## What changed
Register `guardian_native_multi_agent_history` as an under-development feature,
disabled by default, and expose it in the configuration schema.
GitOrigin-RevId: d434750c1aa0cc78b36d1d661a4df0def5426f02
## What changed
Add the `features.simplified_selection_hints` flag, disabled by default. When enabled, replace detailed plugin capability instructions with a concise developer message identifying the selected plugin and directing the model to use its available skills and tools.
Continue omitting hints for plugins without available capabilities and bounding hint length. Preserve the existing detailed instructions when the flag is disabled.
## Testing
Cover plugin refresh in an existing thread with the flag enabled and disabled. Verify that explicit skill prompts precede the simplified plugin hint and that the hint uses the developer role.
GitOrigin-RevId: 64fc3347bd49fffe675f343a4733ced1b4e5e88c
## What changed
Allow omitting `gateway_oauth.delivery` to send the gateway token as `Authorization: Bearer …`. Custom headers and cookies remain available when a provider also needs its own credentials.
Reject conflicting provider authentication and duplicate delivery headers with actionable errors. For gateway bearer delivery, require `model_catalog_url` to share the scheme, host, and port of `base_url`. Consistently reject request header collisions across auth application methods.
## Testing
Add coverage for omitted delivery, provider credential conflicts, and model catalog origin validation. Update inference tests to verify gateway-only authentication while signed in and combined ChatGPT and gateway credentials in separate headers.
GitOrigin-RevId: 8564d3998511b3f6c55f3b65a01ed9056a90417e
## What changed
Keep inherited incremental tool declarations in MCP-disabled prediction forks and `thread/sample` requests, and append a developer notice that MCP tools are unavailable. Skip tool declaration updates within the inherited context window; new windows still declare the current tools.
Add the default-enabled `prediction_preserve_parent_tools` feature flag and its configuration schema entries.
## Testing
Update core snapshots and app-server tests to cover inherited declarations, the MCP-unavailable notice, preservation across MCP refresh, and continued parent tool availability.
GitOrigin-RevId: 3adf96c7d0e0093986dbdbd540bd47674a2c105c
## What changed
- Add the disabled-by-default `skill_catalog_deltas` feature flag to append new and updated skills without repeating unchanged catalog entries.
- Share a cumulative metadata budget across executor, cloud, and host catalogs, preserving usage across turns and resume. Removals emit no update and do not refund budget.
- Rebuild the current catalog and reset its budget after compaction, including any required skill root mappings in updates.
## Testing
Add unit and integration coverage for update costs, shared source budgets, feature rollback, and catalog updates across resume and compaction, with a request-history snapshot.
GitOrigin-RevId: e88b4265d7361498113d43fdc2e0260a9f930bbc
## Why
Hosts that only need installed plugin inventory should be able to skip startup requests for plugin discovery.
## What changed
Add the stable, default-enabled `features.plugin_discovery_prefetch` flag. Setting it to `false` skips startup prefetching of the plugin directory, featured plugins, and recommendations while preserving installed plugin cache refreshes and bundle downloads.
## Testing
Update app-server integration coverage to verify that installed plugin bundles download with discovery prefetch disabled and that no directory, featured, or suggested plugin requests are made during startup. Also cover listing remote marketplaces with the flag disabled.
GitOrigin-RevId: 7cc3072f6045131b9f1acb851f6240db75ac173e
## What changed
Change the default `thread_unload_delay_secs` from 1800 to 60 seconds. App-server threads become eligible for unloading after one minute with no subscribers and no activity. Update the configuration documentation, schema, and thread manager sample to match.
## Testing
Update the configuration test to cover the 60-second default, zero for immediate unloading, and an explicit 1800-second override.
GitOrigin-RevId: 0da8454eb25a6ef4b7e3665601982d2e0c183f7c
## What changed
- Add `tui.keymap.global.select_transcript` with an implicit `leader [` shortcut that follows the configured leader, respects explicit remapping or unbinding, and yields to existing bindings.
- Connect transcript overlays to keyboard selection, including Find, mouse selection, and navigation to the beginning of paged history. Give selection commands priority over remapped pager shortcuts.
- Close selection overlays on exit or after a confirmed copy-and-follow operation, preserving the pending close decision while clipboard confirmation is asynchronous.
- Show selection navigation and copy hints that adapt to the available footer width.
