## What changed
- Add a `codex-diagnostics` crate that snapshots the process ID, available
resident-memory measurements, and registered process-wide gauges.
- Provide guards that update gauges for the lifetime of measured objects.
- Track live `CodexThread` instances with the `core.threads.live` gauge.
## Testing
- Add unit coverage for gauge registration, guard lifetimes, process memory
snapshots, and live-thread reporting.
GitOrigin-RevId: 3236b086bd4ebe31ed4768ab87a5fa288b0891b0
## Why
Applying `project_doc_max_bytes` independently to every selected environment
allows the total project instruction payload to grow with the number of
environments.
## What changed
Treat `project_doc_max_bytes` as one shared byte budget. Consume it in selected
environment order, truncate the entry that reaches the remaining limit, and
skip later environments once the budget is exhausted.
Update the configuration descriptions to document the aggregate limit.
## Testing
Add unit and integration coverage for partial and exhausted budgets across
multiple environments.
GitOrigin-RevId: 4664bdf1f23b66986349d503f44cf51560b9024f
## What changed
- Add `load_local_config_layers` to return raw configuration and requirements layers with their sources, base directories, precedence order, and cloud insertion positions.
- Support projecting layer stacks to selected TOML paths while preserving non-table override blockers and adjusting cloud insertion positions when empty layers are removed.
- Reuse project discovery and trust handling for local reads, including linked-worktree hooks, without resolving relative paths or including profiles, session flags, thread layers, or cloud-provided values.
## Testing
- Cover layer ordering, raw relative paths, legacy requirements, trust filtering, projection semantics, and untrusted linked-worktree hook handling.
GitOrigin-RevId: a1098af5650ac44e5a230ba9a5fe918927986d05
## What changed
Rename `features.tool_registry.include_tool_namespaces_info` to
`features.tool_registry.include_tool_metadata` across configuration parsing,
schema generation, resolved configuration locking, and tests. Update its
description to cover authoritative tool information in request metadata.
GitOrigin-RevId: 93b404483b71fed04031d767a41ac2bb70b836b2
## What changed
- Add `features.tool_registry.include_tool_namespaces_info` to the TOML model,
generated schema, and resolved runtime configuration. The setting defaults to
`false` and controls whether per-turn request metadata includes the resolved
tool namespace inventory.
- Preserve the resolved setting in session configuration locks.
- Cover top-level and profile-scoped strict configuration, deserialization,
resolution, and lock-file persistence.
GitOrigin-RevId: 74124086c0d7de30094b411001f0ec0af490935d
## What changed
- Parse `mcp_tool` hook handlers with a server, tool, JSON input, and optional timeout and status message.
- Return managed MCP tool hooks from `configRequirements/read` and include the handler in the generated protocol schemas.
- Skip MCP tool hooks during discovery with an explicit warning until execution is supported.
## Testing
- Cover MCP tool hook deserialization, including nested and null JSON input values.
- Extend the config requirements RPC test to verify the new handler shape.
GitOrigin-RevId: ff7e2d12b75b486c54d63469af547a29f9b31418
## What changed
- Clamp `wait_agent` timeout requests below `min_wait_timeout_ms` instead of rejecting them.
- Include the timeout adjustment in the wait result message and document it in the tool output schema.
## Testing
- Update the handler test to verify the configured minimum is honored and the adjustment is reported.
- Update the schema test for the expanded result message.
GitOrigin-RevId: 2b4a770ed6d1e9c45b351b479f5ae50c9a3d5388
## What changed
- Add `features.code_mode.default_exec_yield_time_ms`, defaulting to 30 seconds.
- Apply the configured default to code-mode `exec` calls that omit `yield_time_ms` and reflect it in the tool description.
- Remove the `code_mode_buffered_exec` compatibility feature flag.
## Testing
- Cover config loading and tool descriptions for both default and custom yield timeouts.
GitOrigin-RevId: 581ffc737b04721c7b5fc81260b1da1cf7d87523
## What changed
- Add `ThreadManager::with_thread_id_generator` to configure ID allocation for new root, child, and forked threads.
