## What changed
Use `EnvironmentAccess` for skill discovery, environment skill loading, and plugin namespace resolution, replacing direct `ExecutorFileSystem` calls with explicit `None` sandbox arguments.
Wrap existing host and executor filesystems with `FileSystemEnvironmentAccessor::unrestricted` to preserve their current access behavior. Update discovery, loading, and namespace tests to use the same adapter.
GitOrigin-RevId: d68168cc0ee19dc303ef4ee726cf1de1a8db81e0
## Why
Filesystem reads previously required a sandbox whenever writes were restricted, even with full-disk read permission. This made permitted reads depend on sandbox availability.
## What changed
- Select sandboxing independently for reads and writes, allowing full-disk reads directly while keeping restricted operations sandboxed.
- Use the executor's path convention when evaluating full-disk access, including `:slash_tmp` denials.
- Apply read-specific checks to capability discovery and skill resource reads, allowing unrestricted reads on executors without sandboxed discovery support.
## Testing
Add regression tests for direct read APIs, restricted writes and reads, executor-specific permission rules, and capability discovery without sandbox support. Update Windows tests to verify sandbox enforcement through writes.
GitOrigin-RevId: a03844bd1f0ea583bb54326683cddbfdd050119f
## What changed
Stop emitting a warning when skill descriptions are shortened to fit the skills context budget. Continue warning when skills are omitted from the model-visible list.
Update the app-server warning test to set `skills.max_context_tokens` to `1_000` and expect the omitted-skills warning. Remove assertions and tests for the description-shortening warning.
GitOrigin-RevId: feac10b3d159d73648a786120d477b7fe4e082d7
## Why
Orchestrator skill caches were tied to the entire MCP connection set, so runtime updates could discard cached catalogs and contents even when the Apps connection was reused. Plugin changes still need to refresh those resources without requiring a reconnect.
## What changed
Key orchestrator skill caches by the Apps server connection and an explicit invalidation generation. Preserve cached resources while that identity stays unchanged, and invalidate them on MCP runtime refresh requests or configuration refreshes. Replacing the connection also changes the cache identity.
## Testing
Extend the production-turn integration test to verify cache reuse across ordinary turns and approval-policy changes, refreshed skill contents after plugin invalidation without reconnecting, and fresh resource requests after a forced reconnect.
GitOrigin-RevId: 43ce059972369c4c735742e8224b60a692244b02
## Why
Executor skill discovery enabled every discovered skill, with no provider option for callers to disable selected skills.
## What changed
Add `ExecutorSkillProvider::with_disabled_skill_paths` to accept `SKILL.md` paths grouped by environment ID. Mark matching catalog entries disabled in both discovery routes so they are omitted from model context. Skills remain enabled by default, and paths configured for another environment have no effect.
## Testing
Extend catalog tests to cover default enablement, matching paths, and environment isolation across both discovery routes. Add a model-context snapshot test confirming that an active skill appears while a disabled skill is omitted.
GitOrigin-RevId: 7426eb94566db2bcf7e49a5dee28673ab743ad25
## Why
MXC is a sandbox implementation, not a restricted-token sandbox level. Executor requests need to represent that choice separately from `WindowsSandboxLevel`.
## What changed
- Introduce `WindowsSandboxSelection` for executor sandbox contexts and remove `Mxc` from `WindowsSandboxLevel`.
- Preserve the `windowsSandboxLevel` wire field and its serialized values for compatibility.
- Share sandbox selection between executor process launches and filesystem helpers, and use the new selection in capability discovery and skill reads.
- Disable Windows sandbox selection for executor paths that do not use Windows path conventions.
## Testing
Extend coverage for MXC wire serialization, Windows skill-read sandbox checks, and capability discovery with distinct permissions. Exercise remote filesystem write restrictions with both restricted-token and MXC sandboxes, including rejection when native MXC is unavailable.
GitOrigin-RevId: 266211377bcb138a0dc75861e9ff2225fa37a53d
## Why
MCP tool parsing eagerly cloned structured output schemas and built full call-result envelopes. Cloning tool definitions also copied their output-schema JSON, even before a consumer needed it.
