## Why
Model catalog refreshes need to use the same registered actor and credential owner as model requests when runtime authentication is enabled.
## What changed
- Add `ProviderAuthContext` to carry credentials and optional runtime authentication into model providers and catalog clients.
- Select runtime authentication independently for inference and catalog destinations. Reject unsupported OpenAI origins while preserving provider authentication for other destinations.
- Include API organization and project selectors in runtime registration. Reuse registered runtimes across projects within an organization and replace them when the organization changes.
- Preserve transport restrictions and account bindings, and strip sensitive headers on cross-origin redirects.
- Apply the catalog timeout to authentication and fetching while allowing credential refresh and registration to finish safely.
## Testing
Add coverage for runtime-authenticated catalogs, provider isolation, resource selection, gateway authentication, cross-origin redirects, and timeout recovery that preserves registration and refreshed tokens.
GitOrigin-RevId: c14f1a02159031ea0af1f9b26ea890f8dca7d6ad
## What changed
- Add `permissions.approved_command_prefix_saved` to model messages and use valid plain-text headings in saved-prefix notices, with or without full permissions instructions. Reject empty, oversized, control-character, and markup-like headings.
- Keep `Approved command prefix saved:` as the leading marker for older clients and recognize saved-prefix content kinds when trimming rolled-back context.
- Shut down analytics test exporters asynchronously and serialize workspace-switching tests that share authentication environment state.
## Testing
Extend coverage for heading validation, sparse wire values, single-notice emission, rollback with and without metadata, and saved-prefix behavior across model switches.
GitOrigin-RevId: a70175deca64a6339abac2fa69af970f470e3f4f
## What changed
- Add `CodexThread::create_child` to create an idle child from a live tool invocation using a host-reserved thread ID and controller.
- Add `prepare_child` and `ThreadManager::create_prepared_child` to capture inherited settings and fresh or forked history, then start the child on another manager even after the parent shuts down. Reject detached preparation when live bindings cannot be transferred.
- Add opt-in `HostToolInvocationLookup` to track live calls and reject duplicate active call IDs within a turn. Revoke invocation access when dispatch ends and clean up provisional children when startup fails or is cancelled.
## Testing
Add tests for invocation lifetime and call ID reservation, inherited policy and live bindings, detached startup with fresh and full history, and cancellation cleanup.
GitOrigin-RevId: 71f17ecb4cd7636517e675df59289a8e8c7105b8
## Why
Image files can become unavailable between turns. Model requests should reflect their current availability while preserving the original references in saved history.
## What changed
- Add opt-in availability checks through `AttachmentStore::is_resolvable`, retaining references by default and on backend or access errors.
- Check distinct file IDs concurrently for each prepared request and replace confirmed-missing images with `[image unavailable]` in messages and tool outputs.
- Apply the same handling to compaction requests, with background image checks running outside the session lock without delaying foreground turn completion.
## Testing
Add unit tests and multi-turn scenarios covering placeholders, preserved history and annotations, concurrent deduplicated checks, backend errors, and nonblocking background compaction.
GitOrigin-RevId: ec98c7014c6e6b5063d87b943d2cd66a9ce7c1e3
## What changed
Add optional `request_permissions` and `auto_review_suffix` fields to catalog approval messages. Use them to customize the permission tool heading and introduce automatic review guidance while preserving the bundled instruction bodies and existing policy gates. Accept `request_permissions_tool` as a deserialization alias.
Limit headings to 500 UTF-8 bytes on a single line and fall back to bundled text for missing or invalid values. Complete catalog approval messages retain precedence.
## Testing
Add coverage for heading validation, serialization aliases, policy gates, fallback behavior, and complete-message precedence. Integration tests verify that model switches append the selected model's headings without rewriting history or repeating unchanged instructions.
GitOrigin-RevId: 3311591a464cc086783fe25271a352dd5a229790
## What changed
- Add `ConnectorRuntimeManager::without_shared_snapshot()` to keep connector catalogs local to each client and disable disk caching.
- Use the thread's own Apps discovery when snapshot sharing is disabled, preserving its catalog across turns.
- Expose `apps_tools_from_mcp_client()` to read a ready, unshared Apps client's tools without starting or waiting for discovery.
