## What changed
- Carry the selected shell and login mode through unified exec using `ShellInvocation`. Use this metadata for shell snapshots and credential brokerage instead of inferring it from command arguments.
- Add `prependPathDirs` to exec-server environment metadata, populated from the executor's package PATH directory. Default to an empty list for older servers and omit empty lists from serialized output.
## Testing
Extend environment metadata round-trip coverage for `prependPathDirs` and the remote exec-server integration test to verify the packaged `codex-path` directory is reported.
GitOrigin-RevId: c571c068effcb305d196a701ad9a335ec7a3f5a2
## Why
Pasting multiple lines into a blockquote previously left subsequent lines unquoted.
## What changed
- Continue the current line's `> ` prefix across pasted lines, including blank and trailing lines, in the TUI composer and embedded answer fields.
- Append two unquoted newlines so typing resumes in the next Markdown block. Preserve quoting when large paste placeholders expand on submission.
- Use a shared edit target for paste context and insertion so selection replacement uses the prefix at the replacement start.
- Keep shell input and provisional startup pastes literal.
## Testing
Add unit tests and rendering snapshots for blockquote pastes, embedded answers, cursor placement, selection replacement, and large-paste expansion. Add textarea tests for forward and backward selections, adjacent elements, and Vim Replace backspace recovery.
GitOrigin-RevId: 525a7951aa16a25d49cc3be98822d0dd0709de97
## Why
Denied-read policies previously kept explicitly approved commands within their original filesystem restrictions, preventing operations that need broader write access, such as updating Git metadata.
## What changed
- Apply broader filesystem permissions after approval of explicit escalation while retaining the sandbox, denied reads, and network policy. Command allow rules alone do not widen filesystem access.
- Reject escalation when the required local sandbox is unavailable or a remote exec server lacks support for preserving the restrictions.
- Track escalated terminal access so subsequent `write_stdin` calls still require review when stdin approval is enabled.
## Testing
Add coverage for approved and denied escalation, allow rules, remote server compatibility, and stdin approval before input delivery. Add a Windows integration test verifying that an approved `git pull` updates Git metadata while exact-path and glob-based read denials remain enforced. Serialize Windows sandbox integration tests across processes to protect shared test account credentials.
GitOrigin-RevId: 5dce6d41487ee4d39bd795c8d086398ab9794d5b
## What changed
Preserve catalog `multi_agent_version` values instead of forcing V1, allowing models that declare V2 to use it by default. Retain Ultra in supported reasoning levels so it appears in the Astra advanced reasoning picker for Bedrock Mantle and Runtime.
## Testing
Add coverage for preserving configured multi-agent versions, selecting V2 and exposing `collaboration.spawn_agent` and `collaboration.followup_task` without the V2 feature flag, and displaying and selecting Ultra in both Bedrock reasoning pickers.
GitOrigin-RevId: 4fb1336c79b3f86ce12fa5ea81fe2237a300840d
## What changed
Add `openai.gpt-6.1-sol` to the Bedrock Mantle catalog and its `global.` and `us.` variants to the Bedrock Runtime catalog. Make GPT-6.1 Sol the default and provider fallback model, preferring the global variant for Runtime. Keep existing models available.
## Testing
Update catalog and provider assertions, thread-start fallback tests, and TUI model-picker snapshots to cover GPT-6.1 Sol and the new defaults.
GitOrigin-RevId: ec65744ff9409980474cc1faf516beed0b2430da
## Why
Canceled RPC calls could leave entries in the pending request map until further traffic or disconnect. Cleanup should happen when the call is dropped, even if no response arrives.
## What changed
Use a `PendingRequestGuard` to remove each registration when its call completes or is canceled. Protect the pending map with a synchronous mutex so cleanup can run in `Drop`, replacing opportunistic pruning and explicit error-path removals.
## Testing
Add a regression test that drops an in-flight call and verifies that the pending request count immediately reaches zero without further traffic.
GitOrigin-RevId: 82c0629f37a2f4bb89b8d10e167e2a09765b26eb
## Why
Reaching the reconnect backoff cap reset the attempt counter, restarting fast retries during sustained failures such as HTTP 409 responses indicating that the remote app server is already online.
## What changed
Keep the reconnect delay at the 30-second cap and stop advancing the backoff exponent once capped. Successful connections and auth changes still reset backoff. Remove logging for the obsolete reset-at-cap behavior.
