## What changed
Add the manual `//third_party/voice:native_runtime` target for macOS and GNU Linux. It consumes the native prefix archive, validates the completed build receipt against the target and source manifest, inspects libraries, and prepares verified copies using the existing platform policies.
Record the build commit through Bazel workspace status and include it in runtime receipts. Reject invalid or ambiguous commit metadata and escaping library aliases. Keep macOS preparation local and allow the system `libc++.1.dylib` dependency.
## Testing
Add tests for receipt validation, inspection ordering and failures, invalid commit metadata, and escaping archive links. Add a macOS integration test for preparing real libraries from a sandbox-linked archive with native aliases and either an absent or empty output directory.
GitOrigin-RevId: 23717ab33d1d3da5fb0042c1cc8e8efcd333c386
## What changed
Route the TUI's subagent and memory enable prompts through server config writes for new threads, leaving the current thread unchanged. Report success, configuration overrides, or failures after the write completes, and clarify the scope in the prompts.
Write both `features.memories` and the legacy `features.memory_tool` key for compatibility with older app servers.
## Testing
Extend tests to cover writes to the selected server config, preservation of current settings, legacy memory key updates, and managed configuration overrides. Update prompt snapshots and verify that confirmation emits the new save event.
GitOrigin-RevId: ec331db675b38102851899a4aa878d6fe8e9606e
## What changed
Add `//third_party/voice:native_prefix` to run the existing native build recipe with Bazel-declared archives and toolchain inputs on matching macOS and Linux GNU 2.28 targets for x64 and ARM64. The manual target exports `prefix.tar` and a `built.json` receipt through the `receipt` output group.
Keep macOS actions local to access Apple tools, use Apple's linker for libffi partial links, and preserve compiler runtime flags through libtool on Linux. Surface upstream build failure logs in the Bazel action output.
Document the build's host utility requirements and the distinction between the raw prefix and a relocatable SDK or runtime package.
GitOrigin-RevId: b4917943f621dec07bb994392619e8a42e496b8b
## What changed
Add the disabled-by-default `reasoning_effort_override` feature for OpenAI models with `use_responses_lite` enabled. Append a trusted `configuration_update` after accepted input when no effort is established in surviving history or the resolved effort changes. Preserve the existing history prefix and continue sending the request-level reasoning effort.
Share effort normalization through `ModelInfo::resolve_reasoning_effort` so requests and history updates resolve `ultra` consistently and translate `persistent` to `disabled`. Exclude other custom effort values from history updates, and compare only against harness-authored configuration items.
## Testing
Add integration coverage for effort transitions, deduplication, history prefix and cache-key preservation, alias normalization, and feature/provider/model gating. Add unit coverage for model-specific `ultra` resolution, fallbacks, and `persistent` translation.
GitOrigin-RevId: c3fe7050058076454d8ea20054a618bca9d48c7c
## Why
Native voice builds ignore ambient compiler flags, but need a way to accept declared compiler, linker, and archive-tool inputs.
## What changed
- Add repeated `--c-flag`, `--cxx-flag`, and `--link-flag` options plus optional `--ar` and `--ranlib` paths for Unix builds. Record flags and pass them through CMake, Meson, and libffi, including Objective-C flags on macOS.
- Preserve literal libffi compiler arguments with response files. Reject flags containing whitespace, libffi paths requiring shell quoting, and Unix toolchain overrides on Windows.
- Add a pinned Bazel `pkg-config` tool built with LLVM archive tools and native macOS configure checks. Register the pinned Make toolchain and patch its bootstrap to pass preprocessor flags and enable cross-compilation configuration.
## Testing
Extend native-build tests to verify compiler and linker flags, explicit archive tools, Meson and Objective-C inputs, literal definitions through shell and recursive Make expansion, and rejection of unsupported overrides.
GitOrigin-RevId: e5ea541ec76abfa170f6b0411b0f14cd698c07e7
## What changed
Replace `features.guardian_thread_context` with `features.guardianv2.thread_context` and update the configuration schema. The setting controls thread-owned context for synchronous and asynchronous Guardian, defaults to `false`, and remains independent of `features.guardianv2.enabled`.
