## Why
Cache presence and freshness checks deserialize full plugin records even when callers only need to decide whether a cached catalog is available.
## What changed
- Probe cache availability without deserializing plugin records, while still requiring a valid catalog envelope and a `plugins` array.
- Let `PreferFreshCache` reject stale catalogs from a 256-byte prefix when the header provides enough information; fall back to a full read otherwise.
- Limit discovery cache probes to the user and workspace scopes that need them, skipping the global cache probe.
- Serialize cached plugin slices directly without cloning them.
## Testing
Add coverage for malformed cache headers and payloads, reordered fields, stale-prefix rejection, and deferring plugin-record validation until a full catalog load.
GitOrigin-RevId: 1e5ec95917f38c84bba30dbd3bb8c2f91cc7e3a8
## Why
Tool suggestions loaded and cloned the cached connector directory even when no candidates remained after excluding accessible apps.
## What changed
- Filter out accessible connectors before loading the directory, skipping the lookup when no candidates remain.
- Share cached directory entries through `Arc<[AppInfo]>` and clone only matching entries for suggestions.
- Preserve placeholder suggestions for candidate connectors missing from the directory.
## Testing
Add coverage for skipping directory lookups with no remaining candidates, sharing cached storage, and preserving directory metadata and missing-connector fallbacks while excluding accessible apps, including disabled ones.
GitOrigin-RevId: acaf3e1564fb4e2b4f805cffe1d7db8e40d5fe3d
## Why
Attached threads need inherited context for model requests while exposing only their own turns to clients. Parent turns and token usage should not appear as activity in an empty attached thread.
## What changed
- Stop attached-thread history traversal at the parent boundary, including after reverts, and hide inherited interruption markers.
- Apply visible-history boundaries to search, realtime timelines, and turn-specific fork and revert requests.
- Suppress inherited token-usage replay on paginated fork resumes, require fork replay to reference a returned turn, and skip empty turn IDs.
- Require a paginated source for `thread/fork` with `attachToSource` and update the protocol documentation.
## Testing
Extend regression coverage for attached-thread restart and database recovery, retained parent context in model requests, child-only history, mid-turn fork boundaries, legacy-source rejection, and suppression of parent token-usage notifications.
GitOrigin-RevId: 67858caf3bb74b7e79d4dd59bed9c61055fe0ff1
## What changed
Add four advisory exceptions to `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml`, documenting the usage constraints and removal criteria:
- `RUSTSEC-2026-0391`: borrowed contexts are not reused across streams; remove after upgrading to `zstd >=0.14.3` on all paths.
- `RUSTSEC-2026-0398`: the affected seekable feature is disabled; remove after upgrading to `zstd-safe >=8.2.0` on all paths.
- `RUSTSEC-2026-0403`: callers use read decoders or initialized output buffers and discard output on error; remove after upgrading to `zstd-safe >=8.2.0` on all paths.
- `RUSTSEC-2026-0410`: the allocator bug affects `wasm32`, while Codex ships native binaries; remove when the lockfile uses `zstd-sys >=2.1.2`.
GitOrigin-RevId: 556e53be961b01191590e2ca4e9f08dd9f017eac
## Why
On Linux, a cold start from a rotational disk can exceed the ten-second readiness timeout. Extending that timeout should still let startup failures surface promptly when the daemon exits.
## What changed
- Increase the Linux readiness timeout to 30 seconds, matching macOS.
- Stop waiting for readiness when the published daemon process exits, preserving the PID reservation and reporting startup diagnostics, including stderr.
- Kill pending `ps` subprocesses when their process checks are dropped.
## Testing
Add coverage for a managed daemon becoming ready after 15 seconds and for reporting an exited daemon's stderr within five seconds.
GitOrigin-RevId: c663e52bea9039807f14ef8fc4b44aca9df3df21
## Why
ENT26 plans are billed directly in dollars, so credit estimates and credit-weighted breakdowns do not describe their thread usage.
## What changed
- Expose optional `nativeUsageUsdMicros` in app-server `ThreadUsage` responses and generated schemas and SDK types. Missing native usage means unknown, not zero.
- Enable ENT26 usage fetching and display native dollar amounts in `/status`, the status line, terminal titles, and the agents overview. Hide credits and omit credit-weighted `/status` breakdowns for these plans.
- Use native dollar amounts when tracking post-turn usage settlement for ENT26 plans.
