## Why
Bounding collected output also requires limiting the raw event backlog between
V8 and the cell actor. Previously, runtime events and cell output accumulated
in an unbounded channel and vector.
## What changed
- Select the event transport and `OutputCollector` from the cell's
`output_truncation` mode. Server mode uses an ordered, bounded channel with
backpressure; client mode retains untruncated output.
- Transfer the collector with each observation and restore it on failed
delivery, preserving retained media and omission metadata.
- Include server-mode script errors in the observation's output budget. Build
completion output only after completion wins against termination, so a
rejected error cannot evict output returned by termination.
- Keep the public service on client-side truncation.
## Testing
Add regression coverage for channel backpressure, event ordering, receiver
closure, failed observation delivery, termination during completion commit,
and oversized errors across UTF-8 and omission boundaries.
GitOrigin-RevId: 7604b60416e33c636ca41138be65dc0fd452774a
## What changed
Add output collection and rendering components in `code-mode-runtime`, without wiring them into runtime execution yet.
- Retain a text prefix and rolling tail under a 1 MiB text allowance, with independent allowances of 8 MiB for image URLs and 62 MiB for audio URLs and a separate 32,768-item limit.
- Render retained output using the shared token-budget formatter, preserving media details and reporting collector losses even with a zero-token budget. Summarize scattered losses to keep notices bounded.
- Preserve collected output and omission accounting when delivery fails, and document the separate media limits in the protocol.
## Testing
Add unit tests for Unicode retention, item pressure, independent media allowances, media-space reclamation, failed delivery, default token budgets, and loss-notice placement and aggregation.
GitOrigin-RevId: f419fdbe316a8456cea3b7b097c4d3a658f3150f
## What changed
- Add `--codex-ui-plugin-process` to `codex-code-mode-host` and a typed protocol for initializing, invoking, and closing UI plugin isolates.
- Support persistent module state and string results from synchronous or promise-based exports across up to 32 isolates in one helper process.
- Require sandbox-enabled V8 with JIT disabled, restrict executable loading and globals, and enforce execution deadlines and per-instance queue, source, result, and promise limits.
- Close affected isolates on script failures, cancellation, or overload, and return bounded script diagnostics.
- Bump the helper handshake to version 3 and increase the maximum frame size to 1 MiB.
## Testing
Add wire-level integration tests and runtime unit tests covering promise settlement, cancellation, loading restrictions, diagnostics, failure isolation, capacity reuse, transport bounds, and watchdog synchronization. Add CLI tests for argument validation before helper startup.
GitOrigin-RevId: bad6a57c84d9197c1fd76a78cf060502c5bc8bb8
## What changed
- Move the V8 implementation into a dedicated `codex-code-mode-runtime` crate used by `codex-code-mode-host`, removing the embedded runtime fallback from the Codex process.
- Resolve the host executable from the active installation layout and check its availability before selecting tools.
- Fall back to direct tools with a one-time warning when optional code mode is unavailable. Keep `code_mode_only` and `disable_in_process_fallback` configurations fail-closed.
## Testing
- Cover host discovery for standalone and package layouts, including missing hosts and symlinks.
- Verify direct-tool fallback, one-time warnings, and fail-closed code-mode-only behavior.
GitOrigin-RevId: 5aa3c6f1db148b2231fc24089a2ee0e2b00dbddb
Sean Huang