## Testing
Add coverage for shortcut dispatch, remapping, unbinding, and conflicts; overlay exit behavior; selection across history paging; mouse and keyboard selection interaction; and cursor and footer rendering snapshots.
GitOrigin-RevId: 8a920e5fa2b06ff0544d829ba30f8ecb654db0ee
## Why
Stdio servers without `CODEX_MCP_PROTOCOL_VERSION` use the legacy handshake, even when they support MCP `2026-07-28`.
## What changed
- Add the disabled-by-default `mcp_connection_sharing` feature to enable discovery for eligible local stdio servers.
- Recover from failed or late discovery with a fresh handshake when needed, waiting for the previous helper to release resources before restarting.
- Retain a working legacy connection when an upgrade attempt fails for the same account, except on authentication errors.
- Keep tool catalogs separate by protocol and invalidate legacy catalogs when discovery negotiates the modern protocol.
## Testing
Add regression coverage for failed and late discovery, legacy fallback, protocol-specific catalog reuse, message limits, and Windows descendant cleanup.
GitOrigin-RevId: 36c675ef3b81d32fccf06ccbddda2312cfe602c9
## What changed
Add `untrusted_as_tool_output` as an under-development feature, disabled by default, and expose it in the configuration schema. The flag is intended for rendering client-supplied untrusted context as standalone named tool outputs.
GitOrigin-RevId: 6fe630c8d380a87edb48e08887215c1ec17447ed
## What changed
Add the default-disabled `critical_path_timing` feature to capture dependency paths for root-agent turns. Connect direct tool dispatch, execution-lock handoffs, and completed tool batches to turn timing so overlapping work shares its common history without double counting.
Omit captures for unsupported dependencies, including CodeMode, agent communication, approval review, and user waits. Settle aborted tasks before freezing timing, invalidate captures on forced teardown, and apply runtime feature changes only to future turns.
## Testing
Add coverage for serial and overlapping tool dispatch, execution-lock dependency handoffs, cancellation, unsupported paths, frozen timing after completion, and configuration refresh boundaries.
GitOrigin-RevId: 71458b654b1c4a05799886928b449c948ea33109
## What changed
Support `model_providers.gcp.credential_file` as an absolute path to a Google Application Default Credentials (ADC) file. Pass it as `GOOGLE_APPLICATION_CREDENTIALS` in the provider auth command's environment, retaining the override for token refreshes without changing the parent process environment.
Validate the path before merging GCP defaults and preserve the setting in thread configuration serialization.
## Testing
Add coverage for invalid paths, configuration round trips, separate provider token caches, and credential overrides retained after a `401` refresh. Include a Windows regression test for credential paths containing command metacharacters.
GitOrigin-RevId: d9a1d4b3775a9a4c4325dddaa153d92a2d1430a0
## What changed
Add `features.rollout_budget.enforce_limit`, defaulting to `true`. Setting it to `false` keeps shared usage accounting and budget reminders active while allowing turns to continue after the budget is exhausted.
## Testing
Extend coverage to check enforced and advisory budgets on the current and subsequent turns, including a zero-remaining-budget reminder in advisory mode. Verify that configuration defaults to enforcing the limit.
GitOrigin-RevId: deeac8dae5714cc7c10d030cade6f3bfbfc8d3a7
## What changed
- Add `body_secret_substitution` actions to version 2 MITM configuration, replacing exact opaque placeholders with secrets from environment variables or files within the matching hook's scope.
- Bound body size, expansion, replacement count, and search work. Reject overlapping matches, compressed payloads, trailers, and supplied payload-integrity headers.
- Recompute `Content-Length` and substitute before SigV4 signing so signatures cover the transmitted body.
## Testing
Add coverage for markers split across chunks, expansion limits, invalid payloads, overlapping bindings, secret redaction, and search limits. Add a TLS forwarding test that verifies hook scope and independently checks the signature of the substituted body.
GitOrigin-RevId: fa95c9ae0c8fc8f695e03c0e87a0a4875d8418fd
## Why
Deriving a Vertex AI endpoint previously required environment variables. Allow the project and location to be specified directly in GCP provider configuration.
## What changed
- Add `model_providers.gcp.project_id` and `model_providers.gcp.location`, with each taking precedence over its corresponding environment variable. Keep `global` as the default location and preserve explicit `base_url` overrides.
