## What changed
Add `thread.usage.total` to the provider-facing statusline snapshot with total input, cache-read input, cache-write input, other input, and output token counts. Preserve cache-write counts when converting app-server token reports for the TUI.
Omit totals when usage is unavailable, the breakdown is invalid, or the report represents a synthetic context fill. Keep measured zero totals.
## Testing
Add coverage for the reported token breakdown, cache counts exceeding total input, synthetic context fills, and measured zero usage.
GitOrigin-RevId: 6c506af30d6e51a49a780a0316304ef9c067fe43
## Why
The primary executor's working directory can differ from the app-server's. Displaying the app-server directory can misidentify the workspace, and abbreviating a remote path using the TUI's home directory can be misleading.
## What changed
- Carry the primary environment's working directory through thread initialization, restoration, and settings updates.
- Use it for the status line and terminal title's current-directory item, and expose it as `thread.workspace.cwd` in the statusline state.
- Preserve the known environment directory when settings omit environments; fall back to the app-server directory when the environment list is empty.
- Apply home-directory abbreviation only to server-local workspaces on local connections.
## Testing
Add regression coverage for remote executor paths, omitted and empty environment settings, local-only directory abbreviation, and workspace state for inactive threads. Update the resumed-thread snapshot to display the executor directory.
GitOrigin-RevId: 9f3bcad186e07f942ea00d1f4233cf09f022571f
## What changed
Add a serializable `StatuslineState` containing app and status-line configuration, thread identity, agent state, model settings, approvals, and permissions. Reuse the displayed status line's run-state and profile logic, and serialize status-line items with their canonical configuration IDs.
Omit the snapshot for read-only history or when no thread is attached. Omit service-tier, approval, and permission fields until thread settings are confirmed. Use an inferred child thread's reported model and reasoning effort without inheriting the parent's collaboration mode.
## Testing
Add coverage for serialized settings and canonical item IDs, inferred child-thread values, settings confirmation, and snapshot availability before and after interactive resume.
GitOrigin-RevId: 512bdff9b92d886a7764f16955206109f56437d3
## What changed
- Point `Apply for Daybreak` to `https://chatgpt.com/admin/status-and-access`.
- Point the Astra notice’s `Learn more` link to the Daybreak overview’s model-specific reduced-refusals section.
- Update notice snapshots to reflect the new URLs and line wrapping.
GitOrigin-RevId: 14068e8d6e56ec1a3bf3a0f896b5c36204a9eff8
## Why
Encrypted MCP OAuth reads hold a shared file lock while accessing the keyring, blocking writers until the keyring lookup and decryption finish.
## What changed
- Add `LocalSecretsSnapshot` to capture ciphertext under the file lock, then release shared read locks before keyring access and decryption. Keep exclusive locks across conditional credential updates.
- Reuse the loaded passphrase when updating existing secrets, avoiding a second keyring lookup. Return an error when an existing encrypted file has no keyring passphrase instead of generating a replacement.
- Update login storage error fixtures to use directory reads that fail consistently across platforms.
## Testing
Add regression coverage for releasing read locks during keyring access, updating secrets with one keyring lookup, rejecting missing passphrases on cached reads, and reading captured snapshots after later writes.
GitOrigin-RevId: add8f60dba52f71c8f8bc10ae8b8ae2f3379ccac
## What changed
- Keep partial cloud skill and plugin catalogs, and catalogs with warnings, usable while retrying discovery with exponential backoff. Start retries after 5 seconds and cap the delay at 5 minutes; clear backoff after a complete, warning-free result.
- Replace previous catalog entries with each accepted result, including partial results, and clear cached cloud skill resources when publishing a replacement.
- Check catalog freshness across turns and steps using auth and resource identity. Auth or resource changes bypass retry cooldowns, including within the same turn.
## Testing
Add and update tests for retry delays and recovery, concurrent refreshes, auth and resource invalidation, partial catalog replacement, and cloud skill read-cache replacement.
GitOrigin-RevId: 0ce5a9d5596e8a73d7084abbbaeb4fb8cda84aa0
## Why
When an Apps `tools/list` response supplies connector names and descriptions in shared `openai/apps` metadata, tools need those fields restored to expose the correct namespaces and descriptions to the model.