## Testing
Extend coverage for shared-cache eligibility and verify that an unshared thread waits for its own Apps discovery and uses its own tools on successive model requests, even when a peer finishes discovery first.
GitOrigin-RevId: d57ddacaede047e67c09d378c86c1aa3577ca56f
## What changed
Allow `model_catalog_url` under `[model_providers.openai]` while preserving the built-in provider's identity, authentication, and inference routing through `openai_base_url`. Reject other non-default overrides and require an HTTPS catalog URL on an allowed ChatGPT host, without embedded credentials.
Apply the same catalog override merging when checking managed provider requirements for existing threads, preserving each thread's inference endpoint even if user defaults change.
Document the required Codex catalog format, credential forwarding, and existing discovery and access restrictions.
## Testing
Add coverage for allowed and rejected catalog destinations, preservation of built-in provider settings, and managed requirement changes. Add integration coverage for API key and ChatGPT authentication that verifies separate catalog and inference routing.
GitOrigin-RevId: 4d91ada518ebd2a09cbf6ded0ddf4b11c92b77dd
## What changed
Add `CodexThread::replace_dynamic_tools` to replace the tool catalog without starting a turn. Updates apply to subsequent model steps and future turns while preserving in-flight calls; an empty list clears the catalog.
Require host opt-in through `allow_persistent_dynamic_tool_updates` for persistent threads. Persist replacements before publishing them, restore the latest catalog on resume, and preserve replacements and explicit clears through compaction. Keep explicit resume overrides separate from the persisted catalog.
## Testing
Add coverage for pending calls during replacement, replacement and clearing across restart, compaction recovery, resume overrides, submission ordering after caller cancellation, host opt-in, and persistence failures.
GitOrigin-RevId: fd2634906895a9b72ae7892ddd9435dced45eccb
## What changed
Expose `literature_search_query` in standalone `web.run` when the active model lists it in `experimental_supported_tools`. Support query text, domain filters, and recency filters, and reject literature search calls for models without the capability.
Pass the active model information to extensions for each step and report literature queries as search actions in web search events.
## Testing
Add coverage for capability rejection, model-dependent schema exposure, app-server round trips with a turn-level model override, and a scenario that searches for a paper and opens the returned reference.
GitOrigin-RevId: 87ef1fadd80ca7bfc2a7642c4e443f9b9f2e0e00
## What changed
Add optional `TurnInputRequest.user_item_uuid` and carry it through turn starts and steering to the recorded user message. When supplied, use `msg_input_<uuid>` as the Responses item ID; inputs without a UUID retain generated IDs. Raw response items ignore this field.
Add `ResponseItemId` helpers to construct and recognize the reserved `msg_input_` namespace.
## Testing
Add regression coverage for steered inputs with identical text and client IDs, checking that each supplied UUID survives recording and UI item IDs remain distinct. Add a scenario test verifying that the assigned ID reaches Responses and persists in subsequent request history alongside an identical ordinary prompt.
GitOrigin-RevId: 440e306bfdaa7facb69b21930c5244a83db2fdae
## What changed
Add the disabled-by-default `omit_skill_descriptions` feature flag to omit descriptions from model-visible host, executor, and cloud skill catalogs while retaining names and locators. Adapt catalog introductions, usage instructions, and alias budget accounting to the selected policy.
Persist the description policy in catalog snapshots and refresh usage instructions when it changes. Ignore description-only edits in catalog deltas while descriptions are omitted.
## Testing
Add coverage for alias token budgets, policy changes with older snapshots, and suppressed description-only updates. Extend scenario snapshots to cover plugin visibility and catalog deduplication with descriptions omitted.
GitOrigin-RevId: 5bf1dcee8c04059c7a78998affc1efcdef8ec883
## What changed
Extend the incremental Guardian review scenario with historical encrypted `send_message` calls in the default and custom tool namespaces. Add snapshots and assertions that both reviews retain each call and parent reply exactly once, in order, preserving call IDs, namespaces, and encryption metadata with a paired evidence-only output.
Verify that successive reviews reuse the same thread and append to the previous input. The scenarios use mocked ciphertext and decisions to check transport behavior, not backend decryption or authorization outcomes.
