## What changed
Move the Bazel installation, repository cache configuration, and Windows MSVC environment setup directly into `prepare-bazel-ci`, and remove the `setup-bazel-ci` action. Wire the repository cache output and restore step to the inlined configuration step.
Update the Windows PATH script documentation and remove the deleted action from V8 canary path matching.
GitOrigin-RevId: 2472372478e1618cd03e98a1536f862f47352659
Resolve `codex-windows-sandbox-setup` with `codex_utils_cargo_bin::cargo_bin` so the manifest test supports both Cargo binary paths and Bazel runfiles.
GitOrigin-RevId: 23e62800cdd5994eb18fa47fcc1479f4ce10c42e
## Why
Profiles without a v1 memory workspace have no legacy context to preserve or consolidate before using v2.
## What changed
- Select v2 when memories are enabled and the `memories` directory is absent. Preserve explicit `memories.version` settings, the `memories.dual_write = false` opt-out, and the v1 default for existing workspaces or filesystem check errors.
- Report `v2_ready` immediately for profiles without a v1 workspace. Keep the consolidation count and valid-summary requirements for profiles with a v1 workspace.
- Make resetting an absent memory workspace a no-op so it does not create an unused v1 directory.
## Testing
Extend coverage for default and explicit version selection, opt-outs, version-specific memory reads, fresh-profile readiness and reset behavior, and running only the v2 pipeline for fresh profiles.
GitOrigin-RevId: a8fb0844962ae9266ffbe88af97e8dc4a99ac15f
## Why
A concurrent fork can retain locks from a previous cleanup pass until exec,
causing the next pass to skip cleanup and fail the test's assertions.
## What changed
Wait for and explicitly release both staging locks before each cleanup pass in
`cleanup_reclaims_unpublished_and_aged_legacy_clones`. Run the existing age
scenarios in a loop and report the age when legacy directory assertions fail.
GitOrigin-RevId: 115d887e6b74159f22a2f675237e3b3356ab0308
## Why
Allow workloads to make AWS requests with placeholder credentials while keeping real AWS credentials in the trusted proxy process.
## What changed
- Add an `aws_sigv4` hook action with a placeholder access key ID, region, service, HTTPS port, and credential sources from proxy environment variables or files.
- Re-sign matching requests after network and hook authorization and header transformations, using the configured credentials and optional session token.
- Support empty payloads and explicitly unsigned payloads, including streaming unsigned S3 uploads. Reject selected requests with incompatible credential scopes, presigned URLs, unsupported streaming signatures, or ambiguous framing through the hook denial path.
- Mark generated credential headers as sensitive and suppress signing SDK trace events that could expose credentials.
## Testing
Add tests for the published AWS IAM signature vector, unsigned S3 uploads with a session token, and rejection of invalid transport, credential scopes, signing inputs, and unsupported bodies.
GitOrigin-RevId: ab4fbbc00ba40a5bb309add521fea6ee2ff6e79e
## What changed
Promote `reasoning_effort_override` to stable and enable it by default, allowing supported models to receive reasoning effort changes through configuration updates in conversation history.
Update request-history snapshots to include the configuration updates, and remove explicit feature enablement from the reasoning effort override test builder so the suite exercises the default.
GitOrigin-RevId: 6ce16d7f985c33f008e5230fc9bae09cdaf141d5
## Why
Managed network policies need to require approval for selected hosts even when an exact or wildcard allow rule matches them.
## What changed
- Add `experimental_network.review_domains` to managed requirements and route matching hosts through the existing network approval flow. Explicit denials retain precedence, and approved connections still undergo DNS and local-address checks.
- Preserve review patterns across environment policy attachments and remote proxy configuration. Reject execution on an exec-server that lacks the `networkProxyReviewDomains` capability when review patterns are present.
- Expose `reviewDomains` through the app-server requirements API and generated schemas, and show `review_domains` in debug configuration output.
- Update approval reasons to say that network access requires approval rather than assuming the host is absent from the allowlist.