## What changed
Match tools to shared connector metadata by `connector_id` on each response page and copy nonempty names and descriptions into tool metadata before conversion. Restrict this handling to Codex Apps; regular MCP servers use the standard tool listing path.
## Testing
Add a regression test with two tool pages that verifies both connectors' namespaces and descriptions appear in the model's tools state.
GitOrigin-RevId: d4c8b44007773ff65d3e366669ee5c705a480cb1
## What changed
Add `modelProvider/default/set` with a `providerId` parameter to persist the default provider for new threads and model lists. Return `ConfigWriteResponse`, reject unconfigured providers, and respect managed requirements, read-only configuration, and CLI overrides.
Reload the model catalog on its next read when the default changes effectively. Resolve explicit `model/list` provider selections against the current catalog configuration so clients can continue listing models for a retained provider after switching defaults.
Update the protocol schemas, generated TypeScript and Python types, and app-server documentation.
## Testing
Add coverage for switching defaults and switching back, rejecting unknown providers without changing the catalog, retaining explicit provider selections, reporting CLI overrides, and rejecting writes blocked by configuration restrictions.
GitOrigin-RevId: 3615835f58045d33a21b3c57d47932d6d1e3fb12
## What changed
- Remove `Config::legacy_sandbox_policy` and `Permissions::legacy_sandbox_policy`.
- Update core and TUI tests to use permission profiles and filesystem/network policies directly, with explicit conversion where legacy wire formats are required.
- Report the active sandbox label in app-server resume override mismatch diagnostics.
GitOrigin-RevId: cbc5417944e23404523e69dc5516d66d6bfafefe
## What changed
- Add the disabled-by-default `file_backed_tool_audio` feature to prepare fresh function and custom tool audio through the attachment store before persistence. Store returned file IDs in history and preserve them on replay without uploading again.
- Validate and budget mixed text and audio output before uploading retained clips, preserving audio token charges and producer limits. Resolve tool audio durations before continuation compaction checks.
- Keep inline audio on backend upload failures and use text placeholders for invalid or rejected clips. Replace unavailable tool audio files with placeholders in prompts while retaining the original history, so restored files can be used again.
- Treat file-backed tool audio as a competing source when attributing audio or unknown-file errors to user uploads.
## Testing
Add coverage for direct tool and Code Mode audio across follow-up turns, file expiration, restoration, and resume in both legacy and paginated history. Extend tests for truncation before upload, upload failure handling, bounded error placeholders, and error attribution.
GitOrigin-RevId: 66c1e7699c7d92f98c3a2d0f5cecbbd63147eb6c
## What changed
Add `release_id: Option<String>` to `PluginSourceLocation::Cloud` to carry the opaque release ID selected by the cloud catalog for a plugin declaration. Update catalog and discovery test fixtures to supply the new field, including a populated release ID in catalog reconciliation tests.
GitOrigin-RevId: 1d60e25bd5fb8efd84e6e825305ad68b847fc1ee
## Why
Managed network requirements support both legacy tables and `permissions.network`. Equivalent declarations in one source should be accepted, while older runtime clients still need the top-level network field.
## What changed
- Normalize `network_proxy` and `experimental_network` into `permissions.network` before merging requirements, preserving source attribution and explicit empty allowlist replacements.
- Accept legacy and nested declarations in one source when they describe the same policy, comparing domain and review selectors by their canonical identities. Continue rejecting mixed surfaces across sources.
- Populate the legacy output field for compatibility and preserve legacy selector text when both forms are supplied.
- Include contributing requirement sources in cloud bundle errors without exposing submitted TOML.
## Testing
Add coverage for equivalent and conflicting declarations, empty allowlist overrides, loader compatibility, and debug output. Add a proxy regression test verifying that a saved grant cannot bypass managed loopback restrictions.
GitOrigin-RevId: e0d2a600f5c7c6c07a665ccc0e18a72ff172fd6d
## Why
Compaction can drop active client context while deduplication prevents unchanged values from being sent again on subsequent turns.
## What changed
Track additional context by history item ID and restore active items when installing complete or prefix compaction results. Preserve their history order, refresh retained items with their original bounded payloads, and leave queued updates to arrive with their input.
## Testing
Add regression coverage for local compaction with message context and remote compaction with tool-output context. Verify that current context survives exactly once, stale values are absent, and restored context precedes the preserved user prompt.
