## What changed
Augment managed runtime package registration failures with `appx_event_ids` from error-level events in `Microsoft-Windows-AppXDeploymentServer/Operational` that match the deployment activity ID. Report numeric event IDs in sorted, deduplicated order without including free-form event text.
Skip the lookup when the activity ID is unavailable or zero, and leave the registration result unchanged when event diagnostics are unavailable.
GitOrigin-RevId: 50167f3ffed1d07936594ef4b04f5adf2972be8e
## What changed
- Replace individual JSON payload files with numbered Zstandard shards in trace schema v3. Add `PayloadReader` to resolve payload references, cache decoded shards, and validate payloads during replay.
- Capture exact outgoing HTTP bodies and WebSocket messages alongside prepared prompts. Preserve full formatted context for continuations from unrecorded WebSocket warmups while retaining the actual incremental request.
- Flush payload records before publishing references and seal the final shard before recording completion. Replace `recording_complete` with `recording_status` to distinguish unclosed recordings, closed recordings with partial payloads, and complete recordings.
Reduce trace bundles with the binary that recorded them.
## Testing
Add coverage for shard rotation, oversized records, live reads, cache eviction, and malformed or corrupt payloads. Extend HTTP and WebSocket integration assertions to verify captured requests and prepared prompts, including warmup continuations.
GitOrigin-RevId: 40ce3c11383f48e08f52e7120b706c61a449df9c
## Why
The npm wrapper's spawn fallback stopped forwarding signals after the first one, preventing a second signal from interrupting a child's graceful shutdown.
## What changed
Remove the `child.killed` guard so the wrapper continues forwarding `SIGINT`, `SIGTERM`, and `SIGHUP` until the child exits.
## Testing
Add a regression test that forces the spawn fallback and verifies a running child receives a second `SIGTERM` and its numeric exit status is preserved.
GitOrigin-RevId: be96e784e2e4f419c43a5897d264f55fcdfd625f
## Why
Concurrent Apps startups with equivalent discovery inputs each issue a `tools/list` request even though they share a live tool catalog.
## What changed
Share successful tool listings across overlapping startups in the same discovery scope while keeping each client's MCP connection independent. Later startups and explicit refreshes still fetch from the server.
Include time spent waiting for a shared listing in the configured startup timeout. If a listing fails or is cancelled, let a waiting startup retry using its own connection. Preserve separate catalogs for different scopes and honor servers that opt out of catalog sharing.
## Testing
Add tests for shared startup listings with independent connections, waiting timeouts, cancellation recovery, and catalog isolation across discovery scopes.
GitOrigin-RevId: cb626f6cb9c38e27b3d75a8da55bda584aaef6f4
## What changed
Track whether a thread is being viewed without a live attachment. Hide the status line and context usage for saved history and unavailable conversations, even when token usage updates arrive. Restore these displays when the thread resumes interactively, including sessions using read-only permissions.
Avoid a leading separator before the Vim mode indicator when context usage is hidden.
## Testing
Add regression coverage for history viewing, token updates, and interactive resume. Update unavailable-conversation snapshots to omit the status line.
GitOrigin-RevId: 14dfd2ee0f232001814b7fc45a5ac8a5d755669b
## Why
Saved side chats with `attached_to_thread_id` set could appear as root sessions in the agents overview.
## What changed
Exclude attached threads alongside ephemeral threads when building the overview. Reuse the same root eligibility check for history discovery, pinned threads, and refill accounting so attached threads do not count as overview roots.
## Testing
Extend `shared_overview_shows_only_root_sessions` with a saved side chat attached to a root thread, verifying that it stays out of the overview snapshot.
GitOrigin-RevId: 3417d444cfde7fc034c07ec124ba72cbf64b0ef6
## Why
Resuming another session must keep drafts, queued follow-ups, and interrupted steer retries with their original thread. Submitted input whose delivery is still uncertain must wait for matching receipts before the queue can advance.