## Testing
Add coverage for native usage forwarding, ENT26 billing displays, and settlement polling with stale, missing, or zero dollar amounts.
GitOrigin-RevId: ca8ea98141a66bdf0a27feb9f58f67822b821f5f
## Why
Hosts that only need installed plugin inventory should be able to skip startup requests for plugin discovery.
## What changed
Add the stable, default-enabled `features.plugin_discovery_prefetch` flag. Setting it to `false` skips startup prefetching of the plugin directory, featured plugins, and recommendations while preserving installed plugin cache refreshes and bundle downloads.
## Testing
Update app-server integration coverage to verify that installed plugin bundles download with discovery prefetch disabled and that no directory, featured, or suggested plugin requests are made during startup. Also cover listing remote marketplaces with the flag disabled.
GitOrigin-RevId: 7cc3072f6045131b9f1acb851f6240db75ac173e
## Why
The same-owner token-refresh tests need the original backend response to remain pending until `getAuthStatus` publishes refreshed credentials. A fixed response delay does not guarantee that ordering.
## What changed
Gate responses in the `getAuthStatus` test cases until a request-specific auth reload log confirms the credential change. Emit that log after updating the cached auth and generation, and include `auth_changed_for_refresh` as a structured field.
Extend the JSON log test helper to match events with predicates, allowing tests to identify the refresh by its request span.
GitOrigin-RevId: 698f3be499ea3c035f082c501836dae4178adaef
## Why
A duplicated or inherited file handle can keep the rollout maintenance lock held after its guard is dropped, blocking subsequent compression or migration.
## What changed
Explicitly unlock the file in `RolloutMaintenanceGuard::drop` so lock ownership ends with the guard even if another handle remains open.
## Testing
Add a regression test that retains a duplicated file handle, verifies that the lock stays held until the last shared guard is dropped, and checks that dropping the old handle does not release a newly acquired lock.
GitOrigin-RevId: 19005680dbc0a01b36c6f13e4ec358c6f00b75a0
## Why
Each turn runs an external hook, making a shared ten-second deadline too restrictive. Turn completion can also precede deletion of the queued item.
## What changed
Use the event waits' progress deadlines in the rejected-message test and wait for the queue to empty before checking results, replacing the immediate empty-queue assertion.
GitOrigin-RevId: 2b417840156893d829dc2984aa88b06a5a13aefe
Replace the fixed 200 ms sleep in
`reusing_completed_process_returns_unknown_process` with polling until
`write_stdin` reports no process ID, bounded by a 10-second timeout. This
ensures the shell has completed before asserting that reusing its process
ID returns `UnknownProcessId`.
GitOrigin-RevId: c752e9c2c0a419fa5a06ba957bee49dcaeb5d6d2
Run the deferred paste newline and standalone Enter handoff tests with
`start_paused = true` so their timing uses Tokio's paused clock.
GitOrigin-RevId: d903c0e1078b81531912e54819499b0c3a0fb307
## What changed
Change the default `thread_unload_delay_secs` from 1800 to 60 seconds. App-server threads become eligible for unloading after one minute with no subscribers and no activity. Update the configuration documentation, schema, and thread manager sample to match.
## Testing
Update the configuration test to cover the 60-second default, zero for immediate unloading, and an explicit 1800-second override.
GitOrigin-RevId: 0da8454eb25a6ef4b7e3665601982d2e0c183f7c
Remove the hard-coded 9,000-token cap for encrypted agent messages in both synchronous and asynchronous guardian context. Use `message_tokens` directly when converting the configured limit to a byte budget, allowing larger messages when the configured limit permits them.
Messages that exceed the configured budget still produce an omission notice; encrypted content remains intact when retained.
GitOrigin-RevId: a9032ca19102ebad44be8df1ac4d4892d4404ead
## Why
Memory baseline snapshots need bounded file reads, and recovery must keep existing memory files visible to consolidation rather than treating them as already processed.
## What changed
- Limit baseline files to 10 MiB, skip oversized working files, and check stored blob sizes before reading them.
- Version baselines and replace missing, outdated, or unusable metadata with an empty baseline, preserving working files as additions. Also invalidate the baseline when a tracked file grows beyond the limit.
- Serialize baseline initialization, resets, and diffs with a cross-process lock. Isolate repository access and pin index writes to the baseline worktree.
