## Why
Converting each environment's working directory to a host-native path caused
turn-input contributors to omit environments with foreign path formats.
## What changed
- Expose `TurnInputEnvironment.cwd` as a `PathUri`.
- Pass every turn environment to contributors without host-path conversion.
## Testing
Added an integration test that submits a foreign working-directory URI and
verifies the contributor receives the environment unchanged.
GitOrigin-RevId: a122526be47f5331614381e9c6e4b85087a96bed
## What changed
- Carry plugin identity, namespace, root, and discovery mode through host skill loading.
- Apply the owning plugin namespace and IDs to loaded skill metadata.
- Respect direct-child discovery for Agent Plugins and reject skills that resolve outside the plugin root or are not regular files.
- Preserve recursive discovery and symlink behavior for legacy plugin roots, and allow the full 64-character namespace plus 64-character skill name.
## Testing
Add host-loader coverage for plugin metadata, namespace ownership, direct-child filtering, path containment, recursive symlinks, shared assets, and maximum-length qualified names.
GitOrigin-RevId: cdde821643ce39bd030d0c3753b3304b75161690
## What changed
- Add a storage-neutral queue extension for listing, adding, editing, reordering, deleting, and explicitly starting queued user messages.
- Dispatch queued messages in FIFO order when a thread becomes idle after a completed turn, while leaving them queued after interruptions or failures.
- Wait for user input to be persisted before removing its queue item, and report hook rejection, task termination, and persistence failures distinctly.
- Snapshot local image and audio attachments into validated data URLs before storing them, enforce input limits, and emit `ThreadQueueChanged` events after mutations.
## Testing
- Cover queue mutations, automatic and explicit dispatch, interruption and failure behavior, hook rejection, invalid records, input limits, and local attachment snapshotting.
GitOrigin-RevId: 14f39d7c8cbaccb767a6da84b82cced0edfcb4b9
## What changed
- Add `transparentBackground` to image-generation items and legacy completion events.
- Map Images API backgrounds to `true` for transparent, `false` for opaque, and `null` for automatic or unavailable values.
- Preserve the metadata in live notifications and persisted or resumed thread history while continuing to deserialize older items that omit it.
## Testing
- Cover transparent, opaque, and automatic backgrounds, including image edits and thread read/resume flows.
- Verify the stable JSON shape and optional TypeScript field.
GitOrigin-RevId: 08527f37f23431df45fab1ed34eb82b2139b49d7
## What changed
- Move the integration test for reusing plugin-manager skill snapshots into
`codex-core`, which owns both the plugin manager and host skills service
integration.
- Keep the `codex-core-plugins` test focused on resolving local and remote
plugin identities on effective skill roots, and remove its skills-extension
dev dependency.
- Use the skills extension's `HostSkillsSnapshot` type in its world-state
catalog implementation.
## Testing
- Verify the host skills service reuses the plugin manager's parsed snapshot
after the underlying skill file changes, while preserving plugin identity
metadata.
GitOrigin-RevId: afc8a0ebccb629360c59a4546bdb9a134c74da4f
## What changed
- Add `session_source()` to `McpServerContributionContext` for thread-scoped MCP resolution.
- Propagate each thread's `SessionSource` through initial setup, per-step resolution, and runtime refreshes.
## Testing
- Verify global contexts omit the source while thread-scoped contexts retain it.
- Verify MCP contributors observe distinct sources for a root thread and its spawned subagent.
GitOrigin-RevId: 23da1509858e023fbd9e2d179034ddc83553f17b
## What changed
- Load ordinary recursive host skill roots with the skills extension's host loader.
- Keep plugin-specific roots on the existing loader so plugin snapshot caching and namespacing continue to work.
- Merge both kinds of root snapshots through the existing precedence and deduplication logic, including discovery paths and source filesystem mappings.
- Move `HostSkillsSnapshot` into the skills extension as the owner of host skill loading.
## Testing
- Cover merged host and plugin catalogs, precedence for symlinked roots, discovery paths, and end-to-end rendering and invocation of host, repository, and plugin skills.
GitOrigin-RevId: c18080afb917c33c57bc17e36b40dd0f3c72d1d7
## What changed
- Move the orchestrator skill catalog from thread context into its own
`orchestrator_skills` world-state section so unchanged catalogs remain
incremental across turns.