## What changed
- Pause submissions while draining outgoing events, then capture input before switching threads or backends.
- Restore saved input through a shared resume path, reconcile receipts from resumed history and buffered events, preserve active-turn state, and dispatch eligible queued input when the resumed thread is idle.
- Preserve whether a draft's leading `!` is literal text or a shell command.
- Reject `!` shell commands in Cloud conversations with an error and clear the pending submission so the next prompt can proceed.
## Testing
Add regression coverage for session round trips with buffered completion and interruption events, receipt reconciliation across read-only and writable resumes, draft shell mode, and submitting a prompt after a rejected Cloud shell command.
GitOrigin-RevId: 9a823a398a371e689b8ae743de494323ae95ef57
## What changed
Capture `codex_app_used_dictation` as per-input metadata, with patches taking precedence over replacements, and remove the key from metadata forwarded to Responses. Record attribution when user-origin input is accepted into turn history.
Add `used_dictation` to turn analytics: report `true` if any accepted input used dictation, `false` only when every accepted input has known non-dictation attribution, and omit the field otherwise.
## Testing
Add coverage for per-input extraction, patch precedence, and turn-level aggregation. Extend the app-server steering test to verify that dictation attribution reaches analytics while the metadata key is excluded from Responses requests.
GitOrigin-RevId: 0a55687a7dd61f00e9b188f89810e52bd941490b
## What changed
- Add the disabled-by-default `catalog_apps_instructions` feature to use the selected model's `model_messages.apps.usage_instructions`, subject to existing Apps availability and model gates.
- Preserve valid catalog text literally, allow an empty string to clear guidance, and fall back to bundled instructions for missing, whitespace-only, or oversized values. Overrides are limited to 800 UTF-8 bytes.
- Reconcile guidance with the latest retained Apps fragment, emitting replacement or removal notices when needed and avoiding repeated updates across resumes. Preserve compatibility with bundled guidance and legacy checkpoints.
- Recognize catalog Apps fragments as contextual developer messages in event mapping and rollout rollback.
## Testing
Add resolver, world-state, client, and scenario coverage for literal text and byte limits, feature and availability gates, model switches, clearing guidance, resumes, and legacy history recovery.
GitOrigin-RevId: 6240d407ada8f22fa101753ff3ddb338632ae283
## What changed
- Add a TUI helper that saves `tui.status_line_provider` to the active local user configuration, supporting `"default"` and MCP server/tool selections.
- Update the app and chat widget selections only after the write succeeds.
- Return an error when `ConfigEdit::SetPath` cannot insert a value at the requested path.
## Testing
Add tests covering active local profile writes during remote sessions, preservation of unrelated settings and configuration files, CLI override reloading, and failed writes that leave the file and live selection unchanged.
GitOrigin-RevId: 08008f58d7a467bb0c9129b7c198b4d224262ff1
## What changed
Add `tui.status_line_provider` to select `"default"` or an MCP provider identified by `server` and `tool`. Replace provider identities as a unit across configuration layers so partial overrides cannot inherit half an identity.
Ignore this setting from project configuration and packaged defaults when computing effective values and origins, while retaining strict validation. Preserve relative path resolution when an ignored provider value is malformed.
Carry the selection into TUI local settings and refresh it on configuration reload. Use the client's configuration home when rebuilding settings for remote sessions.
## Testing
Add coverage for provider precedence, incomplete profile overrides, malformed values and diagnostics, relative path resolution, and local preference preservation when resuming remote sessions.
GitOrigin-RevId: 0777d754d46cf009569ff0c90fd7426f8b7650bf
## What changed
Set `retain: true` on tool outputs submitted when TUI dynamic tools start a turn, requesting retention of delegation prompts in the thread's model history.
## Testing
Update session lifecycle assertions to require `retain: true` for both `create_thread` and `send_message_to_thread` requests.
