## Why
Checking only the pull request head can miss conflicts with changes already on
`main`.
## What changed
Remove explicit pull request head refs from required workflow checkouts so
GitHub Actions checks out the synthetic merge commit by default. Keep the
blocking gate on the same combined revision as the child workflows it
evaluates, and document the merge-commit policy in the workflow README.
GitOrigin-RevId: dc357caa5dc43f46b9b9a0edea6ee560b4fe8efb
## What changed
- Bind OpenAI credentials to `api.openai.com` and trusted HTTPS hosts derived from local configuration or `OPENAI_BASE_URL`.
- Support GitHub credentials for `uploads.github.com` and translate Bearer, token, and Basic authorization forms while preserving their schemes.
- Apply credential broker configuration changes without restarting the proxy, including clearing affected credential mappings when trusted OpenAI hosts change.
- Restore brokered credentials in environments and command arguments that intentionally leave managed networking, while preserving user overrides and handling Windows environment keys case-insensitively.
- Keep local credential brokerage out of remote proxy launch configuration and avoid launching a remote proxy when brokerage alone enabled the local proxy.
## Testing
Added coverage for trusted host binding, authorization translation, live reconfiguration, credential restoration, managed-disabled behavior, remote launch configuration, and Windows environment key matching.
GitOrigin-RevId: 8d8bd3aaf6e581849cb622b2faec62cee4e13e52
## What changed
- Add `inject_response_items_for_turn` for callers that inject Responses API
items immediately before admitting user input. It defers the rollout flush so
the injected items and user input are persisted together by turn admission.
- Keep `inject_response_items` behavior unchanged by flushing after it delegates
to the new helper.
- Update the turn-start persistence test to exercise the turn-aware path.
GitOrigin-RevId: 8349b65f937af2b2a95d36b3fd73d862d38e5fd9
## What changed
- Add `auto_review_enabled` to serialized turn metadata for regular and review turns.
- Derive the value from approval-policy routing and reserve the metadata key so client-provided metadata cannot override it.
## Testing
- Cover enabled metadata, reserved-key handling, Guardian review requests, and updated compaction request snapshots.
GitOrigin-RevId: 52773e2bf7d4be251f8466332de9f9c9869dd084
## What changed
- Add `ResponseItemEnvelope` as the history-owned wrapper for a `ResponseItem`.
- Store envelopes in `ContextManager` while keeping raw-item iteration and consuming APIs for existing callers.
- Preserve envelopes when compaction and history normalization rewrite retained items, and wrap newly synthesized items.
## Testing
- Cover envelope access, mutation, and conversion back to raw response items.
- Cover annotated history replacement and annotated user-message collection for compaction.
GitOrigin-RevId: 3fa2e7bdd981b08cc7aec410c80deccaecdabab4
## What changed
- Render `node_repl.js` calls in conversation history with their title and the meaningful output from successful executions.
- Keep the full invocation and raw result available in the `Ctrl+T` transcript, including failure details.
## Testing
- Add snapshots covering successful and failed code mode calls in both history and transcript views.
GitOrigin-RevId: c8e24c2eae5e60020e9e8136f386590ca7c42367
## Why
Cross-platform remote `apply_patch` calls were rejected when filesystem writes
were restricted because patch verification and writes could not be safely
performed against executor files.
## What changed
- Route intercepted and direct remote patches through the executor-managed
filesystem sandbox, including the configured workspace roots.
- Select the restricted-token sandbox for Windows executor paths when no
Windows sandbox level was configured.
- Fail closed when an executor cannot enforce the requested sandbox, and treat
executor-managed access failures as sandbox denials so approval can retry the
patch without sandboxing.
## Testing
- Cover sandboxed remote patches, denied writes, approval retries, Windows
sandbox selection, and executor filesystem enforcement.
GitOrigin-RevId: caddeed0b266c456a689080a14a3a58e2bd7887c
## What changed
- Add `GrpcCodeModeSessionProvider` for opening code-mode sessions over HTTP/2 or an existing `tonic` channel.
- Support execution, waiting, termination, per-session limits, cell-closure callbacks, and graceful shutdown over the gRPC protocol.
- Bound transport waits and error messages, validate host identifiers and responses, and clean up abandoned executions and observers.