GitOrigin-RevId: a0927531b6cdae496fefa2a7f35032f7413807b6
## What changed
Add mock guardian approvals for setup handoffs in `handoff_scenario` when native multi-agent history is enabled. Match only the trailing `function_call_output` so historical handoffs cannot consume the final command's separate denial response.
Require five approval requests with native history enabled and none with it disabled.
GitOrigin-RevId: 7b14c97aa85adc63c4d3bf95014c44831eae1c85
## What changed
Make tool descriptions precede namespace descriptions in Code Mode execution and tool search. Mark `code_mode_tool_description_first` as removed and simplify cached definitions to depend only on the input schema budget.
## Testing
Update Code Mode integration assertions and catalog snapshots to expect tool descriptions before namespace descriptions.
GitOrigin-RevId: 1344d4c264d1d2b18ee0388a064b6813ca81f770
## What changed
- Recognize `policy_capacity_unavailable` in HTTP and streaming API errors and expose it as `policyCapacityUnavailable` through the app-server protocol and generated bindings.
- Display “Policy-restricted capacity is unavailable. Please try again later.” while preserving overload retry behavior based on `Retry-After`.
- Handle the new error in TUI overload rendering, reviewer retries, and error telemetry.
## Testing
Add coverage for HTTP and streaming error classification, retry advice, WebSocket terminal error attribution, protocol serialization, and TUI rendering with and without an upstream message.
GitOrigin-RevId: 1b9536fba1e11cc891dcf689aee35410d82f5412
## What changed
When `GuardianNativeMultiAgentHistory` is enabled, require Guardian review for wrapped Multi-Agent V2 calls to `spawn_agent`, `send_message`, `followup_task`, and `interrupt_agent`.
Include these calls in Guardian's asynchronous native-tool scoring scope, honoring the configured multi-agent namespace and preserving that configuration across overrides.
## Testing
Extend the incremental-review scenario with an encrypted, namespaced `send_message` call. Verify that the encrypted parent reply remains present exactly once in both Guardian reviews and the subsequent agent request, and update the snapshot to cover native tool-call review evidence.
GitOrigin-RevId: 2af9561b0d69af4a8f878fa32365ce845368e02d
## Why
Native multi-agent calls must stay intact for backend decryption during Guardian review.
## What changed
When `guardian_native_multi_agent_history` is enabled for multi-agent v2, preserve `spawn_agent`, `send_message`, `followup_task`, and `interrupt_agent` function calls in the configured tool namespace as native transcript items. Use `functions` when no namespace is configured.
Include the paired evidence-only output in token accounting, and omit native evidence whole when limits require it.
## Testing
Extend transcript tests to cover native call ordering, paired-output budgeting, and whole-item omission. Add a native-history snapshot alongside the existing text-history delegation handoff scenario.
GitOrigin-RevId: e7d9b4f5ea772890bf14b79fdb53b0f9d0a842e4
## Why
Custom OpenAI base URLs caused Codex backend authentication to lose Responses headers and Guardian metadata when the URL did not match a recognized backend route.
## What changed
Apply model-scoped Responses headers, Guardian reviewer and classifier markers, and eligible ChatGPT parent credit requests based on the OpenAI provider and authentication configuration, regardless of the base URL. Keep API-key requests and other providers excluded from this behavior.
## Testing
Extend coverage for custom `/v1` URLs and direct `/api/codex` endpoints with ChatGPT, header-based, and API-key authentication, including HTTP fallback and WebSocket requests.
GitOrigin-RevId: cc4bb5b4a1a6596904ecf8965237c7a4f09e112b
## Why
Verified answers omitted because of request-size limits must be marked as missing. Legacy checkpoint messages also need to match retained excerpts after truncation so workers receive only one copy.
## What changed
Move root message preparation into `codex-guardian-context::prepare_root_context`, including handoff selection, shared message limits, legacy matching, and incomplete-context markers. Pass original legacy text into preparation and mark verified answers incomplete when oversized records are excluded.
## Testing
Add a handoff regression scenario for an ID-less checkpoint with a retained excerpt and an oversized verified answer. Assert that the worker receives one capped user message, both incomplete-evidence markers, and an incomplete authorization version.