GitOrigin-RevId: 095d0f6f687a67fbf0b5ffd98539f764d32e2acc
## What changed
Allow Unix workloads to acquire assertions directly from the SPIFFE Workload API for the existing OpenAI token exchange. Select this source with `OPENAI_IDENTITY_TOKEN_SOURCE=spiffe`, alongside `OPENAI_FEDERATION_RULE_ID`, `SPIFFE_ENDPOINT_SOCKET`, and `OPENAI_SPIFFE_AUDIENCE`. Optionally select an identity with `OPENAI_SPIFFE_ID`.
Fetch a JWT-SVID over a Unix socket for each exchange, reconnecting on refresh and bounding acquisition to ten seconds. Reject ambiguous responses and mismatched subject or audience claims, and retain only the gRPC status code from agent errors. Signature and lifetime verification remain the token endpoint's responsibility.
Keep file acquisition as the default, reject conflicting source settings, and exclude the new OpenAI-specific settings from model-launched environments. Document configuration and deployment constraints.
## Testing
Add local-socket tests for token exchange and refresh after agent restart, concurrent refreshes, JWT-SVIDs without key IDs, identity selection, error redaction, and timeouts. Add configuration tests for explicit source selection, invalid or conflicting settings, unsupported platforms, and session consistency.
GitOrigin-RevId: 9d88438ff41cd8f0b7356c512ec451455ed7c399
## Why
The x32 ABI shares the x86-64 audit architecture, so the architecture check alone does not enforce syscall restrictions for x32 callers.
## What changed
Apply existing syscall denials and socket-family conditions to x32 syscall numbers on x86-64, including separate x32 numbers and legacy aliases supported before Linux 5.4.
## Testing
Add probes across all three network seccomp modes to verify that restricted native and x32 calls return `EPERM`, allowed calls preserve their behavior, and socket-family restrictions apply to both ABIs.
GitOrigin-RevId: fa38138d6b6c7b26dfafd6c931880ee1265a1b94
## What changed
- Update the workspace, Bazel toolchain and lockfile, CI and release workflows, and Windows setup script from Rust `1.95.0` to `1.99.1`.
- Adapt Rust code to the updated toolchain and Clippy lints, including `try_update` for atomics, `as_chunks` for fixed-size slices, and targeted allowances for generated tonic services.
- Refresh the halfwidth sound mark rendering snapshot to use literal characters in debug output.
GitOrigin-RevId: 5852029f687436dc814c2bca68141ee1f4a67d49
## What changed
- Store `CodexErr` in a `Box` within `ImageBackendError` while preserving its accessor.
- Terminate `bail!` calls with semicolons in the cloud client and TUI.
- Share a body-prefix length constant across OTLP loopback assertions and remove redundant borrows of diagnostic strings.
GitOrigin-RevId: 40aee7d4d03b17fc8dbd9295e0853c811852c177
## What changed
- Replace `FooterContent` and the separate layout cache with a `StatusLine` that owns native or extension content and caches its layout by bounds.
- Move footer padding into the caller's layout and retain cached wrapping for unchanged agent-labeled status lines.
- Remove extension-to-single-line conversion and render prepared UI trees directly within their allotted rectangles.
## Testing
Extend composer coverage to verify that replacing measured extension content updates the displayed rows. Adapt status-line and UI-tree tests to exercise direct rendering, clipping, hyperlinks, and viewport bounds.
GitOrigin-RevId: 72273c87d689b8b59748ab243793a9e2a45f4884
## Why
Raw trace events and payloads are implementation details of the recording executable. Matching release or schema versions do not establish compatibility with another binary.
## What changed
- Document that bundles must be reduced by the exact executable that recorded them, with `state.json` as the consumer API and `manifest.json` for discovery and identity.
- Require explicit thread IDs on code-cell runtime events and use structured agent-message metadata instead of parsing legacy assistant-message JSON.
- Include expected schema versions and guidance to use the recording executable in schema mismatch errors.
- Update agent-delivery test fixtures to use structured `agent_message` inputs and check manifest schema rejection directly.