## Testing
Update configuration tests to cover the nested setting, profile overrides, and enabling thread context while Guardian v2 is disabled. Migrate Guardian approval, history, and async scorer tests to the new configuration key.
GitOrigin-RevId: 54a91555eb68001e0adedc8a07bdbc5ea2273f9b
## Why
The Rust GStreamer bindings link GLib's GIO library even when none of the selected plugins imports it. Following only plugin dependencies can omit a library the bindings need.
## What changed
- Export `gio-2.0` pkg-config metadata in the voice SDK.
- Require GIO as a runtime dependency root on Linux, macOS, and Windows, including its transitive dependencies under the existing import checks.
- Reject runtime packages that omit the required GIO library.
## Testing
Extend fixtures to cover GIO inclusion and missing-library rejection across platforms, loading GIO and its transitive dependency after moving a Linux runtime, and resolving `gio-2.0` through pkg-config after moving an SDK.
GitOrigin-RevId: d12e45d387d56c54d94d788cf07d82bb22c2b4a3
## What changed
- Intercept incoming Opus RTP before the upstream track queue, preserving arrival timestamps without retaining a second queued copy.
- Limit outstanding media to 64 packets and 2 MiB, with a 64 KiB per-packet limit. Keep packet and byte permits until the received data is dropped.
- Reject unexpected payload types, changes in SSRC, oversized packets, and exhausted budgets. Report an error when a packet is more than one second old.
- Start with incoming audio suppressed and connect suppression to `speaker_suppressed`. Discard packets from earlier suppression epochs.
- Drain received packets in the host loop; decoding and playback are not implemented by this change.
## Testing
Add unit coverage for RTP bytes and arrival timestamps, budget ownership, suppression epochs, and invalid or oversized packets. Extend transport tests to verify incoming Opus delivery over UDP and TCP, including simulated packet loss and delayed TCP connection setup.
GitOrigin-RevId: 60237efafdf2acc1c9c4c5d2728e978b8131d9e6
## What changed
Add `third_party/voice/sdk.py` to export headers, development libraries, and selected pkg-config metadata from an inspected native build. Verify shared libraries against inspection receipts and record the target, source commit, source manifest hash, and exported file hashes in `sdk.json`.
Enable relocatable Meson pkg-config metadata and materialize development library aliases. Reject mismatched receipts, paths escaping the build prefix, nonrelocatable metadata, and unsafe output locations; remove partial output on copy failure. Document SDK consumption as build inputs separate from packaged runtime files.
## Testing
Add tests for exported hashes and pkg-config resolution after moving the SDK and deleting the original prefix, alias materialization, invalid inputs, and cleanup after copy failure.
GitOrigin-RevId: 6d1575e659a02cd1f56e465e7830a296e8eaf486
## What changed
- Add `RealtimeWebrtcSession` and cloneable handles for startup, answer negotiation, audio controls, level meters, and error reporting.
- Open devices after answer negotiation and apply the latest controls before enabling audio. Preserve subsequent control transitions in order and close the session if the command queue fills.
- Cancel pending work on explicit close, external cancellation, or final handle drop, with a shared runtime keeping helper reaping alive.
- Add audio-state polling to consume microphone and speaker peaks and detect helper, device, or connection failures.
- Check packaged helper/runtime availability and initialize build information in the standalone TUI for the helper handshake.
## Testing
Add unit and helper-process integration tests covering startup control ordering, queue overflow, cancellation, helper reaping and loss, package availability, SDP debug redaction, and peak accumulation, clamping, and consumption.
GitOrigin-RevId: 458cd80353697f7411cee785f380d1d53aef8416
## Why
`voice-host` previously drained captured audio locally without sending it to the peer. Connect capture to the outgoing media track while preserving mute boundaries and limiting stale audio.
## What changed
- Resample capture and render references to 48 kHz with Rubato, apply Sonora echo cancellation, noise suppression, and gain control, and encode capture as 20 ms mono Opus packets.
- Attach an Opus track to the WebRTC peer and advance RTP timestamps across mute gaps without introducing sequence-number gaps.