- Validate configured endpoint fields and preserve them through thread configuration serialization.
- Apply built-in GCP defaults, including default command authentication, when checking managed provider requirements so unchanged requirements are accepted.
## Testing
Add coverage for endpoint precedence, invalid explicit configuration, provider construction, thread configuration round trips, and managed GCP requirement checks, including repeated model listing.
GitOrigin-RevId: c3704bcc0b7d4872374e2cae623fd24d75fb02b4
## What changed
- Always use the retained conversation backend for asynchronous classification; keep snapshot sampling test-only.
- Accept legacy `async_classifier_mode` values in configuration and model metadata but ignore them. Emit a startup warning when `[features.guardianv2].async_classifier_mode` is configured.
- Ignore legacy classifier mode differences when checking model-switch compatibility, and fail closed if the conversation backend is missing.
## Testing
Update coverage for legacy configuration warnings, model-switch compatibility, retained approval-review context, and conversation-based scoring.
GitOrigin-RevId: 5e8bb7e4e6e7d1589572f38bfe2498c9fa6825a0
## What changed
- Expose `aws_sigv4` actions in version 2 MITM permissions configuration and the config schema, rejecting multiple signing actions per hook.
- Give local managed commands placeholder AWS credentials for the selected signing pair, and mask configured credentials in environment values and protected shell snapshots.
- Set `AWS_CA_BUNDLE` to the managed proxy CA bundle when unset, and require `features.credential_masking` for local AWS signing hooks.
- Validate placeholders against every configured signing pair to prevent overlap with real credentials.
## Testing
Extend configuration, signing, and TLS forwarding tests to cover action resolution, invalid signing configuration, credential masking, CA trust, snapshot protection, and exclusion of local AWS defaults from remote environments.
GitOrigin-RevId: 81dfdea30ebde74829882b38891ea41e9737058a
## What changed
Register `guardianv3` as an under-development feature disabled by default. Accept either a boolean toggle or a table with an optional `enabled` field, and include both forms in the configuration schema.
## Testing
Add coverage for boolean and table configuration, default behavior, and profile overrides, including inheritance when a profile omits `enabled`.
GitOrigin-RevId: 75333be61b2e336e22fef907d6363b70f9f7225b
## What changed
Add `auto_review.timeout_ms` to configure the overall Guardian review budget, including setup and retries. Keep the default at 90,000 milliseconds; setting it to `0` disables the review deadline while preserving cancellation, retry attempt limits, and independent transport timeouts.
Carry the configured deadline through review execution and report the configured budget in review telemetry, using zero for unlimited reviews.
## Testing
Add coverage for shared setup budgets, configured timeouts, cancellation with unlimited reviews, and retry attempt limits without a deadline.
GitOrigin-RevId: 00404e0cb2f2cfaf6de183d6e27f5e4a371942a8
## Why
Profiles without a v1 memory workspace have no legacy context to preserve or consolidate before using v2.
## What changed
- Select v2 when memories are enabled and the `memories` directory is absent. Preserve explicit `memories.version` settings, the `memories.dual_write = false` opt-out, and the v1 default for existing workspaces or filesystem check errors.
- Report `v2_ready` immediately for profiles without a v1 workspace. Keep the consolidation count and valid-summary requirements for profiles with a v1 workspace.
- Make resetting an absent memory workspace a no-op so it does not create an unused v1 directory.
## Testing
Extend coverage for default and explicit version selection, opt-outs, version-specific memory reads, fresh-profile readiness and reset behavior, and running only the v2 pipeline for fresh profiles.
GitOrigin-RevId: a8fb0844962ae9266ffbe88af97e8dc4a99ac15f
## What changed
Add the disabled-by-default `guardian_recorded_items` feature to forward recorded reviewer items and interruptions through the parent's raw-event subscription, preserving reviewer thread and turn IDs without modifying the parent's history or completing its turn.
Emit reviewer items as `rawResponseItem/completed` notifications and interruptions as interrupted `turn/completed` notifications. Mark opted-in reviewer requests with `guardian_recorded_items` metadata.
## Testing
Extend Guardian integration tests to cover reviewer identity, recorded-item metadata replay, concurrent reviewer interruptions, independent parent completion, and behavior without the feature enabled.
