## Why
Managed command policies need to require a human decision independently of automatic review, hook allowances, and saved approvals.
## What changed
- Support `decision = "prompt-user"` in managed `requirements.toml` prefix rules, requiring a fresh, one-time human decision for matching commands.
- Add experimental `humanCommand` approval requests for clients advertising both `experimentalApi` and `requiredHumanApproval`. Accept only `accept`, `decline`, or `cancel`; reject commands when no capable client is available.
- Restrict responses to capable clients that received the request, and replay pending prompts to compatible clients on reconnect.
- Enable the capability in the TUI and update protocol schemas and client bindings.
## Testing
Add coverage for fresh decisions overriding saved allowances, hook allowances, and automatic review, plus child-thread approval routing and rejection of responses from incompatible or unrelated clients.
GitOrigin-RevId: 0b95ff6aab7f8a04b7298c8a4329d1fddf6a603e
## Why
Guardian review needs the original function-call metadata even when the call is no longer in live conversation history. Looking it up in history can lose the evidence needed to review encrypted multi-agent messages.
## What changed
Capture native-review policy in the tool registry and retain the original call through dispatch for multi-agent tools that require review. Use that retained call for Guardian review, applying hook-rewritten arguments while preserving encrypted-argument metadata and clearing stale replay content. Limit `ToolCall` debug output to the tool name and call ID.
## Testing
Add coverage for selective call retention across review settings and namespaces. Extend Guardian tests to cover calls absent from live history and hook rewrites that preserve call identity and encrypted-argument metadata across incremental reviews.
GitOrigin-RevId: 0e49833741c09c29228440bddd2e12695ae99583
## What changed
Add `otel.log_sse_deltas`, enabled by default. Setting it to `false` suppresses successful SSE event logs whose kind ends in `.delta` while preserving errors, completion events, and metrics.
Apply the setting to session and memory telemetry, support managed requirements, and expose it in the app-server configuration requirements API and generated schemas and bindings.
## Testing
Add coverage for delta log suppression with errors, completion logs, event counts, and duration metrics preserved. Extend configuration and app-server tests to cover defaults, overrides, and managed requirements.
GitOrigin-RevId: 751c7f357c41f51848b025c838246a733eb92e2f
## What changed
Add `CodexThread::guardian_review` to assess the final injected `exec_command` call against recorded history without executing the command. Reuse command preparation and approval policy, returning the call ID and an optional assessment when approval is required.
Reject active threads, unsupported calls, commands intercepted by `apply_patch`, and histories containing `request_permissions`. Honor cancellation and the configured review timeout.
## Testing
Add a scenario test and request snapshot verifying that direct review matches live Guardian input, leaves commands unexecuted, skips assessment for explicitly allowed commands, and rejects trailing tool output and recorded permission grants.
GitOrigin-RevId: 704f8dc77bbb991c231fce03cfda1c238c4e0b02
## What changed
Allow `refresh_mcp_config` to replace explicit session `plugins` overrides while preserving other session overrides and user settings. Omitting session plugins retains the current overrides; supplying an empty map clears them and restores inheritance from lower configuration layers.
## Testing
Add coverage for replacing and clearing plugin overrides, preserving unrelated settings, rejecting stale refreshes, revoking and restoring plugin tools and hooks, and retaining refreshed plugin policy when a deferred executor becomes ready.
GitOrigin-RevId: 26913fac0f8ae9590b39bdc037a78c9be86abb67
## Why
A transient environment startup failure persisted across turns when the selected environment and workspace were unchanged, preventing commands from recovering after the executor became available.
## What changed
Retry failed environment resolution at the start of a new turn when the error is retryable and the workspace remains selected. Reuse healthy or pending resolutions and preserve provisioning failures until the selection is updated.
## Testing
Add coverage for command execution recovering on an unchanged next turn after endpoint availability is restored. Extend provisioning failure tests to verify that subsequent turns receive the original error without restarting resolution.
GitOrigin-RevId: b80af60990f30d277804160c9c39c286024c7667
## What changed
- Add the disabled-by-default `interrupt_on_cancel` feature to interrupt upstream inference when a Responses Lite turn is canceled, with a one-second cleanup deadline.
