tool calls in the fork snapshot, and exclude inherited manual approvals from authorization review while retaining them in model context.
## Testing
Add coverage for preserved request prefixes, child instructions, legacy and paginated histories, Code Mode, missing inherited tool outputs, compaction fallback, and approval isolation across checkpoint replay. Update the noisy helper failure test to read its response before starting cleanup.
GitOrigin-RevId: ce9235dfa111c88d6ce66cb93d564fb63b326489
## What changed
- Remove `ContentItemMetadata`, provenance and namespace types, and the `content_item_metadata` protocol field while retaining `content_item_kinds` classifications.
- Simplify context fragments, extension contributions, and hook output to carry content without source attribution. Return MCP tool results directly without an attribution wrapper.
- Render context-window hints together in a single text fragment.
## Testing
Update Responses and Responses Lite request assertions to expect content-kind classifications without per-content attribution, and adapt context, hook, and extension tests to the simplified types.
GitOrigin-RevId: 201894cd4c93c6d4b4c41c845e7a9af1dd3c95ca
## What changed
Add `history_initialization` to `x-codex-turn-metadata`, distinguishing `new`, `cleared`, `cold_resume`, `warm_fork`, `cold_fork`, and `supplied_history`.
Classify forks by whether the source runtime is loaded and has not shut down. Preserve the classification for the runtime's lifetime, including warm resumes and compaction. This records how history was initialized; it does not establish whether tool metadata is missing. Reserve the field against client-supplied overrides.
## Testing
Extend coverage for warm and cold forks, cold resumes, warm reconnects, supplied history, WebSocket metadata serialization, and reserved-field filtering.
GitOrigin-RevId: 468153512a84d0f4d4ea742198a29e0fa3873a72
## What changed
- Add the disabled-by-default `features.credential_masking` flag to enable credential brokerage through an already enabled network proxy, retaining custom credential providers and managed configuration precedence.
- Prevent project configuration from overriding credential masking and apply existing credential-broker protections to project shell settings when masking is enabled.
- Keep brokerage inactive when the proxy is disabled. Warn at startup and after permission-profile changes when masking is inactive because sandboxing or the proxy is disabled, or provider environment keys conflict.
## Testing
Add coverage for configuration precedence, project protections in both configuration loaders, permission-profile transitions, inactive-masking warnings, and shell snapshot masking of built-in and custom credentials.
GitOrigin-RevId: 4bcb293356e8c1524bdaa4f1b95cbc1e935a5271
## What changed
Move incremental tool guidance out of namespace descriptions and into a developer message preceding each namespace declaration batch after the initial catalog. The notice covers newly added namespaces as well as changed ones, explaining that earlier tools remain available unless explicitly removed and that newer definitions replace earlier ones.
Retain the notice alongside tool declarations in full-history agent forks, and discard it when legacy compaction forks rebuild those declarations.
## Testing
Add unit coverage for multiple new namespaces sharing one notice. Update request-history snapshots for tool changes, removals and restoration, and regular Responses requests. Extend resume and fork tests to cover notice preservation without duplication and removal when rebuilding declarations.
GitOrigin-RevId: 05f79f5eb378a355cf935eabf63951015a9b454b
## What changed
- Add `tui.keymap.global.leader`, defaulting to `ctrl-x`, and symbolic bindings such as `leader c` that follow the configured prefix. The default prefix yields to existing custom shortcuts and chord prefixes.
- Keep leader shortcut hints open until completion or cancellation, while ordinary chords retain their one-second timeout. Pressing `esc` or repeating the leader cancels the pending shortcut.
- Add leader configuration and a `Use leader...` capture option to `/keymap`, with resolved shortcut labels and conflict validation.
- Cancel pending chords when input targets change, on paste or focus loss, and on mouse actions other than movement.
- Move the default voice mute shortcut from `ctrl-x` to `f9` and update its tests and displayed hints.
GitOrigin-RevId: 35b964cccd2812c73200f0c26b0f19506821df92
## Why
Fixed argument limits truncated recorded tool calls even when their metadata fit within the available message budget.
## What changed
- Remove the 8 KiB per-call and 32 KiB per-output argument limits for direct calls and Code Mode.