## Testing
Extend coverage for review precedence over exact and wildcard allows, explicit denials, DNS checks after local and remote approvals, approval hooks, policy merging, remote configuration round trips, and requirements API serialization.
GitOrigin-RevId: 4a861061a0ed80b3537d3b72f2caecb0db2a4f0b
## Why
Enterprise MCP token exchange and sign-in failures can collapse into generic errors, hiding useful diagnostics such as an OAuth `invalid_scope` rejection or a cancelled sign-in.
## What changed
Introduce `EmaErrorDetail` to carry static operation messages and sanitized SDK diagnostics through token-source errors and enterprise login completion. Exchange failures can report the stage, HTTP status, and allowlisted OAuth error code, such as `IdentityProvider: HTTP 400: invalid_scope`, without retaining arbitrary provider text or raw error chains.
Preserve specific discovery, credential storage, cancellation, and account/configuration mismatch errors instead of replacing them with generic failure messages.
## Testing
Extend tests to cover `invalid_scope` diagnostics, specific sign-in completion errors, and exclusion of credentials from diagnostics even when an outer error context contains sensitive text.
GitOrigin-RevId: e9280a5db3565ea91da0810bab528da5ee088d64
Initialize `client_secret` and `token_endpoint_auth_method` to `None` in
`ema_auth_statuses_do_not_wait_for_account_refresh` to match
`McpServerIdpOAuthConfig`.
GitOrigin-RevId: 0c800b4f60d2468d7c2cb0b8d83bbdb4b3998574
## Why
An explicit `final_answer` with empty or whitespace-only text could allow queued agent mail to restart the turn instead of leaving it queued for the next turn.
## What changed
Treat explicit `final_answer` messages as terminal regardless of visible text in both completed-item handling and turn-item finalization. Untagged messages still require visible text to defer mailbox delivery; `commentary` and `partial_answer` messages do not defer it.
## Testing
Extend regression coverage for empty and whitespace-only final answers, delivery of queued agent mail on the next turn, and message board notifications arriving before or after an empty final answer.
GitOrigin-RevId: 466f1a9c613e07d67ce45458858ba32d5d23f11d
## Why
Dropping a local tool-call future did not notify the MCP server that the request was cancelled, leaving remote work running.
## What changed
- Send a cancellation notification for the request when its response future is dropped, covering both ordinary tool calls and tool-input rounds.
- Preserve write order for stdio and in-process transports so cancellation cannot arrive before its tool request, without waiting for tool responses.
## Testing
Add regression tests for cancellation on drop, request-before-cancellation ordering under reversed send polling and exhausted task budgets, and continued use of the shared connection after cancellation.
GitOrigin-RevId: fab02d546fd82c601756117d9ecbf1017c28ac11
## Why
EMA MCP auth status checks acquired an account grant lease, making status inspection wait for account refresh coordination or an existing lease.
## What changed
Add `AuthManager::account_oauth_grant()` to inspect an owner-checked grant without acquiring the refresh lock. Use it for EMA status checks and share a single lazy read across servers, including missing grants and read errors. Keep refresh exclusion for token exchanges through `lease_account_oauth_grant()`.
## Testing
Add regression coverage for status checks across two EMA servers while an account lease is held. Extend account refresh tests to verify inspection completes with a lease held and refresh queued, and returns no grant after logout.
GitOrigin-RevId: 921214dd552eb216c713596f2737460053a07d08
## What changed
Add the disabled-by-default `guardian_recorded_items` feature to forward recorded reviewer items and interruptions through the parent's raw-event subscription, preserving reviewer thread and turn IDs without modifying the parent's history or completing its turn.
Emit reviewer items as `rawResponseItem/completed` notifications and interruptions as interrupted `turn/completed` notifications. Mark opted-in reviewer requests with `guardian_recorded_items` metadata.
## Testing
Extend Guardian integration tests to cover reviewer identity, recorded-item metadata replay, concurrent reviewer interruptions, independent parent completion, and behavior without the feature enabled.