GitOrigin-RevId: 67206fa554f1ba9c1bf9bfdad54840b5d86c5a77
## Why
Suspending a locally controlled agent tree must preserve unfinished turns and child results that arrive during teardown so they remain available after recovery.
## What changed
- Add `ThreadManager::suspend_agent_tree` to stop durable trees, close their writers, and return unfinished root and named V2 child turn IDs plus any pending root wake.
- Persist terminal child results before suspension succeeds, including results queued for evicted parents. Report failed or unconfirmed writes.
- Add `load_suspended_agent` to restore named V2 descendants through their recorded ancestors without starting model turns.
- Allow empty `continue_turn_if_idle` input to wake on saved results, guarded by the preceding turn ID. Keep mail queued until task registration so suspension can preserve it.
## Testing
Add coverage for completion and wake races, child errors, parent writer failures, evicted parents, descendant restoration, repeated suspension after caller cancellation, and ephemeral roots remaining active.
GitOrigin-RevId: 3041791f51bff2555210f6b2d2443f9f05f68330
Describe remote board connection settings, host ownership, and configured
clocks in general terms. Update the remote board test credential to match
that terminology.
GitOrigin-RevId: c2c32808c98afad849f6e4f59f75d8d204f51694
## Why
Inline image previews can leave stale pixels in terminal history when streamed output scrolls their rows.
## What changed
Clear retained previews before inserting history that could move them, then let the next frame redraw them while preserving the draft text. Keep direct Kitty previews when standard history insertion scrolls only above an unchanged, bottom-aligned viewport.
## Testing
Add regression coverage for clearing previews before scrolling, preserving unsent draft text, redrawing file-backed previews, and retaining or repainting direct Kitty previews as appropriate.
GitOrigin-RevId: 683d1313349b1ac707499b021092fc390e21530d
## What changed
Stop rebuilding permission profiles through the legacy sandbox policy when only the working directory changes. Preserve the profile, its active selection, and profile workspace roots while updating runtime workspace roots for the new directory.
## Testing
Extend regression coverage to check that directory-only updates preserve the permission profile snapshot and expected thread settings. Verify that workspace-write permissions allow ordinary files in the new workspace while denying writes to `.git/config` and the previous workspace.
GitOrigin-RevId: a4f4b2dc4ffa16cbf33ddb124eed4b759b2aae78
## What changed
Remove `PermissionProfile::from_legacy_sandbox_policy` and the filesystem helpers for materializing workspace roots and adding legacy writable roots. Keep legacy template conversion self-contained and update round-trip tests to use the conversion that accepts a working directory.
## Testing
Update preset tests to compare converted legacy policies, and move extra-root metadata protection coverage to `FileSystemSandboxPolicy::workspace_write`.
GitOrigin-RevId: d545b329c13b2f09609fd2cbf42f0adbbda5386a
## What changed
- Authenticate eligible protected `main` runs and Rust release tags with GitHub OIDC. Allow cache uploads only on `main` pushes; use read-only access for manual runs and release tags, and leave pull requests without GCS credentials.
- Rename the shared wrapper to `.github/scripts/run_bazel.py` and route Bazel callers through it. Disable the disk cache in GitHub Actions and default macOS GCS connections to 20 while respecting explicit limits.
- Gate additional Bazel release artifacts on `CODEX_BAZEL_RELEASES` and cache configuration, sharing the selected build systems across building, signing, and packaging. Keep Cargo as the default and prepare native Windows dependencies for Bazel releases.
- Add a `Bazel result` check for the full workflow and extend Bazel job timeouts.
## Testing
Add wrapper tests for cache access by event, argument preservation, and macOS connection limits. The wrapper test suite passes.
GitOrigin-RevId: d85edbd083acfaa8bafaa8fd5241daed3e9ef871
## Why
Plan items used a single ID derived from the turn ID, so multiple completed plans within one turn shared an ID across retries or tool continuations.