- Preserve full recorded arguments while retaining message metadata budgets, pending-call limits, and the direct metadata retention limit.
- Rename the normalization helper to `normalize_executed_tool_call_completeness`; it now only clears completeness when calls or tool names were lost.
## Testing
Update regression coverage for large arguments, escaped inputs, reserved-key wrappers, and argument and result metadata preservation across Code Mode waits.
GitOrigin-RevId: 8c199ccf39191d5d44eef02d28b1773654735b43
## What changed
Add the disabled-by-default `guardian_trust_orchestrator_connectors` feature flag. When enabled, Guardian V2 accepts connectors with nonblank IDs from the host-owned plugin service orchestrator as a trusted source without requiring a matching user configuration declaration.
Distinguish orchestrator provenance from user configuration in trusted-tool context. Trust remains scoped to the exact server or connector identity and source; descriptions, outputs, other tools, and other connectors remain untrusted.
## Testing
Add coverage for host-owned connector context, rejection of extension-owned Apps lookalikes and blank connector IDs, source-specific trust metadata, and context token limits. Snapshot the connector approval request history.
GitOrigin-RevId: fbd87dd71110ca7b2b92d50eef02e1e739a74a02
## Why
Tools that do not opt into parallel execution acquire an exclusive scheduler lock, serializing independent reads.
## What changed
Allow skill listing and reading, memory listing, reading and searching, conversation history search and reading, plugin listing, agent listing, current time, remaining context, and `get_goal` to run in parallel. Keep goal creation and updates serialized.
## Testing
Add `cloud_skill_reads_run_in_parallel`, which uses a barrier to require two cloud skill reads to overlap and verifies that each returns the expected resource contents.
GitOrigin-RevId: 97b5634f1f84be2ba092be89e6e9c634ca75c07b
## What changed
Support `plugins._default.enabled` with explicit per-plugin `enabled` overrides. Omission preserves existing source and account enablement; configuration cannot activate a plugin disabled at its source. Plugin settings such as remembered tool approvals inherit the default unless `enabled` is explicitly set.
Apply the policy to plugin skills, MCP servers, Apps, and hooks, including selected executor roots and runtime configuration refreshes. Preserve the latest plugin policy when adding MCP dependencies and rebuild hooks when concurrent configuration updates replace their inputs.
Report effective enablement in `plugin/list`, `plugin/installed`, `plugin/read`, and `plugin/share/list`. Remote installation still installs disabled packages, but skips MCP and Apps authentication setup without writing an enablement override.
## Testing
Add regression coverage for default inheritance and explicit overrides, source-disabled plugins, policy refreshes during active turns, disabled or malformed selected plugin roots, and remote installation authentication behavior.
GitOrigin-RevId: 83b70c5b47fc95474fec292f248683f1f887221e
## What changed
- Add `ContentItemMetadata` to distinguish user input, developer instructions, `AGENTS.md`, skills, harness context, and tool-supplied context independently of message role and content classification.
- Keep attribution attached to content through prompt assembly, history processing, and hook-output spilling. Distinguish command hooks from MCP hooks and retain tool namespaces when known.
- Treat missing historical attribution as unknown and send per-content metadata only to Responses Lite.
## Testing
Update request and history assertions to cover attribution persistence and Responses Lite metadata handling.
GitOrigin-RevId: 24e56005f5bdb98bf82f2b3943f29c4c81f3d587
## What changed
- Accept an optional `description` in `create_channel` and return it in channel summaries so agents can describe a channel's purpose.
- Enforce a limit of 512 UTF-8 bytes and account for JSON escaping in the output budget before creating the channel.
- Store descriptions in both board backends and migrate existing SQLite databases, leaving older channels without descriptions.
## Testing
Add coverage for UTF-8 byte limits, serialization, output budgets, legacy database migration, and persistence after reopening. Update the model-context scenario to create and list a described channel before posting and reading a message.
GitOrigin-RevId: cf6f395944da23e238e078eefa5de201c8b9c197
## Why
MCP servers receiving sandbox state need a usable Codex executable to launch commands with the issuing call's policy. HTTP and remote servers cannot assume access to the host's filesystem.