GitOrigin-RevId: bd3f5fe164ae2fddba440e9269fd63b52e8b12f8
## What changed
- Replace Rust `1.99.1` pins with `1.95.0` across Cargo, Bazel, CI, release workflows, and Windows setup, and update the Bazel lockfile.
- Adjust Rust APIs, borrowing, and lint-related code for the pinned toolchain, and box MCP tool dispatch to bound compiler async-layout query depth.
- Update the halfwidth sound mark snapshot and allow optional symbol hash suffixes in the code mode host package smoke test.
GitOrigin-RevId: 75460c3d0465dc601811e619bce373a4f7ff2912
## What changed
Add optional `approvals.granular` catalog fields for the policy introduction and prompted and rejected category lists. Preserve template strings verbatim in `GranularApprovalMessages`, leaving validation and rendering to consumers.
Document the 500-byte template limit, required `{{ policy }}` and `{{ categories }}` markers, and fallback rules.
## Testing
Extend serialization tests to cover null, empty, and populated granular templates, and verify their preservation through model responses and base instruction overrides.
GitOrigin-RevId: ce32e41a9b37e2e7c45ac9b079708a640c99326c
## What changed
Add the `features.simplified_selection_hints` flag, disabled by default. When enabled, replace detailed plugin capability instructions with a concise developer message identifying the selected plugin and directing the model to use its available skills and tools.
Continue omitting hints for plugins without available capabilities and bounding hint length. Preserve the existing detailed instructions when the flag is disabled.
## Testing
Cover plugin refresh in an existing thread with the flag enabled and disabled. Verify that explicit skill prompts precede the simplified plugin hint and that the hint uses the developer role.
GitOrigin-RevId: 64fc3347bd49fffe675f343a4733ced1b4e5e88c
## Why
Rust formatting should include source files that Cargo cannot discover, while keeping command lines within Windows limits.
## What changed
- Update `scripts/format.py` to discover tracked and non-ignored untracked Rust files with Git and invoke `rustfmt` in batches of 64 files. Use the workspace configuration and skip recursive child-module formatting.
- Pass `SystemDrive` and `LOCALAPPDATA` to Windows Bazel tests.
- Extend the spelling allowlist, remove a manifest feature exception, and clean up an unused import, an empty MCP scenario module, and its snapshot.
GitOrigin-RevId: c0d625fda9290ead6a63919325d65f7352abfa40
## What changed
Allow omitting `gateway_oauth.delivery` to send the gateway token as `Authorization: Bearer …`. Custom headers and cookies remain available when a provider also needs its own credentials.
Reject conflicting provider authentication and duplicate delivery headers with actionable errors. For gateway bearer delivery, require `model_catalog_url` to share the scheme, host, and port of `base_url`. Consistently reject request header collisions across auth application methods.
## Testing
Add coverage for omitted delivery, provider credential conflicts, and model catalog origin validation. Update inference tests to verify gateway-only authentication while signed in and combined ChatGPT and gateway credentials in separate headers.
GitOrigin-RevId: 8564d3998511b3f6c55f3b65a01ed9056a90417e
## What changed
- Add `gpt-6.1-terra` to the bundled catalog and GCP Vertex model picker.
- Add `openai.gpt-6.1-terra` to Amazon Bedrock catalogs, including Global and US cross-region runtime variants.
- Use `gpt-6.1-terra` as GCP's preferred memory consolidation model.
## Testing
Extend catalog, model picker, thread startup, and Vertex request tests to cover GPT-6.1 Terra.
GitOrigin-RevId: edb3be3c4286c191349cdee742005ed3c67029e8
## What changed
Keep inherited incremental tool declarations in MCP-disabled prediction forks and `thread/sample` requests, and append a developer notice that MCP tools are unavailable. Skip tool declaration updates within the inherited context window; new windows still declare the current tools.
Add the default-enabled `prediction_preserve_parent_tools` feature flag and its configuration schema entries.
## Testing
Update core snapshots and app-server tests to cover inherited declarations, the MCP-unavailable notice, preservation across MCP refresh, and continued parent tool availability.