- Discover executor, orchestrator, and host catalogs together and render them
against one context-window-aware metadata budget, preserving executor entries
before orchestrator and host entries under pressure.
- Emit catalog metrics and budget warnings when each world-state section is
rendered.
## Testing
- Cover incremental orchestrator catalogs across production turns, combined
catalog budgeting, disabled and unavailable providers, caching, warnings, and
metrics.
GitOrigin-RevId: a0fb25d39dcaf43c978aff9da7972a1206f736e4
## Why
Symlinked skills have a canonical `SKILL.md` path that can differ from the path
under the configured skill root. A catalog entry that advertises the discovery
path must still select the canonical skill.
## What changed
- Track each loaded skill's discovery path alongside its canonical identity.
- Render discovery paths in the skill catalog and accept either form for
structured selections and linked skill mentions.
- Preserve enabled-state checks, deduplication, and product filtering when
resolving discovery paths.
## Testing
Added loader, catalog, mention-resolution, and end-to-end turn coverage for
skills discovered through directory symlinks.
GitOrigin-RevId: bae539b766cc3782c7c121a4276c337699cbb509
## What changed
- Track Agent Plugin manifests through plugin, skill, and MCP loading so their capabilities use format-specific behavior without changing legacy plugins.
- Discover only direct-child skills, exclude app and hook capabilities, isolate MCP data, and reject MCP configuration files that are non-regular or resolve outside the plugin root.
- Bound model-visible skill instructions, plugin instructions, MCP descriptions, schemas, individual tools, and the aggregate Agent Plugin MCP tool set.
- Stop MCP and OAuth redirects when Agent Plugins send configured or authorization headers, while retaining existing redirect behavior for legacy MCP servers.
## Testing
- Add coverage for capability filtering, skill discovery, isolated MCP data and reserved-path expansion, unsafe MCP configuration files, context limits, and redirect handling.
GitOrigin-RevId: c9af66b051269f3226628ca280a58d32c808c38f
## What changed
- Group top-level function and custom tool definitions into a single `functions` namespace for Responses Lite providers that support namespaced tools.
- Normalize missing, empty, and explicit `functions` namespaces to the same tool identity across registration, routing, lifecycle hooks, configuration, and tool search.
- Keep default tool names unprefixed in code mode, display output, and dispatch traces while preserving explicit non-default namespaces.
## Testing
- Add coverage for Responses Lite serialization, tool search results, namespace normalization and collision handling, routing, lifecycle events, and code-mode namespace policies.
GitOrigin-RevId: d48414005b5d22d39b11a198e19c47814d3a19f2
## What changed
- Key cached skill snapshots by filesystem and plugin snapshot identity so compatible config and working-directory loads can share results without reusing stale plugin data.
- Coalesce concurrent loads for the same cache key and replace the cached entry on forced reload.
- Clear both plugin and skill caches when `skills/list` forces a reload, and bypass working-directory caching when effective plugin roots are present.
## Testing
- Cover concurrent cache sharing, filesystem isolation, forced reloads, and refreshed plugin skill metadata in host service and app server tests.
GitOrigin-RevId: 03fed3b40d45bb29206d5a3c3e78f06df04dbb1e
## Why
The bundled system-skill cache is shared by every process using the same
`CODEX_HOME`. A service with bundled skills disabled must not remove cache
files that another service still uses.
## What changed
- Filter system skill roots from disabled services without deleting the shared
cache.
- Ensure bundled system skills are installed during loads when they are
enabled, including after a runtime configuration change.
## Testing
Add app-server coverage for preserving the cache across enabled and disabled
services and refreshing stale cached skills after runtime enablement.
GitOrigin-RevId: 1eca999b33b7be69873a40a91767fd26f0c2b457
## Why
Orchestrator skills with `allow_implicit_invocation: false` were still exposed in the model-visible skill catalog.
## What changed
- Hide explicit-only orchestrator skills from the prompt catalog while keeping them available for direct invocation.
- Include orchestrator resource-access metadata with injected instructions so `skills.read` can load referenced resources.
- Track visible and hidden discovery limits separately, and record discovery duration and resource-count metrics.
## Testing
Add an integration test that verifies an explicit-only orchestrator skill stays out of the prompt catalog, can be selected explicitly, and can read a referenced resource.
GitOrigin-RevId: 9cab5a61eb27c96bec9d1346c7dcdbc97376f7dc
## What changed
- Update the required pull request attribution to `Generated with [Codex](https://openai.com/codex/).`.