## What changed
- Include optional `codexExecutable` metadata for local stdio servers when the host supplies an absolute, UTF-8 path to a CLI supporting `sandbox --sandbox-state-json`. Cache capability probes by executable path and bound them to five seconds.
- Document forwarding the sandbox state unchanged and requiring an explicit opt-out rather than silently falling back to PATH lookup or unsandboxed execution when the launcher is absent.
- Honor `useMxc` from forwarded sandbox state when selecting the Windows sandbox backend and network proxy policies, preserving a parent's selection made through CLI overrides.
## Testing
Add coverage for launcher eligibility across local, remote, and HTTP servers, invalid or missing executable paths, and binaries without sandbox-state support. Extend metadata integration and serialization tests to cover the optional launcher field, legacy state, and unknown future fields.
GitOrigin-RevId: ea8cd3770616e5a620b423a01052a7bc828bceb9
## What changed
Add `include_environment_context_time`, enabled by default. Setting it to `false` omits `<current_date>` and `<timezone>` while retaining the rest of the environment context, and skips the clock read used to populate the date.
## Testing
Extend configuration, session context, and external time provider tests to cover enabled and disabled time fields, context updates across turns, and current-time reminder behavior.
GitOrigin-RevId: 5071ce1701c044b680624d0cdbba7e0bc2b5bbe6
## What changed
- Use the standard shell executor and remove the zsh fork escalation runtime, `codex-execve-wrapper`, and `shell-escalation` crate.
- Ignore `shell_zsh_fork` and `unified_exec_zsh_fork`, emit migration notices for legacy configuration, and warn when ignoring managed requirements for these flags.
- Keep the active session's `apply_patch` alias directory readable under restricted filesystem permissions.
## Testing
Add coverage for legacy configuration startup and shell execution, migration notice rendering, active alias directory selection, and nested `apply_patch` execution while other files in `CODEX_HOME` remain unreadable.
GitOrigin-RevId: 43af461fea32b4980550ee7237effd2bc0646ed8
## Why
Command processes need thread and tool call labels for correlation, without stale values from inherited environments or cached shell snapshots.
## What changed
- Export the originating `exec_command` call ID as `CODEX_TOOL_CALL_ID`; later `write_stdin` calls leave it unchanged.
- Apply executor metadata as `CODEX_THREAD_ID` and `CODEX_TOOL_CALL_ID` after environment policies, overlays, and snapshot replay. Clear omitted fields when metadata is present; without metadata, preserve thread context and remove the call ID.
- Exclude both IDs from newly captured snapshots and omit the call ID from capture and validation helpers.
- Preserve empty call IDs, omit NUL-containing IDs, and handle case-insensitive environment names on Windows. Document that these labels support correlation, not authorization.
## Testing
Add regression coverage for metadata precedence, missing and invalid IDs, snapshot capture and replay, local and remote execution with pipes and TTYs, sandboxed remote execution, and preservation of the originating call ID across later input.
GitOrigin-RevId: 1027212b5d495d8e7cfac0f498c3134e060aa897
## What changed
Add a scenario test that queues a message for an idle worker, evicts it, and resumes it with `followup_task`. Assert that the same worker is reloaded and that queuing mail and eviction do not start another model turn.
Snapshot the complete parent and worker request histories and the resumed worker's mailbox to verify that earlier context and unread mail survive eviction in order.
GitOrigin-RevId: 2d0f7c63a2221df9c3d7e378eecaf14b8441d2b9
## What changed
Extend `steered_input_checkpoint_controls_next_request` to cover user input with `InstantInterrupt` enabled under both background and synchronous checkpoint policies. Keep the original response gated until the follow-up request arrives to prove that interruption advances the turn while preserving checkpoint ordering.
Explicitly disable `InstantInterrupt` for user-input cases that wait for response completion, and enable it for the tool-output case to verify that tool outputs still wait for completion and synchronous persistence.
GitOrigin-RevId: d39544ce6f5ad83489fd8a80b1e731a64c7a876c
## What changed
- Route app-server idle unloading of multi-agent v2 children through local eviction that preserves unread mail and environment selections for reload.