GitOrigin-RevId: 3adf96c7d0e0093986dbdbd540bd47674a2c105c
## What changed
Accept `[network_proxy]` in `requirements.toml`, retaining `[experimental_network]` as a compatibility alias. Reject both names in a single layer and normalize them before merging across layers so precedence and source tracking are preserved.
Honor the new spelling during credential broker project discovery, display `network_proxy` in debug configuration, and update diagnostics and documentation. Document the distinction between managed requirements, proxy feature configuration, and permission profiles. Policy publishers must keep using `[experimental_network]` until all clients and policy validation layers support the new spelling.
## Testing
Add coverage for alias equivalence, duplicate rejection, cross-layer precedence and sources, and broker project discovery. Exercise both spellings in proxy configuration, network approval routing, app-server requirements responses, and Windows machine policy validation.
GitOrigin-RevId: 5c5bb82bd4b6b1431aa97f27248775820eae6302
## What changed
When `features.untrusted_as_tool_output` is enabled, emit untrusted additional context as `function_call_output` items in the `agent` namespace before user input. Use the explicit context name when supplied; otherwise derive a bounded name from the source key, falling back to `untrusted_content`.
Deduplicate these outputs by name and truncated value so name changes are emitted while changes confined to truncated content are ignored. Application context remains in developer messages, and disabling the feature preserves the existing message format.
## Testing
Extend core and app-server tests and add request-history snapshots covering both formats, turn start and steering, derived names, truncation, and deduplication.
GitOrigin-RevId: cd5e2f4b3121714acb7f4baf5607f3c27d408cae
## What changed
Add `WorldStateSectionContribution::with_window_prefix()` to render extension developer fragments as separate messages before retained history when building a context window, including after compaction. Updates within an existing window still append to history. Ignore fragments with other roles for sections that opt in.
## Testing
Add a unit test for prefix placement and duplicate avoidance, plus local and remote compaction scenarios covering live updates, persisted replacement history, and rejection of non-developer fragments.
GitOrigin-RevId: 8621457c6eec17f1585ca8e6fa154b1bf3257330
## What changed
Add session options for client- or server-owned output truncation and optional `max_output_tokens` budgets for wait and terminate observations. Introduce `TerminateRequest` and update session implementations and callers to use it.
Extend the stdio and gRPC schemas with optional truncation settings and budgets, and define the `bounded-output-v1` capability. Existing sessions retain client-side truncation; providers reject server mode by default. This change defines the contracts without enabling server-side truncation.
## Testing
Extend protocol serialization coverage for `outputTruncation: "server"` while preserving existing wire shapes when optional fields are absent.
GitOrigin-RevId: 22145897ea16d385c5ba9e7549109f7a669fceb4
## What changed
- Add optional `omitted_paths` and `denied_reads` fields to catalog permission messages. The latter requires exactly one `{{ denied_reads }}` placeholder.
- Preserve mandatory denial and no-bypass warnings, path/glob facts, and existing path selection limits. Limit each override to 500 UTF-8 bytes and fall back independently to bundled wording for invalid overrides.
- Pin `i18n-config` to an upstream revision that removes the unmaintained `basic-toml` dependency, updating Cargo and Bazel lockfiles.
## Testing
Add serialization and rendering coverage for sparse values, invalid templates, byte limits, and preserved policy facts. Extend model-switch scenarios to verify that warning wording follows the selected model while preserving request history and permission annotations.
GitOrigin-RevId: f5fa1a978abe07d90917f552c64e7c8fc257c061
## What changed
- Add the disabled-by-default `skill_catalog_deltas` feature flag to append new and updated skills without repeating unchanged catalog entries.
- Share a cumulative metadata budget across executor, cloud, and host catalogs, preserving usage across turns and resume. Removals emit no update and do not refund budget.
- Rebuild the current catalog and reset its budget after compaction, including any required skill root mappings in updates.
## Testing
Add unit and integration coverage for update costs, shared source budgets, feature rollback, and catalog updates across resume and compaction, with a request-history snapshot.
GitOrigin-RevId: e88b4265d7361498113d43fdc2e0260a9f930bbc
## Why
Tool suggestions loaded and cloned the cached connector directory even when no candidates remained after excluding accessible apps.