- Recognize the previous unlinked attribution when restoring saved context so it can be replaced without duplicating the attribution instructions.
## Testing
- Cover cold resume with both commit-only legacy instructions and the previous unlinked pull request attribution.
- Update app-server and MCP server assertions for the linked attribution.
GitOrigin-RevId: 8773546a6a59dab146905e50cf4434d53b9335cf
## What changed
- Generalize `CodexThread::try_start_turn_if_idle` to accept exported
`TurnInput` values, preserving user content and client IDs in the first model
request.
- Allow non-empty user input to start an idle turn in Plan mode while retaining
the Plan-mode rejection for automatic response items and empty user input.
- Process idle user input through the normal user-turn path so connector
selections are cleared, prompt telemetry is recorded, and referenced skill
instructions are included.
## Testing
- Cover idle user input in Default and Plan modes, response-item mailbox
merging, empty-input rejection, and skill instruction injection.
GitOrigin-RevId: 116667d160d4464b525d9e4c7e8cc05d23a94008
## What changed
- Move config-layer, user, system, plugin, extra, and repository skill-root
resolution from `core-skills` into the host skills extension.
- Keep the core loader focused on loading explicit `SkillRoot` values.
- Relocate and expand tests for root precedence, deduplication, repository
ancestry, plugin metadata, and concurrent probing.
GitOrigin-RevId: 3b95cf28101b8b4d64d54079d202154dad560aab
## What changed
- Move host skill discovery, snapshot caching, and configuration handling from
`codex-core-skills` to `codex-skills-extension`.
- Rename `SkillsService` and `SkillsLoadInput` to `HostSkillsService` and
`HostSkillsLoadInput` to distinguish the host implementation from other skill
providers.
- Keep shared loading primitives and skill outcome modeling in
`codex-core-skills`.
GitOrigin-RevId: d81a21791d2ef8c066e157e7e538b8cb7ee4c24b
## What changed
- Move skill interface validation and asset-path resolution into `codex-skills` so both skill loaders share the same behavior.
- Populate host-loaded skills with validated display metadata, prompts, brand colors, and local icons from `agents/openai.yaml`.
- Allow plugin skills to reference icons under the plugin's shared `assets` directory while rejecting absolute paths and paths that escape permitted asset roots.
## Testing
- Add resolver tests for valid, invalid, local, and plugin-shared interface assets.
- Add host loader coverage for interface fields and asset-path restrictions.
GitOrigin-RevId: 3f316191752eeebd15d11ac0bee82201574320ec
## What changed
- Reuse directory-entry file types in local memory listing while continuing to
exclude symlinks, and reuse rollout metadata when reading modification times.
- Avoid following non-symlinks twice in direct filesystem metadata and directory
listing operations while preserving target classification for valid symlinks.
## Testing
- Cover symlink handling in local memory listing and search.
- Extend Unix filesystem tests for followed file and directory symlinks and
dangling metadata links.
GitOrigin-RevId: e4e24576e2e9db704f9da54727928e121f81dc86
## What changed
- Add a loader that discovers skills from canonical host roots and preserves their `SkillScope`.
- Skip hidden directories, follow directory symlinks for user, repo, and admin scopes, and ignore them for system skills.
- Load dependencies and policy from optional `agents/openai.yaml` metadata without rejecting a skill when that metadata is missing or invalid.
- Resolve plugin and symlink namespaces while retaining host paths and reporting per-skill errors outside system scope.
## Testing
Add coverage for frontmatter and metadata loading, invalid optional metadata, hidden directories, plugin namespaces, and scope-specific symlink discovery.
GitOrigin-RevId: ac436d93b5943b7eaae32143e43367921dd1c350
## What changed
- Add extension-owned discovery and namespace resolution for skills loaded directly through an `ExecutorFileSystem`.
- Preserve hidden and symlinked skills, nested plugin namespaces, optional `agents/openai.yaml` metadata, product restrictions, and deterministic ordering.
- Reuse the filesystem walk inventory and bound concurrent skill, metadata, and manifest reads.
- Route direct executor catalog loading through the new extension loader.
## Testing
- Cover namespace lookup, metadata probing, walk reuse, concurrent reads, and parity with the existing environment loader.