- Hold residency pins through input submission so newly reloaded children cannot be evicted before receiving their work.
- Guard listener cleanup against replacement runtimes and subscriptions, and reject local eviction of host-controlled threads.
## Testing
Add coverage for unsubscribe-driven eviction followed by `followup_task`, verifying restored conversation context and exactly-once delivery of queued mail. Extend tests to check that residency pins block eviction and that rejected host eviction preserves the thread and mailbox.
GitOrigin-RevId: e36723730af683d2081e495e637f0e6d23548b8d
## What changed
Add `functions_namespace_functions_description_prefixes` to model tool messages, keyed by unqualified tool name. Prepend this guidance to descriptions in the `functions` namespace across direct declarations, Code Mode documentation, and tool-search results, including custom tools.
Trim prefixes, ignore empty values and unavailable functions, and enforce a combined 256-byte UTF-8 limit including separators for reachable tools. Keep overrides local to each step, preserve search ranking text, and retain runtime caches for unaffected tools.
## Testing
Extend coverage for direct and indirect descriptions, clearing prefixes when switching models, namespace scoping for deferred dynamic tools, and tool-search cache reuse and reset.
GitOrigin-RevId: f434e37cec010764fe3e09fb12c339e933b3c21c
## Why
Disabling `experimental_request_user_input_enabled` previously left `request_user_input_async` available when the model advertised support for it.
## What changed
Require the user input setting to be enabled before registering `request_user_input_async`, while preserving the root-agent restriction and support for both current and legacy model capability names.
## Testing
Add parameterized tests covering enabled and disabled settings, current and legacy capability names, missing capabilities, and subagents. Also verify that `send_message_to_user_async` remains available to root agents independently of the user input setting.
GitOrigin-RevId: 27156a3fe7da38d10fccb6384f28e755c39abc39
## Why
Full WebSocket requests previously used the generic `other` reason when continuation failed because request properties or input changed, obscuring why incremental reuse was unavailable.
## What changed
- Report specific reasons for changed request properties, shortened or mismatched input, and missing response state or response IDs.
- Add `previous_item_type` and `current_item_type` labels to continuation metrics and failure traces. Diagnostics use bounded labels without request contents or identifiers.
- Centralize response item type names in `ResponseItem::item_type()` and reuse them for output logging.
## Testing
Add coverage for unavailable response state and empty response IDs. Expand WebSocket tests to check fallback reasons and item types for rewritten or shortened input, replaced input, changed model, and changed output schema, including precedence when multiple properties change.
GitOrigin-RevId: 3951853dfe87d40b7046af6f6a8efd5d4f5b06d1
## Why
Truncating recorded arguments does not lose the call inventory. Clearing `tool_calls_complete` in that case incorrectly treats retained calls and tool names as incomplete.
## What changed
Define `tool_calls_complete` as completeness of the ordered call inventory, independent of recorded arguments. Preserve it for direct tool outputs and Code Mode cells when argument limits or message budgets truncate arguments, including across later waits. Continue clearing completeness when calls are omitted or tool names are truncated.
## Testing
Update protocol, recorder, and integration tests to verify completeness survives argument truncation and message budgeting. Add coverage confirming that omitted calls and truncated tool names still clear completeness.
GitOrigin-RevId: 1534dbfabbd1291b840dd6fb6738ed51bcd4c0c4
## Why
Prediction forks need to preserve the parent's effective context and request settings to maximize prompt-cache reuse.
## What changed
- Add `experimentalPredictionMode` to `thread/fork` for ephemeral forks of loaded, persisted parents. Reject configuration overrides, `path`, `lastTurnId`, and `beforeTurnId` in this mode.
- Inherit the parent's effective configuration, tools, environments, collaboration settings, disabled plugins, and persisted history.
- Enable `features.reasoning_effort_override` on the fork while preserving the parent's request-effort baseline, including when overrides were disabled on the parent.
- Report the fork's effective model, service tier, and reasoning effort in the response.
## Testing
Add coverage for matching parent and fork requests and prompt-cache keys across legacy and paginated history, invalid fork parameters, and reasoning-effort inheritance. Add a context snapshot for identical parent and fork continuations.