## What changed
- Filter out accessible connectors before loading the directory, skipping the lookup when no candidates remain.
- Share cached directory entries through `Arc<[AppInfo]>` and clone only matching entries for suggestions.
- Preserve placeholder suggestions for candidate connectors missing from the directory.
## Testing
Add coverage for skipping directory lookups with no remaining candidates, sharing cached storage, and preserving directory metadata and missing-connector fallbacks while excluding accessible apps, including disabled ones.
GitOrigin-RevId: acaf3e1564fb4e2b4f805cffe1d7db8e40d5fe3d
## Why
The context inheritance tests enabled `MultiAgentV2` but invoked `spawn_agent` through the V1 namespace, leaving the V2 path untested.
## What changed
- Share a helper that spawns through the V2 namespace, waits for child completion, and identifies the child's request by its thread ID.
- Assert that the child receives inherited instructions in a `developer` message and its task in an `agent_message` addressed to `/root/worker`.
- Test skill instructions both enabled and disabled for parent and child requests, with an explicit skills extension and discovery isolated to the fixture skill.
GitOrigin-RevId: 193fca57398e950acad1f020382dc1bae6453df4
## What changed
Extend `mcp_connection_sharing` to pool compatible local stdio connections that negotiate MCP `2026-07-28`. Keep legacy servers and servers that request input during startup private.
Preserve each chat's tool catalog and route input requests to the calling chat. Release connections independently for each chat, shutting down the shared server after the final release, and retire pooled connections on forced refresh without interrupting other chats.
## Testing
Add pool, runtime, app-server, and core scenario tests covering protocol gating, startup cancellation, refresh, final-release shutdown, and separate tool visibility and simultaneous input responses across chats sharing one process.
GitOrigin-RevId: 896b107267a20ec1bffccdefca6c40fe2945a022
## Why
Stdio servers without `CODEX_MCP_PROTOCOL_VERSION` use the legacy handshake, even when they support MCP `2026-07-28`.
## What changed
- Add the disabled-by-default `mcp_connection_sharing` feature to enable discovery for eligible local stdio servers.
- Recover from failed or late discovery with a fresh handshake when needed, waiting for the previous helper to release resources before restarting.
- Retain a working legacy connection when an upgrade attempt fails for the same account, except on authentication errors.
- Keep tool catalogs separate by protocol and invalidate legacy catalogs when discovery negotiates the modern protocol.
## Testing
Add regression coverage for failed and late discovery, legacy fallback, protocol-specific catalog reuse, message limits, and Windows descendant cleanup.
GitOrigin-RevId: 36c675ef3b81d32fccf06ccbddda2312cfe602c9
## Why
Automatic reviews and user prompts previously invalidated critical-path captures even when their owning tool invocation was known.
## What changed
Record automatic review time as `auto_review` and waits for approvals, permission requests, and user input as `user_wait` when `CriticalPathTiming` is enabled. Bind timing to the owning invocation before asynchronous work begins, and use the triggering tool's identity for network approvals. Continue invalidating captures when a wait cannot be attributed.
## Testing
Add coverage for cancellation, reused call IDs, network ownership, and disabled capture. Update the automatic review integration test to verify attributed review duration.
GitOrigin-RevId: 0a1f5feebd0c4f5ed67dc058e832ec5f8818db02
## Why
`PermissionRequest` and `PostToolUse` hook inputs could report the turn's working directory instead of the local command's execution directory. This also affected commands whose results were collected in a later turn after the working directory changed.
## What changed
- Report the local command's execution directory in hook input `cwd`, consistent with `PreToolUse`.
- Preserve the original directory through `write_stdin` approvals and delayed completion, including network permission requests.
- Retain the host directory for remote commands and keep hook process working directories unchanged.
## Testing
Add coverage for relative and absolute workdirs, approval denials, command rewrites, completion and stdin approval across turns, remote command fallback, network approvals, and Unix and Windows path formatting.