GitOrigin-RevId: 4e0b821eb84d03f0dc1c2dee7b2b9a072ee3fd44
## What changed
- Move parsing of pre-discovered executor skill bundles from `core-skills` to
the skills extension.
- Expose shared `SKILL.md` frontmatter parsing from `codex-skills` so direct
and pre-discovered loading use the same validation and repair behavior.
## Testing
- Add parity coverage for direct and pre-discovered executor skill catalogs,
including plugin namespaces, metadata, product policy, and warnings.
- Add a snapshot for the resulting pre-discovered executor catalog.
GitOrigin-RevId: c5f888226fa5600bd8b90f5682400da39a5db5ff
## What changed
- Allow namespace tool specs to contain custom freeform tools alongside function tools.
- Include namespaced custom tools in deferred tool search and expose them to code mode with names such as `editor__apply_patch`.
- Route custom payloads to matching extension tools while preserving function-only payload validation.
## Testing
- Add serialization, tool search, code-mode definition, and end-to-end dispatch coverage for namespaced custom tools.
GitOrigin-RevId: be64d35f6ae54685c5a9fcf45a732320742ea7e5
## Why
MCP tools can be exposed directly, discovered through tool search, or called
from Code Mode. Servers need to be able to opt out of any of these surfaces
without disabling their tools everywhere.
## What changed
- Add `omit_tools_from` to MCP server configuration, accepting any combination
of `direct`, `deferred`, and `code_mode`.
- Apply the exclusions independently when building direct, deferred, and Code
Mode tool surfaces while keeping omitted tools registered for permitted uses.
- Remove client-private `_meta` fields from MCP results returned to Code Mode.
- Include the new setting in the configuration schema and MCP config
serialization.
## Testing
- Cover every exposure combination across Code Mode, Code-Mode-only sessions,
tool search, direct-only namespaces, and prefixed and unprefixed MCP names.
- Verify direct and nested execution paths, parallel-call support, config
round-tripping, and `_meta` filtering.
GitOrigin-RevId: 12dfcb78bb5c5ecf4d70f38a8b5022792463a27f
## What changed
Make `ExtensionRegistryBuilder` wrap an `ExtensionRegistry` and register
contributors directly on it. Return the wrapped registry from `build()` instead
of copying each field into a new value.
GitOrigin-RevId: ae04de99c17ea951156f9892151b4196c70026bf
## What changed
- Parse `codex_rollout_budget_units` from completed Responses API usage into
`TokenUsage`.
- Keep the provider-only value out of serialized protocol, JSON schema, and
TypeScript representations.
## Testing
- Cover the value in unit and end-to-end SSE response parsing tests.
GitOrigin-RevId: a53d4202beb9c8985d25894cb10e7c01f20b2a44
## What changed
- Make the skills extension own the catalog prompt templates and rendering path.
- Remove the duplicate core fallback that injected available skills into initial context.
- Update core integration tests to install the skills extension explicitly when they expect model-visible skill context.
GitOrigin-RevId: bbe6b15c4e776a09c98b7f4166426fe4e58434ba
## Why
Host skill path aliases should follow the core skill loader's root discovery
order, independent of how catalog entries are sorted for rendering.
## What changed
- Propagate each host skill root's discovery position into its catalog entries.
- Assign `r0`, `r1`, and subsequent aliases from that position while leaving
entries without an explicit root order last.
## Testing
Added coverage for alias ordering in extension rendering and across consecutive
production turns.
GitOrigin-RevId: 9085a3843c91bf2ce78a378cf5ce4926e9c38eb8
## What changed
- Load and cache the host skill provider catalog during world-state contribution.
- Render host skill listings from that catalog with Core-compatible budgeting, while preserving Core's full prompt injection for selected host skills.
- Reuse the cached host catalog for shadow selection, including when skill listings are disabled.
- Preserve an empty Core-compatible skills fragment when every entry exceeds the metadata budget, and make budget warnings independent of the configured percentage.
## Testing
- Cover provider-backed host listings, selected-skill prompt injection, shadow selection, disabled listings, oversized prompts, empty fragments, metrics, and warnings.
GitOrigin-RevId: b6b2d8ea14386356094cff5783d121d74657e9e3
## Why
Executor capability discovery can traverse plugin and skill roots, including
symlinks. Under restricted filesystem permissions, discovery must not expose
files outside the permitted paths.