- Keep the standard UUIDv7 generator as the default and preserve stored IDs when resuming threads.
- Add `ThreadId::from_u128` for constructing identifiers from UUID-compatible values.
## Testing
- Cover default allocation, custom IDs across roots, child agents, and forks, and ID preservation on resume.
GitOrigin-RevId: 6c38c862e30a50bad944a994bcbccf7d1e7ada24
## What changed
- Add `codex migrate-rollouts` with dry-run inspection by default, explicit `--apply`, thread filtering, optional I/O throttling, progress output, and JSON or verbose reports.
- Add the disabled-by-default `background_paginated_rollout_migration` feature to migrate legacy local sessions at startup before rollout compression begins.
- Persist a migration cursor and skipped-file fingerprints so later startups avoid full rescans while retrying changed files and recovering pending migrations.
- Coordinate migration with live writers and emit metrics for manual and startup runs.
## Testing
- Cover startup cursor advancement and lookback, pending migration recovery, live-writer coordination, changed empty rollouts, and progress reporting.
GitOrigin-RevId: 276ac506c50ebec5140fd319faca1bb998172061
## Why
Forked subagents can inherit a parent's compacted history, but their context-window metadata needs to identify the child and start a distinct window lineage.
## What changed
- Always identify context windows by agent name and remove the `features.token_budget.mode` setting.
- Persist the agent path in world state and emit context-window metadata as a standalone developer message when the identity changes.
- Reset inherited compaction metadata to the forked subagent's initial context window and restore that window in session state.
## Testing
Extend the full-history subagent test to verify parent and child world-state snapshots, agent identities, distinct window IDs, and the reset child checkpoint.
GitOrigin-RevId: 6584201e57b3d2fba0ce626b89a8b3b0b3c752db
## What changed
- Add an `x-codex-routing-hint` header containing the request model and, when selected, the service tier.
- Send the hint on Responses HTTP requests, remote compaction requests, and WebSocket handshakes, including prewarm connections.
- Limit the header to Codex-backend authentication with the OpenAI provider, omitting it for API-key and provider-specific credential paths.
## Testing
- Cover routing hints for HTTP, remote compaction, WebSocket streaming, and tiered prewarming, along with the credential paths where the header must be absent.
GitOrigin-RevId: d8d415d7fadddecf9a132d05920b856a35ac9960
## Why
Converting each environment's working directory to a host-native path caused
turn-input contributors to omit environments with foreign path formats.
## What changed
- Expose `TurnInputEnvironment.cwd` as a `PathUri`.
- Pass every turn environment to contributors without host-path conversion.
## Testing
Added an integration test that submits a foreign working-directory URI and
verifies the contributor receives the environment unchanged.
GitOrigin-RevId: a122526be47f5331614381e9c6e4b85087a96bed
## Why
An OAuth-backed Streamable HTTP MCP server can fail startup when its stored credentials are rejected. If a client then completes OAuth sign-in and replaces those credentials, the failed server needs to become available without restarting the Codex session.
## What changed
- Track the credential store and OAuth tokens used for each MCP connection, and detect replacements after authentication failures.
- Refresh affected MCP servers before the next turn and include their recovered tools in the model request.
- Classify HTTP authentication challenges and rejected refresh tokens as requiring reauthentication, with sign-in guidance appropriate to local and client-managed environments.
## Testing
- Cover recovery from expired credentials through an externally written replacement token.
- Cover authentication-error classification, startup messaging, and `Auto` store migration from file credentials to the keyring.
GitOrigin-RevId: 9b090089d4e7a44ffc182f4e25da20a18e97b70f
## Why
Environment readiness can change between sampling requests. Extension turn-input contributors should receive the same refreshed environment snapshot used by the current step.
## What changed
Build `TurnInputContext.environments` from `StepContext` so newly ready environments are included in extension input for the current request.
