## Why
Repeated prewarm calls still prepared instructions, tools, and a prompt even when an existing WebSocket connection was already warm.
## What changed
Check for a previous request and a connection that is not known to be closed before startup prewarm preparation. Reuse this readiness check in `prewarm_websocket`, and record `ready` or `needs_prewarm` in the `codex.startup_prewarm.websocket_check` counter before preparation can fail.
## Testing
Extend the WebSocket resume test to verify that repeated prewarm calls skip instruction loading on a healthy connection, while a closed connection triggers preparation again.
GitOrigin-RevId: 6a1b361b36b4e7f16fb283e48a8ce4d4fb996ceb
## Why
History notes and image generation requests used default HTTP clients that did not carry the configured application network policy.
## What changed
Pass `Config::http_client_factory()` into both extension backends and create transports with `ClientRouteClass::Api`, so their requests honor application network restrictions and configured proxy behavior.
## Testing
Add regression coverage verifying that denied image requests never reach the server and that history notes context requests stop after the network policy becomes restrictive. Retain coverage for image file access restrictions.
GitOrigin-RevId: 7ba61fdc60fa1afe1842d869da9ccd744ab7d82f
## Why
Exceeding the aggregate metadata budget previously replaced all tool result metadata with omission markers, discarding small results unnecessarily. Oversized results also lost resource-access evidence even when that evidence alone would fit.
## What changed
- Raise the executed-tool-call metadata budget per request from 32 KiB to 128 KiB while retaining the 32 KiB per-result limit.
- Reduce the largest result metadata first and stop once the request fits, preserving smaller results.
- Retain `openai/resource_access` when full metadata exceeds capture, request, or direct-call retained-history limits. Keep resource lists intact, and discard optional result metadata before sacrificing call records, source evidence, or completion markers.
## Testing
Add regression coverage for selective reduction, resource-access retention, serialized request size, and direct-call and Code Mode behavior. Update compaction and truncation tests for the larger request budget.
GitOrigin-RevId: 698e47dcbdd3351e9a031e45ea39053608a5a0e4
## What changed
Return completed startup prewarm sessions to the client cache and schedule resume prewarm through the normal session setup path. Keep in-flight warmups shared, remove the separate nonblocking prewarmed checks, and simplify the prewarm handle to own a single task.
## Testing
Update the resume prewarm integration test to assert `User-Agent` and `x-codex-window-id` handshake headers while retaining coverage for connection reuse, response continuation, and reconnection after closure. Remove the assertion that healthy resumes skip instruction preparation.
GitOrigin-RevId: a9b6d4810aca9aba2e6e41df181b7d9d90474230
## Why
A previously used WebSocket can close while a thread is idle. Hosts need a way to prepare the connection before the next turn without repeating warmup on a healthy connection.
## What changed
- Expose `CodexThread::prewarm()` using the existing startup warmup and next-turn handoff.
- Reuse healthy connections and pending warmups, retry failed warmups, and repair closed connections. Treat a finished WebSocket reader task as a closed connection.
- Skip scheduling during an active turn or shutdown, and stop warmup admission before shutdown takes the pending task.
- Expose `active_turn_environment_selections()` so hosts can inspect the environments captured by the active turn, including those still starting or failed, when authorizing steering.
## Testing
Add regression coverage for repeated idle prewarm calls, healthy connection reuse with preserved response continuation, reconnection with `generate: false`, and warmup rejection after shutdown. Update delayed MCP discovery coverage to verify prewarm repairs an eagerly closed socket and the first turn reuses it.
GitOrigin-RevId: aa164b91a399de2375eda3bf28397725439fce93
Use `tokio::select!` to listen for shutdown alongside `ws_stream.next()`
in the test server's request loop, allowing the server task to exit when
shutdown is requested while waiting for the next client message.
GitOrigin-RevId: ef77ae64322ab3bdf9b624645a9062a2a9f827cc
## What changed
Call `ensure_rollout_materialized` after recording pending inter-agent communication, using the supplied persistence context. This also triggers the first execution checkpoint when an agent message starts the first turn.