- Detach canceled WebSocket responses so replacement requests can open a new connection without waiting for cleanup.
- Add an optional `interrupt_on_cancel` override for thread samples, inheriting the parent setting when omitted.
## Testing
Add coverage for cancellation during inference and steering, replacement turns proceeding before cleanup finishes, and prompt cancellation of model response interceptors.
GitOrigin-RevId: 501368746fc04fd3fdbd45c1f34c75ce57f4e955
## Why
Resuming or forking a thread loses the session flag indicating that reported token usage already includes retained reasoning. Counting that reasoning again can trigger automatic compaction too early.
## What changed
Persist `last_usage_includes_reasoning` with `TokenUsageInfo` and use it when estimating context usage. Record the flag with completed sampling and compaction usage, and mark local estimates as including reasoning. Older records without the field retain the existing accounting behavior.
## Testing
Add coverage for saved inclusive, exclusive, and legacy token counts. Extend the encrypted-reasoning compaction test to verify the compaction threshold for live, forked, and cold-resumed threads.
GitOrigin-RevId: 9f22262a693111ec0406dce11804eb4844ad8983
## Why
Stopping a sideband observer should close its WebSocket while preserving the frontend-owned realtime session. The existing frameless session close also sends `session.close`, so observer shutdown needs a transport-only close.
## What changed
- Add `close_transport()` to send a normal WebSocket close without `session.close`.
- Close the sideband transport on cancellation or when the call becomes inactive, including an existing connection awaiting adoption by the input task. Bound the close attempt to five seconds.
- Thread an optional sideband base URL through realtime start processing and allow nested thread ID fields in request serialization scopes.
## Testing
Add WebSocket and core conversation regression tests covering observer detachment for both realtime parsers and conversation versions. Verify that explicit frameless session close still sends `session.close`.
GitOrigin-RevId: 874a8980b0fcd45058e976b00c0d968f5b4b2404
## Why
When `codex-auto-review` is missing from the model catalog, Guardian falls back to the parent model. Refresh the catalog before accepting that fallback so reviews and checkpoint compatibility checks can use the default reviewer when it becomes available.
## What changed
- Share one refresh attempt per parent session, preserving it across cancelled waiters and retaining the parent fallback if recovery fails.
- Respect explicit reviewer overrides and custom catalogs, and skip recovery for basic sessions.
- Resolve reviewers from the in-memory catalog so a failed disk cache write does not discard a recovered reviewer.
- Apply review deadlines and cancellation to configuration setup, and avoid reviewer resolution during history replay unless checkpoint compatibility requires it.
## Testing
Add coverage for recovery, failed fetches and cache writes, overrides and custom catalogs, checkpoint compatibility, cancelled prewarming, review deadlines, and interruption.
GitOrigin-RevId: 87ae285713afde518a12bc2daba006a043b13bc5
## Why
Automatic gRPC reconnection could spawn a replacement host while dispatching an RPC for an existing session. Host loss must remain visible so recovery can report lost state without replaying execution or completed external effects.
## What changed
- Bind each local host channel to one child process and allow only `OpenSession` to replace a dead host.
- Add caller-owned transport support to `GrpcCodeModeSessionProvider` and map local transport failures to `Unavailable` so initial connection failures use the existing bounded admission retries.
## Testing
Add regression coverage for child exit during initial connection and between channel selection and dispatch, concurrent session recovery, and child reaping after teardown. An integration test kills the host after a command completes and verifies that recovery reports the reset, clears stored state, and leaves the command's external effect unchanged.
Increase the remote MCP stalled-handshake test's initialization timeout and mock response delay to let requests reach the server on loaded CI workers.
GitOrigin-RevId: 4ffd810e4cfcfb7a56e606816aa867bc206a09b6
## Why
A bundled reviewer entry does not establish that a custom gateway offers that model. Guardian should fall back to the parent model when the reviewer is neither advertised by the provider nor explicitly configured.