## Testing
- Add end-to-end TCP tests covering session persistence, cancellation, concurrent waits, shutdown, cell cleanup, and independent yield limits.
- Add unit coverage for protocol conversion, deadlines, and session lifecycle state.
GitOrigin-RevId: d4729ce608ad4b42a99744b07e1f230e46cb24ec
## Why
Local stdio MCP servers may start in a different working directory from Codex,
so inherited relative CA bundle paths can otherwise resolve to the wrong file.
## What changed
- Forward the supported custom CA environment variables to local stdio MCP
servers, convert inherited non-empty paths to absolute paths, and let explicit
MCP environment overrides take precedence.
- Match CA variable names and `PATH` case-insensitively where required, avoiding
duplicate environment entries and preserving executable discovery on Windows.
## Testing
- Add an end-to-end stdio MCP test covering relative inherited CA paths, empty
values, explicit overrides, alternate key casing, and a different server
working directory.
- Exercise executable resolution with Windows-style `Path` casing.
GitOrigin-RevId: ea1bc0ae63bc0dc780acb8363b2ed102120f282e
## Why
Per-chunk streaming traces can flood the bounded SQLite log queue.
## What changed
- Persist `codex_tui::streaming::controller` and
`codex_tui::streaming::table_holdback` events at `DEBUG` and above.
- Keep `TRACE` events enabled for other TUI streaming targets.
## Testing
Extended the SQLite log filter test to cover dropped streaming traces, retained
debug diagnostics, and unaffected streaming targets.
GitOrigin-RevId: e7eb999a0770eba6cce5f389005896e64928f02b
## Why
When the event receiver is closed, an MCP elicitation request cannot reach its
consumer. Ignoring that delivery failure leaves the request and its lifecycle
registration pending while waiting for a response that cannot arrive.
## What changed
Return a contextual error when an MCP elicitation event cannot be delivered.
This drops the pending-request guard immediately, removing the responder from
the router and releasing its lifecycle registration.
## Testing
Add a regression test that closes the event channel and verifies the request
fails immediately, the router is empty, and the lifecycle registration is
released.
GitOrigin-RevId: 1067f35a5775d61c5bcd07b4b190d3907d8f219a
## What changed
Retain persistable items directly in the owned append buffer instead of cloning
them into a second vector. Preserve the existing history-mode filtering and
empty-append behavior.
GitOrigin-RevId: 5300312545492bef28f63521427048a27d46a9d1
## What changed
Validate a SQLite thread's rollout path by reading its `SessionMetaLine` and
comparing the recorded thread ID directly. This avoids constructing a
`StoredThread` solely to decide whether the path can supply the requested
history.
GitOrigin-RevId: 8eb1e329514cefc056e44ab4a76d58ff50314a97
## What changed
- Silently complete approved Guardian assessments after clearing their live
review status, instead of adding an approval entry to conversation history.
- Continue rendering denied and timed-out assessments in history.
## Testing
- Update TUI snapshots to verify that approved command and permission-request
assessments add no history entry and that the status returns to `Working`.
GitOrigin-RevId: 32df1f2e3d4e23f0b792dcfdfcf7fbe95f33c703
## Why
Linux sandbox unreadable globs without a non-root directory prefix cannot be safely expanded because they would require scanning from `/`. Silently skipping these patterns leaves the requested deny-read rule unenforced.
## What changed
Return a fatal sandbox construction error when an unreadable glob cannot be split into a safe ripgrep search root. The error directs callers to use a pattern with a non-root directory prefix.
## Testing
Add a regression test confirming that `/**/*.env` rejects Bubblewrap command construction.
GitOrigin-RevId: 2f3cb398d39a9bc077d3a1b74e08dc506d239e60
## What changed
- Add structured `usageLimitExceeded` metadata to failed image-generation
items, including the image limit ID and optional reset timestamp.
- Preserve the failure metadata in completion events, app-server thread
history, thread reads and resumes, and migrated legacy rollouts.
- Export the new failure type in the generated JSON and TypeScript schemas.
## Testing
- Cover usage-limit responses through item completion, persistence, and thread
resume.
- Verify legacy rollout migration retains image-generation failure metadata.
GitOrigin-RevId: 91c31a2a47456b6b916ee03002ff314b05946dd4
## Why
A retryable failure during the initial remote exec-server connection left the
environment disconnected on subsequent readiness checks.