GitOrigin-RevId: beb4dbf6c6f2a800a2fbf3cfd11ae174a1382386
## What changed
- Add `InitialBackendSessions` to carry the initial session and additional sessions into the TUI event loop. Existing launches continue to supply a single session.
- Shut down all supplied sessions on startup errors, cancellation, and early exits.
- Register the under-development `tui_multi_backend` feature flag, disabled by default, and expose it in the configuration schema.
## Testing
Add a regression test that fails bootstrap and verifies that both initial backends receive shutdown requests. Update multi-source event polling coverage to use the new initialization path.
GitOrigin-RevId: e5db439552de97594e6f13360b90be71256ab2f0
## Why
Credential substitution needs to authorize the destination and the original request before exposing host secrets. Project configuration must not redirect trusted credential policies, and older clients must reject scoped policies rather than silently apply unconditional injection.
## What changed
- Add hook `schemes` and `ports` constraints and an exact whole-header `placeholder` for secret substitution. Require `network.mitm.version = 2` for these options in permission profiles.
- Restrict placeholder substitution to HTTPS on port 443 and reject missing, mismatched, or duplicate placeholder headers.
- Reject project changes to trusted MITM definitions and their inheritance chains. Allow self-contained project header-stripping policies only when no trusted MITM policy exists.
- Reject ambiguous query values, value-constrained headers, and semicolon paths during authorization, and preserve case-sensitive extension methods.
- Mark resolved secret headers sensitive, reject secret injection into `User-Agent`, restrict substitution headers, and limit secret files to 64 KiB.
## Testing
Add regression coverage for scoped TOML resolution, legacy-format rejection, unknown fields, project policy restrictions, origin and placeholder denials, ambiguous request matching, secret redaction, and hook application after credential brokerage.
GitOrigin-RevId: 78dc115ab6c88c9a734377626429bc4840731f89
## Why
Enterprise-managed MCP authentication previously required public OAuth clients at both the identity provider and the MCP authorization server, preventing use of registrations that require client secrets.
## What changed
- Accept separate `client_secret` and `token_endpoint_auth_method` settings for the enterprise IdP and MCP server OAuth registration. Support `client_secret_basic` and `client_secret_post`, defaulting to Basic when a secret is configured.
- Validate the registered method against server metadata and use it for enterprise login and both ID-JAG exchanges.
- Require a configured `oauth.authorization_server_issuer` for confidential MCP registrations and reject empty secrets or authentication methods without secrets.
- Require the account OAuth client to match the configured IdP client before reusing an account grant with a provisioned secret; otherwise use dedicated enterprise login.
## Testing
Extend configuration, login, exchange, and app-server lifecycle tests to cover confidential registrations, separate IdP and resource credentials, authentication method validation, and exclusion of client secrets from authorization URLs, stored login grants, and logs.
GitOrigin-RevId: b3be378c2b1bb67e6a3652c648e72fd2e21e956d
## What changed
- Store `logs_2.sqlite` in `log_dir` when explicitly configured, unless a managed `sqlite_home` requirement applies. Keep other databases in `sqlite_home` and preserve the existing SQLite log location when `log_dir` is unset.
- Initialize and lock the selected log directory only when opening its database, so an unavailable directory does not prevent authentication commands from loading configuration. Share the cleanup lock across configuration clones and allow failed initialization to be retried.
- Leave existing logs in place. Read legacy logs for diagnostic submissions when the current query returns no logs, attaching them as `codex-logs-legacy.log`. Continue retention cleanup and page reclamation for both locations, with independent maintenance locks and filesystem checks.
## Testing
Add coverage for configuration routing and managed requirements, deferred initialization and lock lifetimes, authentication with an unavailable log directory, legacy log attachments, and cleanup of current and legacy databases.
GitOrigin-RevId: 48216694596d738eff1b3c5eef6c4e7ada6d0137
## What changed
Add a save RPC that accepts the existing report options and an absolute `savePath` on the server host. Save the report, selected attachments, and a manifest without uploading, and return `savedPath`, `threadId`, and `promptHash`. Local exports remain available when uploads are disabled by configuration.
Publish archives atomically without replacing existing files. Bound uncompressed contents to 200 MiB and attachments to 128, preserve duplicate attachment names safely, and fail without publishing a partial ZIP when a selected file cannot be read. Honor `includeLogs` and omit automatic rollouts for untouched threads without materializing them.