## What changed
Track model metadata origins as `Bundled`, `Provider`, or `ExplicitConfig`, including across catalog merges and cache reloads. Exclude bundled entries from Guardian reviewer selection unless `auto_review_model_override` is set. Continue selecting reviewers from provider and explicitly configured catalogs.
## Testing
Add coverage for gateway reviewer selection with each catalog origin, plus origin tracking across cache reloads, empty provider responses, and authentication changes.
GitOrigin-RevId: f8bf865d406e56ee0ade90087b55f2e33b98181e
## Why
Guardian's `write_stdin` approval requests lacked the command used to launch the receiving terminal, leaving reviews without that context.
## What changed
- Carry `original_command` from the terminal's launch command into the approval request and Guardian action JSON. This describes the original launch, not the terminal's current state.
- Exclude `original_command` from the 8,000-byte stdin approval size check so launch context does not consume the budget for input, permission details, and the approval reason. Launch context remains subject to Guardian's normal request budget.
## Testing
Extend serialization coverage to check `original_command` and the strict stdin review integration test to verify that a launch command longer than 8,000 bytes reaches Guardian intact.
GitOrigin-RevId: cc765a6bf80d080baf94c959eafa6227b2889e1f
## What changed
Decode `response.metadata` Guardian assessments into typed `GuardianAssessment` events over SSE and WebSocket, carrying `response_id`, `item_id`, and `requires_review`. Ignore assessments with missing, empty, or incorrectly typed required fields while preserving independent delivery of other metadata.
Expose the assessment type to request-scoped extension interceptors. Keep assessments out of conversation history; they do not authorize tool execution.
## Testing
Add SSE coverage for assessment ordering, malformed metadata, and mixed metadata delivery. Extend model request tests to cover SSE and WebSocket interceptor delivery and exclusion from subsequent model input.
GitOrigin-RevId: 282b8817ee97346d76b40bcb412eef023df60ff1
Remove `[features.guardianv2].free_guardian` setup and test parameters
from the Guardian review suite, along with redundant opt-in cases.
Retain coverage for authentication-dependent requests, HTTP fallback,
and session prewarming and reuse without explicitly setting the flag.
GitOrigin-RevId: ba1f985ae2f7f0e0b0c8b32cb47ac9993cbb43f2
## Why
`ShutdownComplete` can arrive before detached task cleanup records and exports `codex.turn_profile` events, causing the turn phase trace test to read incomplete profile counts.
## What changed
Poll exported spans until the expected number of profiles is available, with a 10-second timeout, before asserting sampling request and retry counts for reply and interrupt cases.
GitOrigin-RevId: 43cdcdde71bbcd16ed2e6c8b2accaa2a5de03001
## Why
Legacy notifications only need user text, but retaining the full sampling input keeps image and audio payloads alive while the response streams.
## What changed
Extract notification text from the first request attempt only when `notify` is configured, and retain those strings across retries. Consume and drop the prompt after setting up the response stream, excluding attachments and media wrapper labels from notification text.
## Testing
Extend the notification integration test to verify that `input-messages` contains only user text while the model request still includes image and audio attachments.
GitOrigin-RevId: af4653c0e7ac2bf7006f5ae5a82a3e724c30c734
## Why
Model catalog refreshes need to use the same registered actor and credential owner as model requests when runtime authentication is enabled.
## What changed
- Add `ProviderAuthContext` to carry credentials and optional runtime authentication into model providers and catalog clients.
- Select runtime authentication independently for inference and catalog destinations. Reject unsupported OpenAI origins while preserving provider authentication for other destinations.
- Include API organization and project selectors in runtime registration. Reuse registered runtimes across projects within an organization and replace them when the organization changes.
- Preserve transport restrictions and account bindings, and strip sensitive headers on cross-origin redirects.
- Apply the catalog timeout to authentication and fetching while allowing credential refresh and registration to finish safely.
## Testing
Add coverage for runtime-authenticated catalogs, provider isolation, resource selection, gateway authentication, cross-origin redirects, and timeout recovery that preserves registration and refreshed tokens.