GitOrigin-RevId: ee4444072162317974cd2bbfd57ffcf9a9445391
## Why
Checking the tool search cache currently rebuilds search metadata for every deferred tool, even when an immutable tool runtime has not changed.
## What changed
- Track immutable deferred tools by runtime identity and dynamic tools by their current search metadata.
- Rebuild the search handler when the deferred registry, dynamic metadata, or source-listing mode changes.
- Keep only weak references to immutable runtimes in the cache.
## Testing
Added unit coverage for immutable handler reuse, registry and exposure changes, source-listing changes, and refreshed dynamic tool metadata.
GitOrigin-RevId: 024c6f4498d431e7bbfaecde420f77fcf8c0dba7
## Why
MCP tool handlers and their Code Mode definitions are immutable for the lifetime
of a stable MCP binding, so rebuilding them for every sampling step repeats schema
construction unnecessarily.
## What changed
- Cache MCP handlers per session and reuse them while the same binding remains
active, invalidating the cache when the binding changes.
- Lazily cache schema-free Code Mode definitions on MCP handlers while continuing
to rebuild definitions for step-local tools whose specifications may change.
- Reapply current app enablement, tool policy, exposure, and plugin schema budgets
whenever cached handlers are registered for a step.
## Testing
- Cover handler and Code Mode definition reuse, binding invalidation, changing app
policy, stable continuation schemas, and step-local custom tool updates.
GitOrigin-RevId: 69c5011fb97c08580ac476e7fb2286b1e92e0359
## Why
Subagents can reuse cached MCP tool definitions without starting every optional
server before any of its tools are used.
## What changed
- Defer startup for subagent-owned, optional MCP servers when their cache has at
least one visible, allowed tool, and trigger startup on the first operation
that needs the live client.
- Keep root sessions, required servers, selected plugin servers, and explicit
reconnects eager.
- Exclude empty catalogs from cache eligibility and keep dormant servers out of
the initial startup summary.
## Testing
- Extend MCP tool-cache coverage for eager root startup, unused and filtered
subagent servers, deferred startup status events, and startup that survives an
interrupted first tool call.
GitOrigin-RevId: e7528ff08312583a6747cbc6550ea5b6eabda9a6
## Why
A model switch on the first turn has no prior turn settings to compare, and rolling that turn back could leave its model instructions in history.
## What changed
- Track the model that supplied the session's base instructions so first-turn switches inject the target model's instructions, including the selected personality.
- Preserve inherited custom base instructions when starting from an empty fork.
- Remove first-turn model-switch developer content during rollback so retries and cold resumes do not retain or duplicate stale instructions.
## Testing
Add integration coverage for first-turn switches, personality changes, empty-prefix forks, rollback retries, and cold resume.
GitOrigin-RevId: 9df532e9e337521ad3b315b77f8c98e039fb384e
## Why
Multi-agent v2 rejected `agent_type` when `fork_turns` was `all`, forcing callers to choose between a configured role and the parent's full conversation context.
## What changed
- Apply an explicitly selected role to full-history forks, including its model and developer instructions.
- Preserve the parent's developer instructions when the selected role does not define its own.
- Keep the inherited conversation history and model-switch context intact.
- Update the `spawn_agent` schema to clarify that roles apply independently of history inheritance.
## Testing
- Cover full-history role overrides and developer-instruction precedence in multi-agent v2 tests.
GitOrigin-RevId: cd4f35e31d75f56289760f245bff38dd0233abe6
## What changed
- Fetch the paginated installed-plugin snapshot without a `scope` query instead of issuing separate requests for global, user, and workspace plugins.
- Use the combined snapshot for installed-plugin caching and bundle synchronization while continuing to reconcile each scope's marketplace independently.
## Testing
- Cover pagination across mixed scopes, request query parameters, marketplace reconciliation, stale cache cleanup, and discoverable-plugin filtering.
GitOrigin-RevId: 7428a9db81d7ec04e65cc4b236b652278b200956
## What changed
- Add the gated `unified_image_budget` feature for models that support original image detail or Responses Lite.
