## What changed
- Add the experimental `Thread.environments` field with each selected environment's ID, working directory, and runtime workspace roots.
- Populate the field from live thread state in start, resume, read, list, and unarchive responses. Use `null` for unloaded threads and an empty list when a loaded thread has no environment selection.
- Document that the field reports selection rather than connection status and does not affect executor selection or resume behavior.
## Testing
- Cover selection updates, unloaded and resumed threads, loaded pathless unarchives, and clients that subscribe after environment connection notifications.
GitOrigin-RevId: a6daa06aff7089d7c5a1e4c7d03109b41f12fa3c
## Why
Directly deserializing the flattened `RolloutLine` envelope can reject nested
decimal values, preventing affected paginated sessions from resuming.
## What changed
- Add canonical string, byte, and reverse-scanner helpers that decode rollout
records through `serde_json::Value` before decoding the flattened item.
- Route rollout readers across session discovery, history, migration, search,
thread storage, and transcript previews through those helpers.
- Remove `Deserialize` from `RolloutLine` so new readers cannot bypass the
canonical persistence decoder.
## Testing
Add coverage that resumes a paginated rollout after a token-count record with
a decimal rate-limit value and verifies that ordinal sequencing continues.
GitOrigin-RevId: 49abac1e0751c073daa5a93a840d8a483fd2d013
## What changed
- Remove the per-thread `RealtimeConversation` feature check when starting a realtime session.
- Retain `features.realtime_conversation` as a removed compatibility setting that has no effect, even when set to `false`.
- Document the always-available behavior for `thread/realtime/start`.
## Testing
- Cover realtime startup on forked and cold-resumed threads with the legacy setting absent, disabled, or enabled.
GitOrigin-RevId: d9cd9aa3898d1c2efb9414a8f40c86be8951e210
## Why
When ordinary included usage is exhausted, eligible users need a way to keep working with the backend-provided Luna Reserve quota and return to their previous model once ordinary usage recovers.
## What changed
- Automatically switch eligible TUI tasks to Luna Reserve after an authoritative account usage read, preserving the prior model and reasoning effort per task.
- Restrict model selection while on Reserve to its supported reasoning levels, keep queued turns on the accepted model, and restore the saved model after a fresh read confirms recovery.
- Surface Reserve usage in the composer and `/status`, and expose `normalModelSlug` in app-server rate-limit snapshots so clients can use the associated model's display metadata without changing the request model.
- Poll account limits more frequently near exhaustion and retain compatibility with app servers that only accept the legacy null request parameters.
## Testing
- Added coverage for Reserve entry, queued-turn handling, task reconstruction, recovery authorization, account changes, model selection, usage rendering, and banner dismissal.
GitOrigin-RevId: 46a435e9531051f8cec3f6a46c4b9f7cfa479747
## Why
Detached Windows processes cannot receive console signals, so app-server daemons
need another way to enter the existing graceful and forced shutdown flow.
## What changed
- Watch the path in `CODEX_DAEMON_SHUTDOWN_FILE` for a request addressed to the
current process, and consume only a matching PID.
- Race daemon shutdown requests with Ctrl-C on Windows while leaving unmanaged
launches on the existing console-signal path.
- Exercise the SIGTERM-equivalent graceful and forced WebSocket shutdown cases
on Windows.
## Testing
Added unit coverage ensuring inherited control paths and malformed requests
cannot consume another process's shutdown request.
GitOrigin-RevId: 426a3c12edc344802395d4d26288f2bb015c484f
## What changed
- Accept optional `account/rateLimits/read` capabilities for Luna Reserve support
and lightweight background polling while preserving omitted and `null` params.
- Forward the Luna Reserve capability only for eligible ChatGPT sessions, and let
lightweight polls skip the separate reset-credit detail request.
- Return the backend's `ordinaryUsageAllowed` decision only when its account and
user identity match the active session.