GitOrigin-RevId: 46b41f2ac331562b441dadff1a0a9f926c94880d
## What changed
Add the `codex.tools.registered` histogram to count finalized tool registrations by `exposure` and `tool_mode`, including zero counts for empty exposure categories. Record it once per sampling request before transport retries, excluding hosted tools. These counts describe the registered inventory, not model visibility or tool reachability.
## Testing
Add an integration test covering a stream retry, direct and deferred namespace tools, a model-only tool, and hosted web search. Verify that registrations are recorded once, hosted tools are excluded, and metric labels contain no tool names or descriptions.
GitOrigin-RevId: 02b450743886e3d487d6c3bcda12eb65f6d1104b
## What changed
Mark `code_mode_interrupt` as stable and enable it by default, so interrupting a turn terminates active code mode cells and nested tool calls.
## Testing
Update the existing interruption test to use the feature default instead of explicitly enabling `CodeModeInterrupt`. It verifies that active cells and nested tools are aborted while stored session values remain available.
GitOrigin-RevId: 17be94f208713bc232e2292feb48261938254db3
## What changed
Enable `instant_interrupt` by default so new user input can preempt responses and yield foreground code-mode observations. Keep the feature marked as under development and update feature-policy tests to allow this exception.
Explicitly disable instant interrupts in core, TUI, and Python SDK tests that depend on responses completing before steering or processing subsequent input.
GitOrigin-RevId: a8cab2d6c445bfdbd10b0b2abcf7893d32ee8595
## What changed
Add the `ultrafast` service tier to bundled catalogs for `openai.gpt-6.1-sol` on Bedrock Mantle and `global.openai.gpt-6.1-sol` and `us.openai.gpt-6.1-sol` on Bedrock Runtime. This exposes `/ultrafast` for these models while keeping tier selection opt-in.
## Testing
Extend catalog, app-server, core request, and TUI tests to cover GPT-6.1 Sol tier discovery and selection across all three model IDs, including toggling back to the default tier and honoring custom catalog commands.
GitOrigin-RevId: b5bbde8615b73a1d73eb16db7952b10d044b9fa6
## Why
Guardian cannot capture sender instructions from another host when the sender thread is absent from the receiver's local runtime.
## What changed
Fall back to the authenticated thread store to reconstruct sender history without resuming the sender. Respect compaction and rollback, and label persisted evidence to indicate that newer unpersisted messages may be missing.
Limit storage reads to five seconds and capture sender context before acquiring the active-turn lock. Bind the captured evidence to the turn that accepts the delivery, allowing an existing turn to finish while the read is pending.
## Testing
Add cross-host scenarios for legacy and paginated history that verify sender evidence reaches only Guardian and excludes rolled-back permissions. Add a gated storage-read test that verifies turn completion remains unblocked and evidence is bound to the newly accepted turn.
GitOrigin-RevId: fe896f4e82fe3e32017fe4884846f3fa90a87949
## What changed
Apply `code_mode_tool_description_first` when preparing nested tool definitions for Code Mode execution and tool search. When enabled, place each tool's description before its namespace description; otherwise, preserve namespace-first ordering.
Reuse cached MCP definitions only when both the input schema budget and description-order setting match.
## Testing
Extend deferred app tool integration tests to cover both description orders with and without ranked search, including consistency between search results and `ALL_TOOLS`. Extend the MCP cache test to reject reuse when the description-order setting changes.
GitOrigin-RevId: 1e3f84d2d95c200aef21ad710d367274b2169b4b
## Why
Authorization updates during a pending Guardian approval can invalidate its decision. Retries need the updated guidance without inheriting the invalidated review or losing earlier valid context.
## What changed
- Validate authorization while the reviewer is reserved, before publishing its history checkpoint.
- Roll back stale attempts to the last committed review, preserving earlier valid reviews across repeated invalidations.
- Pin the issuing action's repository instruction snapshot for reviewers and retries, avoiding fresh instruction discovery through disconnected executors.
- Treat stale authorization as a request for a new review rather than a failed decision.