- Prioritize queued controls and shutdown between sends. Clear pending audio and processing history on microphone mute transitions, reject delayed pre-unmute buffers, and reset partial history after capture gaps.
- Size bounded capture and render queues for device rates, validate callback timing, enforce a 500 ms processing deadline, and time out stalled sends after 100 ms.
Receive/decode and TUI integration remain unimplemented. The bundled Opus encoder build requires CMake and a C compiler.
## Testing
Add synthetic-audio tests for Opus decoding at 44.1 and 48 kHz input rates, echo reduction, capture gaps, stale audio, queue capacity, and control priority. A loopback WebRTC test verifies RTP delivery, decoded signal, mute isolation, and timestamp and sequence continuity across mute gaps.
GitOrigin-RevId: 38b8438577cfadb8124f8aeb426dffbab4845964
## Why
The bundled Opus encoder uses CMake and should not depend on tools available on a build worker's `PATH`.
## What changed
- Add `rules_foreign_cc` and provide its pinned CMake and Ninja tools and data to the `opusic-sys` build script.
- Add a CMake toolchain file that selects the declared Ninja executable, resolves the archiver path, and sets the target system and processor from `TARGET`, while retaining Bazel's compiler, SDK, and linker inputs.
GitOrigin-RevId: 48580c506d088d8c76cce958589ff94da458bd79
## What changed
- Add `openDevices` and `setAudioControls` to the helper protocol. Open the default microphone and speaker after runtime initialization and transport negotiation, initially muted and suppressed.
- Use CPAL on macOS, GNU Linux, and MSVC Windows, with native audio dependencies confined to `codex-voice-host`. Add ALSA development dependencies to Linux CI.
- Pack callback samples into preallocated, bounded queues and service devices every 5 ms. Reject incompatible callback configurations, invalidate queued audio on control transitions, and reject capture backlog after unmute using device timestamps.
- Handle recoverable stream underruns and overruns without terminating the helper; terminate on device failure, active audio queue overflow, or stale queued audio.
Device opening only establishes local device readiness. Capture and rendered audio references are drained locally; encoding, decoding, and peer audio are not connected by this change.
## Testing
Add unit tests for mute boundaries, stale playback invalidation, sample bounds, partial-block packing and timestamps, callback size and timing limits, startup silence, queue overflow, and recoverable stream errors.
GitOrigin-RevId: 108aea3d411ef6c12908fe5fb67aaf9cddf4475f
## Why
An initial `/apps` request failure with no cached or partial app list left the popup showing “Loading apps...”.
## What changed
Replace the loading popup with a generic failure message and a `Retry` action. Retrying forces a refresh and restores the loading state while the request runs.
## Testing
Add a regression test and snapshot covering the error display, omission of raw request errors, and retry transition back to loading.
GitOrigin-RevId: 9b1974dbc5065a6d3695d881f216f8060d4381a9
## Why
`--worktree` previously supported only `codex exec` and `codex exec fork`. Interactive sessions need the same managed checkout support, with configuration and policy resolved for the destination before starting a turn.
## What changed
- Enable `codex --worktree` and `codex fork --worktree <session-id>` behind the `worktrees` feature, restricted to local sessions. Interactive forks require an explicit session selector.
- Resolve interactive and exec worktree forks from the session's latest saved working directory unless `--cd` is supplied. Keep relative `--add-dir` paths anchored to the invocation directory.
- Load interactive destination configuration before telemetry and login policy initialization, and bind checkout ownership before the first turn.
- Reject explicitly untrusted sources, including when destination cloud policy or refreshed configuration reveals distrust. Retain unbound interactive checkouts after startup failure and report manual recovery instructions.
## Testing
Add CLI integration and TUI tests for startup and named forks, destination instructions and configuration, ownership before the first request, trust enforcement, and retained-checkout recovery. Extend exec coverage for saved fork directories, explicit `--cd`, relative writable roots, and cloud policy rejection.
GitOrigin-RevId: 371583f7feca73b218a4ff188b2b85812c8439e6
## Why
`/copy` only offered the last assistant response and its code blocks or quotes, leaving `/status` output unavailable in the copy picker.