## Testing
Add coverage for oversized files, legacy baseline migration, interrupted resets, cross-process locking, and consolidation with unchanged inputs after baseline recovery.
GitOrigin-RevId: 34ecc9e5700a88ed37eff83a90f08d8a9b0d9f29
## Why
The timeout fallback test depends on short wall-clock deadlines and a server-side sleep, making its timing dependent on thread scheduling.
## What changed
Use a paused Tokio clock and advance past the timeout only after the server receives `HEAD`. Keep the blocking server task alive until the probe consumes the `GET` response to prevent automatic clock advancement during socket I/O.
Assert both request lines and retain the check that the fallback returns `HTTP 405`.
GitOrigin-RevId: da7b2fa9c67e662648da8568ce7f8cfde153dc12
## Why
The context inheritance tests enabled `MultiAgentV2` but invoked `spawn_agent` through the V1 namespace, leaving the V2 path untested.
## What changed
- Share a helper that spawns through the V2 namespace, waits for child completion, and identifies the child's request by its thread ID.
- Assert that the child receives inherited instructions in a `developer` message and its task in an `agent_message` addressed to `/root/worker`.
- Test skill instructions both enabled and disabled for parent and child requests, with an explicit skills extension and discovery isolated to the fixture skill.
GitOrigin-RevId: 193fca57398e950acad1f020382dc1bae6453df4
## Why
Commands that fall back without using a shell snapshot should remain associated with their configured snapshot mode in telemetry.
## What changed
Add a `shell_snapshot_mode` telemetry tag to `exec_command` with values `disabled`, `v1`, or `v2`. Give `v2` precedence when enabled. The tag records configuration, not whether a command actually used a snapshot.
## Testing
Add parameterized coverage for all four combinations of snapshot feature flags using a non-login command, which cannot use V2 snapshots.
GitOrigin-RevId: 2dd9e79b9e02448938166254ea1b988034a81b5e
## Why
The fixture token `new` can appear in randomly generated Base64 public keys, causing the executor registration response's credential check to reject valid test responses.
## What changed
Use hyphenated fixture tokens that cannot occur in Base64 keys. Set the retry test's X25519 public key to a value containing `new` so the former collision is exercised deterministically.
GitOrigin-RevId: 059043eddc388a69c4659d6cdcac6ee107ae1973
## Why
Some I/O errors can repeat without advancing the dotenv iterator, causing environment loading to loop indefinitely.
## What changed
- Only open the Codex home `.env` path when it is a file.
- Stop processing entries on I/O errors other than `InvalidData`, while continuing past invalid UTF-8 lines and parse errors.
GitOrigin-RevId: 4b79b5e87b6924b342265e0688ebe59fefea4637
## What changed
Add `codex queue --resume` to resume an unloaded thread after queueing a message through the local daemon or selected `--remote` server. Already loaded threads are left running. If resumption fails, emit a warning while preserving the successful queue result.
Read only the thread status when checking whether to resume, allowing remote metadata to contain paths from another operating system.
## Testing
Extend CLI integration coverage for unloaded threads consuming queued messages, archived thread rejection, and successful queueing when another server owns the thread and rejects resumption.
GitOrigin-RevId: cc8aa3c11a37e990da36e6ff9a17934f73322e7b
## What changed
Remove unused pending initial-yield state and its plumbing from cell completion handling. Route completion delivery through `send_cell_event`, retaining the completion event and original timestamp when an observer has disconnected.
## Testing
Extend `failed_completion_delivery_rebuffers_the_event` to verify that failed delivery attempts preserve output and report the full elapsed buffering duration on a later successful observation.
GitOrigin-RevId: eebe990a4f8258f1ccb12d0694945678f0cc3a8f
## Why
Pairing can take up to 30 seconds in the daemon, but the client used a two-second timeout when waiting for each response message.
## What changed
Apply a single 35-second deadline to `start_pairing`, including connection and initialization. Wait for the pairing response without a per-message timeout so status notifications cannot extend the overall deadline. Preserve the existing per-message timeout for other remote control requests.
## Testing
Extend the manual pairing test with a three-second response delay and add coverage verifying that a status notification does not reset the pairing deadline.
GitOrigin-RevId: c011fd131262b30baa21e17bc0e0f733dce53fb0
## Why
A running turn can record stale permissions after the thread accepts a settings update. Resuming or forking from that history should preserve the accepted approval and permission settings.