GitOrigin-RevId: a3114f387c6a4ae1a2d1651993d0f7a101be7dd5
## Why
The bounded submission channel reserves all slots at session startup, including space for a full `Submission` in each slot.
## What changed
Send `Box<Submission>` through the channel so each slot reserves only pointer-sized payload storage, allocating full submissions as needed. Update submission producers, delegate forwarding, and test helpers to pass boxed submissions, and unbox them in the submission loop.
GitOrigin-RevId: d8d9c613683076d74fcb3e2f2cb6244c5857bca2
## What changed
Add `codex-windows-sandbox-service` to the Windows package build binary list and include its release files in the combined Bazel runtime archive.
GitOrigin-RevId: 3438aae09cc605303145ac220766a8e71ea284ff
## Why
Cached recommendations can keep offering a plugin after installation. Refreshing the shared catalog during step preparation can also leave the recommendation prompt and install handler with different candidates.
## What changed
- Check `tooling_changed_at` before reusing recommendations, with a one-second reuse window and a 250 ms deadline that includes authentication. Refresh the catalog when the marker changes, preserving cached recommendations on failure and retrying on a later poll.
- Scope recommendation and featured-plugin caches by product, backend, and account identity, and share concurrent recommendation refreshes.
- Use the same recommendation snapshot for a step's prompt and install handler, while allowing later steps to observe updated recommendations.
## Testing
Add coverage for marker changes, missing markers, refresh failures, concurrent and cancelled requests, and the authentication deadline. Extend integration tests to verify consistent step candidates and stop offering an installed plugin while preserving the original recommendation block in conversation history.
GitOrigin-RevId: 44fa6723a623d9604f0c768118bc6889d2d3b693
## Why
Cloud plugin discovery previously ran each turn even when authentication and Apps resources were unchanged.
## What changed
- Reuse complete, warning-free catalogs across turns, including empty catalogs, while authentication and the Apps resource cache key match.
- Retry partial catalogs and catalogs with warnings on subsequent turns, preserving failure backoff.
- Reject discovery results if authentication or Apps resources changed while discovery was in flight. Hosts must invalidate Apps resources when the remote plugin catalog changes.
## Testing
Extend lifecycle tests to cover populated and empty cache reuse, resource and auth invalidation during discovery, and reuse of the empty catalog after plugin revocation.
GitOrigin-RevId: f0f0f4fd5a83179d722ba3cb917deec7eef18458
## What changed
- Add `code_mode.heartbeat_interval_s` to configure heartbeats after inactivity on session-event and tool-call streams. The default value of `0` disables heartbeats.
- Pass the interval through session options and gRPC requests, preserving provider defaults when overriding it.
- Ignore heartbeat messages in the client without admitting tool callbacks, and reject tool-call heartbeats that carry invocation data.
## Testing
Add coverage for disabled heartbeats, repeated idle heartbeats and timer resets after traffic, callback handling, and configuration loading. Extend TCP integration tests to verify heartbeats on both streams and continued session operation after idle periods.
GitOrigin-RevId: bf0b6d3081b5541837d07f35931e0dd3e5472c3b
## What changed
Recognize `orbit_cca`, `orbit_cca_web`, `orbit_cca_desktop`, and
`orbit_cca_mobile` as separate model catalog originators, giving each its
own manager and disk cache.
## Testing
Extend catalog isolation coverage to the Orbit originators, including cache
reuse after manager recreation and avoiding redundant refreshes when the
catalog ETag is unchanged.
GitOrigin-RevId: 9507daae5c418212c9fed1be76df9aaa43c9d73f
## What changed
Show an editable draft while starting a new conversation in the TUI, including on another backend. Hand the draft to the conversation when it opens, keeping submission disabled during the transition.
If opening fails, show a failure hint and restore the draft to the current composer. Drain queued input and preserve delayed paste newlines before handing off the draft.
## Testing
Add regression tests for editing before thread startup completes, retaining drafts and consuming queued Enter keys after failure, and preserving multiline raw pastes across handoff.
GitOrigin-RevId: 40540306b4544c485d0dfe76aeda7a4c8b82b19b
## What changed
- Make `TimeProvider::current_time` and `CodexThread::current_time` synchronous, with clock reads required to avoid yielding or calling back into the session.
- Remove the experimental `currentTime/read` app-server request and its client-backed clock and sleep polling implementation.