## What changed
After `/status`, offer the whole status as plain text, the model, the full directory path, and the thread name and session ID when present. Preserve the displayed status fields across repeated copies and include refreshed rate limits in whole-status copies.
Return to assistant-response copying after a later user message, assistant response, or command other than `/copy`. Rename the picker to “Copy to clipboard”.
## Testing
Add snapshots and regression tests covering status text and field selection, missing fields, full directory paths, repeated copying, refreshed limits, and returning to response copying after subsequent turns and commands, including queued commands.
GitOrigin-RevId: 9424cdca9753c834971992ca29494161957b50c4
## Why
Seeding recent history for the agents overview should not trigger a startup filesystem scan for unindexed rollouts.
## What changed
Set `use_state_db_only` to `true` on the overview's initial recent-thread list requests so they use only the state database.
## Testing
Extend the shared overview regression test with a newer, unindexed rollout and verify that the overview still contains the expected indexed history and loaded threads.
GitOrigin-RevId: b20861bef5b49fa2aa2a3b0953f069528b6f0c4f
## Why
Calling `app/installed` with `threadId` and `forceRefresh: true` refreshed a separate runtime snapshot without updating the thread's tools for subsequent turns.
## What changed
Use the thread's current configuration and refresh its live app tools when a thread is specified. Account for the refreshed snapshot's model-visible tools when reporting `callable`. Requests without `threadId` continue to use a separate runtime for refreshes.
## Testing
Add integration coverage verifying that refreshed tools replace previous tools in subsequent model requests and can be called, and that a failed refresh preserves the last working tools. Extend thread configuration coverage to include forced refreshes.
GitOrigin-RevId: fc13e28a59da00af470cf25c0cde356504e1575b
## Why
Refreshed Apps catalogs need to survive connection reuse. Catalog revisions scoped to the connection set can lose refreshed tools during reconciliation and invalidate prepared calls for unrelated servers.
## What changed
- Store tools, revisions, and refresh coordination on each MCP client, and key cached bindings by client identity and revision.
- Preserve existing binding snapshots while rejecting stale calls before preparation. Wait for active calls to finish before publishing a refreshed catalog.
- Add `CodexThread::refresh_codex_apps_tools` to reconcile the runtime and return the refreshed client's raw Apps inventory alongside tool names eligible under that runtime's generic MCP policy. Keep hidden and disabled tools in the inventory for callers to apply app-specific policy.
## Testing
Add regression coverage for refreshed catalogs surviving client reuse, unrelated calls remaining valid, binding cache invalidation, and refresh snapshots retaining the client's own inventory when another client wins the shared-cache race. Update stale-call and preparation tests to use client-owned catalogs.
GitOrigin-RevId: f2308c81f7474eb31f3380c091c977030123cda2
## Why
Classification metrics report failures without distinguishing their causes, and WebSocket connection attempts lack a dedicated duration metric.
## What changed
- Add `failure_reason` tags to classification counters and duration histograms, covering setup, sampler, and output-processing errors.
- Record `codex.guardian_v2.connection.duration_ms` for WebSocket connection attempts with endpoint, outcome, and failure reason tags.
- Map sampler errors to fixed, low-cardinality categories instead of using error messages that may contain server responses or credentials.
GitOrigin-RevId: bb366be92af2f605643ea7cd527678fa8dbfe53f
## What changed
Capture the ID from `response.created` and pass it as `parent_response_id` in Guardian review and classifier request metadata. Clear the current response ID before sampling retries so tool reviews cannot inherit a failed response's ID.
Request Guardian credits with `guardian_credits_requested` on eligible parent requests. Remove the ticket protocol, transport attachment, and ticket-specific body redaction. Keep ordinary app-server client `parent_response_id` values inside `x-codex-turn-metadata` rather than promoting them to Guardian request metadata.
## Testing
Update coverage for HTTP fallback, WebSocket review reuse, missing response IDs, classifier transport retries, and code-mode yield/resume attribution. Extend app-server tests to verify client metadata placement over HTTP and WebSocket.