Update protocol schemas and generated TypeScript and Python types.
## Testing
Add coverage for local-only saves, disabled uploads, path validation, overwrite protection, log consent, archive budgets, duplicate names, missing files, and rollout selection before materialization and after writer shutdown.
GitOrigin-RevId: 222c0fe7ab923904de9c8a9f12ad27f7a0104875
## What changed
Add `RuntimeAuthProvider` to resolve request authentication through the runtime auth manager. Support `dual_header` mode, which sends a bearer credential alongside `x-openai-agent-assertion`, and `assertion_only` mode, which uses `Authorization: AgentAssertion …`.
Replace stale authentication headers and sign a fresh assertion for each request attempt. Propagate registration failures without falling back to credential-only authentication, preserving policy errors and classifying transport failures, rate limits, and server errors as transient.
Add the disabled-by-default `features.runtime_agent_instances` configuration with independent `enabled` and `mode` settings, schema support, and structured override merging. Selecting a mode alone does not enable the feature.
## Testing
Add coverage for both modes with API key and ChatGPT credentials, stale header replacement, fresh assertions, credential refresh without runtime replacement, registration failures, and configuration parsing and merging.
GitOrigin-RevId: 9e93d25762600f0ff592c5248fe4c8c2c8182c8d
## What changed
Default `features.multi_agent_v2.preserve_fork_prefix` to `true`, so full-history forks retain the parent's model-visible history and append child instructions. Keep `preserve_fork_prefix = false` as an explicit opt-out for instruction filtering, and update the configuration schema documentation.
## Testing
Update coverage to verify inherited prefixes across child and grandchild forks, child instruction ordering after compaction, and explicit filtering opt-outs.
GitOrigin-RevId: f14eae5b924cdeac555d112d0aba3fbbb063b0ea
## Why
Temporary environment attachments for a parent turn should not become a
subagent's persistent environments. Children also need to retain their
configured executor bindings when their runtime is evicted and reloaded.
## What changed
- Add the disabled-by-default `subagent_thread_environments` feature flag.
When enabled, both subagent implementations inherit configured thread
environments captured with the invoking step, excluding turn-only attachments.
- Track configured bindings separately from active turn attachments, preserving
pending configuration ownership and sharing completed executor startup.
- Retain configured selections and bindings across idle eviction. Reload children
using retained bindings when the parent changes workspace, while continuing to
validate current parent roots and permissions for matching workspaces.
## Testing
Extend regression coverage for configured, empty, forked, pending, and legacy
inheritance; temporary attachment removal across eviction; and reload behavior
with changed workspaces, deferred startup, and restricted permissions.
GitOrigin-RevId: 15692ecd99deb38002014b44fd859d793bd54373
## What changed
- Remove `subagent_thread_environments` and the separate configured environment bindings. Spawned agents inherit the invoking step's environment snapshot.
- Retain environment selections across child eviction without retaining executor bindings. Reload V2 children against the parent's captured environments, requiring matching environment IDs, working directories, and workspace roots while preserving permission validation.
GitOrigin-RevId: d820c63ea20f5834ed88071d16c60683f2545406
## Why
Temporary environment attachments for a parent's turn should not become a child's persistent environment configuration or survive child eviction.
## What changed
- Add the default-disabled `subagent_thread_environments` feature flag. When enabled, subagents inherit configured thread environments captured with the spawning step instead of active turn selections.
- Track configured bindings separately from turn attachments, preserving pending configuration ownership when turn selections change.
- Retain configured bindings across child eviction and reload, excluding temporary attachments. Preserve the child's workspace when the parent switches workspaces, while enforcing current roots and permissions when the parent still configures the same workspace.
## Testing
Extend coverage for both multi-agent versions, forked children, empty configured environments, pending configuration, and legacy inheritance. Add eviction and reload cases covering temporary attachments, workspace changes, deferred executor startup, and permission validation.
GitOrigin-RevId: 4533645503d5f863a9ccc064386ed7ca169d98b7
## Why
Thread unload timing used the server-wide delay, ignoring per-thread configuration overrides. Clients need to control how long individual idle, unsubscribed threads remain loaded.
## What changed
- Resolve unload timing from each loaded thread's `thread_unload_delay_secs` configuration. Setting it to `0` allows immediate unloading once the thread has no subscribers or activity.