- Require a host-provided `TimeProvider` for external clocks. App-server thread startup now fails when `features.current_time_reminder.clock_source = "external"` has no provider.
## Testing
Add coverage for external provider selection and rejection of app-server thread startup without an external provider.
GitOrigin-RevId: 09479d6eb28453b343dee78b3673092e73ae5d73
## What changed
- Keep drags within a wrapped table cell scoped to that cell's text. Dragging into another cell selects a rectangle of complete cells.
- Let triple-click select an entire cell, including from its padding, and extend or shrink the selection by dragging.
- Preserve table structure, empty rows, alignment, and escaped literal pipes when copying rectangles. Keep inline Markdown formatting when copying cell text.
- Support grid and stacked record layouts, and return to ordinary text selection when a character drag leaves the table or selection continues with the keyboard.
## Testing
Add regression tests and highlight snapshots covering wrapped cells, reverse and repeated drags, padding, empty cells, stacked records, copy-on-select, clipboard formatting, and selection after resizing.
GitOrigin-RevId: 32e9a6e7781b0a25914907a0ef8f8c28bbaa21f5
## What changed
- Remove the `codex-v8-poc`, `sentry`, and `syntect` workspace dependency entries and the `codex-v8-poc` entry from the `cargo-machete` ignore list.
- Remove unnecessary clones from MCP configuration and web search serialization tests.
- Simplify the final protected-metadata check in `WritableRoot::is_path_writable` to return the negated predicate directly.
GitOrigin-RevId: 80c1dd3106fc24c0767696936c719bb1fbb47227
## What changed
Request plugin suggestions with `includeInstalled=false` and use the endpoint results without filtering against loaded plugins or the local installed-plugin cache. Retain disabled-tool and client eligibility filtering, and remove plugin loading that was only needed for recommendation filtering.
## Testing
Update tests to verify the query parameter and confirm that endpoint recommendations survive local installed-cache filtering while disabled tools remain excluded.
GitOrigin-RevId: a1b199f9ac8da7dae40abe46b6ccfaf1d8230a5c
## Why
Native TCP clients need to reach managed network destinations without implementing proxy support themselves.
## What changed
- Add `--transparent-tcp` to the Linux sandbox command, using a bundled TCP stack, private TUN interface, and DNS stub to route native IPv4 and IPv6 connections through the attributed managed SOCKS proxy.
- Preserve original hostnames for proxy policy checks and cancel pending approval connections when their native sockets close.
- Expose `--linux-sandbox-transparent-tcp` and `--tcp-upstream-proxy` on `codex exec-server` for transparent routing and a mandatory HTTP CONNECT next hop without direct fallback.
- Require private network and PID namespaces, private procfs, system `bwrap`, and access to `/dev/net/tun`; reject incompatible launcher options and untrusted proxy ports.
## Testing
Add integration coverage for native hostname and IPv6 connections, SOCKS attribution, pending connection cancellation, policy denials, and filesystem and host-loopback isolation. Extend launcher and executor tests for option validation and managed-policy propagation.
GitOrigin-RevId: 96bd7726e5369efceb65320face56aa85ae3deb8
## What changed
Wire signer-service settings from repository variables into the PKCS11 setup action for macOS binary, DMG, and provisioned bundle releases. Keep the feature disabled by default; Azure continues to supply tools, certificates, and notarization.
Require signing mode, a pinned certificate, GitHub OIDC, and valid endpoint, purpose, and key ID inputs when enabled. Reject pre-supplied OIDC tokens and providers missing signer-service support markers, then export the signer-service backend configuration.
GitOrigin-RevId: d6c9f2f65512892b286e4bbeb271633e23a96a24
Remove the BuildBuddy cache, build event upload, downloader, and remote execution
presets from `.bazelrc`, while retaining the shared remote execution policy for
callers that supply their own executor.
Update the Bazel documentation and Windows V8 cross-build instructions to remove
references to the deleted presets. Ordinary local `bazel` and `just` invocations
continue to run locally.
GitOrigin-RevId: bb0428a2aa4eac83d7a1b55d4e56a793f9b115bc
## What changed
- Derive sampling diagnostic and rollout trace labels directly from permission profiles instead of constructing legacy sandbox policies. Rename the trace metadata field from `sandbox_policy` to `permissions_profile`.