## What changed
- Introduce `ToolOutputSchema` with immutable `Arc` storage so tool definitions share output schemas when cloned.
- Retain MCP structured output schemas and materialize the call-result envelope only when JSON is requested.
- Update code-mode consumers and schema mutation sites to materialize JSON explicitly, reusing uniquely owned storage when possible.
- Move structured content into the MCP envelope without an extra clone, preserving property order.
## Testing
Add tests for JSON preservation, mutation isolation, equality between lazy and materialized schemas, reuse of uniquely owned storage, and equivalent code-mode definitions.
GitOrigin-RevId: e98ba4c2f0efedc99f7cbc7bba206cc63a3bd8f4
## Why
Model switches within a turn can leave extension context using stale model metadata. Skill catalogs, context windows, and metric attribution need to match the model captured for each sampling step.
## What changed
- Pass captured model metadata and step-specific telemetry to world-state contributors.
- Use that metadata for skill catalog budgets and usage instructions, preserving configured budget overrides.
- Supply the captured model's usable context window to turn-context contributors, including when rebuilding context.
## Testing
Add regression coverage for model switches during skill discovery, catalog budgets and metric attribution, and extension context windows after `new_context` and retained-step context rebuilds.
GitOrigin-RevId: c51b40b739a380b9767a54ea8c8ee6de45bf01c8
## Why
Guardian request and section cost distributions need shared bucket boundaries across synchronous and asynchronous reviewers so their measurements align.
## What changed
- Add `histogram_with_boundaries` to session telemetry and extension metrics while preserving session attribution.
- Use shared request-token buckets up to 2,000,000 tokens and section-cost buckets up to 16,777,216 for both review paths.
## Testing
Extend telemetry tests to verify explicit bucket boundaries and sample counts, and Guardian integration coverage to check exported request and section metric bounds for both synchronous and asynchronous reviews.
GitOrigin-RevId: e34f6972b3418bac3b061939b62eeeccaec5a299
## Why
Another process sharing `CODEX_HOME` can replace an installed plugin version
without invalidating the current process's caches. This could leave skill
listings tied to stale plugin paths and retain obsolete plugin generations.
## What changed
- Reject cached plugin loads when their roots no longer match the active
installation, so skills are reloaded after upgrades or rollbacks.
- Keep the 32 most recently used configuration-based skill snapshots while
allowing callers to continue using snapshots that have been evicted.
## Testing
- Cover external plugin upgrades and rollbacks through `skills/list`, including
a subsequent warm-cache read.
- Cover cache eviction, reuse, and the lifetime of caller-held snapshots.
GitOrigin-RevId: ca00f9539c01461e3945d340bf63f8436665220b
## What changed
- Add callback lifetimes to extension `ToolCall`, `ToolEnvironment`, turn-input context, and skill-read request types.
- Require extension tool executors to handle calls for any invocation lifetime and tie their returned futures to that lifetime.
- Update built-in extensions, adapters, and tests to use the lifetime-scoped APIs without retaining host-owned environment capabilities.
GitOrigin-RevId: aca9ce3a1b6870df550bc84ec9308cc65533f161
## Why
Repeated skill locator roots can make catalog prompts larger even when the
catalog fits within its metadata budget.
## What changed
Evaluate aliased catalogs regardless of budget pressure and select them when
they preserve skill inclusion and description content while reducing prompt
size. Apply the same selection to combined host, executor, and orchestrator
catalogs.
## Testing
Add coverage for alias selection in full host-only catalogs and update skill,
symlink, and orchestrator resource tests to expect shortened locators and their
root mappings.
GitOrigin-RevId: ccedd3f3f6c7efaa1e5177a2d8c3d81d59239f52
## Why
Guardian treated all skill instructions as untrusted, so it could not use the
invocation of a user-owned skill as authorization evidence.
## What changed
- Record explicit and implicit skill invocations through extension contributors.
- Send Guardian a bounded, deduplicated list of canonical skill paths only when
they resolve under the user's Codex or `.agents` skill directories.
- Keep repository skills and symlinks that escape trusted roots untrusted, and
send only verified paths rather than skill contents to the classifier.
- Avoid recording host skill prompts that were superseded by core skill
injection.