## Testing
Add regression coverage for repeated approval invalidation, retention of earlier valid context, exclusion of stale decisions, and execution of the pending action exactly once. Extend the disconnected-executor test to verify that retries retain repository instructions and use updated authorization.
GitOrigin-RevId: 0bff6cc551fee1f0905082eb97ccdecaa8628867
## Why
Elevated Windows sandbox tests share machine-wide accounts. Running them in the sharded core suite can consume test deadlines while shards wait for the account lock.
## What changed
Move the Windows sandbox tests into the Windows-only `windows_sandbox` integration-test binary. Update the nextest account-sharing group to select the entire binary instead of individual test names, so tests queue before their timeouts start. Keep the existing guard for coordination with other test binaries.
GitOrigin-RevId: 613925c9398b5acc8440fa34c658680f31f65c8b
## Why
Failed Guardian review evidence was process-local, so restarting Codex lost the context needed for later diagnostic reports.
## What changed
- Persist failed-review records in SQLite before reviewer cleanup, retaining at most 64 records globally, eight per thread, and 8 MiB of evidence. Delete persisted evidence when its reviewed thread is deleted.
- Recover and deduplicate persisted and in-memory records for the reported task tree when uploading `auto-review-failures.jsonl`.
- Bound persistence attempts to 250 ms and retain an in-memory fallback when storage is unavailable. Keep capture gated by user opt-in and non-ephemeral sessions, and export evidence only when logs are included.
## Testing
Add coverage for persistence across reopen and process restart, retention limits, cascading deletion, busy-storage fallback, and report uploads with and without logs, including SQLite log failures.
GitOrigin-RevId: ea2da1818d4a5da3da29f211042ca45e834342bc
## Why
Published MCP elicitation requests could lose their response waiter without notifying the event consumer that the request was no longer answerable.
## What changed
- Add `ElicitationAbandoned` with the original server name and response token for requests published through unbounded event channels.
- Emit abandonment exactly once when a waiter is dropped, response delivery fails, or the MCP runtime shuts down.
- Close the elicitation router during shutdown, reject new requests on unbounded sources, and wait for terminal deliveries before shutdown completes. Preserve bounded sources' request-only behavior and backpressure.
## Testing
Add router tests for ordered, exactly-once abandonment, closed receivers, failed response delivery, shutdown coordination, and bounded-channel backpressure. Add a core integration scenario verifying that a pending form's abandonment precedes `ShutdownComplete`.
GitOrigin-RevId: 53fe9f4a8b32f7324be180288aa492f31f4d2057
## Why
Interrupting a turn or terminating a Code Mode cell can drop a pending dynamic tool handler before it publishes its completion. Cancellation needs to settle the call in live events and persisted history without allowing a late response into model context.
## What changed
- Let dynamic tool handlers observe cancellation and publish their terminal item before dispatch finishes. Calls cancelled while awaiting a response complete with a failed item and a cancellation error.
- Keep readiness, dispatch admission, registry lock waits, hooks, and output processing cancellable so cancellation can finish even when a hook is blocked.
- Report an aborted tool lifecycle outcome when cancellation interrupts dispatch, including before handler execution.
## Testing
Add regression tests for turn interruption with pending calls or blocked hooks, cell termination with persisted failure and late-response exclusion, cancellation before dispatch admission, and exactly one completion when a response races cancellation.
GitOrigin-RevId: 0112fc74c8652c91503ed5bbfb334ae2e26930ef
## Why
A delayed detach or cleanup from an older realtime conversation must not close its replacement or end the replacement's history segment. Realtime start parameters can also contain credentials in text and transport endpoints, so diagnostics should avoid exposing them.
## What changed
- Add `RealtimeConversationAttach` to report the connection attempt's result through a reply channel, using the sequential start path.
- Add `RealtimeConversationDetach` to close only the matching `realtime_session_id` after earlier starts finish. Detaching an older session leaves the replacement connected.
- Emit the previous conversation's close event before starting its replacement, and prevent stale fanout cleanup from closing or clearing the replacement's context.
- Limit `ConversationStartParams` debug output to output modality, initial item count, and protocol version.
## Testing
Add coverage for attachment completion after the handshake, stale detaches, failed replacement and retry, natural-close ordering, handoff history after replacement, and debug redaction for existing-call and WebRTC transports.