## What changed
Generate UUIDv7 plan item IDs and carry an unfinished plan's ID across model requests within a turn. Once a plan completes, assign a fresh ID to the next plan.
## Testing
Add unit and integration coverage for unfinished retries, retries after plan completion, and tool continuations, including matching streamed events to saved completions. Update the app-server test to check plan IDs against the start notification.
GitOrigin-RevId: 87b4b3e6bd74224ea96f4308f739bcd2efb62299
## What changed
Preserve original root conversation evidence, retained instructions, assistant context, and verified answers until request preparation. Apply shared section preparation to both synchronous and asynchronous reviews, preserving fixed limits and omission notices while allowing elastic preparation to use the originals. Cache the fixed root view for reuse.
Split classifier setup from final input assembly and normalize new images before deduplication and token accounting, preserving committed history.
## Testing
Extend tests for fixed and elastic preparation across both review profiles, original root evidence after handoff, and image normalization during retained-request preparation.
GitOrigin-RevId: 86c83384c1f5be3707622d675fc54b4c8e1ddc0a
## Why
Reconstructing a thread session from the primary session could carry over another thread's fork parent and cached parent title.
## What changed
Use the target thread's `forked_from_id` when reconstructing sessions from `thread/read` responses and `ThreadStarted` notifications. Clear the cached parent title when the parent changes, and treat absent or invalid parent IDs as no parent.
## Testing
Extend the session reconstruction test to cover replacing an inherited fork parent and clearing inherited fork metadata for a thread with no parent, while retaining coverage of active permission settings.
GitOrigin-RevId: 860779b40dc21fb4cc2ec1ac392523da5e439a94
## What changed
Handle `ThreadSetName` requests in the cloud backend through the cloud client's new `set_thread_name` method, without opening an attachment. Trim the requested name and reject empty names or thread IDs.
After the server acknowledges the rename, update the matching loaded thread's name and emit `ThreadNameUpdated`. Leave the cached name unchanged and emit no notification if the request fails.
## Testing
Add tests for the rename request payload, server acknowledgment and error handling, and preservation of the loaded thread's name when a rename fails.
GitOrigin-RevId: eecfe17a9cfba50c9fa9091a38a36c0011ab9246
## Why
Listing threads by ascending `recency_at` can omit `next_cursor` when rollout files have not yet been indexed in SQLite, preventing clients from fetching the remaining threads.
## What changed
Scan and index one extra rollout for ascending recency listings when SQLite is available, so the database can detect another page. Trim filesystem results to the requested page size for this sort order.
## Testing
Add a regression test that creates two unindexed rollouts after startup backfill and lists them with a provider filter and a page size of one. Verify both threads are returned in order, with a cursor only on the first page.
GitOrigin-RevId: 09354055b6e60666a493d9411ed3eb9778b73c0a
## Why
Temporary trusted Git repositories can remain on disk when a process exits without running directory cleanup.
## What changed
Use `MarketplaceStagingDir` for trusted Git repositories under Codex home's `.tmp/.staging` directory. Clean up abandoned staging directories before creating a repository, while ownership locks protect repositories still in use. Reject a symlinked `.staging` directory to keep `GIT_DIR` inside Codex home.
## Testing
Update the cross-process staging test to create trusted Git repositories and verify that cleanup preserves live owners, reclaims a repository after its process exits, and leaves a concurrent checkout intact.
GitOrigin-RevId: f45b60db82814b4bcc09365f68d808c73d2d5378
## What changed
- Stage Cloud speed choices for the next new turn in the conversation, alongside pending model and effort selections. Update the displayed conversation speed after admission without changing the local default.
- Offer speed commands supported by the pending model. Clear an incompatible pending speed change with a warning when switching models.
- Carry `service_tier` through Cloud message requests, preserving omission to inherit the thread tier and explicit null to clear it. Translate `default` to null and reject tier overrides on queued requests.