## Testing
- Added unit coverage for trusted roots, symlink escapes, deduplication, and
size limits.
- Added integration coverage showing that Guardian trusts invoked user skills
while rejecting a forged repository skill.
GitOrigin-RevId: 1cc0be230f7e6649110201c23c3de8f26447ff36
## What changed
- Add `plugin_id`, `model_slug`, and `reasoning_effort` dimensions to
`codex.skill.injected` metrics for explicit and implicit skill invocations.
- Propagate plugin IDs from orchestrator skill metadata so resource-backed skill
invocations can emit the same attribution.
- Record `codex.skill.turn.duration_seconds` once per plugin used in a turn,
tagged with the model, reasoning effort, and completed, aborted, or error
status.
GitOrigin-RevId: d249a9c4e85682b1106ac49d9e598535c6cbb06d
## Why
Selected executor plugin roots could still expose capabilities when managed
requirements disabled the `plugins` feature.
## What changed
- Suppress MCP servers, skills, apps, and connectors from selected executor
plugins when `plugins` is disabled, while preserving the selected-root
identity used to filter those capabilities.
- Apply the policy consistently to direct selected-root discovery and batched
executor capability discovery.
## Testing
- Add contributor-level and app-server coverage that verifies disabled plugin
capabilities are absent and their MCP servers never start.
GitOrigin-RevId: e30bd8a936c4b0e083908b89a65f4d02e01747de
## What changed
- Add the under-development `skip_host_skill_discovery` feature to bypass host
skill snapshots during session warmup and turn setup.
- Let skill invocation contributors declare whether they require host-owned
skills. Preserve host discovery when no contributors are registered or any
contributor requires it.
- Keep executor and orchestrator skill catalogs and instruction loading
available when host discovery is skipped.
## Testing
- Cover executor-only, orchestrator, mixed-contributor, and legacy host-skill
behavior.
GitOrigin-RevId: 48169403090b234e1a304c6523633fd867df454a
## Why
`skills.read` paginated resources against a fixed response limit, so a page could exceed a smaller tool-call response budget.
## What changed
- Size each serialized `skills.read` page to the current call's response budget, accounting for JSON escaping and UTF-8 boundaries.
- Cache one bounded executor-resource snapshot per thread so cursor continuations return consistent contents without rereading the file. Replace the snapshot when another resource is read, and reject stale cursors after a reread.
- Tie cached executor snapshots to the selected environment and sandbox context without keeping the environment alive.
## Testing
- Cover budget-constrained reads, escaped and multibyte contents, multi-page reconstruction, changed resources, snapshot eviction, and expired turn-scoped access.
GitOrigin-RevId: e515935b82771b3f29b3fb91ea7a7a72e19a65ee
## What changed
- Build `skills.list` pages against the current tool-call response-byte budget.
- Skip entries that cannot fit, preserve pagination across retained entries, and report oversized metadata without repeating the warning for the same budget.
- Keep existing cursors compatible while encoding the response budget in new cursors.
## Testing
- Cover direct and Code Mode listing, budget changes between pages, provider and omission warnings, oversized entries, legacy cursors, and budgets too small to return discovery warnings.
GitOrigin-RevId: 4b34cd2714e4849fe9155ce3f0021b218763c395
## What changed
- Add `ToolCallSource` to extension `ToolCall`s and propagate direct or Code Mode
invocation metadata, including the runtime cell and nested tool-call IDs.
- Add `ToolCall::response_byte_budget` so extension tools can bound direct-call
responses by the host truncation policy while allowing Code Mode responses up
to the tool's own limit.
- Share the skills extension's response-size limit between its `list` and `read`
tools.
## Testing
- Verify that Code Mode source metadata is preserved when core constructs an
extension tool call.
GitOrigin-RevId: b10aef01be30d35b67bee3af24a1a4175c9ee112
## What changed
- Require each `ContextualUserFragment` to provide a stable `<feature>.<name>`
`ContentItemKind`.
- Add `AnnotatedContent` and `RenderedFragment` so rendered text, its role, and
its classification can travel together to API boundaries.
- Derive extension-owned world-state classifications from the extension ID and
keep the skills catalog classification with its fragment implementation.