GitOrigin-RevId: 23aee6f70522f0b17e6aa9349dbbcc2ea985f233
## Why
Executor config reads omitted the startup `features.prefer_mxc` override, so clients could not see the CLI sandbox preference.
## What changed
- Include the explicit CLI `features.prefer_mxc` value in `environmentConfig/read` as a `session-flags` layer, above project config and below legacy managed file and MDM config.
- Retain only this preference from startup overrides.
- Expose `windows_mxc_allowed_by_config` to share MXC eligibility checks after callers resolve the active permission profile.
## Testing
Add CLI and remote executor coverage for preference propagation and filtering, plus a unit test verifying that both legacy managed config sources retain precedence.
GitOrigin-RevId: 5ac6f5257f1e807c2f197dcf5dcb2385cedca0ea
## Why
Attachment stores need to distinguish uploads from ephemeral threads, which intentionally skip durable persistence.
## What changed
Add `ephemeral` to `UploadRequest` and propagate the turn configuration through image preparation for messages, tool outputs, and history replay. Include the flag in debug output while keeping attachment bytes redacted.
## Testing
Extend the Guardian context-budget test to assert that a persistent Guardian uploads exactly one image with `ephemeral: false`. Update the attachment debug-output assertion to include the new field.
GitOrigin-RevId: 42814c514a571ed6798e4dcf79a22028ee4efc28
## Why
Agent tree shutdown previously returned a generic error without identifying which operation or thread failed, making cleanup failures difficult to diagnose.
## What changed
- Add `AgentTreeShutdown::wait_detailed()` and public report types while preserving the existing `wait()` result and error message.
- Record operation, optional thread ID, and either an abandoned teardown guard or a failed phase with a payload-free error category across session cleanup, child spawn cleanup, and resident eviction.
- Give each tree a correlation ID, log each failure, and retain up to 64 failures with a count of additional failures omitted. Record failures before releasing tree membership so all completed waiters observe the same report.
## Testing
Add unit coverage for aborted and completed teardown, cloned guard context, concurrent and repeated waiters, omitted failure counts, and report formatting without raw error payloads. Extend integration coverage for successful tree shutdown and persistence writer failures, including compatibility with `wait()`.
GitOrigin-RevId: 68784af28b63e875b00a55d78729f0cc5b01ac15
## Why
Windows temp grants could fall back to host `TEMP`/`TMP` values and bypass read-only or denied subpaths. Sandbox permissions must match the environment passed to the child process.
## What changed
- Resolve `:tmpdir` from absolute `TEMP`/`TMP` paths in the completed workload environment, preserving access modes and missing-path rules without falling back to host values.
- Deduplicate Windows environment keys case-insensitively in a deterministic order so permission resolution and the child environment select the same value.
- Use the resolved temp policy for elevated sandbox overrides across core execution, exec-server, and direct spawning.
- Launch direct-spawn sandbox wrappers with the supplied Codex executable, materializing an inner helper only when it is that executable.
## Testing
Add Windows regression coverage for temp-only writes, read-only and denied carveouts, mixed-case and duplicate environment keys, unavailable temp paths, and empty or missing write-root overrides. Exercise core execution and direct spawning, and extend exec-server RPC coverage to the elevated backend with temp values set through the environment policy.
GitOrigin-RevId: 16b8bd4702cc434fd743a08c75a3e4515780bff3
## Why
MCP contributors need the complete executor selection to distinguish an unavailable primary executor from a ready secondary. Ready capability roots alone do not preserve pending or failed selections.
## What changed
Add `with_selected_environments` and `selected_environments` to `McpServerContributionContext`, and pass the captured selections during thread MCP resolution and model-step plugin selection. Preserve priority order and pending or failed entries. Use `None` for threadless discovery and `Some(&[])` for an explicitly empty selection.
## Testing
Add regression coverage for executor ordering with pending and failed selections, environment context in model-step plugin selection, and the distinction between absent and explicitly empty selections.
GitOrigin-RevId: 2c1222fae72c7e2c75b2f40abfad3b2048cf9316
## Why
Capability discovery needs the roots captured with each environment snapshot. Threads sharing an executor can select different roots, and changing environment order must preserve executor skill aliases.