## Testing
Add tests for Cloud speed toggling, model-dependent speed choices, admission-time updates, and preserving the conversation tier when selecting a model. Extend request and wire tests to cover service-tier values, explicit clearing, and queue rejection.
GitOrigin-RevId: b4daa701f1fe29593d90a938e60cc20cb980298a
## What changed
- Create WebRTC calls using the TUI's local provider and credentials, then attach the app server through `existingCall` with the returned call ID.
- Preserve the effective voice preference and share realtime prompt preparation and thread headers between call creation and the backend observer.
- Run negotiation asynchronously, cancel pending startup when voice stops, and ignore results from stale startup attempts.
## Testing
Update voice request and handoff tests for client-created calls. Add coverage ensuring that canceling and restarting voice attaches only the new attempt, including when an earlier result is already queued.
GitOrigin-RevId: b704976f4918dddd24a17fbaa868a7c62e81885b
## What changed
Rename `SidebarLayout::Chooser` to `SidebarLayout::Panel` and use panel helpers for geometry, transcript visibility, focus routing, and shortcut hints. Retain `chooser_focus()` for chooser-specific logic.
When changing panel focus, reuse the pane's visible content instead of explicitly selecting `SidebarContent::Chooser`. Update existing sidebar tests to use the renamed geometry helper.
GitOrigin-RevId: ee6180bad691da3a76bd23835077aeb11c7d969d
## What changed
Route direct reviews through the reusable Guardian session so sequential `thread/guardianReview` calls on the same loaded thread can share review history with live approvals. Keep the reviewer conversation separate from the actor and follow the parent thread's persistence settings. Retries reassess the final call under the current policy.
## Testing
Extend app-server coverage to verify history reuse within a parent thread and isolation between parents. Extend the core scenario and snapshot to cover sequential direct reviews without executing the recorded commands.
GitOrigin-RevId: 5f10a04aec43a9351e38575265cb6b5ff06530a5
## Why
The Hickory 0.25.2 dependencies used by `codex-network-proxy` through `rama-dns` and `rama-tcp` have five DNSSEC-only advisories. DNSSEC is disabled even with all workspace features enabled.
## What changed
Add matching exceptions to `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml` for `RUSTSEC-2026-0504`, `RUSTSEC-2026-0505`, `RUSTSEC-2026-0511`, `RUSTSEC-2026-0512`, and `RUSTSEC-2026-0514`.
Document that the exceptions must be reassessed before enabling DNSSEC and removed when the Rust/Rama upgrade brings Hickory to version 0.26.2 or later.
GitOrigin-RevId: 506585d84746076f68ec9a0033603533c52f0f7b
## Why
Proxy HTTP 503 responses can contain plain-text or HTML bodies instead of gRPC frames. These responses should reach the existing session admission retry logic as `Unavailable` errors.
## What changed
Strip body data from HTTP 503 responses to `OpenSession`, preserving headers and trailers so tonic can honor an explicit gRPC status or infer `Unavailable` when none is present. Keep this handling scoped to session admission and retain the existing five-attempt retry limit.
## Testing
Extend admission tests to cover bounded retries for plain-text 503 responses, recovery after an HTML 503 response, and an explicit `Internal` gRPC status that prevents retries.
GitOrigin-RevId: c996e13506464e8b65bae06172324bcbadb1f394
## What changed
- Remove `Config::set_legacy_sandbox_policy` and update session, approval, and Guardian test setup to set permission profiles and workspace roots explicitly.
- Reuse `PermissionProfile::from_legacy_sandbox_policy_for_cwd` for legacy policy validation and updates in `Permissions`.
GitOrigin-RevId: 5ee92c46290ee6a3d7e2d2db7b02641e80bdc44f
## Why
Unfocused chat panes reduced status content to a single dim line, hiding rows that were visible while focused.
## What changed
- Share status measurement, wrapping, rendering, and footer row allocation between the main conversation and side chats.