## Testing
Extend the first-input persistence test to cover inter-agent communication, checking that the checkpoint is requested and sampling proceeds while durable metadata is blocked. Verify that prepared context precedes the agent message and that its author and recipient reach the model.
GitOrigin-RevId: 55779edb1a38fcf4d1c1cff24c09f5a810460c3d
## What changed
Always use `GuardianContextMode::ThreadOwned` for session capture and subagent history forks, regardless of `guardianv2.thread_context`. Continue selecting reviewer policy from saved checkpoints, preserving legacy review for incompatible checkpoints and removing the feature gate from reviewer compaction compatibility checks.
## Testing
Update coverage for unconditional retained context across compaction, resume, and subagent forks. Exercise legacy review with saved checkpoints, and verify that local and managed opt-outs do not disable sender context capture or checkpoint migration.
GitOrigin-RevId: cd74e2029c83f12bc655b6563242d06f29dd46af
## What changed
Use retained root context for subagent authorization reviews, removing the separate legacy history path. Remove the runtime `request_user_input` answer buffer and its response counter; authorization versions now track the user-message revision and retained-context completeness.
## Testing
Update authorization and input-handler tests to exercise retained context, and add coverage for the `user_messaging` connector in subagent reviews.
GitOrigin-RevId: 00ad151cf71b843af0e82ae90cbcf559d0c65f89
## What changed
- Deprecate and ignore `features.guardianv2.thread_context`, including profile overrides, with a migration notice. Ignore managed requirements for the removed flag with a warning.
- Preserve surviving legacy root instructions across compaction and resume when retained instructions are incomplete. Include unmatched instructions in worker authorization context with an explicit unknown-ordering notice, without replacing newer retained facts or expanding the reviewer's model window.
- Use surviving source calls to roll back verified answers from older checkpoints that lack acceptance-order metadata.
## Testing
Add regression coverage for legacy instruction recovery, compaction and resume, source matching, and answer rollback around same-turn user input. Update configuration and Guardian review tests to verify that the deprecated opt-out still uses thread-owned context and rejects incompatible compaction evidence.
GitOrigin-RevId: a65936c9e0b912e7667d1385a2ec53df726565de
## What changed
Add `ModelRequestContributor` and `ModelResponseInterceptor` to the extension API. Contributors can add filtered `client_metadata` without overwriting existing or reserved fields and create interceptors for individual requests.
Wire contributors into HTTP and WebSocket requests, distinguishing generation from warmup. Apply response interceptors in registration order before tracing and response bookkeeping so transformed output is recorded consistently. Interceptors can inspect, buffer, or transform events, with stream ownership carrying request state and cancellation.
## Testing
Add tests for metadata protection, incremental event transformation, interceptor ordering, upstream cancellation, and consistency between delivered output, traces, and WebSocket bookkeeping. Integration tests cover output gating and interruption over HTTP and WebSocket, including a contributor that bypasses gating for warmup requests.
GitOrigin-RevId: d4bc1745d2cacf8636728dbc0a58ab9f250e9392
## Why
MCP resource helpers use fixed descriptions and parameter schemas, preventing the model catalog from supplying model-specific guidance.
## What changed
Add `model_messages.tools.mcp_resources` entries for `list_mcp_resources`, `list_mcp_resource_templates`, and `read_mcp_resource`. Resolve these entries for the current model when constructing tool specs for direct calls and Code Mode.
Descriptions and parameter schemas override independently. Preserve bundled defaults for missing fields and fall back to bundled parameters with a warning when a supplied schema is invalid. MCP resource execution remains unchanged.
## Testing
Add unit coverage for independent overrides, literal descriptions, and invalid-schema fallback. Add integration coverage for resource discovery and reading through direct calls and Code Mode, plus assertions that resource tool specs follow model changes between steps.
GitOrigin-RevId: 40b5beddb38b2b61c19dc9cd6013d6ba5d756dbc
## Why
Channel tools use bundled descriptions even when the model catalog supplies tool messages. Let their descriptions follow the active model, including model changes within a turn.
## What changed
- Add channel tool entries to `MultiAgentToolMessages` and pass them to the message board extension for each step.
- Apply catalog descriptions while retaining bundled text for missing or null values and honoring empty strings. Ignore parameter overrides with a warning and keep bundled schemas.