GitOrigin-RevId: beb4dbf6c6f2a800a2fbf3cfd11ae174a1382386
## What changed
- Add `InitialBackendSessions` to carry the initial session and additional sessions into the TUI event loop. Existing launches continue to supply a single session.
- Shut down all supplied sessions on startup errors, cancellation, and early exits.
- Register the under-development `tui_multi_backend` feature flag, disabled by default, and expose it in the configuration schema.
## Testing
Add a regression test that fails bootstrap and verifies that both initial backends receive shutdown requests. Update multi-source event polling coverage to use the new initialization path.
GitOrigin-RevId: e5db439552de97594e6f13360b90be71256ab2f0
## Why
Saving a local preference could succeed but fail to apply live because reloading the full configuration also resolved execution settings. An unknown `model_provider`, for example, prevented the preference from taking effect.
## What changed
Reload config-panel preferences from the configuration layer stack into `LocalSettings` without rebuilding execution settings. Preserve CLI overrides, loader overrides, cloud configuration, and the existing choice of working directory.
## Testing
Extend the offline remote-session preference test with an unknown `model_provider` override, verifying that automatic recap and paste detection preferences still persist and apply live.
GitOrigin-RevId: 2377a01c77f3cb978a7ee6cd67c1fe89361131fb
## Why
A saved client `approvals_reviewer` setting could override the app server's default when starting a fresh thread.
## What changed
Use explicit invocation overrides for the first thread's approval reviewer, leaving the selection to the server when no override is provided. Typed overrides take precedence over key-value overrides, and repeated key-value overrides use the last value. Explicit profile launches retain their resolved configuration behavior.
## Testing
Extend startup tests to cover server defaults, embedded startup, explicit override precedence, and profile launches. Verify that the first turn uses the reviewer returned by the server.
GitOrigin-RevId: 19d4d75bb8fbe522fb9495bd9c6951513f8ac4d2
## Why
Repeated reads of Codex auth and managed secrets repeat expensive scrypt decryption even when the encrypted file and keyring passphrase are unchanged.
## What changed
Extend the decrypted snapshot cache to `CodexAuth` and `ManagedSecrets`, keeping at most one snapshot per namespace. Reuse snapshots only when the file path, ciphertext, and passphrase match, and invalidate matching snapshots on writes. Every read still checks the file and keyring before reusing plaintext.
## Testing
Extend cache tests to cover concurrent reuse, writes, external file replacement, file removal, key rotation, keyring errors, invalid ciphertext, and isolation across homes and namespaces. Prime the auth cache before verifying fallback when the keyring fails.
GitOrigin-RevId: eaf802ef4cfdbe482b56423807a1fe0fe3def2cd
## Why
Local administrators need to require managed configuration from a specific customer-hosted server before a session can start.
## What changed
- Add a local managed `config_server` requirement with an HTTPS base URL and optional OAuth settings. Validate endpoints and derive the bundle route as `codex/config/bundle` beneath the base URL.
- Replace the entire `config_server` block when a higher-priority requirements layer supplies one, keeping the endpoint and OAuth settings together. Reject this setting in fetched policy.
- Track the applied server through configuration snapshots, role overrides, and refreshes. Reject session startup and managed refreshes when the applied server does not match the requirement; user refreshes retain the session's managed configuration.
## Testing
Add coverage for missing, mismatched, and matching server configuration at session startup, whole-block replacement, rejection of server settings in fetched policy, and preservation across role overrides and refreshes.
GitOrigin-RevId: 51e8a1738dabdb117ae858120f6fb09ae2ff1261
## Why
Remote credential masking previously fell back to unmasked execution whenever custom credential providers were configured.
## What changed
- Transport configured provider rules to the executor-local network proxy, where credential values and destination context are resolved.
- Advertise `credentialMaskingCustomProviders` and negotiate masking support. Keep the warning and unmasked fallback for executors that support only built-in providers.