- Allow this runtime retention override in `experimentalPredictionMode` forks while continuing to reject other configuration overrides. Reject negative values and delays too large to schedule.
- Replace the source-specific immediate-unload behavior with explicit configuration.
## Testing
Extend integration coverage for per-thread delays, unloading after active turns finish, fork overrides, and invalid prediction-fork delays. Verify that immediate unloading preserves persistent history and that cold resumes and ordinary nested forks use their default delay instead of retaining the previous runtime's override.
GitOrigin-RevId: fcb82bd73a101260c51e2a8476f94320c23ac929
## Why
Dual-write prepares v2 memories while v1 is selected. Once v2 is selected, running the v1 pipeline is no longer needed.
## What changed
Run both memory pipelines only when `memories.dual_write` is enabled and `memories.version` selects v1. Run only v2 when it is selected, even if dual-write remains enabled. Update the configuration documentation and schema to describe this behavior.
## Testing
Extend the startup test to cover both selected versions, checking model request counts, versioned extraction and consolidation state, and the absence of v1 rollout summaries when v2 is selected.
GitOrigin-RevId: 1eb85bd67d7b32883b4ff086514a2acfb6b18f3a
## What changed
- Add `PreModelRequest` and `PostModelRequest` hooks around model request attempts, including retries. Pass model, session, turn, and optional subagent context; report completion, failure, or cancellation with errors and token usage when available.
- Treat hook output as diagnostic data without allowing it to veto requests or alter model context. Wait for synchronous post-request hooks before dispatching tools, while asynchronous hooks allow streaming tool dispatch to continue.
- Apply memory-consolidation hook filtering and expose the new events through configuration, protocol schemas, generated clients, and the hooks browser.
## Testing
Add integration coverage for failures and retries, ignored control directives, cancellation, synchronous and asynchronous tool ordering, interrupted-turn resume and token accounting, and memory-consolidation filtering. Update hook schema fixtures and hooks browser snapshots.
GitOrigin-RevId: 6ed7b39fc8bb94cf467e350d07d97fcc729c21ce
## Why
A worker can finish after its parent has returned a final answer. Agent messages without `trigger_turn` previously needed an outstanding durable sleep to wake an idle session.
## What changed
Add the disabled-by-default `wake_on_agent_messages` feature to start a new root turn when agent mail arrives through direct delivery or the host mailbox. Reuse the previous turn context for messages without `trigger_turn`. Keep these automatic wakes disabled for interrupted sessions, Plan mode, and child agents.
## Testing
Add coverage for both delivery paths waking a completed root exactly once, child completion waking a parent after its final answer, and the interruption, Plan mode, and child-agent boundaries.
GitOrigin-RevId: f1a4fc7c22be8ca46b2173a85445126cbdd6c4b6
## What changed
Add `features.app_server_websocket_compression`, disabled by default. TCP WebSocket and Unix-domain socket listeners now negotiate zstd compression only when the feature is enabled and the client offers the supported protocol. Otherwise, connections use plain text messages.
Include the feature in the configuration schema and allow its override during TUI daemon startup.
## Testing
Extend transport tests to cover enabled and disabled compression with supported, unsupported, and absent client offers on both transports. Add an app-server integration test that verifies startup configuration controls negotiation and the message format used for initialization responses.
GitOrigin-RevId: 6001d65f66f9c48f099b85380c2cad8ffee04de7
## What changed
Add the `multi_env_copy_file` feature flag, disabled by default and marked as under development, to the feature registry and configuration schema. Install the file-copy extension in app-server threads and CLI debug prompt construction when the flag is enabled.
GitOrigin-RevId: 6d8b4c7479974f4b70c39f52333491c13d60d2a2
## Why
MCP servers can expose new tools during discovery. Refreshing the catalog after a tool-list notification lets Codex discover and call those tools in the same turn.
## What changed
- Add the disabled-by-default `mcp_tool_list_changed` feature for ordinary MCP servers.
- Track notifications in transport order and refresh catalogs before subsequent discovery or tool binding. Coalesce concurrent refreshes and retry listings invalidated by notifications, including during pagination.
- Retain the previous catalog on refresh failure, apply a retry cooldown, and invalidate affected startup caches. Allow notification refreshes to proceed while admitted calls finish.