GitOrigin-RevId: c1665e56382ecec8d260fc2ca0ecd5e20b0b2391
## Why
Reverting a paginated thread can remove the turn context that records its resolved multi-agent version. Preserve that version so a model-selected V2 thread keeps its collaboration tools after reload or a server restart.
## What changed
Pass the live thread's `multi_agent_version` into the thread store and persist it in the replacement rollout's session metadata. When no live version is supplied, retain the existing metadata value. Document this guarantee for `thread/revert`.
## Testing
Add regression tests for model-selected V2 across live reload and cold resume, plus metadata preservation for `V1`, `V2`, and `Disabled` across repeated reverts.
GitOrigin-RevId: bd7d4d76a50d23da16caa2a0631acf10bfa49629
## What changed
Remove the `codex mcp-server` subcommand and the standalone `codex-mcp-server` crate, including its tests, interface documentation, build dependencies, and run recipe.
## Testing
Update the strict configuration test to use `codex exec hello`, preserving coverage for rejecting unknown configuration overrides.
GitOrigin-RevId: 8688b1f41862d7c2073ea2812a257c0087c55d9c
## Why
Plugin updates made by another process do not notify a loaded session's hook runtime, leaving it with stale hooks.
## What changed
Compare the current plugin hook sources and load warnings with those retained by the hook runtime during turn construction. Refresh hooks when either differs so existing sessions pick up external plugin updates.
## Testing
Add an app-server regression test that updates the shared plugin store without notifying the server and verifies that successive turns in the same thread run the installed hooks across an upgrade and a rollback.
GitOrigin-RevId: d3a2653ac4c069d9d8a02f30e21e4506d76a091c
In `guardian_v2_routes_scoped_tool_approvals`, wait for the reviewed
thread's `codex_turn_event` before shutting down the app server. Use the
returned event for assertions instead of looking it up in the
post-shutdown analytics snapshot.
GitOrigin-RevId: 3ba4d37838852842c6caf7701d3abf7c89166a98
## What changed
- Replace the bundled GPT-5.6 Sol migration guide with GPT-6 Astra guidance and update model metadata, migration routes, and official documentation links.
- Document GPT-6 migration compatibility checks for reasoning effort, tool calling, unsupported parameters, fast mode, and prompt caching while preserving model roles for Terra and Luna.
- Refresh the prompting fallback with guidance on autonomy, instruction following, writing style, subagent delegation, and testing. Prefer live official guidance and use the bundled prompting copy only when it is unavailable.
GitOrigin-RevId: d1f298b8e7517687acbf4de5cfb0cd914d3861f5
## What changed
Write Default and Plan directly into the default mode instructions and use the text without template rendering. Remove the mode-name formatting helpers and the `codex-utils-template` dependency from `codex-models-manager`.
Update the instruction test to retain checks for `request_user_input` availability guidance while removing placeholder assertions.
GitOrigin-RevId: d6afa478c30f991baa9ef4d5459e84354f29ce17
## What changed
- Retain question drafts, selections, expanded state, and handled message IDs across thread input restoration and reconnects. Preserve buffered live questions during session refresh without replaying their message text.
- Enable history recall and search in question answers, honoring updated key bindings and stripping image attachments and placeholders from recalled entries. Preserve Vim mode when an answer is not accepted.
- Let forward navigation past the last question restore the latest queued message as an editable main composer draft. Keep working status and queued messages visible alongside questions.
- Show a countdown for newly arrived collapsed questions and clear it when the question editor is opened or used.
- Disable question submission and skipping while the thread is unavailable.
## Testing
Add regression tests and snapshots for draft restoration and replay deduplication, history search and key bindings, queued-message editing, countdown rendering, and question layout with working status.
GitOrigin-RevId: de016120a979db860fd0d4b8098b322b312b7d84
## Why
Background and empty-input turns could lack a `root_turn_id`, and detached memory requests omitted turn identity entirely. Tasks without a root could also adopt one from coalesced mailbox input.
## What changed
- Set `root_turn_id` to the task's turn ID at task start unless an inherited or recovered root is already present.
- Stop assigning roots from mailbox input or steering an active turn.
- Give detached memory requests a fresh UUID for both `turn_id` and `root_turn_id`, included in turn headers and client metadata while still omitting session and thread identity.