## What changed
- Pass each environment's filesystem sandbox context through capability root
discovery and apply it to metadata, directory walks, and file reads.
- Enable discovery for restricted sessions so permitted executor skills remain
available while inaccessible roots and symlink targets are omitted.
- Key discovery caches by sandbox context and reject sandboxed discovery on
executors that do not advertise support for it.
- Split requests with more than 128 roots into supported-size batches.
## Testing
- Cover permitted and denied external symlink targets.
- Verify restricted skill listing excludes inaccessible skills.
- Verify cache separation across permission contexts and discovery of 129 roots.
GitOrigin-RevId: 44d16468ca003403bdb8b71a04ae8c9ff94ed494
## Why
Executor-backed skill resources must honor the active filesystem permission profile instead of reading outside its allowed roots.
## What changed
- Propagate each environment's filesystem sandbox context into `skills.read` calls.
- Apply turn-scoped permission grants when reading executor skill resources.
- Fail closed when no matching sandbox context exists or a restricted Windows read cannot be sandboxed.
- Preserve the existing resource size limit for both sandboxed and streamed reads.
## Testing
- Cover reads within permitted roots and reads that succeed after a permission grant.
- Verify denied references do not expose their contents and disabled Windows sandboxing is rejected.
GitOrigin-RevId: 5cc679b9385b0621665ff20cf5848863cc6396a4
## What changed
- Send the active turn ID in the `x-codex-image-turn-id` header for image generation and edit requests.
- Add `explicit_client_interrupt_requested_at_ms` to turn analytics. Record the earliest explicit interrupt request that receives a successful response, while excluding rejected requests.
- Track errors returned by `turn/interrupt` so pending analytics state is cleaned up correctly.
## Testing
- Cover turn ID headers for image generation and editing.
- Cover accepted, retried, and rejected explicit interrupt requests in analytics tests.
GitOrigin-RevId: 80fe996a161b4952b79c5c38238f75b7661b92af
## What changed
- Preserve `encrypted_function_args` on function calls so an empty list can mark plaintext collaboration arguments across request replay.
- Deliver `spawn_agent`, `send_message`, and `followup_task` payloads as structured plaintext agent messages when that marker is present; retain encrypted delivery otherwise.
- Redact plaintext collaboration arguments from tool and communication logs, and omit the metadata when sending requests to non-OpenAI providers.
## Testing
- Cover serialization of empty encrypted-argument metadata and plaintext versus encrypted subagent message delivery.
- Verify plaintext tool arguments are redacted and provider-specific metadata is removed from non-OpenAI requests.
GitOrigin-RevId: 64db98ff0b61a3af2f04ed609292363f2e2362a8
## What changed
- Allocate 2% of the resolved model context window to skill metadata without
imposing the previous 4,000-token ceiling.
- Keep the 8,000-character fallback when no context window is available.
- Extend catalog rendering coverage to verify that a 400,000-token context
window receives an 8,000-token metadata budget and includes more skills.
GitOrigin-RevId: 5120d462de22fbfe5f9c4ab0d1bb97e51950d4b2
## Why
Rendering host and executor skill catalogs independently allows their combined
metadata to exceed the skills context budget.
## What changed
- Allocate one budget across both catalogs when both contain model-visible
skills.
- Prefer retaining executor skills when budget pressure requires omissions,
while preserving an executor omission marker and reporting when all host
skills were omitted.
- Evaluate absolute and aliased host paths under the shared budget and select
the rendering that best preserves executor entries, total entries, and
descriptions, in that order.
## Testing
Added renderer and production-turn coverage for shared-budget description
shortening, host-first omission, executor omission markers, and alias selection.
GitOrigin-RevId: 30041736a76aa173cb641aa98a876a306cb437d2
## Why
Host skill catalogs supplied through extension world state should report budget warnings only when their catalog update is actually rendered.
## What changed
- Stop rebuilding an extension-owned host catalog in core.
- Emit host catalog budget warnings when the corresponding world-state fragment is rendered, and deduplicate them with executor catalog warnings.
- Cover full, shortened, and omitted host and executor catalogs, including repeated turns and resumed persisted snapshots.
GitOrigin-RevId: ba28b6e337281b49ed4da2175c193fd4a6898ab7
## What changed
- Add a character n-gram shadow selector that combines skill descriptions with host interface metadata and tool dependency names and descriptions.
- Bound routing fields, dependency records, and candidate counts before ranking.