- Discard provider rules when masking is disabled and omit their contents from debug output.
## Testing
Extend coverage for capability compatibility, provider configuration round trips, and fallback on older executors. Exercise configured-provider masking in remote request history and verify that masked placeholders are restored to real credentials in upstream request headers.
GitOrigin-RevId: b036f56900b343ddccc17b5293c82bc1f3426237
## Why
Executor hooks depended on V1 discovery snapshots, so plugins discovered through V2 could not run their cleanup hooks.
## What changed
Prepare executor hook sources during step setup from either V1 or V2 discovery and capture them in `StepContext` for stop, interrupt, and memory consolidation hooks. Restrict V2 sources to selected plugin installations while preserving plugin enablement, hook admission, MCP routing, and app tool policy checks.
## Testing
Add unit coverage for V2 hook admission, environment routing, disabled plugins, and failed discovery. Add integration coverage showing that `Stop` and `Interrupt` cleanup hooks run with V2 discovery alone and remain silent when the plugin is disabled.
GitOrigin-RevId: a4c0e9c56bdebcdf22cea63f02f8fb4c5eed358e
## What changed
- Add `CloudClient` and integrate it with `AppServerClient` and `AppServerRequestHandle` for requests, notifications, server-request replies, events, and shutdown.
- Keep retained request and reply handles bound to their cloud backend, with event delivery independent of request completion and a timeout for shutdown.
- Return no platform or Codex home metadata for cloud clients, and reject TUI filesystem operations for this backend.
## Testing
Add tests for backend ownership of retained handles, independent event delivery, errors after the command receiver closes, and shutdown timeouts when the worker does not respond.
GitOrigin-RevId: 4cf308dc0ea6fa6e7b14dd4542d93e8030b0162d
## What changed
- Add `OAuthSessionRequest` to pair access tokens with their authorization identity and retain rejected-token recovery across transient failures and retries. New sign-ins receive an identity that survives token refresh.
- Expose explicit login, logout, and authorization identity lookup, plus a per-manager option to disable automatic browser login while allowing credential reuse and refresh.
- Move serializable `OAuthSessionConfig` into `codex-model-provider-info`, add an optional `device_authorization_url` field, and share endpoint URL validation through `codex-http-client`.
- Distinguish permission failures, transient token endpoint failures, and invalid responses using `io::ErrorKind`.
## Testing
Add coverage for sign-in identity preservation through refresh retries, removal of saved and cached credentials on logout, and suppression of automatic browser login. Extend token endpoint error classification coverage.
GitOrigin-RevId: ae9f72e787171e179fe139a3b840a9f7e1e46506
## What changed
Promote `bedrock_setup_wizard` to stable and enable it by default for eligible onboarding. Users can still disable it with `features.bedrock_setup_wizard = false`.
## Testing
Update onboarding coverage to check the enabled default and explicit opt-out. Remove the explicit opt-in from daemon startup tests so they exercise the default configuration.
GitOrigin-RevId: 5bd911088681a31d34aa444398e6d3f7d1d87955
## Why
Rust v0 symbols can mention `codex_code_mode_host` as the instantiating crate of a dependency's generic function, so matching the crate name alone can select the wrong function.
## What changed
Demangle `nm` output and match `codex_code_mode_host::main` exactly, preserving spaces within demangled names. Include local symbols in the Linux lookup by removing `--extern-only`.
GitOrigin-RevId: b4ea4face3fe861966d3643d13db168143bcefa3
## What changed
Add optional `responsesapiClientMetadata` to `ThreadSampleParams` and forward it to the sample turn's Responses API metadata. Update the experimental protocol schema.
## Testing
Extend the thread sample integration test to verify that client metadata appears in both the request header and body, preserves the explicit `turn_trigger` when client metadata supplies a conflicting value, and does not carry over to the next parent turn.