## What changed
- Prefer settings snapshots owned by the source thread over stale turn contexts, including later legacy updates associated with that thread's checkpoint.
- Restore unnamed permission profiles from attributable settings updates while honoring explicit request overrides. Avoid restoring raw permission grants from history without an identifiable owner.
- Share permission restoration logic between resume and fork.
## Testing
Add regression coverage for stale turn contexts, legacy updates across thread ownership boundaries, and unnamed permission restoration on resume and fork.
GitOrigin-RevId: 450bc1688be78c7ec685f6dc56bcc5e5dd2d130a
## Why
NFS database migration rejected files with group or other access. Allow accessible databases to migrate while making the effects on file access explicit.
## What changed
- Preserve file mode bits during migration while requiring owner read and write permissions on replacement files.
- Before CLI consent, disclose that replacements belong to the current user and do not copy the original owner, group, or extended ACLs. Require explicit confirmation for files with permissions other than `0600`.
- Warn at Linux TUI startup when NFS databases need migration and permission confirmation. Inspect journal mode without accessing WAL shared memory or releasing another connection's locks.
- Allow five seconds to acquire the exclusive database lock during migration.
## Testing
Add CLI coverage for consent, access disclosures, and migration of `0644` files. Extend state tests for permission preservation, rejection of missing owner access, and interrupted migration recovery; snapshot the startup warning.
GitOrigin-RevId: 2d9c3663172c3e631a787dc1dc76db95c39e6aa1
## Why
Existing databases retain their journal mode, so selecting `DELETE` for new NFS databases leaves existing WAL databases unchanged.
## What changed
- Add the managed `unsafe_enforce_sqlite_journal_mode` requirement to migrate existing NFS databases before opening writable pools and require `DELETE` on each connection.
- Share migration code between startup and `codex migrate-nfs-db`, preserving WAL backups and resuming interrupted replacements, including lazily opened databases.
- Hold the migration lock through pool initialization and keep migration failures out of automatic corruption recovery.
- Preserve local logs behavior and skip legacy NFS logs cleanup when enforcement is enabled.
## Testing
Add coverage for requirement precedence, database settings, data and backup preservation across restarts, interrupted replacement recovery, refusal of active WAL databases, migration lock waiting, and local logs remaining in WAL mode.
GitOrigin-RevId: da41ec1b58b1ee8092591cdf8b358280928ff9d4
## Why
Leaving transcript selection with a held key can send repeated input to the composer and submit a preserved draft.
## What changed
- Route the transcript selection shortcut and selection controls in both the owned transcript and transcript overlay, preserving drafts and ignoring pastes outside search.
- Give fixed selection controls and pager motions precedence over conflicting key chords while allowing search and voice controls.
- Consume held exit keys across selection dismissal and asynchronous copy completion, and require fresh presses for composer submit and queue actions.
- Initialize overlay selection against the refreshed transcript frame and complete selection navigation when older history finishes loading.
## Testing
Add regression coverage for draft preservation, repeated `Enter` events, selection and search key precedence, refreshed-frame selection, and pending copy exit-key cleanup.
GitOrigin-RevId: 6cca9f399af1d49ff79337ae745cfc1564a14b88
## What changed
- Add `tui.keymap.global.select_transcript` with an implicit `leader [` shortcut that follows the configured leader, respects explicit remapping or unbinding, and yields to existing bindings.
- Connect transcript overlays to keyboard selection, including Find, mouse selection, and navigation to the beginning of paged history. Give selection commands priority over remapped pager shortcuts.
- Close selection overlays on exit or after a confirmed copy-and-follow operation, preserving the pending close decision while clipboard confirmation is asynchronous.
- Show selection navigation and copy hints that adapt to the available footer width.
## Testing
Add coverage for shortcut dispatch, remapping, unbinding, and conflicts; overlay exit behavior; selection across history paging; mouse and keyboard selection interaction; and cursor and footer rendering snapshots.
GitOrigin-RevId: 8a920e5fa2b06ff0544d829ba30f8ecb654db0ee
## What changed
- Support `/` to open Find in selection mode and `Enter` to move the cursor to the match, extending an active selection.
- Repeat the accepted search from the cursor with `n` for older matches and `Shift+n` for newer matches. Cancel pending repeats when the cursor or selection changes.
- Restore the previous search, cursor, and selection when cancelling a new search, and reuse the previous search when accepting an empty query.