## Testing
Add regression tests for long failure streaks and repeated HTTP 409 handshakes, with and without a subscribe cursor. Verify capped retry intervals, recovery after a successful handshake, backoff reset on success, and preservation of enrollment and cursor state.
GitOrigin-RevId: 56e3f10ec5ceeced5a71397a99ca22b75dd5ef52
## Why
`CreateProcessWithLogonW` failures with `ERROR_SERVICE_ALREADY_RUNNING` (1056) previously aborted sandbox startup without retrying. At this stage, neither the runner nor the user command has started, so retrying does not replay the command.
## What changed
Retry runner creation once with the same sandbox credentials when logon returns error 1056. Propagate a second failure without refreshing credentials, and keep child startup errors with the same code ineligible for this retry.
## Testing
Add regression tests for recovery, the two-attempt limit, and exclusion of child startup failures. Add a unified exec test that injects a logon failure, verifies that the retry preserves the original request and credentials, and checks that the command runs exactly once.
GitOrigin-RevId: 78def6cdb93bf32f9b4a3e398cd16de83286fec4
Add `gpt-6.1-sol` to the bundled model catalog with its capabilities,
reasoning levels, and availability message. Give it the highest catalog
priority and update older Sol descriptions to reflect their generations.
Update startup, model picker, and tool catalog snapshots to reflect the
new default and catalog contents.
GitOrigin-RevId: 1092a0524c6d1813ddd600c31c4fd0e708294ae9
## Why
A subagent stopped by repeated Guardian denials remained interrupted without notifying its parent. The parent needs guidance to report the stop and wait for explicit user confirmation before continuing the blocked work.
## What changed
Forward `TooManyDenials` interruptions from `MultiAgentV2` children to their parents with Guardian-specific guidance to inform the user and avoid resuming or retrying until the user explicitly confirms. Preserve the child's `Interrupted` status and keep ordinary interruptions silent.
## Testing
Add integration coverage for parent notifications under `CircuitBreakAction::Strict`, silence under `CircuitBreakAction::Default`, and preservation of the child's interrupted status. Add a unit test ensuring long denial messages stay within the notification token limit while retaining the guidance.
GitOrigin-RevId: c9bb90827393068d9c92edaf0443a52e6ff57f9f
## What changed
Use `ConsoleMode::NoWindow` for legacy Windows sandbox capture and non-TTY unified execution, enabling `CREATE_NO_WINDOW` for these piped processes.
## Testing
Extend the PowerShell interrupt and capture tests to assert that `GetConsoleWindow()` returns null before checking process termination and descendant survival.
GitOrigin-RevId: dcc3b5554986ab0280748e5fa7080d36ded3d673
## Why
Thread name resolution performs a separate SQLite metadata lookup for each thread. Batch these reads to reduce database queries for large result sets.
## What changed
Add `StateRuntime::get_threads` and use it in `resolve_thread_names`. Fetch metadata in batches of at most 999 IDs to stay within SQLite's bind limit, skipping missing or invalid records independently so valid metadata remains available.
## Testing
Add regression coverage for reads spanning multiple batches, invalid and missing records, duplicate IDs, and empty input.
GitOrigin-RevId: a403416f1da5adea56705c70839850760d3eb550
## Why
Parsing multiple tag delimiters in a chunk repeatedly drained the pending
buffer, shifting its remaining contents after each delimiter.
## What changed
Track a consumed offset in `InlineHiddenTagParser::push_str` and drain the
buffer once after processing the chunk, preserving partial delimiters for
the next chunk.
## Testing
Add a regression test comparing visible text and extracted tags against
single-chunk parsing at every UTF-8 character boundary. The input covers
non-ASCII text and delimiters, adjacent tags, an empty tag, and an unfinished
tag at end of input.
GitOrigin-RevId: 18bfbfdb81060ffda30901d5cb82ee5804878b09
## Why
Batch thread name lookups read the entire append-only session index even when all requested names could be found near the end.
## What changed
Use `ReverseJsonlScanner` in `spawn_blocking` for `find_thread_names_by_ids`, stopping once every requested ID has a usable name. Preserve the latest nonempty, trimmed name for each ID while skipping malformed entries.
## Testing
Add regression coverage for renamed threads, whitespace-only names, Unicode, reads across chunk boundaries, malformed entries, a partial final write, and missing IDs.