- Retain structured status content in inactive side chats so native and extension status lines can use the available rows and reflow when resized.
- Keep unfocused status content dimmed with hyperlinks suppressed, while respecting space reserved for the draft and footer hints.
## Testing
Add regression coverage for status reflow across split-pane focus switches and resizing, and update extension status coverage to verify multiple dimmed rows when unfocused.
GitOrigin-RevId: f4def37259fe106d6a3fac9fe4c6cc2d4972f244
## What changed
- Route filesystem helpers through `SandboxManager::transform`, moving helper policy preparation and Windows direct-spawn wrapping into the sandboxing crate.
- Require explicit workspace roots and an available sandbox for helper launches, restrict networking, and reject managed networking configuration.
- Share command preparation and integrity checks between helper requests and sandboxed file opens.
## Testing
Extend coverage for helper executable reads, workspace write boundaries, restricted networking, and Windows wrapper policy serialization. Verify that sandboxed writes to helper siblings leave host files unchanged.
GitOrigin-RevId: e57bfdabf47f79f2194b35df8a75051daf933465
## What changed
Use `legacy_sandbox_policy_label` from the active permission profile to check sandbox overrides when resuming a loaded thread. Continue accepting `external-sandbox` for `danger-full-access` requests, and construct the legacy sandbox policy only when reporting a mismatch.
GitOrigin-RevId: 0f923323394692d2e1f39bafe637c70ce305dc3d
## What changed
Move permission normalization into `Session::apply_session_settings`, leaving `SessionConfiguration::apply` to install the normalized snapshot. Preserve existing deny-read restrictions and infer active profile identity before merging those restrictions.
Convert legacy `sandbox_policy` updates into permission profiles using the updated working directory, clearing active profile identity and profile workspace roots. Normalize a copy so previews preserve the original compatibility input for subsequent admission.
## Testing
Extend session tests to cover deny-read preservation for both update forms, Git metadata protection when changing the working directory, and preview/commit behavior for legacy updates and active profile identity.
GitOrigin-RevId: 8b3a0f630ab56aca6ad75cf16ad432f7fdc08255
## What changed
- Build and assert `PermissionProfile` values directly in memory consolidation tests using filesystem and network permissions.
- Remove the `SandboxPolicy` dependency from rollout trace test fixtures while preserving their `DangerFullAccess` value.
- Update sandbox documentation to describe legacy `sandbox_mode` conversion to `PermissionProfile` and nested filesystem rules, and reference `SandboxMode` in the CLI documentation.
GitOrigin-RevId: ac1be62625b1bfd98dde5f762b379eb840f9186b
## What changed
Consolidate cache refresh entry points around an explicit refresh mode, derive plugin keys from the configured sources, and share request matching and batch outcome handling. Clarify pending refresh state and extract the worker notification callback helper.
## Testing
Add an app-server regression test verifying that the first full plugin list installs a newly published plugin version while preserving cached contents for a plugin whose version is unchanged.
GitOrigin-RevId: 85d91ec7675e98f7430a8bd9c699118c7feb06c4
## Why
Allow collector credentials to refresh without rebuilding OpenTelemetry providers.
## What changed
Add `otel.headers_helper`, a command run from `CODEX_HOME` that returns a JSON object of header strings. Share its results across explicitly configured HTTP log, trace, and metric exporters. Refresh every 29 minutes by default, configurable through `otel.headers_helper_refresh_interval_ms`.
Helper headers override matching static headers. Failed refreshes block affected exports until the helper recovers, and HTTP redirects are disabled when helper headers are used. Repository-local configuration cannot set the helper; exporters set by admin requirements, gRPC exporters, and built-in analytics do not use it. Helper execution respects network policy.
## Testing
Add tests for shared execution, credential refresh and recovery, blocked exports after failure, network restrictions, and configuration validation. Collector tests cover header precedence across all three signals using JSON and binary HTTP encodings, including exclusion of an admin-managed exporter.