## What changed
Route retryable startup errors through the existing reconnect path. This lets
later `get()` and `wait_until_ready()` calls establish a replacement client,
while concurrent callers share the same reconnect attempt.
## Testing
Add a WebSocket test that fails the initial handshake, then verifies that later
readiness and client requests share a successful replacement connection.
GitOrigin-RevId: 82d425af0a73331884439b4350a7a1052d4ae865
## What changed
- Remove effective-config lockfile export, replay, and validation from session startup.
- Remove the `debug.config_lockfile` settings and generated schema entries.
- Remove feature-config materialization helpers that were only used to create lockfiles.
GitOrigin-RevId: a8c07c1c06325b3ec3dae9a97c36c2488d37df25
## What changed
- Import skill metadata and mention helpers directly from `codex-skills`.
- Import host skill loading types directly from `codex-skills-extension`.
- Make the remaining `codex-core` skills module private and remove its skill API re-exports, including the `HostSkillsService` re-export from `codex-core-api`.
GitOrigin-RevId: 26bf8fffd980df9c4d0c308d7e983ceab9a5df82
## Why
`skills/list` can load multiple working directories in one request, but bundled
skill discovery did not account for different effective configurations across
those directories.
## What changed
- Resolve `skills.bundled.enabled` from each load input's effective config layer
stack inside the host skills service.
- Include or exclude system-scoped skills for each working directory based on
that resolved setting.
- Keep bundled skills enabled by default when the setting is absent or invalid.
## Testing
- Add a multi-directory `skills/list` test with bundled skills disabled in one
project and enabled in another.
- Add config-layer tests for defaults, overrides, and malformed bundled-skill
configuration.
GitOrigin-RevId: e4e97dc7d0a374ac71d0aa11e55a9e337f661717
## Why
Subagents should be able to use known HTTP MCP tool definitions without opening a connection until a tool is actually called.
## What changed
- Add streamable HTTP configurations to the process-scoped MCP tool catalog cache when their authentication identity can be derived safely.
- Fingerprint transport settings, relevant environment variables, protocol mode, plugin status, and client capabilities so catalogs are reused only across equivalent connections.
- Keep OAuth and other dynamically resolved credential configurations out of the shared cache.
## Testing
- Add an integration test proving that a subagent receives cached HTTP tools without reinitializing the server, then starts its own connection when it calls one.
GitOrigin-RevId: bb2787e29e9b71993def31aafd1f0d8f1b728d26
## What changed
- Reject invalid or unsupported image data before producing tool output, so
non-image file contents are not exposed through code mode.
- Preserve valid image bytes and metadata while leaving image preparation and
resizing to the history insertion path.
## Testing
- Cover invalid images in both code mode and standard `view_image` calls.
- Verify that code mode preserves PNG bytes, dimensions, EXIF orientation, and
metadata.
GitOrigin-RevId: 07343ed10b781d0ce0ffb5b24432658be4c046e3
## What changed
- Add `codex-build-info` to resolve a packaged runtime's semantic version from `codex-package.json` while preserving the commit stamped into the executable.
- Represent source builds as version `0.0.0` and expose helpers for display, serialization, and source-build detection.
- Stamp `STABLE_GIT_COMMIT` into final Bazel Rust binaries so Git changes do not invalidate the shared library graph.
## Testing
- Cover packaged, source, legacy, and invalid-version resolution, plus serialization round trips.
GitOrigin-RevId: 669b02449644c738ba2946a1b7aafe4ec31a9edb
## What changed
- Add `PersistContext` to the thread-store persistence contract so stores can
identify persistence requested immediately before model sampling. A
`TurnStart` request may be enqueued in the background when later flush and
shutdown operations fence it and report any failure; all other persistence
remains synchronous.
- Use the turn-start context only for the initial input of a regular turn, while
admission acknowledgments, steered input, and other persistence paths keep
the standard durability behavior.
- Flush pending metadata before turn-start persistence and ensure shutdown is
still attempted if that metadata update fails.
## Testing
- Verify that developer instructions and user input are persisted before the
model request completes for a default paginated-history thread.
GitOrigin-RevId: 162f0ec796a61aebe66ca0b909fbcccec3047b85
## What changed
- Move the host process harness and common session delegates into shared test
support modules.