GitOrigin-RevId: ef5dad2a0634dda9edb2f841ef4fe49ae0d1187d
## What changed
Add the default-disabled `critical_path_timing` feature to capture dependency paths for root-agent turns. Connect direct tool dispatch, execution-lock handoffs, and completed tool batches to turn timing so overlapping work shares its common history without double counting.
Omit captures for unsupported dependencies, including CodeMode, agent communication, approval review, and user waits. Settle aborted tasks before freezing timing, invalidate captures on forced teardown, and apply runtime feature changes only to future turns.
## Testing
Add coverage for serial and overlapping tool dispatch, execution-lock dependency handoffs, cancellation, unsupported paths, frozen timing after completion, and configuration refresh boundaries.
GitOrigin-RevId: 71458b654b1c4a05799886928b449c948ea33109
## Why
`PreToolUse` hooks receive the host working directory even when a local
`exec_command` call specifies a different `workdir`. This prevents hooks from
seeing the directory in which the command will execute.
## What changed
- Share working-directory resolution between command execution and hook input,
using the selected environment and the command's `workdir`.
- Report the resolved local directory in the hook input's `cwd`. Keep hook
processes in the host directory and retain the host `cwd` for remote commands.
- Reject invalid environment selections or paths before running hooks and record
failures in tool-result telemetry.
## Testing
Add unit and integration coverage for default, empty, relative, and absolute
working directories; Windows path conventions; remote commands; hook denial and
input rewriting; and invalid arguments that fail without running hooks.
GitOrigin-RevId: 97f71f6d3e21a5d95a7abf5384f06f4993241797
## Why
Executors older than `0.164.0` can advertise V2 discovery support without implementing the final contract. Enabling V2 also suppressed V1 discovery for incompatible executors, hiding selected capability roots and skills.
## What changed
Require both the V2 capability flag and an executor version of at least `0.164.0` before issuing `capabilities/discoverV2`. Share this compatibility check between session discovery and the exec-server client. Fall back to V1 when incompatible executors provide no V2 snapshots, clearing any previously stored V2 inventory.
## Testing
Add coverage for version boundaries, prereleases, missing and malformed versions, and transport recovery for compatible executors. Verify that an older executor retains selected plugins and skill instructions through V1 with V2 enabled.
GitOrigin-RevId: 93adf52fc91f02b58fd14f8ff3b093712b3346b8
## What changed
Consume local stdout and stderr receivers directly with `tokio::select!`, removing the intermediate broadcast channel and its lag-related chunk skipping. Drain both streams until they close.
Pass `ExecOutputStream` through local and remote output collection to `OutputBuffers::push_chunk`, while retaining combined output buffers.
## Testing
Update output-buffer tests for the stream argument and exercise stderr chunks in pushed-event and replay test fixtures.
GitOrigin-RevId: be7804fd30cefeb812e372454665923ba051ddb4
## What changed
Support `model_providers.gcp.credential_file` as an absolute path to a Google Application Default Credentials (ADC) file. Pass it as `GOOGLE_APPLICATION_CREDENTIALS` in the provider auth command's environment, retaining the override for token refreshes without changing the parent process environment.
Validate the path before merging GCP defaults and preserve the setting in thread configuration serialization.
## Testing
Add coverage for invalid paths, configuration round trips, separate provider token caches, and credential overrides retained after a `401` refresh. Include a Windows regression test for credential paths containing command metacharacters.
GitOrigin-RevId: d9a1d4b3775a9a4c4325dddaa153d92a2d1430a0
## What changed
Add `features.rollout_budget.enforce_limit`, defaulting to `true`. Setting it to `false` keeps shared usage accounting and budget reminders active while allowing turns to continue after the budget is exhausted.
## Testing
Extend coverage to check enforced and advisory budgets on the current and subsequent turns, including a zero-remaining-budget reminder in advisory mode. Verify that configuration defaults to enforcing the limit.
GitOrigin-RevId: deeac8dae5714cc7c10d030cade6f3bfbfc8d3a7
## What changed
- Add an optional `name` to `AdditionalContextEntry` across the protocol, app-server schemas, and generated clients.
- Accept names matching `[a-z][a-z0-9_]{0,63}` only for `untrusted` context. Reject invalid names and names on `application` context before admitting turn input, returning invalid-request errors from `turn/start` and `turn/steer`.