## What changed
- Attach the receiving thread's capability roots when constructing `TurnEnvironmentSelection` at startup and settings updates, including roots loaded from saved history.
- Resolve capability roots from environment snapshots while preserving their original order. Retain startup roots so deselecting and reselecting an environment restores its capabilities.
- Match inherited configuration by environment and workspace so differences in capability root metadata do not interrupt configuration propagation.
## Testing
Add regression coverage for root ordering across environment states and configuration changes, independent root selections on a shared executor, reselection with startup or saved roots, active turn updates, and pending configuration failures reaching child and grandchild threads.
GitOrigin-RevId: 4f2e4bb414d27195a6752406117a6050718a1198
## What changed
Remove `workspace_roots`, `current_date`, `timezone`, `network`, `personality`, and `multi_agent_mode` from `TurnContextItem` and stop recording them in rollouts. Update the precomputed protocol schema accordingly.
Make `summary` optional when reading turn context and write `"none"` as a compatibility placeholder for older readers, rather than persisting the active reasoning-summary setting.
## Testing
Update protocol tests to cover omitted `summary` fields and compatibility-placeholder serialization. Extend compaction tests to verify that model requests retain the updated reasoning-summary setting after compaction while the rollout checkpoint records the placeholder.
GitOrigin-RevId: d49eabaa1b340be1d79f7f09115281a307ea8a64
## Why
Changing the incremental tools setting on resume should not move tool declarations and base instructions within an existing context window.
## What changed
- Determine the current window's tool declaration mode from its history, and apply the incremental tools setting when building a new window after compaction or a context reset.
- Use that mode consistently for sampling, remote compaction, startup prewarm, prompt debugging, and Guardian input budgeting.
- Preserve tool declarations alongside their comparison baseline in full-history agent forks, including compacted histories; remove them together when rebuilding context.
## Testing
Add request snapshots covering legacy resume, migration after remote compaction or a context reset, disabling incremental tools, and tool updates after restart. Extend agent fork and WebSocket startup prewarm tests to cover retained declarations and incremental tools.
GitOrigin-RevId: 7c46849a1788027a8435082e4d1f7e7f48d2700c
## Why
Transcript content can contain forged role headers, transcript boundaries, or claims of user approval. Guardian needs to distinguish that content from host-assigned authorship metadata.
## What changed
- Add `features.guardianv2.transcript_mode` with `line` (the default) and `json` options for synchronous review and asynchronous scoring.
- Render JSON transcript entries with host-assigned metadata and escaped `text`, and prepend matching provenance instructions to reviewer and classifier prompts.
- Preserve JSON metadata when budget recovery shortens historical text, and keep provenance instructions outside the configured classifier prompt limit.
## Testing
Add coverage for forged roles and approvals remaining within their original entries, JSON metadata surviving budget recovery, and provenance instructions surviving prompt limits. Extend review and scoring integration tests to verify JSON evidence and matching instructions.
GitOrigin-RevId: 81a3580390d3c4d1a664e554976cda5f1adc9a2c
## What changed
Add `model` and `reasoningEffort` to `subAgentActivity` items for multi-agent v2 spawns. Capture startup settings before the child begins its turn and resolve the reported effort against model metadata, including model defaults, while preserving the child's configured effort.
Carry these fields through live notifications, persisted activity, thread history, and legacy rollout migration. Update the JSON schemas and generated TypeScript and Python types. Older records and other activity kinds retain null values.
## Testing
Add coverage for resolved spawn settings matching the child's request across legacy and paginated history, preserving configured effort, forwarding metadata through events and history, and reading and migrating older records without the new fields.
GitOrigin-RevId: a9e4241ae21bb8db1ead293f78ffba8257cca0ae
Use `TurnEnvironmentRequests` and the executor environment's `request()` in the MCP turn metadata test to match `ThreadSettingsOverrides`. Allow additional fields when matching `TurnInputSubmission::Started` in the pending input test.
GitOrigin-RevId: 6f7f7c60511d999274079f715ba2a68163e69caf
jif