## Testing
Add coverage for same-turn discovery and invocation in direct and Code Mode, notifications during startup and pagination, disabled behavior, cache invalidation, and concurrent refreshes with timeout recovery.
GitOrigin-RevId: 9afee8deba00dd9851b5f32625f61f96965aa00c
## Why
A plugin's scripts can change without changing its hook declaration. Declaration-only approval therefore lets changed plugin code run under an existing hook approval.
## What changed
- Fingerprint plugin bundle contents and include the content hash in the approval value returned by `hooks/list`. Persist it as `trusted_content_hash`, keeping `trusted_hash` compatible with older clients.
- Verify contents before each command or MCP hook execution, within the hook's timeout, and require renewed approval when approved contents change.
- Migrate legacy declaration-only approvals to a shared, immutable content baseline per plugin and config home.
- Exclude generated Python bytecode, `.venv`, and `.egg-info` entries from fingerprints. Run app-server hook listing on blocking tasks.
## Testing
Extend integration coverage for plugin upgrades and rollbacks requiring approval, same-turn script changes preventing further hook execution, shared legacy approval baselines, and generated Python artifacts preserving trust.
GitOrigin-RevId: faaf7658210d8adb2534ddd614c72ec993920840
## What changed
Add optional `remote_plugin_id`, `release_id`, and `auto_provision` fields to `PluginConfig` and the configuration schema. Store remote plugin identity, release, and provisioning metadata without fetching releases or triggering provisioning. Entries containing only this metadata continue to inherit existing plugin activation defaults.
## Testing
Extend configuration round-trip and plugin loader tests to cover remote metadata entries with inherited enablement and with `plugins._default.enabled = false`.
GitOrigin-RevId: bb657c25929cab100982b37120ab62b089eb7044
## What changed
Replace the `/presets` recall picker with a responsive menu above the composer. Press `0`–`9` to run a saved preset or create one in an empty slot; use `n`, `s`, `e`, and `d` to create, start from current settings, edit, and delete presets.
Add `tui.keymap.chat.open_presets` with an implicit `leader p` shortcut that yields to existing bindings and explicit configuration. Show the action in `/keymap` and add a shortcut tooltip.
Preserve the composer draft, respect popup ownership, and consume held-key repeats after menu actions.
## Testing
Add snapshots for empty, populated, and narrow preset menus, plus coverage for draft preservation, cancellation, held-key handling, transcript search precedence, and default shortcut conflicts.
GitOrigin-RevId: f438c7015dbd416c90cdeb479d2a15d9d6d24954
## What changed
Add `tui.presets` entries keyed by a single digit from `0` to `9`, each with an `input` prompt or slash command and an optional `label`. Expose presets in the configuration schema, load them into runtime configuration, and preserve them in TUI local settings.
Reject invalid slots, blank inputs, shell commands beginning with `!` after leading whitespace, and inputs exceeding 8,000 UTF-8 bytes.
## Testing
Extend the runtime configuration test to verify loading both a slash command with a label and a prompt without one.
GitOrigin-RevId: d2911e540bc50f05b4a5224abf17ce4ef5a18ea3
## What changed
Apply `tui.copy_on_select` to composer mouse selections on release, including X11 PRIMARY publication when enabled. Keep editable selections highlighted so typing can replace the selected text, even when `tui.copy_on_select_clear_selection` is enabled.
Share clipboard destination handling across the transcript, footer, and composer. Apply automatic deselection to footer selections after confirmed delivery, and release composer and footer PRIMARY ownership on focus loss or resume. Update configuration descriptions to clarify the behavior across all three surfaces.
## Testing
Add composer tests covering copy on release, retained selection highlights, replacement by typing, PRIMARY ownership lifetime, and clipboard-only status reporting for pending copies.
GitOrigin-RevId: 46999a32170149193fca561741000e97dfc458cf
## What changed
- Add the disabled-by-default `executor_capability_discovery_v2` feature to acquire `capabilities/discoverV2` inventories from supporting remote executors using each selected environment's working directory and sandbox.
- Share snapshots with MCP and world-state contributors and skill providers without activating discovered plugins or publishing discovered skills to the model.
- Cache inventories by environment instance, executor session, working directory, and sandbox. Coalesce concurrent requests, refresh the cache at turn start, retry transient failures, and refresh MCP projections after recovery.
- Resolve the system skills root in the executor and pass it explicitly to capability location discovery.