GitOrigin-RevId: 2ab9254ba8b718fe3e02c47fc9b0de20c09fd10f
## What changed
Replace the custom recursive JSON canonicalizer with `serde_json::Value::sort_all_objects()` before hashing configuration values, preserving existing fingerprints.
## Testing
Add a regression test that checks reordered keys in nested tables and tables inside arrays produce the same existing fingerprint.
GitOrigin-RevId: 890e79865a1d690adea3b35f19fcc6c30dbd17ce
## Why
Guardian review and classification telemetry lacks the context mode needed to distinguish `legacy`, `independent`, and `thread_owned` reviews.
## What changed
- Add `guardian_context_mode` to review and classification analytics and `context_mode` to their metrics.
- Capture the mode from the conversation history snapshot before review preparation or classification setup so failure metrics retain it, including when review preparation or reviewer startup fails.
- Use `unknown` for review metric tags when no context mode is available.
## Testing
Update metric assertions to cover `thread_owned` classification tags and the `unknown` review fallback.
GitOrigin-RevId: 79f7d11b3e4ccfc53681890d75fbc7c54e1ce7de
## What changed
Allow users with an active session to start MCP OAuth sign-in through `/mcp login <name>`. Request login through the app server, open the authorization URL in the browser, and display success or failure in the originating thread.
Guard overlapping start requests and track login attempts per server so stale retry completions do not overwrite current results. Skip opening the browser when the attempt has already completed, and retain results across thread switches and session refreshes.
## Testing
Add command dispatch coverage and regression tests for overlapping starts, stale retry completions, rejected starts, independent server logins, and result retention across thread switches and session refreshes.
GitOrigin-RevId: aeec2dbee566660f9aa26ef23039196ef3ca49d6
Replace the three optional fields in `AttachmentState` with `Attached` and
`Detached` variants, making inconsistent field combinations unrepresentable.
Keep the connection ID in both variants and the expiration deadline only in
`Detached`, and update attachment and expiration checks to match on the state.
GitOrigin-RevId: 6a5f05f0ce2f064acc8f5cacd00bc374c4f47986
## Why
Stale thread capability roots can reconnect executors that are not selected for the current turn and shadow selected roots with the same ID.
## What changed
Filter out roots whose environments are absent from the turn snapshot before deduplication and readiness resolution. Update app-server capability tests to explicitly select the executor environments used by each turn, including after resume.
## Testing
Add regression coverage for full-access and workspace-write permissions, verifying that stale roots never connect an unselected executor, selected roots with matching IDs remain available, and turns with no environments expose no roots.
GitOrigin-RevId: afe375047cc5e8aad06df83334149510460dcdcc
## Why
`TurnComplete` can arrive before the previous turn finishes teardown, making `start_turn_if_idle` race with cleanup in the encrypted parent reply scenario.
## What changed
Submit the reply through `Op::InterAgentCommunication` so it queues through the same mailbox path as real agent messages. The scenario continues to verify that the encrypted parent reply appears exactly once in each incremental Guardian review.
GitOrigin-RevId: 3d356c274442aa839324b9425490feafacd47313
## Why
The app server previously rejected OAuth login for enterprise-managed MCP servers. These servers need an explicit sign-in flow that ties saved authorization to the active Codex user and workspace and prevents canceled or superseded attempts from saving credentials.
## What changed
- Enable enterprise sign-in through `mcpServer/oauth/login` for configured servers with a connected thread, trusted IdP registration, and `features.use_xaa` enabled. Scope shared enterprise credentials by user, workspace, issuer, and client ID.
- Add `loginId` to MCP OAuth login responses and completion notifications, preserving compatibility with older servers that omit it.
- Support enterprise login replacement and `account/login/cancel`, wait for callback listener shutdown before replacement, and recheck account and configuration before saving grants. Fence stale attempts across processes and account changes.
- Remove shared enterprise authorization during account logout and `codex mcp logout`, including when the feature is disabled. Continue account logout if enterprise cleanup fails, and invalidate MCP runtimes on account changes.
Start a fresh session after successful enterprise sign-in to use the saved grant.
## Testing
Add regression coverage for login replacement and cancellation, callback port reuse, account changes during setup, cross-process logout invalidation, persisted workspace policy selection, cleanup failures, and responses from older servers without `loginId`.
GitOrigin-RevId: 7ed4caaab4659ed1e67064262cf5cee48e3a26ac
## Why
Responses prewarm can reconnect and consume scripted WebSocket replies intended for realtime conversations when both share a test server.