## Testing
- Verify that an extension-owned world-state section renders with an
`<extension-id>.instructions` content kind.
GitOrigin-RevId: e46b74a0bb41e0b6112667c9d36bc9e7f2714451
## What changed
- Require each `PromptFragment` to include a producer-owned `ContentItemKind`.
- Re-export `ContentItemKind` from `codex_extension_api` and assign stable kinds to skills, memories, examples, and test contributors.
- Limit prompt slots to developer policy and developer capabilities, and combine contributed fragments into a single developer update.
## Testing
- Update extension registry tests to verify fragment ordering with the new content-kind metadata.
GitOrigin-RevId: ef8624a9b4ae9dce025bca9c0954d91dd8075e85
## Why
An `apply_patch` path can be replaced with a symlink after verification, allowing an unsandboxed patch operation to reach a different file than the one that was approved.
## What changed
- Add `follow_symlinks` options to executor filesystem reads, writes, metadata lookups, directory creation, and removal, including the corresponding `followSymlinks` protocol fields.
- Implement no-follow filesystem operations on Unix and Windows that reject links in any path component and restrict file access to regular files.
- Run `apply_patch` with symlink traversal disabled when an otherwise-required sandbox is bypassed, while retaining the existing follow-symlink default for standalone callers.
## Testing
- Cover leaf and ancestor symlinks across patch add, update, delete, and move operations, including a path swap after verification.
- Exercise local and remote no-follow filesystem behavior, concurrent directory creation, special-file rejection, and Windows reparse points.
GitOrigin-RevId: 43fd479084891493ce13564fbd894b98f329c6dd
## What changed
- Use `ExecutorFileSystem::read_file_stream` for capability files and executor skill resources regardless of whether filesystem sandboxing is active.
- Enforce per-file and bundle size limits incrementally as chunks arrive.
- Preserve the existing error for Windows resources when the required filesystem sandbox is unavailable.
GitOrigin-RevId: 1a40602a8f913588ec9a6ad7edd2d62eb82436e1
## What changed
- Carry selected plugin identities from MCP discovery into per-turn extension data, limited to capability roots that are ready for the turn.
- Annotate executor skill catalog entries with the matching plugin ID and `user` scope.
- Include that attribution in `skill_invocation` analytics for both explicit and implicit executor skill invocations.
## Testing
- Extend the executor skills app-server test to verify plugin ID, skill scope, and invocation type for explicit and implicit analytics events.
GitOrigin-RevId: 9345600ae29bcb8eb894fffd2d6f7b05f22ebf74
## What changed
- Pass metrics bound to the active turn's model to approval-review contributors.
- Add counter support to `ExtensionMetrics` while preserving host session attribution.
- Record Guardian v2 tool-call score lag and count stale-score fallbacks with the `score_lag` reason.
## Testing
- Cover counter forwarding and session metadata tags.
- Verify Guardian v2 metric samples for current and stale scores.
GitOrigin-RevId: 0ec34736d29d2e37ed217a27e773b4f6230ae38a
## What changed
- Stop parsing and exposing the `model` field from skill frontmatter.
- Remove the skill model delegation types and instruction generation.
GitOrigin-RevId: 01198c68c095da5062e8abec417cc3539099d9d5
## Why
Short continuation prompts such as `continue` do not contain enough context for
skill selection on their own.
## What changed
- Add the `task_context_fusion_v1` shadow selector, combining the current request
with up to two prior substantive requests and recently relevant skills.
- Record explicit skill intent and successful skill invocations for future turns,
while excluding same-turn observations from predictions.
- Bound retained requests, augmented queries, and skill history, including safe
truncation at UTF-8 character boundaries.
## Testing
Add unit and extension tests for continuation prompts, explicit intent, turn
isolation, cold thread state, bounded history, and unchanged control selectors.
GitOrigin-RevId: 72eca3f0d64620a0d24e95d5675f126ac982f8c7
## What changed
- Add shadow selectors that fuse recently invoked skills with character routing-card matches using reciprocal rank fusion.
- Add a second variant that also incorporates weighted lexical matches.
- Record both variants in the existing shadow-selection experiment, capped at 50 candidates.