- Apply one 6,000-pixel, 10,000-patch preprocessing limit regardless of legacy image detail hints.
- Hide detail controls from `view_image` and code mode while continuing to accept existing hints for compatibility.
- Preserve detail-based resizing and tool contracts for unsupported models.
## Testing
- Cover unified resizing limits, Responses Lite, legacy detail hints, unsupported models, and `view_image` integration in code mode.
GitOrigin-RevId: cb07bff1669a96599fdfd076b3d9ec80f2b6fff7
## What changed
- Add a storage-neutral queue extension for listing, adding, editing, reordering, deleting, and explicitly starting queued user messages.
- Dispatch queued messages in FIFO order when a thread becomes idle after a completed turn, while leaving them queued after interruptions or failures.
- Wait for user input to be persisted before removing its queue item, and report hook rejection, task termination, and persistence failures distinctly.
- Snapshot local image and audio attachments into validated data URLs before storing them, enforce input limits, and emit `ThreadQueueChanged` events after mutations.
## Testing
- Cover queue mutations, automatic and explicit dispatch, interruption and failure behavior, hook rejection, invalid records, input limits, and local attachment snapshotting.
GitOrigin-RevId: 14f39d7c8cbaccb767a6da84b82cced0edfcb4b9
## What changed
- Add a Guardian circuit-breaker policy for models whose catalog specialty is
`cyber`.
- Interrupt those models after the first Guardian denial while retaining the
existing denial thresholds for other models.
- Centralize the `cyber` model-specialty identifier for use across core,
protocol, app-server, and TUI code.
## Testing
- Cover the cyber-specific threshold in the circuit-breaker unit tests.
- Verify end to end that a denied command is not executed and the turn is
interrupted after one denial.
GitOrigin-RevId: fad24c9e7aa280432580db1f0e39d13535779710
## Why
Resumed sessions need the current multi-agent usage instructions when configuration changes or the saved history predates usage-hint tracking.
## What changed
- Store multi-agent usage hints in world state and refresh changed or previously untracked hints before re-emitting the active multi-agent mode.
- Present `wait_agent` polling guidance in the overridable developer instructions only when the tool is enabled, instead of embedding it in the tool schema.
## Testing
- Cover cold resumes, changes to `wait_agent` availability, custom usage hints, message ordering, and tool-schema behavior.
GitOrigin-RevId: a9c6798d5dc2dedc8dadc49e0a80ff50a757ab83
## What changed
- Remove namespace tools named `tool_search` before registering the built-in
search tool, preventing them from sharing its model-visible surface.
- Record removed namespace tools as collisions so strict collision handling
reports their qualified tool names.
## Testing
- Cover direct and deferred MCP tools that use the reserved namespace.
- Cover strict collision errors for both direct and deferred conflicts.
GitOrigin-RevId: 28fff918b4358a67b167467d92728fa545b951d7
## What changed
- Add `transparentBackground` to image-generation items and legacy completion events.
- Map Images API backgrounds to `true` for transparent, `false` for opaque, and `null` for automatic or unavailable values.
- Preserve the metadata in live notifications and persisted or resumed thread history while continuing to deserialize older items that omit it.
## Testing
- Cover transparent, opaque, and automatic backgrounds, including image edits and thread read/resume flows.
- Verify the stable JSON shape and optional TypeScript field.
GitOrigin-RevId: 08527f37f23431df45fab1ed34eb82b2139b49d7
## What changed
- Add `ExplicitSkillLookup` to decouple explicit mention selection from the
core skill-loading model.
- Export `collect_explicit_skill_mentions` from `codex-skills` and implement
the lookup interface for `SkillLoadOutcome`.
- Move the selection tests into `codex-skills` while keeping the prompt-size
boundary test with prompt injection.
GitOrigin-RevId: 21105af31c9b519c231c5ea02464da560705c293
## What changed
- Move tool mention parsing, skill-name counting, and implicit invocation detection into `codex-skills` and expose them through its public API.