GitOrigin-RevId: c14f1a02159031ea0af1f9b26ea890f8dca7d6ad
## What changed
- Add `permissions.approved_command_prefix_saved` to model messages and use valid plain-text headings in saved-prefix notices, with or without full permissions instructions. Reject empty, oversized, control-character, and markup-like headings.
- Keep `Approved command prefix saved:` as the leading marker for older clients and recognize saved-prefix content kinds when trimming rolled-back context.
- Shut down analytics test exporters asynchronously and serialize workspace-switching tests that share authentication environment state.
## Testing
Extend coverage for heading validation, sparse wire values, single-notice emission, rollback with and without metadata, and saved-prefix behavior across model switches.
GitOrigin-RevId: a70175deca64a6339abac2fa69af970f470e3f4f
## What changed
- Add `CodexThread::create_child` to create an idle child from a live tool invocation using a host-reserved thread ID and controller.
- Add `prepare_child` and `ThreadManager::create_prepared_child` to capture inherited settings and fresh or forked history, then start the child on another manager even after the parent shuts down. Reject detached preparation when live bindings cannot be transferred.
- Add opt-in `HostToolInvocationLookup` to track live calls and reject duplicate active call IDs within a turn. Revoke invocation access when dispatch ends and clean up provisional children when startup fails or is cancelled.
## Testing
Add tests for invocation lifetime and call ID reservation, inherited policy and live bindings, detached startup with fresh and full history, and cancellation cleanup.
GitOrigin-RevId: 71f17ecb4cd7636517e675df59289a8e8c7105b8
## Why
Image files can become unavailable between turns. Model requests should reflect their current availability while preserving the original references in saved history.
## What changed
- Add opt-in availability checks through `AttachmentStore::is_resolvable`, retaining references by default and on backend or access errors.
- Check distinct file IDs concurrently for each prepared request and replace confirmed-missing images with `[image unavailable]` in messages and tool outputs.
- Apply the same handling to compaction requests, with background image checks running outside the session lock without delaying foreground turn completion.
## Testing
Add unit tests and multi-turn scenarios covering placeholders, preserved history and annotations, concurrent deduplicated checks, backend errors, and nonblocking background compaction.
GitOrigin-RevId: ec98c7014c6e6b5063d87b943d2cd66a9ce7c1e3
## What changed
Add optional `request_permissions` and `auto_review_suffix` fields to catalog approval messages. Use them to customize the permission tool heading and introduce automatic review guidance while preserving the bundled instruction bodies and existing policy gates. Accept `request_permissions_tool` as a deserialization alias.
Limit headings to 500 UTF-8 bytes on a single line and fall back to bundled text for missing or invalid values. Complete catalog approval messages retain precedence.
## Testing
Add coverage for heading validation, serialization aliases, policy gates, fallback behavior, and complete-message precedence. Integration tests verify that model switches append the selected model's headings without rewriting history or repeating unchanged instructions.
GitOrigin-RevId: 3311591a464cc086783fe25271a352dd5a229790
## What changed
- Add `ConnectorRuntimeManager::without_shared_snapshot()` to keep connector catalogs local to each client and disable disk caching.
- Use the thread's own Apps discovery when snapshot sharing is disabled, preserving its catalog across turns.
- Expose `apps_tools_from_mcp_client()` to read a ready, unshared Apps client's tools without starting or waiting for discovery.
## Testing
Extend coverage for shared-cache eligibility and verify that an unshared thread waits for its own Apps discovery and uses its own tools on successive model requests, even when a peer finishes discovery first.
GitOrigin-RevId: d57ddacaede047e67c09d378c86c1aa3577ca56f
## What changed
Allow `model_catalog_url` under `[model_providers.openai]` while preserving the built-in provider's identity, authentication, and inference routing through `openai_base_url`. Reject other non-default overrides and require an HTTPS catalog URL on an allowed ChatGPT host, without embedded credentials.
Apply the same catalog override merging when checking managed provider requirements for existing threads, preserving each thread's inference endpoint even if user defaults change.
Document the required Codex catalog format, credential forwarding, and existing discovery and access restrictions.
## Testing
Add coverage for allowed and rejected catalog destinations, preservation of built-in provider settings, and managed requirement changes. Add integration coverage for API key and ChatGPT authentication that verifies separate catalog and inference routing.