## Testing
- Cover cold starts, duplicate removal, short exact matches, deterministic ranking, result limits, and truncation metadata.
- Extend the skills integration test to verify both selectors recover a skill invoked on an earlier turn.
GitOrigin-RevId: 4ff9e91da8cb49ecbce54ab8e760820616e1a1d3
## What changed
- Add `[skills].max_context_tokens` to override the token budget used to render the available-skills catalog.
- Require a positive value and cap configured budgets at 10,000 tokens.
- Preserve the existing default of 2% of the model context window when the option is unset.
## Testing
- Cover configuration parsing, override behavior, the 10,000-token cap, and catalog rendering within the configured budget.
GitOrigin-RevId: f29ddcb57fc2d800c0006d03e1c33cbe3ab6272d
## What changed
- Add an optional `model` field to parsed and loaded skill metadata.
- Recognize `model: luna` while ignoring unsupported model values without
preventing the rest of the skill metadata from loading.
## Testing
- Cover supported, absent, unsupported, and repaired frontmatter model values.
GitOrigin-RevId: 376b65555e81d29a5eae93cc4c2633aacf7cd7c8
## What changed
- Add `oauth.callback_port` to MCP server configuration and preserve it when
serializing configuration edits.
- Accept `oauth.callbackPort` from plugin MCP declarations and skill dependency
metadata.
- Prefer the server-specific callback port over `mcp_oauth_callback_port` for
CLI login, app-server, plugin installation, executor, and skill dependency
OAuth flows.
## Testing
- Cover configuration parsing, serialization, and fallback behavior.
- Verify plugin, executor, and skill OAuth registrations use their configured
callback ports instead of the global port.
GitOrigin-RevId: 7f65e5e7869358307e49779f1b75e8672b607736
## Why
Transient executor disconnects could leave capability discovery and skill catalogs
stuck on a cached failure for the rest of a thread, even after the executor
reconnected.
## What changed
- Replay capability discovery after executor recovery and retry transient failures
on later requests while continuing to cache permanent failures.
- Avoid caching skill catalogs produced from failed discovery so a later step can
load the recovered catalog.
- Mark the MCP runtime dirty when recovered manifests change the projected MCP
servers, and allow discovery to be cancelled with the turn.
## Testing
- Cover same-request recovery after a disconnect and recovery on a later request.
- Cover retry classification through connection-attempt errors and skill catalog
caching after discovery recovers.
GitOrigin-RevId: a57f90844351e73ea831931f72a9ddc4e4f3335c
## Why
Executor-backed skills can include bundled scripts, so skill readers need the
skill directory in the executor filesystem to locate them.
## What changed
- Add `skill_root` to `skills.read` responses for executor-backed skills.
- Derive the root from the parent directory of the skill's main resource and
omit the field for other skill authorities.
## Testing
- Verify executor skill reads return the expected root for both `SKILL.md` and
a referenced resource.
GitOrigin-RevId: b7035c7e2e62155890795fb508fefe3a1c17805b
## Why
Skill catalogs can present shortened package locators, but callers previously had
to expand those aliases before reading a skill.
## What changed
- Resolve catalog aliases automatically when `skills.read` looks up a
model-visible executor or orchestrator skill package.
- Update skill prompts and tool documentation to tell models to pass the listed
package locator directly.
## Testing
- Exercise reading an executor skill through its shortened package locator when
the skills catalog exceeds its context budget.
GitOrigin-RevId: d1cdfd64002510b616146929deb5b7077850b951
## What changed
- Add the `lru_plus_lexical_v1` selector, combining the 50 most recent skills
with weighted lexical matches through reciprocal rank fusion.
- Include the combined selector in the shadow-selection experiment and propagate
query and candidate truncation metadata from both inputs.
- Generalize the existing reciprocal-rank fusion helper to accept a rank
constant while preserving the existing lexical/character selector behavior.
## Testing
- Cover lexical-only selection, merging recent and matching skills, promotion
from agreement between both rankings, and weak overlaps.
- Extend the skills extension test to verify invocation metrics for the new
selector alongside `lru_v1`.