## Testing
Extend assertions for background turns, empty input, goal continuations, manual compaction, and detached memory requests. Exercise mailbox coalescing with both independent and inherited roots to verify the task keeps its established root.
GitOrigin-RevId: ee0f2f1b43542a9f5884f694c1d94341b476779c
## Why
Async questions with suggested choices only accepted those choices. Allow users to write an alternative answer directly in the question pane.
## What changed
- Append an editable Other choice. Typing or pasting opens it, while number shortcuts still submit named choices.
- Preserve custom drafts when switching choices, reject blank Other submissions, and distinguish the input from a suggested choice named Other.
- Support Vim editing and search in question inputs while keeping arrow keys available for choice navigation.
- Wrap custom answers inline, cap the editor height, and keep the input visible in narrow layouts.
## Testing
Add interaction tests and snapshots covering custom answer delivery, draft preservation, selector key repeats, blank answers, remapped shortcuts, Vim editing and search, and narrow or wrapped layouts.
GitOrigin-RevId: 0e9aa9fcd2410e8da25f5ca43bdef94cbb9253b8
## Why
Asynchronous questions can include suggested answers, but the TUI previously displayed only a freeform input. Show those choices and require them to be fully visible before submission.
## What changed
- Render numbered, wrapped choices with a default selection, list navigation, and digit shortcuts. Submit the selected label as the answer.
- Block submission of clipped choices and prompt the user to expand the terminal. Limit option processing to the first 32 entries and discard labels over 512 bytes.
- Preserve freeform input when no usable choices remain, and add contextual submit, skip, and question navigation hints.
- Ignore repeated submit keys so holding a key cannot answer another question.
## Testing
Add state, snapshot, and chat widget tests covering wrapped and clipped choices, constrained layouts, option limits, long answer preservation, oversized answer rejection, key repeats, and conflicting keybindings.
GitOrigin-RevId: 5d3ebadf61da62a9680ba819e6dfcf8302c4e9da
## What changed
- Display questions from live agent messages with a collapsed question count and an expandable answer editor.
- Support navigating, answering, queueing, and skipping questions while preserving the main composer draft. Expose question navigation and skip actions in the keymap picker.
- Route answers through existing input delivery and consume them only after an accepted send or queue operation. Keep questions editable while disconnected, with delivery and skipping disabled.
## Testing
Add tests for answer delivery, queued answers, retained drafts, disconnected editing, Vim undo, buffered input, constrained layouts, and question shortcut descriptions.
GitOrigin-RevId: 084b54dceb8c0100aefbf9f0b7897bf8d26eac47
## What changed
- Introduce an async-question editor component with per-question drafts, navigation, replay deduplication, and submit or queue handling using the shared composer.
- Add bounded `AnsweredQuestion` framing that truncates question text at a UTF-8 boundary and flattens line breaks before prepending it to an answer.
- Add `prompt_stack_back` and `skip_question` keybinding actions and the `tui.question_esc_back` setting. Normalize `Ctrl+]` and `Ctrl+5` for key matching and conflict detection, and let default question shortcuts yield to explicit bindings.
- Flush buffered typing in both the main composer and the covering view so background input cannot keep the draw loop waiting.
The async-question component is not yet connected to the TUI event flow.
## Testing
Add regression coverage for bounded Unicode question framing, question-shortcut conflicts, and paste-buffer flushing in background and covering editors.
GitOrigin-RevId: 4098043cf588ddafc05c27505645495edd690cb9
## What changed
- Record `exec_server_client_requests_total` for every client RPC call attempt,
labeled by protocol method.
- Count attempts before local admission so rejected, timed-out, cancelled, and
transport-failed calls are included, while notifications and responses are not.
- Export the counter to configured OpenTelemetry collectors while excluding it
from the built-in Statsig metrics set.
## Testing
- Cover every RPC call entry point, successful responses, local and transport
failures, timeouts, cancellation, notifications, and disabled metrics.
- Verify that the OTLP HTTP exporter retains the counter.