- Exclude explicitly selected skills from shadow candidates and only record invocations for skills eligible for the experiment.
## Testing
- Add unit coverage for host interface metadata, connector dependencies, baseline description matches, and long routing metadata.
GitOrigin-RevId: 36ef0cb4a68601f2d9d41c3344c88f7927c32bf4
## Why
Empty rendered skill catalogs skipped catalog telemetry instead of reporting
zero-valued counts.
## What changed
- Record a default render report when thread, turn-input, or executor catalog
rendering produces no fragment.
- Record zero-valued host world-state metrics when skill instructions are
enabled but no host skills are available.
- Preserve the `catalog_surface` tag so empty host and executor catalogs remain
distinguishable.
## Testing
Add coverage for empty catalog rendering and mixed nonempty-executor,
empty-host world state.
GitOrigin-RevId: f68d65806703c0ded1ece1e5ae1ffaf6d6045126
## What changed
- Add an optional `ExtensionMetrics` capability to thread, turn-input, and world-state contributors, backed by session telemetry in the host.
- Record skill counts, omissions, and truncated description characters for extension-rendered catalogs, tagged by the catalog surface.
- Preserve host session attribution on extension metrics, including the effective model for each turn, and prevent extension tags from overriding host metadata.
- Avoid duplicate host-catalog samples by recording world-state metrics only when the section is published or changes.
## Testing
- Cover metric values and surface tags, session metadata preservation, turn-level model changes, and host world-state publication behavior.
GitOrigin-RevId: 9059e521943a8f81df25a38b03692eddbc1d990d
## What changed
- Carry a plugin's local and remote identities together from plugin loading into
`SkillMetadata`.
- Resolve remote IDs from the installed-plugin snapshot when available, falling
back to persisted install metadata only when no snapshot exists.
- Include plugin identity in skill cache keys so identity changes refresh cached
skill metadata.
## Testing
- Cover snapshot and persisted identity resolution, local marketplace isolation,
cached skill refreshes, and propagation through plugin skill snapshots.
GitOrigin-RevId: aabeeb631a43361fe817358ace7f1ea8ba5db708
## Why
Executor skills that disallow implicit invocation are omitted from `skills.list`, so an explicitly selected skill did not provide the authority and package identifiers needed to read its referenced resources.
## What changed
- Add `resource_access` metadata to injected instructions for explicit-only executor skills.
- Teach the `skills.read` description to accept that metadata as well as values returned by `skills.list`.
- Keep discoverable executor skill instructions unchanged.
## Testing
Add an app-server integration scenario that selects an explicit-only executor skill, confirms it remains absent from `skills.list`, and reads a referenced file through `skills.read`.
GitOrigin-RevId: 97d3b93d1618c013363788452303c8a31e32cc56
## What changed
- Add executor authority support to `skills.list` and `skills.read` for skills from selected capability roots.
- Allow `skills.read` to load package-relative resources referenced by an executor skill while keeping reads within the selected package.
- Paginate skill listings and resource contents with bounded response sizes and stale-cursor validation.
- Resolve executor filesystems per sampling step so skill tools use the active selected capability roots.
## Testing
- Extend the app-server executor skill test to list an executor skill, read its main `SKILL.md`, and read a paginated reference resource.
- Cover visibility filtering, metadata bounds, pagination, invalid cursors, package boundaries, and resource size limits.
GitOrigin-RevId: 1b5de95d5d1b9f79c34d2879d6e67f24401e9c29
## Why
Repeated absolute path prefixes consume the bounded skill catalog and can leave
less room for descriptions or later skills.
## What changed
- Track the discovery root for host skills and render shared roots as `r0`,
`r1`, and similar aliases when doing so improves the bounded catalog.
- Include a skill-roots table and alias-aware usage instructions whenever
compact paths are selected.
- Keep absolute, authority-aware locators when aliases provide no benefit or
the catalog contains non-host skills.
## Testing
Added unit and extension coverage for unpressured catalogs, constrained shared
paths, mixed-source catalogs, and plugin-cache root selection.
GitOrigin-RevId: 4196df2c52be27338796065cb2e6434efcfac6d5
## Why
Extension warnings need a stable thread target even when they are emitted outside an active turn.
## What changed
- Add `ExtensionWarning` and a dedicated `ExtensionEventSink::emit_warning` path with an explicit thread ID and optional turn ID.