## Testing
- Cover capability defaults, eligible and restricted authentication modes,
lightweight polling, identity filtering, and backend permission handling.
GitOrigin-RevId: f407a3ae1e70e411fdf245f072a16e453f59cd87
## Why
Reasoning configuration changes need to retain their position and trusted provenance when model history is persisted and replayed. Client-injected history must not be able to forge these controls.
## What changed
- Add a typed `configuration_update` response item carrying reasoning effort, including custom model-defined values.
- Persist harness-authored updates with provenance and preserve them across history reconstruction, thread resume, raw response notifications, and agent forks.
- Exclude untrusted configuration updates from model history, strip client-supplied provenance metadata, and reject configuration updates supplied as turn input.
- Export the new item through the JSON and TypeScript app-server schemas and classify it in telemetry and persistence metrics.
## Testing
- Cover serialization, provenance persistence, history filtering and rollback, resume reconstruction, and injection attempts before and after restart.
GitOrigin-RevId: eb5559d2b52b7a931621e7c9812f009ff9fb8939
## Why
Windows control sockets need a rendezvous directory that cannot be accessed or
replaced by another user while the listener is active.
## What changed
- Create socket directories with a protected, inheritable, current-user-only
DACL, and reject existing directories with broader permissions.
- Validate socket paths without following a junction at the rendezvous
directory, and pin the directory through listener cleanup to prevent
replacement after validation.
- Add a Windows peer check that verifies the kernel-reported peer process uses
the current user's non-elevated token.
- Document the Windows requirements for custom control socket paths.
## Testing
Add Windows coverage for ACL inheritance and rejection, junction and volume-root
rejection, extended-length paths, directory pinning, and elevated peer rejection.
GitOrigin-RevId: cc8dd76e5732c288f6346cfd6138051188533bfa
## What changed
- Add the top-level `thread_unload_delay_secs` configuration key for the
app-server, with a 60-second default instead of the previous 30-minute
fixed delay.
- Allow zero-delay unloading and reject values that cannot fit in a
monotonic-clock deadline.
- Reset the unload countdown when a thread gains a subscriber or becomes
active, and preserve active turns even when the configured delay is zero.
- Document that unloading ephemeral threads discards their in-memory state.
## Testing
- Cover configuration parsing, defaults, overrides, and overflow rejection.
- Cover unsubscribe, resubscribe, delayed and immediate unloading,
notifications, persisted-thread resume, and WebSocket disconnect behavior.
GitOrigin-RevId: edd46f6b49bbdafbf606bff74378e8f569e95977
## Why
Permission requests can originate in an environment whose path convention differs from the Codex host. Requiring the request working directory to be host-native prevents those requests from reaching interactive approval.
## What changed
- Carry the request `cwd` as a `LegacyAppPathString` through core events and the app-server protocol so the target environment's native representation is preserved.
- Convert the preserved value back to a `PathUri` when materializing permission grants.
- Regenerate the JSON and TypeScript protocol schemas for the updated `cwd` type.
## Testing
- Exercise the app-server permission request round trip with a target-native working directory across host path conventions.
- Verify remote permission requests retain their environment working directory and granted access still unblocks later execution.
GitOrigin-RevId: 97dc9707d9048883d20bab1b69c93871039f3188
## Why
Compaction replaces the model history window, but host-verified user answers may
still be needed for the rest of the owning thread.
## What changed
- Add bounded, model-invisible retained context for verified
`request_user_input` answers.
- Persist retained context in rollout events and compaction checkpoints, and
restore it when a thread resumes.
- Remove answers when their source turns are rolled back, and prevent
parent-local answers from being inherited by child forks.
## Testing
Add lifecycle coverage for deduplication and size limits, compaction and resume,
rollback, rollout migration, and child forks.
GitOrigin-RevId: c32900d3e8120a9899b71f0576683acd67a4b898
## What changed
- Extend the app-server integration test to cover both synchronous and asynchronous Guardian reviews across compaction, server restart, and thread resume.