GitOrigin-RevId: 1b7b82bc97ea919c719cd05a009351b701019306
## What changed
- Track the 50 most recently invoked skills for each thread and evaluate them
as the `lru_v1` shadow-selection method.
- Filter stale and duplicate entries while preserving recency order.
- Increase the shadow result limit to 50 and add a `21_50` rank bucket.
## Testing
- Add unit coverage for recency refresh, eviction, filtering, limits, and rank
buckets.
- Add an extension test showing that `lru_v1` recovers a skill invoked on an
earlier turn.
GitOrigin-RevId: 7aa56514db57cf180cc3f57b4d493dee3304e766
## Why
Executor skills required a `skills.list` lookup before their contents could be
read, even when the catalog already identified the skill.
## What changed
- Render executor skill catalog entries as package locators, including shortened
locators when skill roots are aliased.
- Tell the model to pass those packages directly to `skills.read`, while keeping
`skills.list` as the fallback when no package is available.
- Use the shorter package locators when applying the skills context budget.
## Testing
Update catalog, aliasing, budget-pressure, and selected-skill coverage, including
an executor package ID containing a literal backslash.
GitOrigin-RevId: 2ace5e527dc4f29651a8f3214475ccc90d52c73f
## What changed
- Detect executor-owned skill document reads and script executions across native and URI-based working directories.
- Match skills only within the active execution environment while preserving host skill detection for local commands.
- Emit resource-backed implicit invocation events and deduplicate repeated accesses within a turn.
## Testing
- Add unit coverage for document reads, script executions, and environment-scoped matching.
- Add an integration test for environment selection, resource-backed analytics, and repeated-access deduplication.
GitOrigin-RevId: f78a48c3a4766fe8775bd88926b45a76761f6af8
## What changed
- Emit skill invocation analytics when a resource-backed skill is explicitly selected or its main resource is successfully read from the first page.
- Preserve provider-supplied skill IDs and user scope when available, and derive a stable ID from the main resource otherwise.
- Deduplicate repeated implicit reads of the same main resource within a turn.
## Testing
- Extend the orchestrator skill integration test to cover explicit and implicit invocation events, stable fallback IDs, failed reads, and repeated-read deduplication.
GitOrigin-RevId: 7d8453b31b5a2205847e65cda2c46183d6c97b45
## Why
`skills/list` can load multiple working directories in one request, but bundled
skill discovery did not account for different effective configurations across
those directories.
## What changed
- Resolve `skills.bundled.enabled` from each load input's effective config layer
stack inside the host skills service.
- Include or exclude system-scoped skills for each working directory based on
that resolved setting.
- Keep bundled skills enabled by default when the setting is absent or invalid.
## Testing
- Add a multi-directory `skills/list` test with bundled skills disabled in one
project and enabled in another.
- Add config-layer tests for defaults, overrides, and malformed bundled-skill
configuration.
GitOrigin-RevId: e4e97dc7d0a374ac71d0aa11e55a9e337f661717
## What changed
- Restrict host loading, snapshot, and outcome implementation details to the
skills extension crate.
- Require `HostSkillsLoadInput` construction through its public constructor
instead of exposing its fields.
- Remove redundant implicit-invocation helpers from `SkillLoadOutcome`; use the
`ImplicitSkillLookup` interface for enabled-skill lookup instead.
GitOrigin-RevId: e79c77fc3e69ecc0231b0c87e5f9f24a5487f9e4
## Why
The plugin and skill test suites were excluded wholesale on Windows, even though
most cases do not depend on POSIX behavior.
## What changed
- Make generated TOML and JSON fixtures escape Windows paths correctly.
- Use Windows-safe path canonicalization and normalize advertised skill paths.
- Select test environments through the environment-aware builders.
- Run the suites on Windows while narrowly skipping cases that execute POSIX
commands or require matching host and executor path conventions.
GitOrigin-RevId: aadf31013c2bf9bac728adc4dd96f572d4a3bf3f
## Why
The app server should not need access to host skill root internals to decide
which paths require filesystem watching.
## What changed
- Add `HostSkillsService::watchable_skill_root_paths` to return non-plugin,
non-system skill roots for the watcher.
- Make `HostSkillRoot` and root resolution private to the skills extension.