- Decouple implicit invocation detection from `SkillLoadOutcome` with an `ImplicitSkillLookup` trait, while preserving the existing `core-skills` interface through re-exports.
- Cover remote plugin attribution for both implicit `SKILL.md` reads and skill script runs.
GitOrigin-RevId: f3da85c9821868638ccfd2fc2e01e0869d2fd437
## What changed
- Move the integration test for reusing plugin-manager skill snapshots into
`codex-core`, which owns both the plugin manager and host skills service
integration.
- Keep the `codex-core-plugins` test focused on resolving local and remote
plugin identities on effective skill roots, and remove its skills-extension
dev dependency.
- Use the skills extension's `HostSkillsSnapshot` type in its world-state
catalog implementation.
## Testing
- Verify the host skills service reuses the plugin manager's parsed snapshot
after the underlying skill file changes, while preserving plugin identity
metadata.
GitOrigin-RevId: afc8a0ebccb629360c59a4546bdb9a134c74da4f
## What changed
- Add `session_source()` to `McpServerContributionContext` for thread-scoped MCP resolution.
- Propagate each thread's `SessionSource` through initial setup, per-step resolution, and runtime refreshes.
## Testing
- Verify global contexts omit the source while thread-scoped contexts retain it.
- Verify MCP contributors observe distinct sources for a root thread and its spawned subagent.
GitOrigin-RevId: 23da1509858e023fbd9e2d179034ddc83553f17b
## What changed
- Load ordinary recursive host skill roots with the skills extension's host loader.
- Keep plugin-specific roots on the existing loader so plugin snapshot caching and namespacing continue to work.
- Merge both kinds of root snapshots through the existing precedence and deduplication logic, including discovery paths and source filesystem mappings.
- Move `HostSkillsSnapshot` into the skills extension as the owner of host skill loading.
## Testing
- Cover merged host and plugin catalogs, precedence for symlinked roots, discovery paths, and end-to-end rendering and invocation of host, repository, and plugin skills.
GitOrigin-RevId: c18080afb917c33c57bc17e36b40dd0f3c72d1d7
## What changed
- Add end-to-end coverage for a remote environment whose provisioning status is
reported ready before it is selected for a turn.
- Verify that `wait_for_environment` makes remote execution tools and selected
capability-root context available once the transport is ready.
- Update pending-environment and relay tests to cover separate materialization
and readiness reporting, including deferred connection and reconnection.
GitOrigin-RevId: d86d66e8f722e9bafac88b93d93e7c5244a7156e
## What changed
- Share an in-flight `git status --porcelain` invocation among concurrent workspace metadata requests for the same canonical repository root.
- Keep scans for different repositories independent, and start a fresh scan after an in-flight request completes or loses all consumers.
- Pass the known repository root into dirty-worktree detection so requests from sibling directories and symlink aliases use the same key.
## Testing
- Add coverage for request coalescing, repository and symlink keying, completed scans, and consumer cancellation.
GitOrigin-RevId: 4c197c1d5bb94ca83c02979be34b17f24aefde08
## What changed
- Move the orchestrator skill catalog from thread context into its own
`orchestrator_skills` world-state section so unchanged catalogs remain
incremental across turns.
- Discover executor, orchestrator, and host catalogs together and render them
against one context-window-aware metadata budget, preserving executor entries
before orchestrator and host entries under pressure.
- Emit catalog metrics and budget warnings when each world-state section is
rendered.
## Testing
- Cover incremental orchestrator catalogs across production turns, combined
catalog budgeting, disabled and unavailable providers, caching, warnings, and
metrics.
GitOrigin-RevId: a0fb25d39dcaf43c978aff9da7972a1206f736e4
## What changed
- Add `include_apps_usage_instructions` to model metadata, defaulting to true for compatibility with existing metadata.
- Emit generic Apps guidance only when apps are available and the selected model enables it.
- Enable the capability for interactive model presets while leaving `codex-auto-review` and local models opted out.