- Verify that compatible asynchronous review models receive the parent compaction checkpoint while incompatible models fall back to retained evidence; synchronous reviews continue to receive the checkpoint.
- Check that partial rollback removes only the rolled-back input and that rolling back past compaction removes the retained evidence and checkpoint.
- Confirm that the compaction request includes the original user restriction and MCP tool output.
GitOrigin-RevId: 41c377fa12dfde9ee1a73a65d08bfdf87f66a788
## Why
Another process sharing `CODEX_HOME` can replace an installed plugin version
without invalidating the current process's caches. This could leave skill
listings tied to stale plugin paths and retain obsolete plugin generations.
## What changed
- Reject cached plugin loads when their roots no longer match the active
installation, so skills are reloaded after upgrades or rollbacks.
- Keep the 32 most recently used configuration-based skill snapshots while
allowing callers to continue using snapshots that have been evicted.
## Testing
- Cover external plugin upgrades and rollbacks through `skills/list`, including
a subsequent warm-cache read.
- Cover cache eviction, reuse, and the lifetime of caller-held snapshots.
GitOrigin-RevId: ca00f9539c01461e3945d340bf63f8436665220b
## What changed
- Skip Guardian prewarming and asynchronous scoring when `approvalsReviewer` is
`"user"`, including when the reviewer changes during an active turn.
- Automatically accept ordinary `node_repl.js` execution confirmations in this
mode while continuing to surface sensitive-action checks and requests for user
input.
- Cover transitions between User approval, automatic review, and Full Access in
the app-server integration tests.
GitOrigin-RevId: 599c8ebb672728b9bf3d64c34377ddec230325f8
## What changed
- Emit a `codex_thread_hint_status` analytics event for each native history-notes thread hint attempt.
- Report whether retrieval was successful or failed along with thread context and timing, without including hint contents.
- Treat valid empty responses as successful retrievals while continuing to omit them from the context window.
## Testing
- Extend the app-server history-notes tests to verify success, empty-result success, and backend failure statuses.
GitOrigin-RevId: b9462f312847e8c871ed2be0c8cf8df0928a7fdd
## What changed
- Replace `send_user_message_async` with `request_user_input_async`, accepting one or more questions with optional suggested answers while allowing the turn to continue.
- Attach structured question metadata to asynchronous agent messages while retaining readable fallback text, and preserve it through app-server events, thread history, and generated schemas.
- Continue enabling the new tool for model catalogs that advertise either the old or new tool name.
## Testing
- Cover tool registration, question validation, emitted items, continued turn execution, history preservation, and backwards-compatible deserialization.
GitOrigin-RevId: ffc49aebde2e854c3c50a122aa52805fec3fc6b3
## What changed
- Add nullable `model` and `reasoningEffort` fields to the shared app-server `Thread` object and generated schemas.
- Report current settings for loaded threads and the latest persisted settings for unloaded threads across thread read, list, start, resume, rollback, metadata update, and notification paths.
- Keep unavailable legacy or filesystem-only settings nullable, and allow metadata reads without loading a thread or dispatching queued work.
## Testing
- Cover live-setting precedence, persisted settings after restart, null legacy values, and model metadata returned by thread lifecycle operations.
GitOrigin-RevId: 22ebe8a8d1910a820d90a97730d812a00d8c1372
## Why
Configured Git marketplaces may be defined outside the user config, but those definitions could not download or update their snapshots.
## What changed
- Select marketplace source, ref, and sparse-path settings from the effective merged configuration for startup synchronization and explicit upgrades.
- Preserve the initiating operation's configuration loader and overrides when reloading before activation.
- Roll back activation if the marketplace definition changed or configuration can no longer be loaded, without copying settings into the user config.
## Testing
- Cover system-defined marketplaces, CLI overrides, startup fallback after invalid user configuration, and rollback after configuration changes.