- Clarify bundled descriptions for channel discovery, thread reading, posting, and subscription notifications.
## Testing
Add coverage for full and partial overrides in namespaced and Code Mode tools, preserving Code Mode declarations and parameter schemas. Extend the mid-turn model-change test to verify that the `post` description follows the active model.
GitOrigin-RevId: fca20bed1203d5214713f82cb16a91eeebb38f56
## Why
Output produced before the streaming subscriber attaches can be missing from command completion events, even when it was returned to the model.
## What changed
Record the bounded completion transcript directly in `UnifiedExecProcess` as local and exec-server output arrives. Keep it independent of output polling and streaming delta delivery, and use it for completion events.
## Testing
Add regression coverage for output collected before subscription, both with and without later output. Strengthen the lifecycle test to assert that `aggregated_output` includes both early and late output.
GitOrigin-RevId: 9825acbd706dc4845837c8b4ab1347d8267ce0af
## Why
The default transport fallback bypassed managed application network policy when using `ReqwestDefault` proxy handling or running inside the Codex sandbox.
## What changed
Use a `RouteAwareClientPool` whenever application network policy is managed, retaining policy enforcement for requests and redirects while preserving legacy proxy behavior and custom CA fallback.
## Testing
Add code mode web search regression cases for denied initial requests and denied redirect destinations, verifying that policy errors reach tool output and no requests reach the denied destination.
GitOrigin-RevId: 74ba0e6e4dcad03f3e83c0450b8b17bcefcc267c
## Why
Tool lifecycle observers need visibility into calls rejected before execution starts and timing that remains available on cancellation, independently of tracing settings.
## What changed
- Add `on_tool_dispatch` and `on_tool_timing` callbacks to `ToolLifecycleContributor`, with thread, turn, and call IDs for correlation.
- Report direct calls before readiness, dispatch waiting, and hooks. Report handler duration when dispatch completes or is dropped, excluding readiness and gate waiting and returning zero if the call never passes the gate.
- Expose code-mode host durations as a separate `HostOperation` timing boundary. Exclude nested code-mode calls from dispatch and handler timing observations to avoid double counting.
## Testing
Add tests for callback ordering on completed and rejected calls, timing on cancellation, zero handler duration before gate admission without tracing, and code-mode host timing without nested dispatch or handler timing observations.
GitOrigin-RevId: 97998b5094564c13cb2cfad089bb0a9d6615eb5c
## What changed
Add `otel.log_agent_responses`, disabled by default and requiring an OTLP HTTP or gRPC log exporter. Emit `codex.agent_response` for completed `final_answer` messages from main agents and spawned task agents, with session, turn, item, and available parent/root attribution.
Strip memory citations from exported text, preserve the stored answer, and cap responses at 64 KiB on a UTF-8 character boundary. Include the original byte length and a truncation flag, and suppress duplicate item completions within each turn. Exclude commentary and non-task agents.
## Testing
Extend configuration tests for default-off and explicit opt-in behavior, the agent execution test for main/subagent response attribution, and the log-buffer test for response-event exclusion.
GitOrigin-RevId: eacda1150de2e6bac2c667d71b57214b0a086f1a
## Why
The Browser connector on `codex_apps` needs the computer-use policies and review handling already applied to `node_repl` and `cua_repl`.
## What changed
- Classify `connector_openai_browser` using registered tool metadata and preserve its computer-use scope through Guardian review.
- Extend confirmation-policy forwarding, review evidence capture, JavaScript execution tracking, and initial-call approval handling to the Browser connector.
- Correlate Browser elicitations with live invocations so nested actions retain their own review identity while assessments are attributed to the originating call. Require verified Browser identity for strict nested review.
- Include the Browser connector in computer-use policy prompts and bundled model messages.
## Testing
Add integration coverage for ordinary and strict Browser nested reviews, including policy injection and action attribution. Verify strict review declines requests with missing or unknown invocation correlation or a non-Browser registration.
GitOrigin-RevId: b04af6fb9db1bac2203dc4265913d210746df90b
## What changed
Add `model_messages.tools.indirect_description_prefixes` with selectors for exact namespaces and configured MCP server names. Apply the selected model's guidance to namespace documentation embedded in `CodeModeOnly` prompts, `ALL_TOOLS` descriptions, and namespaces returned by tool search.