GitOrigin-RevId: 4d91ada518ebd2a09cbf6ded0ddf4b11c92b77dd
## What changed
Add `CodexThread::replace_dynamic_tools` to replace the tool catalog without starting a turn. Updates apply to subsequent model steps and future turns while preserving in-flight calls; an empty list clears the catalog.
Require host opt-in through `allow_persistent_dynamic_tool_updates` for persistent threads. Persist replacements before publishing them, restore the latest catalog on resume, and preserve replacements and explicit clears through compaction. Keep explicit resume overrides separate from the persisted catalog.
## Testing
Add coverage for pending calls during replacement, replacement and clearing across restart, compaction recovery, resume overrides, submission ordering after caller cancellation, host opt-in, and persistence failures.
GitOrigin-RevId: fd2634906895a9b72ae7892ddd9435dced45eccb
## What changed
Expose `literature_search_query` in standalone `web.run` when the active model lists it in `experimental_supported_tools`. Support query text, domain filters, and recency filters, and reject literature search calls for models without the capability.
Pass the active model information to extensions for each step and report literature queries as search actions in web search events.
## Testing
Add coverage for capability rejection, model-dependent schema exposure, app-server round trips with a turn-level model override, and a scenario that searches for a paper and opens the returned reference.
GitOrigin-RevId: 87ef1fadd80ca7bfc2a7642c4e443f9b9f2e0e00
## What changed
Add optional `TurnInputRequest.user_item_uuid` and carry it through turn starts and steering to the recorded user message. When supplied, use `msg_input_<uuid>` as the Responses item ID; inputs without a UUID retain generated IDs. Raw response items ignore this field.
Add `ResponseItemId` helpers to construct and recognize the reserved `msg_input_` namespace.
## Testing
Add regression coverage for steered inputs with identical text and client IDs, checking that each supplied UUID survives recording and UI item IDs remain distinct. Add a scenario test verifying that the assigned ID reaches Responses and persists in subsequent request history alongside an identical ordinary prompt.
GitOrigin-RevId: 440e306bfdaa7facb69b21930c5244a83db2fdae
## What changed
Add the disabled-by-default `omit_skill_descriptions` feature flag to omit descriptions from model-visible host, executor, and cloud skill catalogs while retaining names and locators. Adapt catalog introductions, usage instructions, and alias budget accounting to the selected policy.
Persist the description policy in catalog snapshots and refresh usage instructions when it changes. Ignore description-only edits in catalog deltas while descriptions are omitted.
## Testing
Add coverage for alias token budgets, policy changes with older snapshots, and suppressed description-only updates. Extend scenario snapshots to cover plugin visibility and catalog deduplication with descriptions omitted.
GitOrigin-RevId: 5bf1dcee8c04059c7a78998affc1efcdef8ec883
## What changed
Extend the incremental Guardian review scenario with historical encrypted `send_message` calls in the default and custom tool namespaces. Add snapshots and assertions that both reviews retain each call and parent reply exactly once, in order, preserving call IDs, namespaces, and encryption metadata with a paired evidence-only output.
Verify that successive reviews reuse the same thread and append to the previous input. The scenarios use mocked ciphertext and decisions to check transport behavior, not backend decryption or authorization outcomes.
GitOrigin-RevId: a0927531b6cdae496fefa2a7f35032f7413807b6
## What changed
Add mock guardian approvals for setup handoffs in `handoff_scenario` when native multi-agent history is enabled. Match only the trailing `function_call_output` so historical handoffs cannot consume the final command's separate denial response.
Require five approval requests with native history enabled and none with it disabled.
GitOrigin-RevId: 7b14c97aa85adc63c4d3bf95014c44831eae1c85
## What changed
Make tool descriptions precede namespace descriptions in Code Mode execution and tool search. Mark `code_mode_tool_description_first` as removed and simplify cached definitions to depend only on the input schema budget.
## Testing
Update Code Mode integration assertions and catalog snapshots to expect tool descriptions before namespace descriptions.