GitOrigin-RevId: 53d1eecf68a91ce2aa8430e5749d78697bfcd821
## Why
Full Access already combines `approvalPolicy: "never"` with unrestricted
permissions, so confirmation-only actions do not require a model review.
## What changed
- Detect Full Access consistently across the thread and every selected
environment. Pending, failed, or restricted environments are not treated as
Full Access.
- Approve confirmation-only Guardian and MCP requests without synchronous
review, sampler prewarming, or background scoring. Cancellation, explicit
denials, and forms that require user input keep their existing behavior.
- Re-evaluate the active permission state on each turn so an existing thread
can enter or leave Full Access safely.
## Testing
Added coverage for switching approval modes, strict sensitive MCP
confirmations, failed and pending environments, and suppression of Guardian
requests and background-scoring connections.
GitOrigin-RevId: 089ab4296dde473b8e33ab8324be79c5446c46f6
## Why
`request_permissions` paths and grants need to be evaluated against the selected executor environment, including its path convention, home directory, workspace roots, and temporary directories.
## What changed
- Resolve relative and home-relative permission paths using the executor context, reject mismatched path conventions and lossy paths, and support legacy `read` and `write` path lists.
- Move grant intersection into core so requested and granted permissions use the originating environment's sandbox context. Preserve deny entries conservatively when a special path cannot be resolved.
- Keep the full originating environment with pending permission requests so delayed responses are normalized against the same context.
## Testing
- Cover POSIX, Windows, UNC, relative, and home-relative path resolution and invalid path contexts.
- Verify end-to-end app-server grants are limited to the requested workspace scope and unresolved temporary-directory denies are preserved.
GitOrigin-RevId: 730a2aacd391262e92a6314f3a5b6c262e3dca10
## What changed
- Emit `codex_guardian_v2_classification` events with the outcome, risk
level, duration, model, and thread attribution.
- Emit `codex_guardian_v2_fast_decision` events when Guardian V2 approves an
action without a full review.
- Add `guardian_v2_enabled` to turn analytics, accounting for review scope
and model requirements.
## Testing
- Extend the Guardian V2 app-server coverage to verify event payloads,
attribution, enablement state, and scoped event emission.
GitOrigin-RevId: 0805975f8e8f9d954aa1058ea8c60545a090ae74
## Why
Forking a resumed paginated thread failed when the managed `sessions` directory was a symlink, even though the rollout remained under that managed root.
## What changed
- Validate rollout lineage references against the canonical `sessions` and `archived_sessions` roots.
- Accept rollouts beneath symlinked managed roots while rejecting nested symlinks that escape those roots.
## Testing
- Cover forking a resumed rollout under a symlinked `sessions` root.
- Cover rejection of rollout lineage paths that escape through a nested symlink.
GitOrigin-RevId: 0128ecde7087120ef510baa3ed62cdbb33073117
## Why
Git root discovery is optional metadata work, but filesystem probes can block. They should not exhaust Tokio's blocking pool, delay runtime shutdown, or prevent later turns from observing repository changes.
## What changed
- Add a shared `GitRootDiscovery` service that coalesces concurrent lookups for the same working directory and limits probes across directories.
- Run probes on detached threads, retain in-flight work across caller cancellation, and discard completed results instead of caching them.
- Use the service for turn and memory metadata enrichment, abort unused turn enrichment when its state is dropped, and limit memory metadata waits to one second.
## Testing
Add coverage for probe sharing, capacity limits, cancellation, fresh discovery, runtime shutdown, memory timeouts, and repositories restored after startup prewarming.
GitOrigin-RevId: bca46fc263e7a12a2f69146d8a0b3e7c7e0846cb
## What changed
Restrict cached remote plugin catalog test helpers to `.json` files when
reading plugin IDs or rewriting `fetched_at` timestamps.
GitOrigin-RevId: a144f44a8adc26a8d0aa0d85e95c8fe0366e8aa0
## What changed
- Add `approvalsReviewer` to the experimental `turn/settings/update` API.