- Deliver extension warnings as thread-scoped app-server `warning` notifications, preserving listener ordering and waiting briefly for a subscriber when no listener is active.
- Move skills warnings to the new path, limiting provider catalog warnings to four messages of 256 bytes each.
## Testing
- Cover warning routing, ordering, UTF-8-safe truncation, subscriber fallback, and invalid thread IDs.
- Verify skills warning bounds and app-server delivery of executor catalog budget warnings.
GitOrigin-RevId: 4dcb1ba7f17c0edb1a9d548f9568e0c734bffc15
## What changed
- Recognize root `plugin.json` files using the Agent Plugins 1.0 schema and map their portable metadata, `skills/`, and `mcp.json` into Codex plugin manifests.
- Apply Codex-specific apps, hooks, and interface settings from the inline `com.openai` extension, with `.codex-plugin/plugin.json` as a fallback overlay.
- Preserve legacy manifest precedence when a root `plugin.json` is unrelated, and reject unsupported Agent Plugins schema versions.
- Add a direct-child skill discovery mode that excludes nested skills and paths resolving outside the plugin root.
## Testing
- Cover manifest metadata, validation, extension precedence, legacy fallback, and direct-child skill path boundaries.
GitOrigin-RevId: eab24139f13a5cc5cb3ad3fb444d8e904511aca6
## Why
Skill catalog rendering can shorten descriptions or omit enabled skills to fit
the model context budget. Surface these reductions so users know when the
model-visible catalog has lost detail.
## What changed
- Emit a warning with the omitted skill count whenever entries do not fit.
- Warn when description shortening averages more than 100 characters per skill.
- Deduplicate executor catalog warnings across repeated world-state builds in a
turn.
## Testing
- Cover the description-shortening threshold and omission warning text.
- Verify warnings through extension and production-turn catalogs, including
per-turn deduplication.
GitOrigin-RevId: bd7fc3482e5dfd8c79072f772a2f54aa502478d9
## Why
Codex and SQLite data can use separate home directories, but state consumers
could reconstruct database paths from the Codex home instead of consistently
using the resolved SQLite configuration.
## What changed
- Pass `SqliteConfig` through the core, rollout, state runtime, and thread store
instead of passing a directory and rebuilding the configuration downstream.
- Use that shared configuration for state, logs, memories, goals, and paginated
thread-history database access, including integrity checks and cleanup.
- Reject state database handles whose SQLite configuration does not match the
requesting store.
## Testing
Add coverage with separate Codex and SQLite homes that verifies startup
backfill, thread listing, and paginated history all use the configured SQLite
directory.
GitOrigin-RevId: 1de1cdd1d6ff1d70bbb6c360c8352e6543fb8ebf
## Why
Refreshing MCP runtime state should not restart an unchanged, ready server or
relist its tools.
## What changed
- Reconcile refreshed MCP configuration against the published connection set
and reuse connections whose transport, environment, authentication, OAuth
credentials, and client capabilities are unchanged.
- Keep tool filters, timeouts, metadata, and plugin provenance in the published
server view so those settings can change without reconnecting.
- Update elicitation authority in place for reused connections, and reconnect
when connection-defining inputs or live OAuth credentials change.
## Testing
Added coverage for unchanged-server reuse, view-only and elicitation-policy
updates, connection identity changes, OAuth credential changes, and avoiding
redundant tool listing.
GitOrigin-RevId: f04f5db5fbdde127b6a14f6aa9673112c0b557e7
## What changed
- Make `McpRuntime` own the published MCP configuration, connections, elicitation routing, and selected capability roots for a thread.
- Capture immutable MCP bindings for model steps and tool calls so in-flight work keeps a consistent connection set and approval authority while refreshed state is published atomically.
- Mark MCP state dirty when relevant configuration, plugins, environments, authentication, or elicitation capabilities change, then rebuild it before the next sampling request or out-of-band MCP operation.
- Separate config reloads from server invalidation: `ReloadMcpConfig` applies resolved MCP inputs, while `RefreshMcpServers` requests reinitialization from the thread's latest state.
## Testing
- Cover refreshed state visibility for existing turns, stable step bindings, current approval authority, cancelled refresh retries, resource-client reconciliation, and Apps recovery between sampling requests.
GitOrigin-RevId: 59eabb1aa8dc083426bd18ef4d3630508f376401