GitOrigin-RevId: 1344d4c264d1d2b18ee0388a064b6813ca81f770
## What changed
- Recognize `policy_capacity_unavailable` in HTTP and streaming API errors and expose it as `policyCapacityUnavailable` through the app-server protocol and generated bindings.
- Display “Policy-restricted capacity is unavailable. Please try again later.” while preserving overload retry behavior based on `Retry-After`.
- Handle the new error in TUI overload rendering, reviewer retries, and error telemetry.
## Testing
Add coverage for HTTP and streaming error classification, retry advice, WebSocket terminal error attribution, protocol serialization, and TUI rendering with and without an upstream message.
GitOrigin-RevId: 1b9536fba1e11cc891dcf689aee35410d82f5412
## What changed
When `GuardianNativeMultiAgentHistory` is enabled, require Guardian review for wrapped Multi-Agent V2 calls to `spawn_agent`, `send_message`, `followup_task`, and `interrupt_agent`.
Include these calls in Guardian's asynchronous native-tool scoring scope, honoring the configured multi-agent namespace and preserving that configuration across overrides.
## Testing
Extend the incremental-review scenario with an encrypted, namespaced `send_message` call. Verify that the encrypted parent reply remains present exactly once in both Guardian reviews and the subsequent agent request, and update the snapshot to cover native tool-call review evidence.
GitOrigin-RevId: 2af9561b0d69af4a8f878fa32365ce845368e02d
## Why
Native multi-agent calls must stay intact for backend decryption during Guardian review.
## What changed
When `guardian_native_multi_agent_history` is enabled for multi-agent v2, preserve `spawn_agent`, `send_message`, `followup_task`, and `interrupt_agent` function calls in the configured tool namespace as native transcript items. Use `functions` when no namespace is configured.
Include the paired evidence-only output in token accounting, and omit native evidence whole when limits require it.
## Testing
Extend transcript tests to cover native call ordering, paired-output budgeting, and whole-item omission. Add a native-history snapshot alongside the existing text-history delegation handoff scenario.
GitOrigin-RevId: e7d9b4f5ea772890bf14b79fdb53b0f9d0a842e4
## Why
Custom OpenAI base URLs caused Codex backend authentication to lose Responses headers and Guardian metadata when the URL did not match a recognized backend route.
## What changed
Apply model-scoped Responses headers, Guardian reviewer and classifier markers, and eligible ChatGPT parent credit requests based on the OpenAI provider and authentication configuration, regardless of the base URL. Keep API-key requests and other providers excluded from this behavior.
## Testing
Extend coverage for custom `/v1` URLs and direct `/api/codex` endpoints with ChatGPT, header-based, and API-key authentication, including HTTP fallback and WebSocket requests.
GitOrigin-RevId: cc4bb5b4a1a6596904ecf8965237c7a4f09e112b
## Why
Verified answers omitted because of request-size limits must be marked as missing. Legacy checkpoint messages also need to match retained excerpts after truncation so workers receive only one copy.
## What changed
Move root message preparation into `codex-guardian-context::prepare_root_context`, including handoff selection, shared message limits, legacy matching, and incomplete-context markers. Pass original legacy text into preparation and mark verified answers incomplete when oversized records are excluded.
## Testing
Add a handoff regression scenario for an ID-less checkpoint with a retained excerpt and an oversized verified answer. Assert that the worker receives one capped user message, both incomplete-evidence markers, and an incomplete authorization version.
GitOrigin-RevId: bd3f5fe164ae2fddba440e9269fd63b52e8b12f8
## What changed
- Replace Rust `1.99.1` pins with `1.95.0` across Cargo, Bazel, CI, release workflows, and Windows setup, and update the Bazel lockfile.
- Adjust Rust APIs, borrowing, and lint-related code for the pinned toolchain, and box MCP tool dispatch to bound compiler async-layout query depth.
- Update the halfwidth sound mark snapshot and allow optional symbol hash suffixes in the code mode host package smoke test.
GitOrigin-RevId: 75460c3d0465dc601811e619bce373a4f7ff2912
## What changed
Add optional `approvals.granular` catalog fields for the policy introduction and prompted and rejected category lists. Preserve template strings verbatim in `GranularApprovalMessages`, leaving validation and rendering to consumers.