- Apply reviewer changes to subsequently captured steps and new background approval requests while preserving pending approvals and future-thread defaults.
- Allow reviewer-only updates without `step_model_switching`, while continuing to enforce managed reviewer restrictions and model-required auto review.
- Use an explicit live reviewer update for MCP approvals while retaining refreshed thread defaults for clients that have not set one.
## Testing
- Cover switching between user and automatic review during a live turn, future-turn isolation, and managed-authority rejection.
GitOrigin-RevId: e1216b09c6a7972c2c9eaf4955d8d57d60604ca1
## What changed
- Centralize the allowlist for bundled MCP cleanup hooks and use it for both local and executor-discovered plugins, including `unified-computer-use` cleanup through `cua_repl`.
- Mark matching cleanup hooks as trusted built-ins so they run without saved hook trust and remain active when regular hooks or their per-hook state are disabled. Plugin enablement and managed-only policy still apply.
- Hide built-in cleanup hooks from hook listings and lifecycle notifications while retaining their metrics. Keep the built-in classification out of serialized protocol data.
## Testing
- Cover allowlist boundaries, trust and enablement behavior, inline and file-based hook declarations, MCP success and error responses, hook listing, lifecycle notifications, metrics, and protocol serialization.
GitOrigin-RevId: f93b7bc99f4ed9694f529def8ec383b45f31430e
## Why
When the remote Sites plugin is installed and its local bundle is available, exposing the bundled copy as well creates duplicate catalog entries and can load the wrong skills.
## What changed
- Persist an account- and backend-scoped exclusion for `sites@openai-bundled` once the remote replacement is installed and loadable.
- Apply the exclusion to plugin catalogs, search, direct reads and installs, runtime loading, hooks, and skill caches while preserving the remote plugin's server-owned enabled state.
- Restore the bundled fallback when the remote plugin is absent or its local files are unavailable, and throttle repeated availability checks for 60 seconds.
## Testing
- Added manager tests for persistence across restarts, account/backend isolation, fallback restoration, concurrent checks, and refresh throttling.
- Added app-server and agent-turn tests confirming that catalog, search, and skill loading prefer remote Sites.
GitOrigin-RevId: bc1154f79d3107910fee9fa27389a0ddb48ce6cf
## Why
Diagnostic reports can span several envelopes, and the previous 10-second shared
network budget could expire before slow uploads and their attachments completed.
## What changed
- Give each diagnostic report a single five-minute deadline shared by the event,
attachments, retries, and retry backoff.
- Stop reading or sending later attachments once the deadline or a Sentry rate
limit is reached.
- Limit the app server to three concurrent report uploads and return an
overloaded JSON-RPC error for additional requests until a slot is released.
## Testing
Add coverage for slow multi-envelope reports, deadline-aware retries, skipped
attachments, rate-limit handling, and concurrency-slot release after failures.
GitOrigin-RevId: bdacf6c9731df16d2763e204565986eb6d540233
## What changed
- Add typed context sections for root-conversation evidence, trusted user answers, and conversation transcripts to `codex-guardian-context`.
- Use the shared section registry when building core Guardian prompts and asynchronous Guardian V2 scoring context.
- Preserve source-role labeling while delivering authorization evidence as user-role context, and fail closed when context collection fails.
## Testing
- Cover shared section ordering and role preservation for synchronous and asynchronous targets.
- Verify trusted user answers appear exactly once as user-role input in Guardian V2 approval flows.
GitOrigin-RevId: 1d5d793ffbf166077411a66e85e039596907fb7e
## Why
Guardian review evidence must remain available after a compacted thread is resumed or forked, while rolled-back or parent-local evidence must not grant authorization in a different context.
## What changed
- Store the bounded, model-invisible Guardian transcript alongside compacted rollout history and restore it from the newest surviving checkpoint during replay.
- Trim Guardian history at rollback boundaries, clearing it when the boundary has already been evicted.
