## Why
A persistent tmux session can gain remote clients after Codex starts, so successful native copying must not skip terminal forwarding. Terminal sends also lack delivery acknowledgement and cannot replace native copying reliably.
## What changed
- Attempt native copying first, then independently forward through tmux or OSC 52 in tmux and SSH sessions. Preserve existing native clipboard leases when a later copy returns no new lease.
- Target the most recently active client in the current pane's tmux session, checking that client's clipboard capability before sending. Retain OSC 52 fallback when tmux forwarding fails.
- Reject empty selections without touching clipboards and apply the 100,000-byte terminal payload limit to tmux copies.
- Resolve tmux and PowerShell through trusted system locations, adding Nix system profiles and the WSL PowerShell directory to helper discovery.
## Testing
Add regression coverage for native-before-terminal ordering, fallback routing, clipboard lease retention, empty and oversized payloads, tmux client selection, capability checks, and combined backend errors.
GitOrigin-RevId: df4b66fa4368a3cf19b4d07fde6c76ea96a8fef5
## Why
Automatic startup work and `codex doctor` can run before a workspace is
trusted. A repository-controlled `PATH` must not be able to make those flows
execute workspace-provided helpers.
## What changed
- Resolve helpers used by automatic startup from trusted system installation
directories, and give plugin-sync Git subprocesses a sanitized environment.
- Make terminal detection environment-only and have doctor inspect executable
locations without running them. Fetch update metadata with the HTTP client
instead of `curl`.
- Fall back conservatively when trusted terminal helpers are unavailable,
including for tmux keyboard enhancement flags.
## Testing
Add black-box coverage with hostile workspace `PATH` entries for startup,
interactive tmux startup, support log collection, doctor, and curated plugin
sync. Add unit coverage for trusted executable resolution and bounded update
HTTP responses.
GitOrigin-RevId: 3b8995eb422b60ed53b0386951de59e8f9bfc542
Felipe Coury