- Allow the host harness to start either WebSocket or gRPC listeners and
validate the endpoint scheme they publish.
- Update the stdio and WebSocket integration tests to use the shared fixtures.
GitOrigin-RevId: a0408be7c88e4eb9ad1832b6d2698781de77168a
## Why
Background refreshes previously warmed only the on-disk cache, so new sessions in the same process continued using the startup snapshot.
## What changed
- Make `CloudConfigBundleLoader` retrieve the latest shared bundle on each configuration load.
- Update the in-memory bundle after successful refreshes while preserving the last successful bundle when a refresh fails.
- Stop refresh work when its loader is replaced or its final clone is dropped.
## Testing
- Cover refreshed requirements and managed configuration in later sessions.
- Cover concurrent initial loads, refresh failures and recovery, bundle clearing, and refresh-task cancellation.
GitOrigin-RevId: ae3d79b575bad71a1eed370cee6dc66dc022ffa8
## What changed
- Send notification events without waiting for client acknowledgment, so an
unacknowledged notification no longer delays cell completion.
- Keep the notification acknowledgment RPC as a compatibility no-op after
validating the session and notification ID.
- Remove pending-notification tracking and cancellation events from the gRPC
session routing path.
## Testing
- Verify that a cell completes after emitting an unacknowledged notification
and that a later acknowledgment is still accepted.
GitOrigin-RevId: 19cf3ed5ce82cf45d84fa75f238c2afa4e83acb5
## What changed
- Pass image bytes from `view_image` through unchanged for both direct and code-mode calls, leaving decoding and resizing to the shared history-insertion path.
- Represent invalid image data with the existing image-omission placeholder instead of returning a tool error.
## Testing
- Update the `view_image` integration test to cover placeholder output for invalid image data.
GitOrigin-RevId: 62863defd4815efb8a7725712fd583ad81db3fbb
## What changed
- Remove `Clone` from `Submission` and remove `Clone` and `PartialEq` from `Op`.
- Consume operations directly in the submission loop instead of cloning them.
- Limit thread-manager test capture to the operation variants under test and update assertions to compare their relevant fields.
GitOrigin-RevId: 781cc631391b8583d94dad5ca45f589856c0b21a
## What changed
- Add optional `icon` and `color` appearance fields to custom thread sections and expose them through the app-server protocol.
- Persist appearance metadata in SQLite and include it when listing sections or returning threads.
- Let `threadSection/update` preserve an omitted appearance, clear it with `null`, or replace it with a new value.
- Reject appearance fields larger than 64 bytes.
## Testing
- Cover protocol compatibility, persistence across restart, update and clear behavior, and field-length validation.
GitOrigin-RevId: 8f55ce4f42f8bd17aa5416848a85845f681953df
## What changed
- Add pinned `windows_support` repositories for the Windows SDK and MSVC runtime on `x64` and `arm64`.
- Require explicit acceptance through `--repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1` before materializing the MSVC runtime.
- Preserve case-only SDK aliases when repositories created on case-insensitive Windows filesystems are consumed by case-sensitive remote executors.
GitOrigin-RevId: c7a5278e87c5e7e25e9c5f60af3d99e19303b0fd
## What changed
- Add `responses_api_metadata` for product-owned key/value metadata included in
every Responses API turn metadata payload, including parent and subagent
requests.
- Limit the map to 16 entries, ASCII identifier keys of at most 64 bytes, and
values of at most 128 bytes. Reject reserved Codex metadata keys and ignore
this setting in project-local configuration.
- Give configured product metadata precedence over app-server client metadata
while keeping it out of metadata sent to external MCP servers.
## Testing
- Cover reserved-key validation, metadata precedence, MCP isolation, and
propagation to parent and subagent Responses API requests.
GitOrigin-RevId: a7be798294fde25145ab375a468321bb4e4a49f1
## What changed
- Decode image data in the `view_image` handler and return a clear error for invalid or unsupported input.
- Re-encode code-mode images as PNG pixel data while preserving original image bytes for direct tool calls.
- Cover code-mode PNG output and rejection of invalid image data.
GitOrigin-RevId: 0a00e595ab749c19eab866a22f6577b6627e19f1
## What changed
- Add an optional `threadId` parameter to `app/read`.