- Extract `with_workspace_write_cwd` to share default workspace metadata protections between legacy policy conversion and the TUI's sandbox-mode compatibility check. Build the check's workspace-write profile from filesystem and network permissions directly.
## Testing
Add a regression test confirming that the sandbox-mode compatibility check accepts standard workspace metadata protections and rejects a profile with an additional writable `.git` root.
GitOrigin-RevId: f20d23afd80dff6347865df3d6a94d6f5e90e1e0
## Why
Paginated MCP server status requests previously discovered all configured servers before selecting the response page, causing unnecessary connections to servers outside that page.
## What changed
Select and deduplicate server identities before discovery, then collect status only for servers on the requested page. Include thread runtime statuses when selecting pages and preserve separate entries for same-named servers in different environments. Empty pages skip discovery.
## Testing
Add coverage that counts MCP initialization requests across successive pages and an empty final page. Extend environment inventory coverage to verify that pagination preserves each registration's identity, authentication status, and tools.
GitOrigin-RevId: 0c9c9ca6c8016147eb9a12b53ffe533ac3334444
## Why
Relative attachment paths in queued submissions should refer to files in the thread's working directory, even when the app server runs from a different directory.
## What changed
Resolve relative `LocalImage` and `LocalAudio` paths against the loaded thread's current working directory or the stored working directory for an unloaded thread when adding or updating queued submissions. Preserve absolute paths and reject relative paths that cannot be resolved to an absolute path.
## Testing
Add a regression test for queue add and update with different images sharing the same filename in the thread and server working directories. Verify that the relative path selects the thread's image and that explicit absolute paths retain their meaning.
GitOrigin-RevId: 3c1a48693c031f1c650650a9b3a7059fb962ba5c
## What changed
Attach a tagged `ProcessStartErrorData` value to JSON-RPC errors for not-found, permission-denied, and other spawn failures, unavailable sandboxes, and sandbox preparation failures.
Record the error code and structured error kind for failed `process/start` responses in the `codex.exec_server.response_received` tracing event.
GitOrigin-RevId: 556d0068e469ea25e95108262826a77a66b7d83b
## Why
`codex mcp get` suggests `codex mcp remove` for servers defined in the active profile, but that command only edits the global config.
## What changed
For servers defined in the active profile, replace the removal hint with the profile settings file path and an explanation of the command's scope. Keep the removal hint for servers inherited from the global config.
## Testing
Add CLI coverage for profile-only servers, profile overrides of global servers, and inherited global servers.
GitOrigin-RevId: 454df034f7e74b10f96983a9f13821d5ababfde7
## What changed
Add `CodexThread::reproject_mcp_on_next_turn()` to request an MCP reprojection after `TurnStarted` and before tools are bound. Repeated requests coalesce, and idle reconciliation or prewarming leaves the request pending until the next regular turn.
## Testing
Add coverage for deferred requests surviving prewarm and idle reconciliation, coalescing into one reprojection, and exposing refreshed tools in the turn's first model request. Verify that discovery starts after `TurnStarted`.
GitOrigin-RevId: 260b2381013291a47eb9a7f736c129de76c5897f
## What changed
- Use the `rules_rs` 0.2.3 registry release instead of an archive override, and upgrade `platforms` to 1.1.0.
- Disable root crate alias targets and migrate explicit dependencies to package labels such as `@crates//tokio`. Disable root crate data for the argument comment linter's crate repository.
- Refresh the retained `rules_rs` patches, remove the zlib snapshot URL backport, and drop extra dependency declarations from `exec-server` and `v8-poc`.
GitOrigin-RevId: c354413a19b45964104457063c613028f5325bc0
## What changed
Allow the Guardian housekeeper to route evidence to existing channels without repeating their descriptions. Request descriptions only for new destinations or changed descriptions, and skip channel updates when a returned description matches the catalog.
New destinations still require descriptions, and description updates remain limited to routed channels.
## Testing
Extend housekeeping tests to cover omitted and repeated descriptions without extra channel writes, preserved descriptions, and rejection of missing new-channel descriptions or updates to unrouted channels before any writes.
GitOrigin-RevId: 3ab00fc17263d68d15e68f9d17ab31fc6f43f551
## What changed
Add `ChatWidget::is_read_only_view()` and use it for read-only guards across input handling, navigation, transcript rendering, and session restoration. The new helper delegates to `is_external_writer_view()`, preserving existing behavior.