## What changed
- Give realtime conversations a separate scripted server in tests for runtime replacement, prompts, and voice selection.
- Disable Responses WebSocket prewarm in the audio/text round-trip test while preserving coverage of the default realtime endpoint.
- Update connection counts and request assertions to address only realtime connections.
GitOrigin-RevId: 8e3b5ac86ee80777cf94063db468c80203966999
## Why
Reloads can reject a valid thread configuration when the host configuration references a missing model provider that thread overrides replace. Concurrent cloud refreshes can also leave older policy snapshots or staged cache writes eligible for publication.
## What changed
- Compose preserved session layers before materializing refreshed configuration, retaining source-aware validation errors.
- Carry cloud policy revision bindings through config loading and role overrides. Reject stale MCP refreshes and disable enterprise MCP authorization when the policy is suspended. Retire the old policy when replacing or clearing its loader.
- Stage cloud cache writes in temporary files and publish them atomically only while their policy revision remains current.
- Route file reloads through the shared runtime refresh path, resolve paths relative to each config file, and preserve session settings. Restore host defaults for `secret_auth_storage` and `mcp_oauth_refresh_coordination` when explicit overrides are removed.
## Testing
Add regressions for thread-provided model providers, managed plugin and feature requirement refreshes, stale and suspended policy snapshots, superseded and retired cache writes, and file reloads preserving runtime settings and restoring feature defaults.
GitOrigin-RevId: 3280a2445eeb7074a142f720690bb0e4f01d174b
## What changed
Add `features.multi_agent_v2.message_board_remote` with a board URL and a bearer token supplied directly or through an environment variable. When configured, use the remote board in preference to local or in-memory storage, including in ephemeral sessions, while preserving the existing board tools and session identity.
Ignore remote board settings in project-local configuration and use the runtime HTTP client and clock for remote requests.
## Testing
Add a mock-server integration test and snapshot covering an ephemeral session posting through the existing tool, with the expected bearer authentication, session identity, timestamp, and returned post.
GitOrigin-RevId: 263413d90a1ee4c0bdba8c1b08ba9f68bdd7a986
## Why
Steering and recovery requests can have different traces from the turn they join. Sampling can also finish while tools remain in flight. Tracing needs to preserve that correlation and distinguish sampling time from time spent waiting for tools.
## What changed
- Add `codex.turn_input` spans with `conversation.id` and the accepted `turn.id` for started, steered, and recovered turns.
- Add sampling, tool-blocking, and automatic and manual compaction spans with `codex.turn.phase` and conversation and turn IDs. End the sampling span before draining outstanding tools.
- Emit a `codex.mailbox_preemption` event when pending mailbox input preempts sampling.
## Testing
Add integration coverage for cross-trace steering and recovery, sampling and tool-blocking boundaries through a blocked dynamic tool, and completion or interruption. Extend mailbox preemption tests to check event emission with preemption enabled or deferred.
GitOrigin-RevId: 59893c2d463c02cbd05f5c332e5afc2351cc8b62
## Why
Restoring the error mode with `SetErrorMode` can overwrite the failure code from `CreateProcessWithLogonW`, causing `RunnerLogonError` to report the wrong error.
## What changed
Capture `GetLastError()` immediately after a failed runner launch, before restoring the previous error mode, and use the saved code for `RunnerLogonError`.
GitOrigin-RevId: c0f4267232306be4d06e7e8accd60f7b77b8d6f3
## Why
Configuration reloads must honor current managed restrictions without granting new enterprise MCP authority to existing sessions or overwriting newer configuration with stale snapshots.
## What changed
- Allow enterprise managed authentication only for configured MCP servers. Remove plugin `ema_auth` overlays from the schema and disable servers that still use them.
- Refresh ordinary MCP settings while preserving session settings and initially admitted enterprise registrations. Disable enterprise MCP when its registration changes, policy revokes access, or configuration loading or resolution fails; require a new session to restore enterprise authority.
- Publish refreshes only when their captured configuration is still current, with bounded retries in app-server reloads. Preserve updated managed restrictions even when a refresh is rejected.
- Finish processing other thread refreshes before `config/mcpServer/reload` reports a rejection, and document that an error can accompany partially applied changes.
## Testing
Add regression coverage for stale refreshes, bounded retries, managed-policy revocation, persistent enterprise disablement, ordinary MCP transport changes, and rejection of plugin enterprise authentication. Verify that denied enterprise servers receive no requests.