- Align the cursor to selectable graphemes and preserve expanded matches when leaving selection mode.
## Testing
Add regression coverage for search acceptance and cancellation, repeated searches, Unicode cursor placement, expanded output retention, and history pages loaded while a search is saved.
GitOrigin-RevId: 077be52a54d5e006f65eacc4634baf8c089d3662
## What changed
- Add word motions (`w`, `b`, `e`), logical line boundaries, page and half-page motions, and jumps to the transcript's beginning and end. Honor configured pager bindings for navigation.
- Add whole-line selection with `V` and active-end swapping with `o`.
- Adopt existing mouse selections when entering select mode, preserving selection units and endpoint bounds so keyboard motions can adjust the range.
## Testing
Add regression tests for word motion across entries, reverse whole-line selection, empty-line boundaries, configured pager motion, final-grapheme selection, endpoint swapping, and caret placement after copying.
GitOrigin-RevId: f0cd05900f2a7a15840777cee4d50659a2c8b134
## What changed
Track cumulative compressed and uncompressed payload bytes, message counts, and percentage savings for each connection and direction. Use paired Zstd codecs for listener and native client connections, sharing a connection ID between transmit and receive statistics.
Log totals as traffic is processed at 60-second intervals and when codecs are dropped. Transmit totals include encoded payloads even if the subsequent socket write fails; receive totals count only successfully decoded messages.
## Testing
Extend compression tests to verify shared connection IDs, matching transmit and receive totals, savings calculations, and exclusion of oversized messages rejected during decoding.
GitOrigin-RevId: 32602caa85864de7a4e0d28907311af6f67d8db2
## What changed
Advertise `zstd-stream-v1` compression for WebSocket and Unix socket connections and use the negotiated codec for JSON-RPC messages. Retain compression history for the connection and keep plain-text messaging when compression is not negotiated.
Fragment compressed writes to respect the server's advertised frame limit, reject text messages in compressed sessions, and stop using the connection after a failed write to avoid mismatched compression history.
## Testing
Add an integration test covering compression negotiation, fragmentation, retained codec history, request/response handling, and disconnection on an uncompressed text message.
GitOrigin-RevId: 510073444ea49376a116c05214bcb79bd0bc3b50
## What changed
- Add a source coordinator that streams rows as backends reply, preserves each source's pagination cursor and listing mode, and rejects stale replies.
- Route previews, transcripts, archive, and restore requests to the selected row's backend.
- Keep healthy results visible when a source fails, and fall back from an empty or failed initial database listing per source.
- Cancel reads when the picker closes while allowing accepted mutations to finish.
The app-server picker now uses the coordinator with a single source.
## Testing
Add regression coverage for independent source replies, pagination and fallback, action ownership, stale replies, disconnected sources, and mutation completion after picker shutdown. Add a snapshot for the partial-backend failure warning.
GitOrigin-RevId: 1b565c680133d460f4a29c9946a8398e9c950773
## What changed
- Configure the code-mode host to send zstd-compressed responses when clients advertise support, and enable both client transports to accept them.
- Preserve uncompressed responses for clients that do not advertise zstd support.
- Patch `tonic` in Bazel builds to use zstd compression level 1, favoring response latency over compression ratio.
## Testing
Extend the TCP session integration test to check response encoding and successful session opening for both zstd-capable and uncompressed-only clients.
GitOrigin-RevId: b6cf0da51dd30fc2ac9a1b0af11bec26555c559d
## What changed
Extend `mcp_connection_sharing` to pool compatible local stdio connections that negotiate MCP `2026-07-28`. Keep legacy servers and servers that request input during startup private.
Preserve each chat's tool catalog and route input requests to the calling chat. Release connections independently for each chat, shutting down the shared server after the final release, and retire pooled connections on forced refresh without interrupting other chats.
## Testing
Add pool, runtime, app-server, and core scenario tests covering protocol gating, startup cancellation, refresh, final-release shutdown, and separate tool visibility and simultaneous input responses across chats sharing one process.
GitOrigin-RevId: 896b107267a20ec1bffccdefca6c40fe2945a022
## Why
Stdio servers without `CODEX_MCP_PROTOCOL_VERSION` use the legacy handshake, even when they support MCP `2026-07-28`.
## What changed
- Add the disabled-by-default `mcp_connection_sharing` feature to enable discovery for eligible local stdio servers.