- Preserve the checkpoint for user-initiated forks, but remove it when spawning a subagent so parent review evidence is not inherited.
- Keep the new rollout field optional for compatibility with existing compacted records and legacy readers.
## Testing
- Cover Guardian history across compaction, restart, paginated and pathless stores, user forks, rollback, bounded replay, serialization, and subagent forks.
GitOrigin-RevId: 6ab076d5e0c3aac4d6a41ebd50ba2b200c90213e
## What changed
- Add `apps.<app_id>.links.<link_id>` configuration for overriding
`approvals_reviewer` and `default_tools_approval_mode` per connected account.
- Expose link settings through the app-server protocol and generated JSON and
TypeScript schemas.
## Testing
- Extend `config/read` coverage for populated, empty, and absent `links`
sections.
GitOrigin-RevId: 43004d2722439060fdadc5e5cd9ed3108774ecaf
## What changed
- Add `turn_trigger` and `codex_turn_source` to `codex_turn_event` analytics.
- Read the source from effective Responses metadata, preserving configured-over-client precedence and reflecting accepted steer metadata.
- Omit trigger and source values from analytics when they exceed the existing Responses metadata value limit.
## Testing
- Cover event serialization, turn lifecycle emission, configured and client source precedence, size limits, and source updates after steering.
GitOrigin-RevId: bbd45af4c6af52956d2394b722ea78e65e5b9bd7
## What changed
- Include the complete upstream `response.usage` object in
`ResponseUsageMetadata.metadata` while retaining the existing `amount` field.
- Expose the metadata through `rawResponse/completed` notifications and update
the generated JSON and TypeScript schemas.
## Testing
- Cover SSE, WebSocket, turn, and compaction completion paths.
GitOrigin-RevId: 6d79b1b4c92ac11abf43ec98f380b4868288a701
## What changed
- Add the `plugin/reconcile` JSON-RPC method to synchronize installed remote plugin bundles and wait for required hook updates.
- Return affected plugin IDs with MCP, Apps, hooks, and skills refresh hints, plus remote update and materialization failures.
- Refresh loaded hook runtimes after relevant updates and return an empty result when plugins or backend authentication are unavailable.
## Testing
- Cover workspace and global bundle installs, unchanged passes, enablement changes, updates, removals, materialization failures, hook refreshes, and disabled plugins.
GitOrigin-RevId: 45c02518d71990d13eb09d56ed51505c91c66956
## What changed
- Query workspace-visible turn estimates for ChatGPT-authenticated sessions through the appropriate Codex or ChatGPT endpoint.
- Track completed response IDs and emit `codex.turn.cost_microusd` only when the estimate is nonnegative, visible, and covers every observed response.
- Keep error response bodies out of turn-cost worker logs.
## Testing
- Cover both endpoint styles, nullable estimates, settlement validation, exact micro-USD conversion, and response-ID tracking.
- Add an app-server integration test that verifies a settled ChatGPT turn reaches the OTLP metrics exporter with its turn, conversation, and auth-mode attributes.
GitOrigin-RevId: 6ae3f8df729fad52984a0c6efafd8c96c7214e55
## Why
Realtime history should be recorded consistently for every Core host, including
when no app-server event listener is attached.
## What changed
- Move transcript segmentation, session boundaries, and backing-agent artifact
promotion into Core for paginated threads.
- Persist canonical realtime items through the thread store in event order and
emit dedicated history lifecycle events for hosts to present.
- Translate those Core events into the existing app-server realtime item
notifications without app-server persisting the items a second time.
## Testing
- Cover Core-only persistence across repeated sessions, ephemeral sessions,
accepted and rejected steering, typed input ordering, and artifact promotion.
- Verify app-server notifications correspond to the persisted timeline.
GitOrigin-RevId: 7cbef14129d77f6d6d7099b733be91f5279c55f5
## Why
Resumed threads need to continue per-turn and per-thread token totals without scanning arbitrarily far beyond the latest compaction checkpoint.