GitOrigin-RevId: 34429cd339c1ec152a2ee8697cb29f0cff5d9e5f
## Why
Missing retained root instructions could indefinitely block a worker's matching low-risk cached score from approving an action.
## What changed
Require complete retained local context for cached approvals, while allowing incomplete root context when the cached score matches the current authorization. Root omissions remain visible to the classifier.
## Testing
Extend the cached-delivery regression test to verify that a worker with complete local context and an `IncompleteRootInstructions` marker can approve using a matching low-risk cached score.
GitOrigin-RevId: 06feda47fe47feb933c67239d32bf154b2032615
## Why
Copying executable fixtures in the test process can expose writable file descriptors to sibling spawns. The shared `copy_executable` helper completes copies in a separate process on Linux before launching the fixtures.
## What changed
Use `copy_executable` for both `codex-linux-sandbox` and `bwrap` in `bazel_build_rejects_tampered_bundled_bwrap`, and add `codex-utils-cargo-bin` as a Linux test dependency.
GitOrigin-RevId: 05fb1381eeefb64568b525925c9e81863acc2b54
Read `model_provider` from the effective configuration's nested `config`
field in `history_model_provider`, retaining the `openai` fallback.
GitOrigin-RevId: 06a8b3da1b499e673f80b8827951020c469c3970
## Why
Background helpers launched from a detached Windows process can allocate console windows. Job Object launches and containment fallbacks need to preserve console suppression as well.
## What changed
- Add `codex_utils_process::background_command` to set `CREATE_NO_WINDOW` on Windows, and use it across background subprocess launches, including Git, plugins, authentication, diagnostics, and sandbox helpers.
- Centralize console suppression in Job Object launches. Keep `CREATE_NO_WINDOW` when retrying without containment, and clear `CREATE_SUSPENDED` so the fallback child can run.
- Preserve console inheritance for interactive shell launches and interactive AWS authentication refreshes.
## Testing
Add Windows regression tests covering console-free launches from detached parents through standard and Tokio commands, stdout/stderr capture, successful containment, Job Object creation and assignment failures, and sandbox setup refresh helpers.
GitOrigin-RevId: b2c238fa7d4f9fbd868e5adf7d4be9958ff01e6c
## Why
Client provider defaults can override the app server's configured provider and hide its sessions from resume and fork history.
## What changed
- Omit implicit provider overrides from thread start, resume, and fork requests so the server can resolve its defaults.
- Use the server's effective provider for named history lookup, `--last`, and resume and fork pickers, while honoring explicit CLI and selected-profile choices.
- Respect managed provider requirements when resolving history filters and preserve the active session's provider when forking it.
## Testing
Add app-server regression tests for provider defaults, explicit choices, configuration changes, selected profiles, and managed requirements. Add CLI coverage for resume and fork pickers and `--last` with local daemon and embedded servers, plus a picker rendering snapshot.
GitOrigin-RevId: a077758b13a5e55552b52e5532ad4bebe86dce7e
## What changed
- Skip folder trust prompts for locally discovered projectless directories without a saved trust decision. Apply workspace-write permissions and granular approval defaults only when local execution, configuration, and managed policy allow them.
- Prompt for Windows sandbox setup when needed before enabling implicit workspace-write permissions.
- Restore saved task permissions on resume unless explicitly overridden, and keep ordinary turns from overwriting the server's saved permission profile. Track explicit approval reviewer choices separately from restored permissions.
- Let `/cd` request folder trust with a “Keep current directory” option. Recheck task activity and background terminals before switching, and enforce destination permission requirements.
## Testing
Add regression coverage for projectless defaults and session transitions, explicit permission overrides, saved profile preservation, trust discovery, destination policy conflicts, and the directory consent and Windows sandbox prompts.
GitOrigin-RevId: cf74f5a90245f2aee96caa80d76de64da6ec1ebd
## Why
Copying text selected within a blockquote adds Markdown quote markers that are not part of the selected content.
## What changed
Return plain text for selections containing only quoted content, preserving literal `>` characters and selected whitespace. For quoted tables and task lists, remove quote prefixes while retaining table reconstruction and checkbox states. Selections spanning quoted and unquoted content continue to preserve Markdown structure.
Preserve the existing logical source when marking list separator lines as omitted from Markdown copying.