## Testing
- Verify that missing metadata defaults to enabled and an explicit opt-out survives serialization.
GitOrigin-RevId: 6a20573cddfd3b80083d2b4b015829b49e6cc283
## Why
Symlinked skills have a canonical `SKILL.md` path that can differ from the path
under the configured skill root. A catalog entry that advertises the discovery
path must still select the canonical skill.
## What changed
- Track each loaded skill's discovery path alongside its canonical identity.
- Render discovery paths in the skill catalog and accept either form for
structured selections and linked skill mentions.
- Preserve enabled-state checks, deduplication, and product filtering when
resolving discovery paths.
## Testing
Added loader, catalog, mention-resolution, and end-to-end turn coverage for
skills discovered through directory symlinks.
GitOrigin-RevId: bae539b766cc3782c7c121a4276c337699cbb509
## What changed
- Add the disabled-by-default `image_resize_notice` feature.
- When enabled, append a developer message after resized images from user
messages or tool outputs. The notice identifies each image and reports its
original and prepared dimensions.
- Persist notices with new history while avoiding backfilled notices for images
processed when a session is resumed.
## Testing
- Cover notice placement, image numbering, failed images, user and tool image
sources, and resumed-session replay.
GitOrigin-RevId: 11dd808b3ad47eac35e9e2f4a4370f85d0122770
## Why
Authentication restrictions must apply before stored or environment-provided credentials can be used, including during bootstrap before cloud requirements are fetched.
## What changed
- Add local `requirements.toml` allowlists for login methods and ChatGPT workspaces. Ignore these fields in cloud-provided requirements.
- Combine managed workspace allowlists with existing workspace restrictions by intersection, and fail closed when the resulting policy permits no usable login method.
- Centralize policy checks in the authentication manager so CLI, TUI, app-server, external-auth, and credential-loading paths consistently reject disallowed authentication before token hydration or network requests.
## Testing
- Cover policy composition, workspace intersection, invalid stored and external credentials, bootstrap enforcement, and login endpoint restrictions.
GitOrigin-RevId: efef22b248f3c3333e9aa55423e539efa2d2dd48
## What changed
- Move permission hooks, reviewer routing, approval caching, and user approval requests into the session-level approval flow.
- Have shell, unified exec, and apply-patch runtimes describe requests as `ApprovalAction` values, which now provide their hook payloads and cache keys.
- Pass a shared `ApprovalContext` through initial and retry approvals so telemetry and approval reasons are handled consistently.
GitOrigin-RevId: 5bfa61daa97e4427f3a648f6cf9d1c27f1551942
## What changed
- Select `gpt-5.6-luna` for Guardian approval reviews authenticated with an API key, while retaining `codex-auto-review` for ChatGPT authentication.
- Exercise API-key reviews through Responses Lite and fall back to the bundled Guardian policy when the selected model has no catalog-provided review policy.
- Refine the bundled policy's handling of trusted authorization, sensitive-data egress, credential probing, destructive command targets, and post-denial approval.
## Testing
- Cover provider model selection for API-key and ChatGPT authentication.
- Verify Guardian prewarming and review reuse with both Responses Lite and standard Responses requests.
GitOrigin-RevId: e35c43e1692fd643ab8faad1444c0d6a869b3e0c
## What changed
Store the output buffer, notifications, closed state, and cancellation token
together in `OutputHandles`. Pass that shared bundle through output collection
and local output tasks instead of cloning and forwarding each field separately.
GitOrigin-RevId: 2f0f66dd419778e0b17ff47323c795f5dc88fe33
## Why
The 4 KiB aggregate limit can truncate source metadata before it reaches the
model through the tool search description.
## What changed
Raise the aggregate source-description limit to 512 KiB while retaining the
existing character-boundary-safe truncation and bounded output.
## Testing
Expand unit and RMCP round-trip coverage to verify that substantially longer
Unicode descriptions remain complete within the new limit.
GitOrigin-RevId: 002760cdd2e8741e531b45f75f8624ef84334d24
## What changed
- Propagate the optional `modelSpecialty` field through the model catalog and
app-server `model/list` response.