## What changed
- Add durable `TokenUsageRecord` rollout items with response, turn, thread, session, and root-turn attribution.
- Restore accumulated usage on resume and snapshot the latest record plus the compaction response ID in compaction checkpoints.
- Preserve root-turn lineage in persisted turn context, while ensuring forked child threads start with their own usage totals.
## Testing
- Cover usage accumulation across multiple responses and resumed turns.
- Cover local and remote compaction checkpoints, invalid remote compaction output, rollout reconstruction, and fork isolation.
GitOrigin-RevId: ef9e0c4a9102a08a2c382be4cdac68c84353c90a
## Why
Guardian reviews need the original conversation evidence even after the parent context has been compacted, while rollback must still remove evidence from reverted turns.
## What changed
- Build synchronous and asynchronous Guardian transcripts from the retained review-history snapshot.
- Use the shared Guardian transcript collector for consistent entry formatting, tool attribution, and per-entry truncation while preserving the existing transcript retention budgets.
## Testing
- Add app-server coverage for retaining user and tool evidence after compaction and discarding it after rollback.
- Extend transcript tests for standalone tool outputs, shell calls, attribution, truncation, and retention limits.
GitOrigin-RevId: a18b1176f14a4d006c263aa82d4e593afee66bc3
## What changed
- Initialize Guardian reviewer subthreads with empty extension data.
- Remove the special registration that exposed inherited read-only `history`
tools in the Guardian tool plan.
GitOrigin-RevId: 7700f033faab125d59d11bc2d82955c67689e3c3
## What changed
- Carry optional backend-owned banner and account identity data through
`account/rateLimits/read`, filtering banners that do not match the authenticated
account and user.
- Render supported rate-limit notices above the composer with actions for usage,
credits, resets, owner notifications, and plan management while preserving the
existing fallback UI for absent or unsupported banners.
- Refresh usage after limit errors, reject stale responses, and keep queued input
paused until recovery completes. When instructed by the banner, switch to the
first available fallback model without changing unrelated thread settings.
## Testing
- Add protocol, banner parsing and rendering, CTA, identity filtering, refresh
ordering, fallback-model, account-change, and queued-input recovery coverage.
GitOrigin-RevId: e03d75a82e425deb87f4b120a71cf2286c0ef6cc
## Why
The first REPL execution should proceed while its initial asynchronous Guardian
classification is still pending.
## What changed
- Fast-approve the first `js` execution from a Node REPL-backed server while
continuing its asynchronous classification.
- Track `js` executions separately so setup and reset tools do not consume the
first-execution allowance.
- Apply the normal Guardian review policy to subsequent executions.
## Testing
Add coverage for browser and computer-use startup, reset, and module-directory
setup sequences, verifying that only the first `js` execution skips the wait.
GitOrigin-RevId: 7297b35411a6317bcf9e7058c08c6db3e3310ac8
## What changed
- Cover the default, explicitly enabled, and explicitly disabled states of
`tools.update_plan.enabled`.
- Verify prompt tool lists remain consistent across requests, including when
custom base and developer instructions are configured.
- Explicitly enable `update_plan` in existing fixtures that depend on the tool.
GitOrigin-RevId: 3be279cb5195dfc5892c2c8ff6a1461fac879309
## Why
Resuming a thread without an explicit `cwd` should restore that thread's latest
retained setting. Forked history can contain settings copied from another
thread, while compaction can move the latest setting outside the replay window.
## What changed
- Record the owning thread ID on new settings snapshots and only use snapshots
owned by the resumed thread when restoring `cwd`. Older snapshots without an
owner remain readable but do not override the startup `cwd`.
- Checkpoint the current settings after compaction and serialize checkpoints
with settings updates so the retained history contains an accepted, current
snapshot.
- Cover resume behavior across compaction, forks, reverts, legacy histories,
and concurrent settings updates.