- When provided, load the thread's effective configuration before applying app feature gating, workspace policy, and plugin attribution.
- Share the thread-aware configuration loader with `app/list`.
## Testing
- Add coverage showing that `app/read` honors a thread-level connector feature override.
GitOrigin-RevId: 161e910a2d7435ecf4acd0ba9f5f5069d1631f12
## Why
Unix socket proxy permissions are macOS-only, but configuring them could still
clamp Windows proxy listeners to loopback and emit warnings about unsupported
settings.
## What changed
- Exclude Unix socket permissions from Windows runtime settings and bind-address
clamping.
- Suppress the macOS-only Unix socket warning on Windows.
- Preserve the original configuration for state updates and remote launch
configuration.
## Testing
Add coverage for proxy startup, live configuration replacement, remote launch
configuration, and warning behavior with Unix socket permissions configured.
GitOrigin-RevId: 5d72f5365486ab11ae3cf5edfd78da665e05344d
## What changed
- Recognize executables under `codex-resources/` as part of a package layout by resolving the sibling `bin/` directory, while requiring that directory to exist.
- Add `InstallContext::package_manifest()` to parse the semantic package version from `codex-package.json`.
## Testing
- Extend the package-layout test fixture with a complete manifest and verify that version `1.2.3` is returned.
GitOrigin-RevId: 034aad3e8b865c6c6ecdff47da7c12c969744404
## What changed
- Parse safety-buffering payloads from typed `response.metadata` SSE events.
- Preserve the existing top-level `safety_buffering` field as the authoritative value when it is present, including when it is null or malformed.
- Continue applying the header-provided fallback model when the metadata payload omits `retry_model`.
## Testing
- Add parser coverage for metadata fallback, top-level precedence, and unrelated metadata events.
- Exercise metadata-based safety-buffering delivery through the core SSE integration test.
GitOrigin-RevId: 7dadfd54be28f2f33c2283de92fd49da0557d98a
## What changed
- Add `goals.max_goal_token_budget` as a positive-integer configuration setting.
- Use the configured maximum as the default budget for new goals and when `tokenBudget` is reset to `null`.
- Reject goal creation and updates whose token budget exceeds the configured maximum, including requests through goal tools and `thread/goal/set`.
- Respect managed configuration precedence and per-thread configuration overrides.
## Testing
- Cover configuration parsing and managed overrides.
- Cover defaulting, resetting, and rejecting oversized budgets through the goal service, goal tools, and app-server API.
GitOrigin-RevId: f8d7e6418cdc237d454c8cf47bb32ba0d44a60cf
## Why
Managed networking implicitly selected the elevated Windows sandbox backend,
even when the sandbox was configured to use a restricted token.
## What changed
- Select the Windows sandbox backend solely from `WindowsSandboxLevel`.
- Reject managed networking with a restricted-token sandbox before spawning a
process, since managed networking requires the elevated backend.
- Cover the rejection through sandbox preparation, unified exec, and Windows
sandbox session tests.
GitOrigin-RevId: 308858652d7b629af623d22896dafde3a23d3758
## What changed
- Exclude conversation turn count, response-engine latency, and turn token usage metrics from the built-in Statsig exporter, alongside the existing API and tool-call exclusions.
- Apply the Statsig exclusion list consistently to counters, histograms, gauges, observable gauges, and duration histograms.
- Preserve all excluded metrics for custom OTLP exporters and extend the loopback coverage to verify they are exported.
GitOrigin-RevId: e49f9aa1433126a3de8dbed76a4d2688f2831af8
## What changed
- Add `codex-history` for model-history and persisted-rollout domain types, including `RolloutItem`, `RolloutLine`, `CompactedItem`, and initial/resumed history state.
- Re-export the persisted types from `codex-rollout` and update consumers to use the new crate boundary instead of `codex-protocol`.
- Preserve existing rollout serialization, including legacy numeric compacted-window IDs.
## Testing
- Add `codex-history` tests for rollout JSON round trips, compacted-history compatibility, persisted history modes, and multi-agent version selection.
GitOrigin-RevId: 944daa9297ddd231d3aebbdcb05fff4adf8b4e1b
## What changed
- Reject patches containing multiple operations whose paths resolve to the same file, such as `duplicate.txt` and `./duplicate.txt`.