- Update the app-server watcher to consume the filtered paths directly.
## Testing
Add a host service test confirming that user skill roots remain watchable while
plugin and generated system roots are excluded.
GitOrigin-RevId: b3e3b576e4ffe96230af71d9bf7c6c315b1705d3
## Why
A single `skills/list` request should use one view of shared skill roots across
all requested workspaces while still applying each workspace's skill rules.
## What changed
- Add a request-scoped host skills view that reuses non-plugin root snapshots
across `cwd` entries without persisting them across requests.
- Resolve user-scoped plugin skill roots once per request, then apply workspace
skill configuration separately for each `cwd`.
- Make `forceReload` refresh plugin roots before building the request-scoped
view so subsequent entries see the refreshed skills.
## Testing
Expanded `skills/list` and host skills service tests to cover multiple ordered
workspaces, per-workspace skill rules, request-local snapshots, cached results,
and forced plugin-root refreshes.
GitOrigin-RevId: eedd3a4c3e213b7f30df6cacd3adf23ba2967437
## What changed
- Load an optional package-supplied config file as the lowest-precedence
configuration layer, so every existing layer can override its values.
- Report the layer as `packagedDefaults`, including its source path, through
config diagnostics and the app-server protocol.
- Return an error when a configured packaged defaults file is missing.
## Testing
- Cover precedence across packaged, system, user, and session layers.
- Cover the missing-file error path.
GitOrigin-RevId: 52406890f4d580eedabc90bf2a9ee3affa36fee1
## What changed
- Make `package` the only required argument to `skills.read`, resolving the
owning orchestrator or executor catalog automatically.
- Default omitted `resource` values to the package's main `SKILL.md`.
- Render orchestrator skills as package locators and instruct the model to read
them directly without first calling `skills.list`.
- Update skill extension and app-server coverage for direct main-resource
reads, referenced resources, aliases, and the revised tool schema.
GitOrigin-RevId: 9faf57a8d0935566a15094931eaabaa8f0613e9e
## What changed
- Move `SkillLoadOutcome` and its implicit-path indexing into
`codex-skills-extension`.
- Import shared skill types directly from `codex-skills` and keep the skill
prompt size limit with the extension renderer that uses it.
- Remove `codex-core-skills` from the Cargo workspace and dependent crates.
GitOrigin-RevId: 4e9e84909fa2f692bcc94af990bb4671affd776f
## What changed
- Add `HostSkillsSnapshot::load_skill_prompts` so the skills extension owns reading and rendering selected host skills.
- Keep explicit invocation telemetry, unreadable-skill warnings, plugin prompt ordering, and suppression of host prompts superseded by provider prompts.
- Remove the legacy prompt injection and fragment implementation from `codex-core-skills`.
## Testing
- Cover prompt truncation without an installed skills extension, skill/plugin ordering, selective provider supersession, unreadable skills, and contextual fragment detection.
GitOrigin-RevId: 9c8b84ad54b90d174abc287ab49cc5a231e9e1aa
## Why
Long executor and orchestrator resource identifiers can consume enough of the
skills context budget to omit otherwise available skills.
## What changed
- Add source-aware root aliases for executor, orchestrator, and host skill
catalogs, including catalogs with a single shared root.
- Select the best combination of aliased catalogs under the shared metadata
budget while accounting for root tables and alias usage instructions.
- Explain how to expand shortened `skill://` locators and accept the resulting
description-shortening warning in app-server coverage.
## Testing
- Add rendering and production-turn coverage for singleton, executor,
orchestrator, host, and combined catalog aliases.
GitOrigin-RevId: c1bc1f3d371eae9526232674060235272cc28f16
## What changed
- Compact executor and orchestrator skill locators under metadata pressure, using provider-specific `e` and `o` aliases alongside host `r` aliases.
- Derive alias roots from executor discovery paths and orchestrator namespaces while preserving host plugin root handling.
- Centralize alias ordering, deduplication, and longest-prefix matching across skill providers.
## Testing
- Cover alias planning, cross-platform executor roots, and host plugin discovery.
GitOrigin-RevId: e7d15bd3891c08ae20170e96c4ad45c76d353707
Adam Perry @ OpenAI