Trim prefix values, treat empty values as no prefix, and reject conflicting selectors for the same namespace. Apply prefixes during rendering so model changes take effect without altering direct tool specifications, search ranking, or tool dispatch.
## Testing
Add unit tests for prefix normalization, namespace grouping, MCP server mapping, and conflicts. Add scenarios covering both Code Mode variants, clearing prefixes on model changes, unchanged tool dispatch, and conflict rejection before a model request.
GitOrigin-RevId: 0c7ce6d418c775945c2ccfdab3c605fa4d431b55
## Why
HTTP retries used local backoff even when the server supplied `Retry-After`. Relative retry delays also failed to account for time spent propagating errors or reporting retries.
## What changed
- Parse `Retry-After` delay seconds and HTTP dates into a monotonic deadline captured when response headers arrive.
- Honor that deadline for HTTP retries, falling back to local backoff when valid advice is absent.
- Preserve deadlines through API and Bedrock error mapping, stream retries, and exhausted retry state. Expired advice remains a zero delay instead of triggering local backoff.
## Testing
Add coverage for header parsing, deadline countdown and expiry, error mapping after exhausted HTTP retries, and delayed stream retry notifications. Update Responses and remote compaction tests to verify that HTTP retries honor `Retry-After`.
GitOrigin-RevId: a2eff02946e5524f29e06f7ba1431e3d339261a4
## Why
Startup prewarm waited for tool discovery before opening its WebSocket connection. Slow MCP startup therefore delayed connection setup even though the handshake could proceed independently.
## What changed
- Run the WebSocket handshake concurrently with tool capture, then send `generate=false` with the discovered tools and finalized request metadata.
- Include model and effective service-tier routing hints in preconnect, including the inherited tier for spawned subagents. Omit routing hints for guardian reviewer requests.
- Recover authentication failures during preconnect and switch to HTTP fallback on `426 Upgrade Required`.
## Testing
Add and extend regression coverage for handshake overlap with delayed MCP discovery, cancellation before warmup, finalized Responses Lite tool metadata, socket reuse and reconnection, service-tier changes and inheritance, and authentication recovery during preconnect.
GitOrigin-RevId: ecb53540765df8227e55e79910a13a05260a4c8d
## Why
Actions targeting a secondary environment could be reviewed with the primary environment's denied-read restrictions. Each review needs the permission context of the environment that owns the action, including when a Guardian session is reused across environments.
## What changed
- Carry `environment_id` through environment-scoped approval requests and their planned-action JSON.
- Select and label permission context using the target environment, explicitly stating when it has no denied-read paths or globs.
- Reject reviews for unavailable target environments and reject environment IDs longer than 256 bytes before Guardian inference, while preserving manual approval routing for oversized IDs.
## Testing
Add coverage for `exec_command`, `apply_patch`, and `request_permissions` reviews switching environments while preserving the existing review prefix. Extend tests for environment-specific restrictions, unavailable environments, action serialization, and the 256-byte ID boundary.
GitOrigin-RevId: ad3292edddb1c6f5b180142c6857cba6f1308328
## Why
Enabling `features.token_budget.use_history_notes_extension`, explicitly or through model defaults, rejected session startup when the model lacked `supports_experimental_context`, even with experimental mode disabled.
## What changed
Remove that startup restriction so token-budget history and notes can be used independently of the model's experimental context capability.
## Testing
Extend core tests to cover explicit configuration and model defaults on startup and cold resume, checking `new_context`, token-budget contexts, and `history_ingest_requested` metadata. Add app-server coverage for native history and notes tools and context-window hints without experimental context capability.
GitOrigin-RevId: 6157479aeb75ffd785b8d4b2f48b11c6f46e8f35
## Why
Messages sent through the singular `user_message` connector were omitted from Guardian's delivered assistant message evidence because only `user_messaging` tool names were recognized.
## What changed
Accept both namespaced and flat `user_message` forms of `send_message` alongside the existing `user_messaging` forms.