- When a newly selected model has the `cyber` specialty, default an active TUI
thread to workspace-write permissions with on-request approval. Use auto
review when available, otherwise keep the user as reviewer, while respecting
configured permission requirements.
- Show a notice when auto review is applied and strengthen the full-access
warning for cyber models.
- Preserve explicitly selected permissions when only reasoning settings change.
## Testing
- Cover auto-review defaults, requirement-aware fallback behavior, permission
preservation across reasoning changes, and the new warning notice.
GitOrigin-RevId: 8f25b0082d3051d9ff91f7355921236d0f82f758
## What changed
- Treat different non-empty descriptions for the same tool namespace as a
collision when `error_on_tool_collisions` is enabled, including deferred
tools.
- Continue allowing multiple tools to share a namespace when their descriptions
match or are empty.
- Preserve the first non-empty namespace description when strict collision
checking is disabled.
## Testing
- Cover strict collisions across direct and deferred tools, valid shared
namespaces, relaxed description merging, and failure before model sampling.
GitOrigin-RevId: 788a2ae0eccb64c97995af7a208d9abb79edf2d0
## What changed
- Build filesystem and permission context from the primary turn environment's permission profile, working directory, and workspace roots, falling back to the thread context when no primary environment is available.
- Build capability-discovery sandbox contexts from each environment's permission profile and treat discovery as restricted when any selected environment has restricted filesystem access.
## Testing
- Add regression tests covering environment-specific capability discovery and permission context updates.
GitOrigin-RevId: 6bbbd9b88aafa5e6583971ce4e427fc7557f2d93
## What changed
- Derive sandboxing, approval, and permission-profile environment variables from the selected turn environment for shell, unified exec, `apply_patch`, image viewing, and network approval flows.
- Materialize project-root permissions against every workspace root in that environment, allowing `apply_patch` to write to secondary workspace roots while preserving protected paths.
- Carry the selected environment's permission profile into spawned or resumed agents and Guardian permission context.
## Testing
- Add an integration test covering `apply_patch` writes in a secondary workspace root.
- Extend tool, Guardian, and multi-agent tests to distinguish environment permissions from thread-level permissions.
GitOrigin-RevId: e22da8974bcd3de1e724978b1a7790307a51e4bc
## What changed
- Expect tool collisions to report names canonicalized into the default
`functions` namespace.
- Remove the obsolete test that allowed an explicitly namespaced
`functions.shell_command` external tool.
GitOrigin-RevId: 9a517f49c027ffe5b811f6668dca91246f4925a6
## What changed
- Include the current permission profile in each turn environment's configuration.
- Refresh retained environment configurations when session settings change, while preserving the configuration already captured by active turns.
- Keep environment connection and shell snapshot resolution reusable across configuration updates.
## Testing
- Cover permission profile updates applied through both session settings updates and per-turn updates.
- Verify that pending environment resolutions use the configuration captured by their turn and that configuration-only updates do not retry failed environments.
GitOrigin-RevId: 923694f0729b87a118d7635ade3a8ca9bcd4e7b1
## What changed
- Track Agent Plugin manifests through plugin, skill, and MCP loading so their capabilities use format-specific behavior without changing legacy plugins.
- Discover only direct-child skills, exclude app and hook capabilities, isolate MCP data, and reject MCP configuration files that are non-regular or resolve outside the plugin root.
- Bound model-visible skill instructions, plugin instructions, MCP descriptions, schemas, individual tools, and the aggregate Agent Plugin MCP tool set.
- Stop MCP and OAuth redirects when Agent Plugins send configured or authorization headers, while retaining existing redirect behavior for legacy MCP servers.
## Testing
- Add coverage for capability filtering, skill discovery, isolated MCP data and reserved-path expansion, unsafe MCP configuration files, context limits, and redirect handling.
GitOrigin-RevId: c9af66b051269f3226628ca280a58d32c808c38f