- Recover from failed or late discovery with a fresh handshake when needed, waiting for the previous helper to release resources before restarting.
- Retain a working legacy connection when an upgrade attempt fails for the same account, except on authentication errors.
- Keep tool catalogs separate by protocol and invalidate legacy catalogs when discovery negotiates the modern protocol.
## Testing
Add regression coverage for failed and late discovery, legacy fallback, protocol-specific catalog reuse, message limits, and Windows descendant cleanup.
GitOrigin-RevId: 36c675ef3b81d32fccf06ccbddda2312cfe602c9
## What changed
Include critical-path capture status and duration totals in `codex_turn_event`, with categories for inference, auto review, user wait, tools, overhead, and unknown time. Count sampling and compaction as inference.
Distinguish `disabled`, `incomplete`, and `complete` capture. Emit null durations for disabled or incomplete capture so missing measurements are not reported as zero. Freeze the completion timestamp so repeated terminal notifications preserve the original measurement window.
## Testing
Add core and analytics tests for capture status, duration reporting, rounding, and repeated completion. Add app-server integration coverage for completed and interrupted turns with default, enabled, and disabled capture.
GitOrigin-RevId: c6c867120ee563ac48584c2f4b12df23acbabe06
## Why
The standalone Unix update pipeline could return success when `curl` failed because the shell consuming its output exited successfully.
## What changed
Download the installer into a shell variable and evaluate it only after a successful download, preserving `CODEX_NON_INTERACTIVE=1`. Update the displayed update command to match.
## Testing
Add a Unix regression test that forces an installer download failure and asserts a nonzero exit status. Update the update-available snapshot for the new command.
GitOrigin-RevId: cf6ce0dae483203e3609bb35f35eb04bb3096c28
## Why
Automatic reviews and user prompts previously invalidated critical-path captures even when their owning tool invocation was known.
## What changed
Record automatic review time as `auto_review` and waits for approvals, permission requests, and user input as `user_wait` when `CriticalPathTiming` is enabled. Bind timing to the owning invocation before asynchronous work begins, and use the triggering tool's identity for network approvals. Continue invalidating captures when a wait cannot be attributed.
## Testing
Add coverage for cancellation, reused call IDs, network ownership, and disabled capture. Update the automatic review integration test to verify attributed review duration.
GitOrigin-RevId: 0a1f5feebd0c4f5ed67dc058e832ec5f8818db02
Add `RUSTSEC-2026-0387` to the `cargo audit` and `cargo deny` ignore lists for `crypto-bigint` 0.5.5, pulled in through `elliptic-curve` 0.13.8.
Document the affected dependency paths and the potential timing leakage during private-key or session-secret operations. Remove the exceptions when those paths use `crypto-bigint` 0.7.6 or later.
GitOrigin-RevId: 7ff42c9b127900ddf772bf1cc88947f6e7dfcd10
## What changed
Add `untrusted_as_tool_output` as an under-development feature, disabled by default, and expose it in the configuration schema. The flag is intended for rendering client-supplied untrusted context as standalone named tool outputs.
GitOrigin-RevId: 6fe630c8d380a87edb48e08887215c1ec17447ed
## Why
`PermissionRequest` and `PostToolUse` hook inputs could report the turn's working directory instead of the local command's execution directory. This also affected commands whose results were collected in a later turn after the working directory changed.
## What changed
- Report the local command's execution directory in hook input `cwd`, consistent with `PreToolUse`.
- Preserve the original directory through `write_stdin` approvals and delayed completion, including network permission requests.
- Retain the host directory for remote commands and keep hook process working directories unchanged.
## Testing
Add coverage for relative and absolute workdirs, approval denials, command rewrites, completion and stdin approval across turns, remote command fallback, network approvals, and Unix and Windows path formatting.
GitOrigin-RevId: ef5dad2a0634dda9edb2f841ef4fe49ae0d1187d
## What changed
Instrument the returned tool runtime future with the same dispatch span as the spawned dispatch task, keeping completion and cancellation handling in that span.
## Testing
Extend the detached code-mode callback test to assert that the router's `dispatch_tool_call_with_state` span has `dispatch_tool_call_with_code_mode_result` as its parent.