GitOrigin-RevId: 89018ac09c2c99523d3f92bf77048e7ed9dae5f2
## What changed
Move shell command construction, bounded process execution, and JSON header parsing from `rmcp-client` into `codex-http-headers-helper`. Preserve the 10-second timeout, 64 KiB output limit, process-tree cleanup, and rejection of invalid or duplicate headers. Keep MCP environment setup and reserved-header validation in `rmcp-client`.
Mark helper-provided header values as sensitive so debug formatting redacts credentials.
## Testing
Add parser tests for credential-safe errors and debug redaction, and adapt the MCP reserved-header test to exercise helper execution.
GitOrigin-RevId: e32d96261ff3648722014971bbf3803d37176ab4
## What changed
Parse reasoning removals from response `input_transformations` and carry the counts through completion events to sampling telemetry.
- Add `codex.responses.reasoning_replay` to distinguish unavailable reports, no reported removals, prefix mismatches, and other removals.
- Add `codex.responses.reasoning_items_removed` histograms by bounded removal reason, grouping unknown or missing reasons under `other`.
- Include zero counts for usable reports; exclude missing, null, or malformed reports from histograms without failing the response.
- Use the sampling step's session telemetry when recording response events.
## Testing
Add SSE and WebSocket integration coverage for report availability, removal counts, unknown reasons, zero observations, and `product_sku` tags in exported metrics.
GitOrigin-RevId: 83c70ca6067fa4b34bf5c463958b4632a7a0a188
## Why
A recovery turn can occupy the core turn slot before `TurnStarted` is published and thread statuses reflect it. During this window, `thread/resume` with configuration overrides could treat an unsubscribed thread as idle and shut it down, interrupting recovery.
## What changed
Require the core turn slot to be empty before replacing a loaded thread during resume. Expose `CodexThread::has_active_turn()` and reuse it in the residency unload check.
## Testing
Add a regression test that blocks paginated history writes to hold a recovery turn before status publication, reconnects with a configuration override, and verifies that the client receives completion for the preserved recovery turn.
GitOrigin-RevId: f295038c8502a9b2849ddc08614db4a3cb5610cf
## Why
Cancelling an MCP HTTP request during a reactive OAuth refresh must not interrupt persistence of rotated credentials. Concurrent requests receiving a `401` also need to reuse a fresh replacement token without refreshing it again.
## What changed
- Route authenticated streamable HTTP requests through `OAuthRuntime`, giving token exchanges independent tasks that finish persistence even if the caller is cancelled.
- Serialize refreshes in both legacy and coordinated modes, recheck the rejected token and replacement expiry, and persist legacy credentials before releasing the manager lock.
- Keep requests waiting to start an exchange cancellable, and use cached access credentials for session cleanup without refreshing tokens.
## Testing
Add coverage for reactive refresh cancellation and rotated refresh-token persistence in both modes, concurrent refreshes with fresh or expired replacements, cancelled waiters, and legacy credentials with only a relative expiry.
GitOrigin-RevId: f52da37d82baf89abcb1585e8e24359de53d40d7
## Why
Providers can echo a bare reserved prefix or return an opaque item ID. Request preparation previously stripped these IDs when they lacked an underscore prefix, even if they carried allocation metadata.
## What changed
- Keep response item IDs with allocation metadata when preparing requests.
- Add `ResponseItemId::with_generation_prefix` to attach a request reservation's allocation while preserving the exact wire ID and recording a matching item-kind prefix and provider suffix.
GitOrigin-RevId: 3249c2669aca11ee5facbd8a246016490a29a4f4
## What changed
Render service tier names in lowercase for the `model-with-reasoning` status line item, while preserving their display casing in terminal titles.
## Testing
Extend footer snapshots to cover Fast and Ultrafast, verify terminal title casing, and check lowercase Flex and multiword tier labels.
GitOrigin-RevId: 16227735d4aae55463df537b91ff7e81c436a66e
zm-oai