Document the 500-byte template limit, required `{{ policy }}` and `{{ categories }}` markers, and fallback rules.
## Testing
Extend serialization tests to cover null, empty, and populated granular templates, and verify their preservation through model responses and base instruction overrides.
GitOrigin-RevId: ce32e41a9b37e2e7c45ac9b079708a640c99326c
## What changed
Add the `features.simplified_selection_hints` flag, disabled by default. When enabled, replace detailed plugin capability instructions with a concise developer message identifying the selected plugin and directing the model to use its available skills and tools.
Continue omitting hints for plugins without available capabilities and bounding hint length. Preserve the existing detailed instructions when the flag is disabled.
## Testing
Cover plugin refresh in an existing thread with the flag enabled and disabled. Verify that explicit skill prompts precede the simplified plugin hint and that the hint uses the developer role.
GitOrigin-RevId: 64fc3347bd49fffe675f343a4733ced1b4e5e88c
## Why
Rust formatting should include source files that Cargo cannot discover, while keeping command lines within Windows limits.
## What changed
- Update `scripts/format.py` to discover tracked and non-ignored untracked Rust files with Git and invoke `rustfmt` in batches of 64 files. Use the workspace configuration and skip recursive child-module formatting.
- Pass `SystemDrive` and `LOCALAPPDATA` to Windows Bazel tests.
- Extend the spelling allowlist, remove a manifest feature exception, and clean up an unused import, an empty MCP scenario module, and its snapshot.
GitOrigin-RevId: c0d625fda9290ead6a63919325d65f7352abfa40
## What changed
Allow omitting `gateway_oauth.delivery` to send the gateway token as `Authorization: Bearer …`. Custom headers and cookies remain available when a provider also needs its own credentials.
Reject conflicting provider authentication and duplicate delivery headers with actionable errors. For gateway bearer delivery, require `model_catalog_url` to share the scheme, host, and port of `base_url`. Consistently reject request header collisions across auth application methods.
## Testing
Add coverage for omitted delivery, provider credential conflicts, and model catalog origin validation. Update inference tests to verify gateway-only authentication while signed in and combined ChatGPT and gateway credentials in separate headers.
GitOrigin-RevId: 8564d3998511b3f6c55f3b65a01ed9056a90417e
## What changed
- Add `gpt-6.1-terra` to the bundled catalog and GCP Vertex model picker.
- Add `openai.gpt-6.1-terra` to Amazon Bedrock catalogs, including Global and US cross-region runtime variants.
- Use `gpt-6.1-terra` as GCP's preferred memory consolidation model.
## Testing
Extend catalog, model picker, thread startup, and Vertex request tests to cover GPT-6.1 Terra.
GitOrigin-RevId: edb3be3c4286c191349cdee742005ed3c67029e8
## What changed
Keep inherited incremental tool declarations in MCP-disabled prediction forks and `thread/sample` requests, and append a developer notice that MCP tools are unavailable. Skip tool declaration updates within the inherited context window; new windows still declare the current tools.
Add the default-enabled `prediction_preserve_parent_tools` feature flag and its configuration schema entries.
## Testing
Update core snapshots and app-server tests to cover inherited declarations, the MCP-unavailable notice, preservation across MCP refresh, and continued parent tool availability.
GitOrigin-RevId: 3adf96c7d0e0093986dbdbd540bd47674a2c105c
## What changed
Accept `[network_proxy]` in `requirements.toml`, retaining `[experimental_network]` as a compatibility alias. Reject both names in a single layer and normalize them before merging across layers so precedence and source tracking are preserved.
Honor the new spelling during credential broker project discovery, display `network_proxy` in debug configuration, and update diagnostics and documentation. Document the distinction between managed requirements, proxy feature configuration, and permission profiles. Policy publishers must keep using `[experimental_network]` until all clients and policy validation layers support the new spelling.