## Testing
Extend Guardian subagent authorization tests to cover the singular connector and flat tool names, including blocked post-tool hooks and cancellation before confirmation. Add a negative case ensuring `send_message_to_thread` is not treated as delivered message evidence.
GitOrigin-RevId: 68495642ef4b78eec71df4fee2bacfda407adc47
## Why
A realtime call can start or end while a text turn is still running. Using call activity captured at turn creation leaves subsequent model requests with stale realtime context.
## What changed
Capture realtime activity and mode instructions together in a `StepContext` snapshot for each model request. Use that snapshot to build realtime instructions and persist `realtime_active` in the request's turn context. Store the conversation and mode instructions under one mutex so they are installed together when a call starts.
## Testing
Extend the realtime handoff integration test to start and close a call during one text turn, verifying that successive requests include the appropriate start and end instructions.
GitOrigin-RevId: 4c5c2b47b7c0c06ae28167013218dc2e3cd72c42
## What changed
Serialize custom reasoning effort values that parse as `u64` as JSON numbers in API requests. For example, `model_reasoning_effort = "64"` now sends `reasoning.effort` as `64`. Keep named values and custom values that cannot parse as `u64` as strings.
## Testing
Expand the request integration test to cover configured named effort, zero, a positive integer, an unknown name, a negative value, and an integer exceeding `u64`.
GitOrigin-RevId: 18ad03a1cd97dfa3f1a3cc49a43b3f7ca7d9b657
## Why
Guardian authorization reviews need the assistant message that prompted a user’s approval, even when a post-tool hook blocks the messaging result or compaction removes the original tool call.
## What changed
Retain confirmed delivered assistant text from tool-output metadata at the original call’s position in thread-owned Guardian context. Recover these messages when restoring checkpoints and respect the call’s inherited-context status.
## Testing
Extend authorization coverage to verify that a delivered message remains in the Guardian root snapshot after a blocked tool result, compaction, and resume, and update checkpoint expectations to preserve assistant/approval ordering.
GitOrigin-RevId: df30ec8a3ef21443210a937ab6db119de8a5fd51
## Why
A user can reply to a streamed question before its completed message is recorded. Assigning the assistant message's order at completion can place the reply before the question in retained context.
## What changed
Reserve an assistant message's order when its source stream starts in thread-owned Guardian context, then reuse that reservation when recording the message. Reserve completion-only messages before publishing their text, and give text and plan output from the same source message a single order.
## Testing
Add streaming regression coverage that accepts a reply before the question completes and verifies question-before-reply ordering both live and after resume. Cover server-provided and generated message IDs, plan output, and text combined with a plan.
GitOrigin-RevId: cb67e7459c804df7beb0841908244202448c655a
## Why
Ordinary user replies can depend on preceding assistant messages. Losing those messages during compaction can leave Guardian without the context needed to interpret a reply's scope.
## What changed
- Retain original assistant messages, including commentary, with their recorded order across checkpoints and resume. Exclude compaction output from this evidence.
- Include assistant context in local and delegated reviews as untrusted context, with separate storage limits and lower budget priority than user instructions.
- Prefer assistant context preceding ordinary replies when selecting bounded root evidence, and report unavailable context without inferring what a reply refers to.
- Preserve inherited context scope and remove assistant evidence beyond rollback boundaries, including during rollout migration.
## Testing
Extend coverage for compaction and resume, checkpoint migration, queued-input ordering and rollback, role labeling, and evidence budgets that preserve user restrictions while dropping assistant context.
GitOrigin-RevId: 886189b0be29ffc3d324b56f5d0b673d6b8d84da
## Why
Turn completion precedes active-turn cleanup, so the remote compaction test must wait for the thread to become idle before injecting its history fixture.
## What changed
Register the `ThreadIdle` lifecycle contributor and wait after the initial turn in `remote_compact_v2_rewrites_multiple_trailing_function_call_outputs`, covering both manual and automatic compaction cases.
GitOrigin-RevId: 1593b212db0e07b1457f090b5ac7ba2313a28360
## What changed
Add `features.multi_agent_v2.disable_direct_message`, defaulting to `false`. When enabled, omit `send_message` and `followup_task` while preserving spawning, automatic child results, and the remaining agent management tools.