GitOrigin-RevId: c8fd66526f502d79be306a19ee261e79c5abcd57
## What changed
Add `canonical_allow_pattern`, `canonical_deny_pattern`, and
`canonical_review_pattern` to validate and normalize selectors for policy
comparisons using the domain matcher's syntax.
Treat `?*.example.com` and `*.example.com` as equivalent comparison keys.
Canonicalize unscoped IPv6 addresses for deny and review rules, and preserve
wildcard ports on local allow rules so they remain distinguishable from explicit
local grants. Deny rules continue to reject global wildcards.
Share pattern validation with the matcher and local-literal classification with
runtime policy checks.
## Testing
Add a regression test covering equivalent subdomain selectors, local wildcard
ports, and differing IPv6 comparison keys for grants and restrictions.
GitOrigin-RevId: c72262ae9f625765d5351e9da403be1f87042a47
## Why
After a cloud model selection was accepted for future turns, status displays still showed the session's serving model and reasoning effort. A reasoning-only `/model` command also resolved against that model instead of the accepted selection.
## What changed
- Show the accepted model's display name and reasoning effort in the status line, terminal title, and `/status`.
- Resolve reasoning-only `/model` commands against the selected model.
- Share the session-only model change confirmation between cloud and local selections, including reasoning effort and service tier when present.
## Testing
Extend cloud model admission coverage to check accepted selections in status output, reasoning-only commands, and unchanged status before acceptance and after session metadata clears the selection.
GitOrigin-RevId: cc50c2b0a98e884138ad2c2339c79c28ee3d346a
## What changed
Set `DENO_CERT` and `CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE` to the managed proxy CA bundle when unset, preserving explicit values, including empty strings. Keep these client settings separate from the CA roots imported into the proxy trust bundle.
Preserve shell startup overrides when replaying snapshots, regenerate managed CA defaults instead of capturing them, and allow sandboxed processes to read the managed bundle referenced by these variables.
## Testing
Extend regression coverage for default CA settings, explicit overrides, trust-root selection, shell snapshots, and restricted sandbox access to the generated CA bundle.
GitOrigin-RevId: 2761706b54e0bb230c37bd4c515204c6eba0c650
## Why
Elastic request allocation did not account for item IDs added after evidence selection. Their token cost could push the completed request over its input limit instead of allowing optional evidence to be dropped.
## What changed
Reserve IDs for the possible new request items before allocating evidence, including their JSON escaping and field overhead in the global request budget. Assign the same reserved IDs to the selected items while preserving existing IDs and committed history.
## Testing
Add coverage for escaped IDs and native tool call outputs, and a regression test with long IDs that verifies optional images are omitted while committed history and new transcript text are retained within budget. Update budget boundary tests to distinguish fixed rejection from elastic evidence reduction.
GitOrigin-RevId: 621d6d83e3cc95efb9eef4976dff9b7799a6e7c8
## Why
Trusted classifier evidence needs to fit configured entry limits while preserving complete records and metadata that reflects only delivered reviews.
## What changed
Apply elastic caps before rendering trusted tools, trusted skills, and previous reviews into developer messages. Omit oversized tool attestations and review fragments whole, retain only complete skill paths that fit, and record omissions for the request's omission notice. Keep review IDs aligned with retained fragments and preserve fixed-budget behavior.
## Testing
Add coverage for whole-record omissions, retained review IDs, and omission notices. Exercise orchestrator connector evidence with both fixed budgeting and an elastic tool entry cap.
GitOrigin-RevId: 729db452026f93b59765a3936730b9b6dddfcf9a
## What changed
- Add `async_elastic_budgeting` and `async_elastic_sections` under `[features.guardianv2]`, independently of synchronous budgeting and disabled by default.
- Apply section limits and elastic allocation to new classifier evidence after accounting for setup and retained conversation history. Preserve the configured elastic policy when applying model defaults.
- Keep permission context whole during elastic allocation and record truncation observations when image preparation rejects an image.
## Testing
Add coverage for configuration validation, fixed and elastic conversation budgeting, retained history and cursor preservation, and complete classifier requests that retain evidence beyond the fixed entry limit.