GitOrigin-RevId: eb1f80824d476fc6c584a2b35d97e59d51fd4273
## Why
QPACK can expand compact response headers into large decoded field sections. Bound their size before `h3` constructs its capacity-limited `HeaderMap`.
## What changed
Set the HTTP/3 client's maximum field section size to 64 KiB so oversized responses are rejected with `HeaderTooBig`.
## Testing
Add a regression test that sends QPACK static references around the size limit and a much larger expansion. Verify that oversized responses are rejected and a subsequent valid response succeeds on the same connection.
GitOrigin-RevId: d7c83a7a755dfafae05919ec52542ffce40a1ef4
## What changed
When AWS profiles or environment credentials are detected, move manual Bedrock API key entry under “Other AWS sign-in methods” and update its description to include API keys. Keep API key entry directly available when no credentials are detected.
## Testing
Update onboarding method assertions and rendering snapshots to cover the grouped options and API key entry in the other sign-in methods menu.
GitOrigin-RevId: 992ecf7a2e3ac9f2f0eef2ef6534cf9beb88ea8e
## Why
When `-c` or `--config` appears at multiple command levels, Clap retains only the deepest scope's values, dropping earlier overrides.
## What changed
Collect config overrides from each command scope in order while preserving typed child arguments and their existing precedence. Arguments forwarded after `--` remain unchanged.
## Testing
Add regression coverage for overrides split across nested `mcp add` commands, forwarded `-c` arguments, and validation of an invalid override before `app-server` when another override follows it.
GitOrigin-RevId: 40c64eda866497e2f59491a523c6777a8bfe5d5f
## What changed
Keep the leading `/` in the textarea and render slash commands after the normal composer prompt, so `/model` appears as `› /model`.
Track the full `/command` token as a text element and remove stale slash-command elements when the draft changes. Update composer tests and snapshots for the new representation.
GitOrigin-RevId: 60119f18b69cec16f4e21839f45132231feb84b4
## Why
`thread/sample` previously required the latest source turn to have completed successfully, rejecting failed or interrupted turns even when the source was idle.
## What changed
Accept the latest completed, failed, or interrupted turn in both legacy and paginated history modes. Update the protocol documentation and validation error to reflect the accepted statuses, while continuing to reject stale or active sources.
## Testing
Expand integration coverage across all three terminal statuses and both history modes, checking that sampling preserves context and leaves the source unchanged. Also verify that sampling an active source is rejected before interrupting it.
GitOrigin-RevId: a5dfdb2800868ee178eae16b12ee7f6f9515898c
Use `ConfigEditsBuilder` to persist a concurrent MCP server edit during OAuth discovery without launching another CLI process inside the HTTP timeout. Preserve coverage that the concurrent server and issuer-bound callback are saved, and assert that OAuth fails with the expected invalid authorization endpoint error.
GitOrigin-RevId: 41d782f9dbbc96d528e4990171bffd87e95f6e4f
## Why
Runtime process handles are recyclable and thread-local. Using them as terminal session identities can merge separate commands or associate `write_stdin` operations with the wrong exec.
## What changed
- Give each exec a distinct terminal session and track the latest session for each thread-local process handle.
- Record the exec selected by `write_stdin` at runtime and use it to correct session membership during replay, including when dispatch is delayed until a handle is reused.
- Fall back to the latest session for the thread and handle when replaying older traces without runtime target events.
## Testing
Extend reducer coverage for process ID reuse across threads and successive execs, stdin session membership, and delayed runtime target resolution.
GitOrigin-RevId: 330c6fd26a4eebdef03ae600a030dc76920e0dd9
## What changed
Add the `codex-direct-tool-timing` crate to record tool execution, automated reviews, human waits, and dependency paths. Human waits take precedence over overlapping reviews, and dependency waits with unavailable history are recorded as unknown time.
Invocation guards complete each call once, explicitly or on drop. Separate invocation identities prevent late review or wait guards from affecting calls that reuse an ID; duplicate active IDs disable ambiguous path attribution. Batch timing exposes the last-finishing invocation's path once all calls complete.