GitOrigin-RevId: d266e840d5871aa2c34bed8ce44f3345e2b4650f
## What changed
Set GPT-6-Astra's bundled model visibility to `list` so it appears first in the interactive model picker, and update the picker snapshot for the new entry and numbering.
GitOrigin-RevId: 1bbbb7cb932b53d121a2d3246343c06e120da2f7
## Why
Preparing a filesystem sandbox could synchronously probe unrelated permission
roots on the executor runtime thread and repeatedly resolve the same filesystem
aliases while deriving writable roots.
## What changed
- On Linux, leave permission-root alias resolution to the sandbox helper.
- Filter effective permission entries once and cache their resolved paths for
writable-root and read-only carveout construction.
- Return early when the policy has no effective writable entries.
GitOrigin-RevId: 305364173ca55f967c1701aad94d2374f78999d3
## Why
Requirements layers may use either `features` or its `feature_requirements`
alias. Treating those names as separate tables prevents feature settings from
merging consistently across layers.
## What changed
Normalize `feature_requirements` to `features` after validating each layer so
mixed aliases share one merge path and retain layer precedence.
## Testing
Add coverage for both alias orderings across low- and high-priority layers.
GitOrigin-RevId: e23ad3e0853b8b49ca10447875f33706de39bcfe
## Why
Clients need a per-thread Daybreak toggle that survives restarts and can be
restored on resume without changing the access program of an active or future
turn.
## What changed
- Add experimental `daybreakEnabled` support to `thread/metadata/update` and
expose the saved value on thread responses.
- Store the preference in SQLite, including for threads without a first turn,
and preserve it through reads, resumes, reconciliation, and restarts.
- Copy the preference when forking a thread while keeping subsequent updates
independent.
- Keep `daybreakEnabled` separate from the per-turn `cyberAccessProgram` field;
app-server does not derive one from the other.
## Testing
- Cover persistence across restarts, cold reads, reconciliation, and forks.
- Verify metadata updates do not alter the access program of active or later
turns.
GitOrigin-RevId: bcf987a9fcd7b0ac8a88b1c8f0df06b33ed8ad6e
## Why
Guardian reviews must not lose user authorization constraints or reuse an
unreadable or incompatible parent checkpoint after compaction.
## What changed
- Retain bounded excerpts of oversized root user messages across compaction,
resume, and rollback, and recover excerpts from legacy Guardian history when
available.
- Require thread-owned Guardian review sessions and asynchronous scoring to
reuse only non-empty checkpoints produced by a compatible review model.
- Fail closed instead of reviewing without the required checkpoint when reuse
is disabled, compatibility is unknown, or checkpoint content is unusable.
## Testing
Expanded retained-context, review-session, asynchronous-scoring, and app-server
coverage for oversized instructions, legacy recovery, model incompatibility,
missing content, resume, rollback, and disabled checkpoint reuse.
GitOrigin-RevId: f30d837197e0d838e656a632109f490c38208f5e
## What changed
- Configure the CLI and app server to use `tikv-jemallocator` on
`x86_64-unknown-linux-musl` and `aarch64-unknown-linux-musl`.
- Keep the dependency and global allocator selection scoped to those targets.
GitOrigin-RevId: 93c54c90d9acb7e48edffd032cd8ec685a782210
## What changed
- Add rendered HTML alongside the original Markdown when copying a whole response through the native clipboard, so rich-text destinations preserve headings, lists, tables, code, and other formatting.
- Keep code-block, blockquote, transcript, terminal, and WSL clipboard copies as plain text.
- Escape raw HTML, omit remote image sources, and render unsupported link destinations as visible text when producing clipboard HTML.
## Testing
- Add coverage for rich formatting, local and unsafe links, inert images, fenced tables, copy selection formats, and clipboard fallbacks.
GitOrigin-RevId: c6f5edd88b65f9e9b1ddc5618442868cf47ee560
## Why
Guardian reviews need the original user instructions even when compaction or
transcript selection removes them from the active conversation window.
## What changed
- Capture complete user messages in host-owned retained context and include them
as ordered authorization evidence alongside verified answers.
- Omit oversized instructions atomically and emit an explicit incomplete-evidence
notice instead of exposing a potentially misleading partial permission.