GitOrigin-RevId: 2955f0482f7c3e18325e296fc2ccb6592ffcb73a
## What changed
Allow `thread/inject_items` to accept wrapped items with `retention: "default"` or `retention: "always"`, while preserving support for raw response items. Persist explicit policies separately from legacy client-authored metadata.
Carry explicitly retained items through local and remote compaction, context-window changes, and child-agent creation, subject to retention budgets. Preserve history order and keep retained tool exchanges together; require matching calls and outputs to be adjacent in the injection request and both marked `always`.
Update Quinn dependencies and record exceptions for additional Hickory DNSSEC advisories where DNSSEC is disabled.
## Testing
Update injection tests for explicit retention metadata and extend the compaction scenario to cover a retained tool exchange across repeated compaction and restart.
GitOrigin-RevId: 1195a4ed62dc162a62e58bc2ad733262fbabea27
## Why
Saved side chats can inherit their parent's name, leaving them labeled for the parent conversation rather than their own question.
## What changed
Generate an automatic title from the first successfully submitted direct text input in a newly saved side chat. Allow the generated title to replace the inherited name while preserving manual renames and leaving the parent title unchanged. Image-only first inputs retain the `[Image]` label without generating a title from inherited conversation text.
## Testing
Add regression coverage for saved side chat labels from text and image-only inputs, inherited-name replacement, manual rename preservation after switching threads, and retaining title eligibility when turn submission fails.
GitOrigin-RevId: 97f08dee8cc3280f1128aca23f27960235e00e86
## Why
An in-flight `ThreadList` request can block the cloud worker from processing subsequent requests even after its caller drops it.
## What changed
Skip queued `ThreadList` requests whose response receiver is closed, and cancel in-flight list handling when the receiver closes. Thread listing has no conversation state to commit, so the worker can safely move on to the next command.
## Testing
Add a regression test that holds a list RPC open, drops the caller's request, and verifies that a subsequent `GetAccount` request completes before the list RPC is released.
GitOrigin-RevId: 7c74e3305d58b85224d9882ea7e24b1ae791ec52
## What changed
- Add the disabled-by-default `safe_image_decoder` feature to decode and re-encode prompt images without source metadata, with byte and decoded-pixel limits.
- Apply JPEG orientation and supported ICC color conversion to sRGB, emitting PNG for PNG/GIF inputs and JPEG for JPEG/WebP inputs.
- Use the selected decoder for image preparation, `view_image` validation, and MCP image validation. Include the decoder in image cache keys.
- Preserve original inline images in history metadata so resume and fork can regenerate prepared images without repeated JPEG encoding changing their bytes.
## Testing
Add regression tests for identical JPEG replay after history serialization and for preventing legacy cache entries from bypassing sanitization.
GitOrigin-RevId: 718cd83d0a233e2eb8efd1a64c14d8944e44c350
## What changed
- Add `SessionModelIdStore` with SQLite and in-memory implementations for looking up and assigning aliases by session, namespace, and external key.
- Commit SQLite assignments before returning them, and recheck under a write transaction so concurrent writers reuse the same alias.
- Support snapshotting and initializing alias maps from generator state and ordered keys, and remove mappings when their thread is deleted.
- Expose alias stores through `ThreadStore` and add distinct types for registered environment IDs and model-facing `env` aliases.
## Testing
Add a test using two SQLite runtime instances to verify that concurrent assignments return the same alias, different keys receive different aliases, and lookups and snapshots preserve the assignments.
GitOrigin-RevId: 2668f605251ca76d4891f70f94bfb4151ba8142c
## Why
Inferring wait targets from request arguments can abort trace replay on malformed arguments and link waits to cells the host never resolved.
## What changed
Record an explicit `CodeCellWaitTargetResolved` event when the host confirms a live cell, and expose its runtime handle as `resolved_wait_runtime_cell_id` on the tool call. Build cell wait links from these observations, preserving links while cell source is pending and preventing late confirmations from linking to recycled handles after thread resume.
Older traces no longer infer wait links from request arguments, so an empty `wait_tool_call_ids` list does not establish that nobody waited on a cell.
## Testing
Extend dispatch and replay tests to cover live, missing, and invalid wait targets, pending cell source, legacy traces, and runtime handle reuse across threads and resume.
GitOrigin-RevId: 0f13b291c197c5487258b6ce36276cf1f19e2b6d
Joe Savona