GitOrigin-RevId: 1efc9cf55472d6b88c465c4efe44672a232dbf64
## Why
Automatic goal continuations should remain attributable to the turn that created the goal. External input, hook context, or goal edits can make that attribution ambiguous and must not leave stale lineage metadata behind.
## What changed
- Carry the trusted root and previous parent turn through successive automatic goal continuations.
- Invalidate stored lineage when external context reaches an active turn or when a goal is edited or cleared.
- Preserve lineage for async hook results only when they belong to the receiving turn.
## Testing
- Cover goal continuations across intervening user turns and external objective edits.
- Cover active, buffered, and externally injected hook or response context.
GitOrigin-RevId: 22ccc07961cd0ed8f4b17912b7efa416b342bf50
## What changed
- Add model message metadata for built-in tool descriptions.
- Use the active step model's catalog description for `send_user_message_async`, including after a mid-turn model change.
- Fall back to the built-in description when catalog metadata is absent, while preserving an explicitly empty description.
## Testing
- Cover catalog serialization, fallback and empty-value behavior, and model changes within a turn.
GitOrigin-RevId: 72b953214ab9708931065321debf12133f8d2d40
## What changed
- Track failed `exec` attempts whose handler ran for each active goal.
- Mark the goal as blocked after three qualifying failure turns.
- Reset the failure streak when any tool succeeds, and keep failures from carrying over to a replacement goal.
## Testing
- Cover failure classification, streak resets, goal replacement, and end-to-end goal blocking through the app server.
GitOrigin-RevId: 14dac7f4eb35507f12df3b2a82ab97bdafe7b897
## Why
Code mode wall time should measure the host operation itself, without including
client-side response delays or idle time between requests.
## What changed
- Measure each execute, wait, and terminate request in the code mode host.
- Carry the duration through the stdio and gRPC protocols and use it for
model-visible wall time.
- Emit a structured `codex.code_mode.host_timing` event correlated with the
conversation, turn, tool call, and cell.
## Testing
- Cover successful and failed execution timing, delayed response reads,
repeated waits, termination, and missing cells across stdio and gRPC.
- Verify timing survives protocol serialization and is reflected in app-server
model output and structured telemetry.
GitOrigin-RevId: d24af30c3fc5820521b4beba1f9970714dad6482
## What changed
- Advertise `openai/elicitation` form support when the client declares an
object-valued `form` capability, without deriving it from the legacy
`openai/form` capability.
- Handle `openai/elicitation/create` requests in `form` mode and forward their
metadata and opaque schema through app-server as `openaiForm`, preserving
`x-openai-*` annotations.
- Keep legacy form handling independent and have the TUI automatically decline
the new form requests it cannot render.
## Testing
- Add an app-server round-trip test for capability negotiation, request
forwarding, and accepted responses.
- Extend MCP capability filtering coverage for `openai/elicitation.form`.
GitOrigin-RevId: 88f39257bffafe4ee98a9c910e38507843cd7eeb
## What changed
- Add the disabled-by-default `omit_app_server_notification_media` feature.
- When enabled, remove inline image and audio content from `item/started`,
`item/completed`, and `rawResponseItem/completed` notifications, including
tool output and image-generation results.
- Keep the media in model input; the filter only changes app-server
notifications.
## Testing
- Verify that image content is absent from all three notification types while
the model request still receives it.
GitOrigin-RevId: 9a4434d18a3dac6d67c2e0c3723ff4595a9b3797
## What changed
- Add an optional `timeoutMs` parameter to `thread/shellCommand` and propagate it to user shell execution.
- Preserve the one-hour default when the parameter is omitted or `null`, allow longer deadlines, and treat `0` as an immediate timeout.
- Reject negative or otherwise invalid values before execution. Timing out an auxiliary shell command leaves its active turn running.
## Testing
- Cover default, extended, immediate, invalid, standalone, active-turn, and interruption behavior.
GitOrigin-RevId: d72f67793d9766b7383f28d30140270a4a76a495
Anton Panasenko