## Testing
Add coverage for feature gating, unsupported executors, inert inventories, cache reuse and eviction, turn refreshes, failure recovery, executor replacement, and system skill locations.
GitOrigin-RevId: 1bdca28fa7f17622b27e2713ab3dcc0c13426889
## What changed
Use `conversation` when neither a local `async_classifier_mode` override nor a model default specifies a mode. Keep `snapshot` available as an explicit override and update the configuration documentation and schema to describe the new fallback.
## Testing
Expand configuration tests to cover all local override and model default combinations. Update app-server approval tests to exercise conversation mode without an explicit override, and explicitly select snapshot mode in tests that depend on it.
GitOrigin-RevId: a62479a3f6454bf28d589373a236d8b0ab5023b9
## What changed
Add `features.multi_agent_v2.disable_native_tools` to hide native multi-agent tools while keeping the V2 runtime and its instructions enabled for host-provided tools. The option defaults to `false`, preserving existing tool exposure.
## Testing
Extend configuration parsing tests for the new option and parameterize the multi-agent catalog scenario to cover both settings. Add a snapshot showing native tools are absent while the V2 runtime and instructions remain enabled.
GitOrigin-RevId: 21a53584d2395bb678813c876a8b7927bea61c90
## What changed
Register the disabled-by-default `async_compaction` feature and accept either a boolean or a `[features.async_compaction]` table. Add `model_async_compact_threshold_percent` with a default of 65 and a valid range of 1–100, validated even when the feature is disabled. Setting a threshold alone does not enable the feature.
Expose the threshold in the runtime configuration and update the JSON schema for both configuration forms.
## Testing
Add configuration loader tests covering boolean and table forms, default and custom thresholds, explicit enablement, and rejection of out-of-range values.
GitOrigin-RevId: cf33de76878e7044bc8cf5d146375a07ea9eb078
## What changed
- Group preferences into Appearance, Notifications, Input, Sessions, and Text selection tabs, with search and links to existing theme, status line, terminal title, and keyboard editors.
- Persist preference changes to the selected local configuration file, apply supported changes immediately, and show save errors, configuration overrides, and restart requirements in the panel.
- Add a delayed notification test and controls for notification timing while preserving custom event filters.
- Add `tui.copy_on_select_clear_selection`, disabled by default, to clear transcript selection highlights only after confirmed automatic clipboard delivery.
- Keep local configuration editors usable while disconnected and prevent held activation keys or buffered input from triggering actions across editor and reconnect transitions.
## Testing
Add regression tests and rendering snapshots for panel navigation, search, dependency states, editor handoffs, offline persistence, notification timers, custom filter preservation, and confirmed-copy deselection.
GitOrigin-RevId: a16d218046060fcb6e61705a803fcd9297266e6e
## Why
Client-supplied tool outputs can carry task instructions. Even when marked with `retain: true`, these instructions could be trimmed before compaction and disappear from the compacted history.
## What changed
Add the disabled-by-default `retain_client_tool_outputs` feature to honor retention for explicitly marked, named `function_call_output` items without a `call_id`.
- Preserve eligible outputs in remote compaction v2 and when starting a new context window, keeping their original role.
- Stop emergency tool-output trimming at a retained output.
- Share the existing 64,000-token retention budget, keeping outputs whole and dropping an oversized output and older items rather than partially truncating it.
- Place initial context before retained standalone outputs and account for their images in retained-image counts.
## Testing
Add a scenario covering enabled and disabled retention, emergency trimming, oversized-output handling, and preservation of the latest instruction after compaction and cold resume. Verify that retention annotations stay out of model requests.
GitOrigin-RevId: 449179670e4d2be2623928700738758e43b5dc1a
## What changed
- Add the disabled-by-default `output_token_replay` feature to request `output.encrypted_content` from OpenAI providers.
- Preserve encrypted message and tool-call output, message and function-call status, and output-text `annotations` and `logprobs` through history and replay. Update the generated protocol schemas and SDK types.
- Strip output ciphertext from requests to other providers while retaining it in stored history, including after replay is disabled. Remove encrypted content from memory extraction inputs.
## Testing
Add integration coverage for the feature/provider combinations, metadata replay across follow-up requests, and history preservation when resuming with replay disabled.
GitOrigin-RevId: 77729a021b6771933402aebe74ece8eb39c057e2
jif