GitOrigin-RevId: e4d4bef26563554bf703b3e4f05490e25d8eb0ad
## What changed
Add the default-disabled `critical_path_timing` feature to capture dependency paths for root-agent turns. Connect direct tool dispatch, execution-lock handoffs, and completed tool batches to turn timing so overlapping work shares its common history without double counting.
Omit captures for unsupported dependencies, including CodeMode, agent communication, approval review, and user waits. Settle aborted tasks before freezing timing, invalidate captures on forced teardown, and apply runtime feature changes only to future turns.
## Testing
Add coverage for serial and overlapping tool dispatch, execution-lock dependency handoffs, cancellation, unsupported paths, frozen timing after completion, and configuration refresh boundaries.
GitOrigin-RevId: 71458b654b1c4a05799886928b449c948ea33109
## Why
Truncating a JSON summary at the 240-byte limit can panic when the cutoff falls inside a multibyte UTF-8 character.
## What changed
Truncate at the nearest preceding character boundary before appending `...`.
## Testing
Extend the JSON tool-call reuse test with multibyte arguments and assert the truncated summary and original payload reference.
GitOrigin-RevId: e4b2af17eb6e3abaeb042772944305c6e1744bdf
## Why
`PreToolUse` hooks receive the host working directory even when a local
`exec_command` call specifies a different `workdir`. This prevents hooks from
seeing the directory in which the command will execute.
## What changed
- Share working-directory resolution between command execution and hook input,
using the selected environment and the command's `workdir`.
- Report the resolved local directory in the hook input's `cwd`. Keep hook
processes in the host directory and retain the host `cwd` for remote commands.
- Reject invalid environment selections or paths before running hooks and record
failures in tool-result telemetry.
## Testing
Add unit and integration coverage for default, empty, relative, and absolute
working directories; Windows path conventions; remote commands; hook denial and
input rewriting; and invalid arguments that fail without running hooks.
GitOrigin-RevId: 97f71f6d3e21a5d95a7abf5384f06f4993241797
## What changed
Omit zero-count actions and use singular or plural wording when summarizing skill changes. For example, show `Disabled 1 skill` instead of `0 skills enabled, 1 skills disabled`.
## Testing
Add a snapshot test covering enable-only, disable-only, mixed, and unchanged skill states, including no summary when nothing changes.
GitOrigin-RevId: ff68c799f29ceb8736e6941778d29a3f8d500b70
## Why
Concurrent requests on a shared MCP connection need to route prompts to their own callers and pause only their own timeouts while awaiting input.
## What changed
- Add `call_tool_with_elicitation` and `read_resource_with_elicitation` with per-request callbacks and timeout pause state, requiring MCP protocol `2026-07-28`.
- Share continuation handling between tool calls and resource reads, and assign globally unique input IDs across requests and connections.
- Add `enable_request_cancellation` to extend cancellation on dropped response futures to catalog, resource, and custom requests.
## Testing
Add or extend tests for concurrent form and URL input routing, unique prompt IDs, independent native verification cancellation and timeouts, resource continuations, and remote cancellation when resource or custom request futures are dropped.
GitOrigin-RevId: ad5a3cd0e289726828a694d00c20870e2d1108c6
## Why
Tool interception and MCP aliases can route a requested callable to a different handler. Rollout traces need to reflect the handler that actually executes, including when an `exec_command` invocation is intercepted as `apply_patch`.
## What changed
Carry an explicit `ToolCallKind` in runtime-start events and use it to update the tool call's execution classification. This replaces MCP-specific payload inspection while preserving the original callable summary and invocation for intercepted patch and aliased MCP calls.
## Testing
Add a regression test verifying that an intercepted `exec_command` is recorded as `ApplyPatch`, retains its original summary and invocation, completes successfully, and creates no terminal operations or sessions.
GitOrigin-RevId: 0e72f3ef55cda2796e779efd16241e4a0dbf0c5b
## Why
Invalid model arguments to `write_stdin` represent a tool failure, but parsing them could fail rollout trace replay.
## What changed
Skip terminal operation creation when dispatched `write_stdin` arguments cannot be parsed or lack a usable `session_id`. Preserve the generic tool call and its error, including the original arguments, so replay can continue.
## Testing
Add a regression test covering malformed JSON and missing or null `session_id` values. Verify that replay retains the failed call's arguments and error without creating terminal operations or sessions.
GitOrigin-RevId: 967e975a88072c169eb3e391d5c62e807d608fbf
Charlie Marsh