- Mark user messages inherited by forked agents so they remain model-visible
without becoming child-local authorization.
## Testing
- Cover retained instructions across compaction, resume, rollback, and agent
forks, including oversized evidence and legacy context behavior.
GitOrigin-RevId: 97122509d818c90d2f87c6a1b29c99c05ad0316e
## What changed
- Render sparse, fading stars across the composer when using an Astra model in a true-color terminal.
- Preserve composer content, cursor state, effort effects, and terminal colors, and pause the animation while popups are open.
- Add the default-on `tui.whimsy` setting so decorative effects can be disabled independently. Sparkles also respect `tui.animations`.
## Testing
- Cover model and setting eligibility, terminal color handling, protected composer cells, popup behavior, effort effects, and layout stability.
GitOrigin-RevId: fe0471ebef0bca21c44e1d8f731d46959eba0165
## What changed
- Add `codex-mxc-sandbox` with native MXC availability detection and a launcher that inherits standard I/O and waits for the sandboxed process.
- Reject unsupported learning-mode and fallback policies, and verify deny-path support before launch.
- Route the existing Windows MXC availability metric through the new crate and move its Windows linking dependencies alongside the adapter.
GitOrigin-RevId: e2a220b85718e00b0e710c30bbe66b6c56958176
## Why
Guardian approval actions can contain paths from a remote executor whose path convention differs from the host, such as Windows paths reviewed on a POSIX host. Converting those paths to host-native absolute paths prevents the action from being reviewed.
## What changed
- Render command working directories using the executor's reported path convention, and preserve URI-backed paths for attribution.
- Carry foreign command and patch paths through Guardian events and app-server schemas as legacy path strings.
- Bound remote plugin attribution within the overall review deadline and reject Guardian action payloads that exceed the review byte limit.
## Testing
- Cover Windows and POSIX executor path rendering, foreign patch paths, protocol round trips, oversized payload rejection, and remote Guardian review context.
GitOrigin-RevId: 38be0fcdac897139519e74e077eb5cb4f8f8017e
## What changed
Update the bundled GPT-6-Astra instruction template to apply the
`functions.request_user_input_async` guidance only when the tool is available.
GitOrigin-RevId: 1dbf0299d4e5bf81e570e88c98b10c3822da99ed
## Why
Windows sandbox setup reconciles persistent deny ACLs against the paths supplied for a session. The `codex sandbox --permission-profile` path supplied an empty list, which could discard the profile's deny-read restrictions.
## What changed
Resolve deny-read paths from the selected permission profile and workspace roots before starting a Windows sandbox session, and pass them through to setup.
## Testing
Add a Windows CLI integration test that launches the same managed-deny profile twice and verifies that denied file reads and DLL loads remain blocked while allowed access still works.
GitOrigin-RevId: 6ec8b6a13a33b862d7b152eadbbdde3146de4b7d
## Why
`ShellExecuteExW` needs `SystemRoot` to elevate the Windows sandbox setup helper.
## What changed
Add `SYSTEMROOT` to the environment variables copied from the host for wrapper
setup. Keep the serialized inner command environment unchanged so the host value
is available only to the wrapper.
## Testing
Extend Windows sandbox manager tests to cover case-insensitive replacement of
`SystemRoot` and verify that it is excluded from the inner command environment.
GitOrigin-RevId: c69f9f92665e97a178e2de488fbb9fd6b7ff7ac6
## Why
Guardian reviews for delegated workers need the current root instructions and verified answers even after the parent context is compacted. Approvals must also become stale when that root authorization changes.
## What changed
- Build bounded root review evidence from retained context, preserving source order and answer scope while prioritizing user instructions over optional assistant context.
- Recover retained instructions from Guardian history after compaction and mark authorization incomplete when required instructions or answers are unavailable.
- Version root authorization in synchronous and reusable review sessions so an allow result is cancelled when its evidence changes.
- Strip parent-only Guardian approvals when forking worker history in retained-context mode.
## Testing
- Cover retained and legacy context modes, oversized evidence, message limits, parent compaction, and authorization changes during review.
GitOrigin-RevId: 658219b7cee08f2752adcea9966268fd21727976