## Testing
Add coverage for partial and nested blockquote selections, quoted tables and task lists at narrow and wide widths and after rewrapping, and copying a mouse-selected blockquote.
GitOrigin-RevId: 5ac0c8c47a77937e5a35c376d8908065217ad2dc
Replace the trailing-slash removal loop in `normalize_base_url` with
`trim_end_matches('/')`, preserving existing behavior.
Add regression coverage for unchanged URLs, single and repeated trailing
slashes, empty and slash-only inputs, and ChatGPT URLs with and without
`/backend-api`.
GitOrigin-RevId: db71e80c4dcaac33b308a45684b14e7edbd71528
## What changed
Omit the reasoning summaries setting from the model details when connected to a remote server or local background server. Continue displaying it when no server connection is present.
## Testing
Expand status snapshots to cover no server connection, a remote server, and a local background server, including the reasoning summary setting visibility in each case.
GitOrigin-RevId: f7213e7ad7439107705461ccf4e070501729113b
## Why
Forwarding local defaults as request overrides can replace server defaults or saved thread settings for reasoning summaries and verbosity.
## What changed
Only forward `model_reasoning_summary` and `model_verbosity` as shared thread request overrides when their winning configuration layer is a session flag or an explicitly selected user profile. Use the effective values from that layer, and omit values whose winning source is ordinary user or project configuration. Preserve the existing reasoning-summary defaults for new embedded threads.
## Testing
Add coverage for profile, project, and CLI precedence. Extend outbound model request tests to verify that remote-mode thread start and resume preserve server reasoning summary and verbosity settings despite conflicting local values.
GitOrigin-RevId: 5e14254a51ed7506118a46847bb7466ab58908ef
## Why
Turn error hooks receive only a `CodexErrorInfo` category, which omits backend metadata such as usage-limit reset times and rate-limit snapshots.
## What changed
Add borrowed `CodexErrorDetails` to `TurnErrorInput` and pass the original details through turn and compaction error notifications, alongside the existing error category.
## Testing
Add coverage for usage-limit metadata during sampling, manual compaction, and post-turn compaction, including preservation of completed answers and existing error events. Extend lifecycle tests to verify that an `InvalidImageRequest` retains its details when surfaced as `BadRequest`.
GitOrigin-RevId: 6f2058992126da0f69508ef51998e7581557deea
## What changed
Render macOS Option shortcuts as `⌥t` and `ctrl+⌥t` instead of `⌥+t` and `ctrl+⌥+t`. Keep `+` separators after text modifier labels such as `ctrl`, `shift`, and `alt`.
## Testing
Update key-label and chord assertions and UI snapshots to expect the compact labels across shortcut help, navigation hints, and tooltips.
GitOrigin-RevId: 7d52088ebce3dfa3f8bdad65eb159ca0fead8a31
## Why
Providers with `model_catalog_url` could advertise bundled models absent from their catalog or reuse stale models after a failed refresh. Model metadata could also match by prefix or namespaced suffix instead of the provider's exact model ID.
## What changed
- Suppress bundled model fallback and merging for explicit provider catalogs, including when discovery is disabled.
- Require unique, non-empty catalog slugs and match metadata by exact model ID.
- Serialize explicit catalog refreshes and invalidate in-memory and persisted catalog entries after fetch failures, preventing stale cache reuse.
- Report a clear configuration error when startup has no available model, while allowing an explicitly configured `model`.
## Testing
Add regression coverage for exact model matching, hidden catalog entries, cache invalidation across restart and recovery, invalid slugs, and empty-catalog startup with and without an explicit model. Update app-server model-list expectations and verify the TUI configuration error.
GitOrigin-RevId: ac323a94178e3c48df8d4a159a86fdbac20b03a2
## What changed
Move content-filter guidance recording from the sampling loop into
`handle_response_stream_error`. Pass `StepContext` so the handler can resolve
model-specific guidance and record it before retry decisions for sampling
requests. Keep remote compaction excluded from guidance recording and update
callers and the existing retry-deadline test to use the new signature.
GitOrigin-RevId: 030bde1d4f1597fc4f3971ad837478e5304c5aa9
## Why
Skills available from both cloud and executor providers consume duplicate catalog space, leaving less room for descriptions of unique skills.
## What changed
- Prefer model-visible cloud skills over executor listings with the same `plugin:skill` name before allocating the metadata budget.