## Testing
Add unit tests for parallel batch completion, duplicate and reused call IDs, cancellation, missing dependency history, overlapping reviews and human waits, and nested wait guards.
GitOrigin-RevId: 8b251f51a0c52342657f2d244524b562a371bd8e
Pause the Tokio clock before spawning the review in
`run_review_on_reused_session_waits_for_submitted_turn` so its one-second
deadline uses simulated time while the test verifies that stale turn completions
are ignored.
GitOrigin-RevId: c6712219f894835b576f499eb080ec15a3f09a78
## Why
A total-duration assertion does not prove that two shell commands overlap and depends on execution speed.
## What changed
Update `shell_tools_run_in_parallel` to wait for both commands to create start markers before releasing them through a shared file. Fail if both commands do not start within five seconds, and verify that each command exits successfully and returns its expected output.
GitOrigin-RevId: ba322157a60951ad5dd2f1b018ddc6007de1de89
## Why
Credential substitution needs to authorize the destination and the original request before exposing host secrets. Project configuration must not redirect trusted credential policies, and older clients must reject scoped policies rather than silently apply unconditional injection.
## What changed
- Add hook `schemes` and `ports` constraints and an exact whole-header `placeholder` for secret substitution. Require `network.mitm.version = 2` for these options in permission profiles.
- Restrict placeholder substitution to HTTPS on port 443 and reject missing, mismatched, or duplicate placeholder headers.
- Reject project changes to trusted MITM definitions and their inheritance chains. Allow self-contained project header-stripping policies only when no trusted MITM policy exists.
- Reject ambiguous query values, value-constrained headers, and semicolon paths during authorization, and preserve case-sensitive extension methods.
- Mark resolved secret headers sensitive, reject secret injection into `User-Agent`, restrict substitution headers, and limit secret files to 64 KiB.
## Testing
Add regression coverage for scoped TOML resolution, legacy-format rejection, unknown fields, project policy restrictions, origin and placeholder denials, ambiguous request matching, secret redaction, and hook application after credential brokerage.
GitOrigin-RevId: 78dc115ab6c88c9a734377626429bc4840731f89
## Why
Enterprise-managed MCP authentication previously required public OAuth clients at both the identity provider and the MCP authorization server, preventing use of registrations that require client secrets.
## What changed
- Accept separate `client_secret` and `token_endpoint_auth_method` settings for the enterprise IdP and MCP server OAuth registration. Support `client_secret_basic` and `client_secret_post`, defaulting to Basic when a secret is configured.
- Validate the registered method against server metadata and use it for enterprise login and both ID-JAG exchanges.
- Require a configured `oauth.authorization_server_issuer` for confidential MCP registrations and reject empty secrets or authentication methods without secrets.
- Require the account OAuth client to match the configured IdP client before reusing an account grant with a provisioned secret; otherwise use dedicated enterprise login.
## Testing
Extend configuration, login, exchange, and app-server lifecycle tests to cover confidential registrations, separate IdP and resource credentials, authentication method validation, and exclusion of client secrets from authorization URLs, stored login grants, and logs.
GitOrigin-RevId: b3be378c2b1bb67e6a3652c648e72fd2e21e956d
## Why
HTTPS requests and WebSocket connections on Windows need to authenticate when a proxy rejects `CONNECT` with status `407`.
## What changed
- Retry proxy challenges through the existing Windows authentication helper, using the signed-in user's Negotiate or NTLM credentials. Treat an origin `407` as a normal HTTP response.
- Bridge authenticated tunnels to the HTTP client through destination-specific named pipes, retaining redirect checks and TLS backend fallback without caching those tunnels across destinations.
- Carry explicit CA certificates and client identities into HTTPS proxy TLS configuration, and apply the configured connect timeout when opening authenticated HTTP tunnels.