- Preserve existing model-input rendering and deduplicate context when only its name changes.
## Testing
Add coverage for valid name boundaries, callers that omit `name`, invalid-name rejection without admitting input, and deduplication across name changes.
GitOrigin-RevId: 2caffa6fddd40ddb178733b335f520f317239edd
## Why
API keys with FedRAMP issuance markers previously used commercial endpoint defaults without a FedRAMP request header.
## What changed
- Recognize `sk-proj-fedramp-` and `sk-svcacct-fedramp-` prefixes as routing hints and send `X-OpenAI-Fedramp: true`, preserving the complete key for authentication.
- Select `https://gov.api.openai.com/v1` for default OpenAI API routing and `https://gov.chatgpt.com/backend-api/` for default ChatGPT backend requests, including model discovery and analytics.
- Preserve explicit endpoint overrides, including an explicitly configured commercial default URL.
- Resolve provider routing and authentication from the same credential snapshot, and apply key-dependent routing to realtime WebSocket startup.
## Testing
Add regression coverage for prefix recognition, unchanged key storage and authorization, provider credential precedence, endpoint overrides, credential rotation, model discovery, analytics routing, and realtime request preparation.
GitOrigin-RevId: a62576ce205c34e067532b8e6c0e431f87a157e2
## What changed
- Add nullable `startedAtMs` and `completedAtMs` fields to `ThreadItem` in live notifications and turn history. Values are Unix milliseconds when recorded.
- Preserve recorded item times through history reconstruction, pagination, and resume, including command start times recorded during approval.
- Separate the Rust item payload into `ThreadItemPayload` while keeping the JSON payload flat, and update consumers, schemas, and generated TypeScript and Python types.
## Testing
Extend coverage for timestamp serialization, history reconstruction, paginated reads and resume, and persisted Python SDK items.
GitOrigin-RevId: ecbcee95af52db7c807b46a6e9deb30e5fba1f80
## What changed
- Add opt-in runtime authentication through `ModelClient::with_runtime_auth`, requiring the provider and runtime manager to share the selected OpenAI credentials.
- Keep runtime identity, credentials, routing, and transport selection consistent for each request and its retries, signing a fresh assertion for each attempt.
- Apply authentication asynchronously to WebSocket handshakes, replace stale authentication headers, and reconnect when the runtime changes.
- Reject account, organization, or project selectors that conflict with the registered runtime, and preserve gateway OAuth composition.
## Testing
Add coverage for dual-header and assertion-only authentication, HTTP retries, runtime replacement and account switches, stale WebSocket headers, selector mismatches, gateway OAuth failures, transport revocation, and Realtime compatibility.
GitOrigin-RevId: 45b9efc2c80481406a0f6f6396a8cdd21d933c12
## Why
Deriving a Vertex AI endpoint previously required environment variables. Allow the project and location to be specified directly in GCP provider configuration.
## What changed
- Add `model_providers.gcp.project_id` and `model_providers.gcp.location`, with each taking precedence over its corresponding environment variable. Keep `global` as the default location and preserve explicit `base_url` overrides.
- Validate configured endpoint fields and preserve them through thread configuration serialization.
- Apply built-in GCP defaults, including default command authentication, when checking managed provider requirements so unchanged requirements are accepted.
## Testing
Add coverage for endpoint precedence, invalid explicit configuration, provider construction, thread configuration round trips, and managed GCP requirement checks, including repeated model listing.
GitOrigin-RevId: c3704bcc0b7d4872374e2cae623fd24d75fb02b4
## What changed
- Always use the retained conversation backend for asynchronous classification; keep snapshot sampling test-only.
- Accept legacy `async_classifier_mode` values in configuration and model metadata but ignore them. Emit a startup warning when `[features.guardianv2].async_classifier_mode` is configured.
- Ignore legacy classifier mode differences when checking model-switch compatibility, and fail closed if the conversation backend is missing.
## Testing
Update coverage for legacy configuration warnings, model-switch compatibility, retained approval-review context, and conversation-based scoring.
GitOrigin-RevId: 5e8bb7e4e6e7d1589572f38bfe2498c9fa6825a0
cooper-oai