- Preserve aliases from the full visible executor inventory so filtering duplicates does not renumber remaining packages. Continue choosing full locators when they fit the budget better.
- Keep executor packages available through `skills.list` and `skills.read`, and retain executor listings when cloud skills are disabled.
## Testing
Add regression tests and a model-request snapshot covering description retention, stable aliases across turns, executor availability changes, package reads, and full-locator selection after deduplication.
GitOrigin-RevId: 477e4cf16b8968dbe61438dd5af1eca9cbfa78c8
## Why
Responses stopped by `content_filter` previously followed generic stream-error retry handling without guidance about the block. Retried requests need instructions to explain the limitation and offer a permitted alternative.
## What changed
- Recognize content-filter failures as a distinct error while preserving retryability and the existing public error representation.
- Append developer guidance to the conversation after each sampling block, retaining delivered output and using the existing retry handling.
- Support a model catalog override through `model_messages.content_filter_guidance`. Missing, null, blank, or values exceeding 512 UTF-8 bytes fall back to bundled guidance.
- The bundled guidance tells the model to avoid reproducing or working around blocked content, briefly explain the limitation, offer a permitted alternative, and continue unrelated authorized work.
## Testing
Add a scenario and request-history snapshot covering repeated blocks, catalog guidance on each retry, retained partial output, and eventual completion. Add error-mapping assertions for retryability, public error classification, and error text.
GitOrigin-RevId: ba0c201b3a5a3acf5cfa971332027240e0690225
Clarify in the `requires_openai_auth` field documentation and configuration schema that credentials use the backend selected by `cli_auth_credentials_store`, rather than always being stored in `auth.json`. Also clarify that `env_key` specifies the environment variable containing the API key.
GitOrigin-RevId: e65753a72258e43b24c4e40b51ff26830c5b3756
## Why
Sessions can share an analytics client while using different product SKUs. Analytics requests need per-thread attribution to reflect each session's configuration.
## What changed
- Register each thread's `apps_mcp_product_sku` and send `X-OpenAI-Product-Sku` on analytics requests grouped by product, without changing authentication.
- Send product groups concurrently while preserving event order within each group.
- Flush buffered tool events before changing or evicting their product attribution, and clear attribution when a session disables analytics.
- Bound retained thread registrations and concurrent product groups. Drop attribution when registration cannot be queued or a batch exceeds the product-group limit.
## Testing
Add tests for shared-session attribution, clearing attribution on resume with analytics disabled, buffered events across product changes, queue overflow recovery, registry limits, and concurrent delivery with preserved event order.
GitOrigin-RevId: 25a98788cd44d4a85f97ee87aadf3a6909607f6a
## What changed
- Publish released mouse selections from both transcript views to X11 `PRIMARY` as plain text, even when copy-on-select is disabled. Preserve configured `CLIPBOARD` copying when it is enabled.
- Paste `PRIMARY` into the editable fullscreen composer on middle-click, including while a transcript selection remains active.
- Limit support to local Linux X11 sessions, excluding Wayland, SSH, tmux, WSL, and VS Code terminals.
- Retain the latest deferred selection publication and order it before a pending `PRIMARY` read, while giving explicit copies priority. Cancel stale deferred work when its selection or paste target is invalidated.
- Clarify that scrollback mode uses native terminal copy, paste, and scrollback.
## Testing
Add regression tests for selection publication with copy-on-select enabled and disabled, publication-before-read ordering, explicit-copy priority, cancellation of deferred work, and middle-click paste invalidation.
GitOrigin-RevId: 6ba7bddffda60183b7f9ad5cd69a97da8a4a8dcd
## Why
The command center seeded only ten recent sessions, with no way to browse older history from the task list.
## What changed
- Add a keyboard-selectable “Show more” row that discovers up to ten more tasks, with loading and retry states that remain accessible during search.
- Retain per-source cursors and buffered rows across requests, merging interactive and non-interactive history by recency without discarding existing tasks on failure.
- Refill vacancies after tasks are archived or deleted, and prevent stale refreshes from restoring removed tasks.
- Limit routine detail refreshes to recent and loaded tasks, plus explicitly targeted threads, as retained history grows.
## Testing
Add regression coverage for pagination across mixed sources, cursor retries without row loss, automatic refill, queued pagination, and “Show more” navigation, loading, search, and retry rendering.
GitOrigin-RevId: 0bfcc970c9adf0c8d509b275a92ecf01c29595ad
Adam Perry @ OpenAI