## Testing
Add coverage for alias equivalence, duplicate rejection, cross-layer precedence and sources, and broker project discovery. Exercise both spellings in proxy configuration, network approval routing, app-server requirements responses, and Windows machine policy validation.
GitOrigin-RevId: 5c5bb82bd4b6b1431aa97f27248775820eae6302
## What changed
When `features.untrusted_as_tool_output` is enabled, emit untrusted additional context as `function_call_output` items in the `agent` namespace before user input. Use the explicit context name when supplied; otherwise derive a bounded name from the source key, falling back to `untrusted_content`.
Deduplicate these outputs by name and truncated value so name changes are emitted while changes confined to truncated content are ignored. Application context remains in developer messages, and disabling the feature preserves the existing message format.
## Testing
Extend core and app-server tests and add request-history snapshots covering both formats, turn start and steering, derived names, truncation, and deduplication.
GitOrigin-RevId: cd5e2f4b3121714acb7f4baf5607f3c27d408cae
## What changed
Add `WorldStateSectionContribution::with_window_prefix()` to render extension developer fragments as separate messages before retained history when building a context window, including after compaction. Updates within an existing window still append to history. Ignore fragments with other roles for sections that opt in.
## Testing
Add a unit test for prefix placement and duplicate avoidance, plus local and remote compaction scenarios covering live updates, persisted replacement history, and rejection of non-developer fragments.
GitOrigin-RevId: 8621457c6eec17f1585ca8e6fa154b1bf3257330
## What changed
Add session options for client- or server-owned output truncation and optional `max_output_tokens` budgets for wait and terminate observations. Introduce `TerminateRequest` and update session implementations and callers to use it.
Extend the stdio and gRPC schemas with optional truncation settings and budgets, and define the `bounded-output-v1` capability. Existing sessions retain client-side truncation; providers reject server mode by default. This change defines the contracts without enabling server-side truncation.
## Testing
Extend protocol serialization coverage for `outputTruncation: "server"` while preserving existing wire shapes when optional fields are absent.
GitOrigin-RevId: 22145897ea16d385c5ba9e7549109f7a669fceb4
## What changed
- Add optional `omitted_paths` and `denied_reads` fields to catalog permission messages. The latter requires exactly one `{{ denied_reads }}` placeholder.
- Preserve mandatory denial and no-bypass warnings, path/glob facts, and existing path selection limits. Limit each override to 500 UTF-8 bytes and fall back independently to bundled wording for invalid overrides.
- Pin `i18n-config` to an upstream revision that removes the unmaintained `basic-toml` dependency, updating Cargo and Bazel lockfiles.
## Testing
Add serialization and rendering coverage for sparse values, invalid templates, byte limits, and preserved policy facts. Extend model-switch scenarios to verify that warning wording follows the selected model while preserving request history and permission annotations.
GitOrigin-RevId: f5fa1a978abe07d90917f552c64e7c8fc257c061
## What changed
- Add the disabled-by-default `skill_catalog_deltas` feature flag to append new and updated skills without repeating unchanged catalog entries.
- Share a cumulative metadata budget across executor, cloud, and host catalogs, preserving usage across turns and resume. Removals emit no update and do not refund budget.
- Rebuild the current catalog and reset its budget after compaction, including any required skill root mappings in updates.
## Testing
Add unit and integration coverage for update costs, shared source budgets, feature rollback, and catalog updates across resume and compaction, with a request-history snapshot.
GitOrigin-RevId: e88b4265d7361498113d43fdc2e0260a9f930bbc
## Why
Tool suggestions loaded and cloned the cached connector directory even when no candidates remained after excluding accessible apps.
## What changed
- Filter out accessible connectors before loading the directory, skipping the lookup when no candidates remain.
- Share cached directory entries through `Arc<[AppInfo]>` and clone only matching entries for suggestions.
- Preserve placeholder suggestions for candidate connectors missing from the directory.
## Testing
Add coverage for skipping directory lookups with no remaining candidates, sharing cached storage, and preserving directory metadata and missing-connector fallbacks while excluding accessible apps, including disabled ones.
GitOrigin-RevId: acaf3e1564fb4e2b4f805cffe1d7db8e40d5fe3d
jif