GitOrigin-RevId: ec7d9168972a7a640350e5348cfca40307390fbf
## What changed
Expose `connect_windows_proxy` for callers handling a CONNECT `407` response. Use libcurl with the signed-in Windows user's Negotiate or NTLM credentials, then return the authenticated connection with buffered data preserved.
Support HTTP and HTTPS proxies, with default or caller-provided TLS configuration. HTTPS proxies requiring authentication tokens bound to their TLS connection are unsupported.
Enable libcurl's NTLM support in Cargo and Bazel builds.
## Testing
Add a Windows-only test asserting that libcurl provides NTLM, SPNEGO, and SSPI support.
GitOrigin-RevId: 4ed7d2208766404b6125ce2f4b5f91de5616a37f
## Why
Callbacks from the shared stdio host need to retain each execution's trace context after it yields, without keeping the execution span open until its background cell closes.
## What changed
Capture a W3C trace-context snapshot for each execution and restore it as the parent of tool callback and notification spans. Instrument delegate invocation and its returned future so the context is available on entry and across awaits.
## Testing
Add an integration test with overlapping yielded cells completed in reverse order. Cover sampled, unsampled, and untraced callers, trace isolation, callback and notification parentage, and execution spans finishing while callbacks remain blocked.
GitOrigin-RevId: 57924123d2c2f31bcfaf725688d8bba775235fa0
## Why
Responses Lite includes retained reasoning in its reported token usage even without an `X-Reasoning-Included` header. Adding a separate reasoning estimate can trigger automatic compaction prematurely. Locally recomputed usage also already includes retained reasoning.
## What changed
Initialize reasoning accounting from `use_responses_lite` before each sampling or compaction request, while allowing server events to override it. Mark locally recomputed token usage as including reasoning.
## Testing
Update the compaction regression test to verify that Responses Lite usage without the header stays below an 81-token limit at 80 tokens and triggers compaction at 81 tokens.
GitOrigin-RevId: 06f9272cb3c259e927941f1d2a1d7096310ffb2c
## Why
Remote registry requests need to recover when credentials are rejected or rotated while `exec-server` is running. Concurrent requests should reuse refreshed credentials rather than refresh the replacement token again.
## What changed
- Add an `AuthProvider` recovery hook and retry registry registration, connection, and harness-key validation once after a `401` when the provider supplies replacement credentials.
- Use live ChatGPT authentication for remote `exec-server` and guard proactive and unauthorized refreshes so concurrent callers share the completed refresh.
- Allow executor credentials to retry when the parent has already supplied a valid replacement.
- Keep connection authentication, refresh, and retry within the original connection deadline.
## Testing
Add coverage for concurrent refreshes, stored and parent-supplied credential rotation, refresh failures, retry limits, and connection deadlines, plus a CLI integration test for refresh and credential reload in a running executor.
GitOrigin-RevId: 9ed533e410762c7ac8b7c0c30bb93fd20d96778b
## What changed
- Store `logs_2.sqlite` in `log_dir` when explicitly configured, unless a managed `sqlite_home` requirement applies. Keep other databases in `sqlite_home` and preserve the existing SQLite log location when `log_dir` is unset.
- Initialize and lock the selected log directory only when opening its database, so an unavailable directory does not prevent authentication commands from loading configuration. Share the cleanup lock across configuration clones and allow failed initialization to be retried.
- Leave existing logs in place. Read legacy logs for diagnostic submissions when the current query returns no logs, attaching them as `codex-logs-legacy.log`. Continue retention cleanup and page reclamation for both locations, with independent maintenance locks and filesystem checks.
## Testing
Add coverage for configuration routing and managed requirements, deferred initialization and lock lifetimes, authentication with an unavailable log directory, legacy log attachments, and cleanup of current and legacy databases.
GitOrigin-RevId: 48216694596d738eff1b3c5eef6c4e7ada6d0137
## What changed
Add `codex migrate-nfs-db` to replace configured SQLite WAL databases in place with validated copies in `DELETE` journal mode, retaining the originals and their sidecar files in backup directories. Stage conversion locally, check database integrity before installation, and support resuming an interrupted replacement.