- Preserve support for patches that update multiple distinct files.
## Testing
- Add CLI integration coverage for distinct updates and duplicate resolved paths.
GitOrigin-RevId: 0fb7f69ae31acc5c677268ffd9e38ad8d8314276
## What changed
- Cover non-blocking credential probes when the file or secrets store is locked, including retaining only a matching prior credential snapshot and recovering after the lock is released.
- Extend the streamable HTTP OAuth round trip to verify that user turns continue during store contention, newly discovered servers recover after contention, and logged-out servers do not reuse authenticated connections.
- Cover reconciliation of authentication failures and effective `Authorization` headers.
GitOrigin-RevId: 8e377644001bd0be04dc9f79841080094d09d199
## Why
Standard MCP forms can require user-entered values even when tool permissions are
otherwise auto-approved in full-access sessions.
## What changed
- Recognize the `openai/standard-form-input` client extension and surface
non-approval forms in full-access, user-initiated root threads.
- Keep approval forms, automation and subagent threads, headless sessions, and
clients without the capability on their existing decline or review paths.
- Treat the capability as client-only so it is not advertised to MCP servers,
and enable it after session startup so required servers cannot block startup
waiting for form input.
## Testing
Add unit and app-server coverage for accepted form round trips, declined cases,
approval metadata safeguards, resumed threads, and extension filtering.
GitOrigin-RevId: 053bfe397a5c79eceef90a81d13e2aca6353af43
## What changed
- Rename `EnvironmentConfig` to `TurnEnvironmentConfig` to make its scope explicit.
- Rename the corresponding `SessionConfiguration` accessor and update all call sites.
GitOrigin-RevId: f47d745566199e699bd8e7c671c313eaf3bba79e
## Why
Refreshing MCP connection identities should not stall the async executor while another process holds the OAuth credential-store lock.
## What changed
- Probe file and secrets credential stores without waiting during runtime refreshes, retaining the last known credentials when the store is contended.
- Reuse unchanged authentication failures while credentials are temporarily unavailable instead of restarting the connection.
- Run blocking credential loads on a blocking worker during MCP client construction.
- Allow OAuth fallback when a configured authorization header is missing, empty, or invalid.
GitOrigin-RevId: 38dad5606da9a1ceb30fe945000ec9151a5058fa
## What changed
- Send Unix `execve` approvals intercepted by the zsh fork through the shared approval pipeline, including permission hooks, Guardian review, user prompts, and telemetry.
- Resolve the active turn and its auto-review setting when an intercepted command needs approval, so commands sent to persistent terminals use the current turn's reviewer.
- Give each intercepted command a distinct approval ID and propagate an aborted approval as a turn abort.
## Testing
- Cover Guardian review for intercepted `unified_exec` commands and persistent terminals across turns.
- Verify repeated identical intercepted commands receive separate user approvals.
GitOrigin-RevId: e6cccf160637e4246aff4714c22f08c90b65306d
## What changed
- Add `pluginId` to each `mcpServerStatus/list` result.
- Populate it for MCP servers contributed by installed or selected plugins, and
return `null` for servers from other sources.
- Update the generated protocol schemas, TypeScript bindings, and app-server
documentation.
## Testing
- Cover plugin-owned servers in plugin installation and executor flows.
- Verify non-plugin servers and protocol serialization return a null
`pluginId`.
GitOrigin-RevId: 0e4b912252cf51be56dcb63e0c1c7365a5e870ee
## What changed
- Set `CODEX_SESSION_ID` to the shared root-session ID for shell tool calls,
unified exec processes, and user shell commands.
- Preserve `CODEX_SESSION_ID` when restoring a shell snapshot, alongside the
existing runtime-owned environment variables.
GitOrigin-RevId: 5228867d25507105c7edf11607a8298958c3b917
## What changed
- Restore a V2 agent's inherited environment selections when reloading its
thread after residency eviction.
- Keep the restored execution environment and its tools available when the
agent receives a follow-up task.
## Testing
- Add an integration test that evicts and reloads a V2 agent, then verifies
its environment selection and `exec_command` tool are preserved.
GitOrigin-RevId: a5d4ad0fa465c717b32b7ae6807486429187a41d
Adam Perry @ OpenAI