Require confirmation and exclusive access, with all Codex instances stopped on every host until migration succeeds. The NFS mount must support cross-client POSIX locks. Reject unsupported file permissions and ACLs, and serialize migrations with a migration lock.
Support configuration overrides, `--profile`, and `--staging-dir`. Skip the logs database when `log_dir` is explicitly configured and leave databases already in `DELETE` mode unchanged. Reject remote mode.
GitOrigin-RevId: 7b48cc3a713113a3c09a2243e49b54258bef609d
## Why
`message_board_tools` always exposed all nine discussion tools. Consumers need a way to expose a subset, such as `read_thread` and `list_threads`, over the same board.
## What changed
Accept an ordered slice of the new `MessageBoardTool` enum and optional description overrides in `message_board_tools`. Use the enum for schemas and dispatch, and keep the agent extension's existing tool set and order through `MessageBoardTool::DISCUSSION`.
## Testing
Extend the local-board integration test to verify that a reader-only selection exposes exactly the requested tools in the supplied order and reads the existing discussion.
GitOrigin-RevId: 60026d73768330ff4b694c3a9e99480e3ed7af27
## Why
Local message boards use a fixed database filename. Callers need separate storage for boards that share a session identity.
## What changed
- Add `LocalBoardOptions` with a validated `storage_namespace`, and support it when opening, configuring, and permanently deleting boards.
- Allow `LocalBoard::with_options` to select storage for its connections.
- Store custom namespaces in `message_board_<namespace>_1.sqlite`, while preserving `agent_message_board_1.sqlite` for the default namespace.
- Have the agent message board extension select the same namespace for opening, setup, and deletion.
## Testing
Add coverage for namespace isolation, reopening saved posts, and avoiding collisions with other runtime databases. Update setup tests to exercise a custom namespace through reopening and deletion.
GitOrigin-RevId: a6ea8d171809625edeedc3a8ac3ee2e1bbf1682a
## What changed
Move the message-board API, types, permissions, storage backends, and tool implementations into the new `codex-message-board` crate. Keep extension registration in `codex-agent-message-board-extension`, and update core and the remote client to use the shared crate directly.
Move the existing board tests with the implementation and add the crate to the Cargo workspace and Bazel build.
GitOrigin-RevId: 33ce527c2bef7f862eba55cb9b32222902ccf4ad
## Why
Mailbox preemption can discard completed response items and lose the response ID needed for incremental continuation. Buffered tool calls must also wait for queued agent messages to be read.
## What changed
- Gracefully interrupt and drain Responses Lite streams, retaining completed items and the response ID for the next request.
- Cancel buffered tool calls before dispatch and suppress partial items that may be discarded during the drain.
- Keep user steering queued until draining finishes. Include pending mail in follow-up requests after disconnects and preserve content-filter recovery guidance.
## Testing
Add WebSocket regression coverage for buffered completion, interrupts without acknowledgement, buffered tools and partial items, user steering during draining, disconnects, and content-filter recovery.
GitOrigin-RevId: c9d3fb87a81850e5686e07f28103e2ff4378ddec
## Why
Failed cloud discovery previously retried before each model step. Apply a cooldown across steps and turns to avoid repeated discovery requests while a provider remains unavailable.
## What changed
- Share per-thread retry backoff logic between cloud skill and plugin catalogs, starting at 30 seconds and doubling to a maximum of 5 minutes.
- Scope cooldowns to authentication and MCP resource generations so account changes and reconnects permit immediate recovery.
- Clear backoff after successful discovery or configuration resets, while allowing cancelled refreshes to retry immediately.
## Testing
Update lifecycle and concurrency tests to cover shared cooldowns, reconnect recovery, and cancellation. Use paused time to verify exponential delays, the 5-minute cap, and backoff across turns.
GitOrigin-RevId: 30dab5ceba51e8ad64c0794c1729719e99f577ce
Adam Perry @ OpenAI