Require an available message-board `post` tool when this option is enabled for sessions using multi-agent v2 collaboration tools, exempting internal worker sessions.
## Testing
Extend configuration parsing tests and run the message-board subscription/resume scenario with direct messaging both enabled and disabled. Verify post search, subscription behavior, and which collaboration tools are exposed.
GitOrigin-RevId: 72ec22ef0b92fa81e02cdeb058d8b4f93aca3be6
Add a regression test that fails `exec_command` with a missing working directory, pauses command completion, and interrupts the turn before releasing completion.
Verify that the command emits exactly one start and completion, retains its failure status and launch diagnostic, and persists the completion in the rollout. Check that reconstructed history includes the failed command in the interrupted turn.
GitOrigin-RevId: 5962f0791b298ebb05e752138d02b0e0b3af4c63
## What changed
Run `AGENTS.md` and thread-instruction refresh concurrently with capability discovery, MCP setup, and tool construction. Box both preparation futures to keep them off caller stacks while they are live together.
Finish delivering returned instruction warnings even when tool preparation fails or is cancelled. Preserve instruction-error precedence and publish the selected-plugin snapshot only after both branches succeed and cancellation is checked.
## Testing
Add tests covering concurrent preparation, warning delivery on tool failure and cancellation, instruction-error precedence, and plugin snapshot publication. Verify that cancellation does not repeat consumed warnings on the next capture.
GitOrigin-RevId: 6b2d7b091aae2dba67ad154a19bdb0ed0f96f6f7
## Why
Retry timing assertions can fail if the test is descheduled before retry telemetry is emitted, and parallel tests can leave shared tracing callsites disabled for the test subscriber.
## What changed
- Measure retry intervals from the failed request, filter HTTP observations to `/responses`, and track WebSocket stream requests as well as connections.
- Keep a tracing interest-cache guard alive and rebuild callsite interest when installing the telemetry capture.
- Reserve the connection-failure test's port with a bound socket until the recovery server starts listening.
- Wait for the WebSocket warmup request and assert `generate: false` before submitting user input in connection-limit, rate-limit, and overload tests.
GitOrigin-RevId: bba39ea2ac29ac8553ae6184139382f1e6cdc7ac
## What changed
- Add `environments` to `TurnSettingsUpdate` to replace the selection for subsequent steps without changing future turns.
- Capture model settings and environments together so combined updates apply or reject atomically, while existing steps retain their captured selection.
- Validate environment IDs, working directories, configuration ownership, and permission requirements against the running turn's selections.
- Preserve executor startup behavior when switching environments and use the step's local working directory for tool hooks.
## Testing
Add coverage for workspace switching and restoration on the next turn, atomic model and environment updates, permission validation, executor connection waits, and replacement of pending environment selections.
GitOrigin-RevId: 02b5c57a78fd594b2aed84fc09d9e99eb97be28c
## Why
Thread permission updates could affect later steps of a running turn. Keep inherited environment settings consistent throughout the turn and apply saved updates when the next turn starts.
## What changed
Store active thread defaults alongside selected environments and refresh them when activating a new turn, even when its environment selections are unchanged. Resolve new selections from those active defaults while preserving owner-provided configuration, selection workspace roots, and the local Windows sandbox type.
## Testing
Add a regression test that changes permissions during a paused turn and verifies that both steps retain restricted filesystem access while the next turn receives unrestricted access. Update session and MCP elicitation tests to check that permission changes take effect on the next turn.
GitOrigin-RevId: 37ee44198fa40c138d140974dc90c4177d8c1f4c
## Why
AWS credential discovery, analytics, and telemetry used clients that did not share the application's network policy. These requests need to honor destination restrictions and permission revocation.
## What changed
- Route AWS credential and region HTTP requests through the shared HTTP client, and check the signing destination before loading credentials. Skip discovery for static access keys with an explicit region.
- Apply account-scoped policy to Bedrock authentication. Require unrestricted policy for credential exporters and reauthentication commands, and cancel active work when permission is revoked. Document that AWS profile `credential_process` network traffic remains outside the application's HTTP policy.
- Send analytics through the authenticated account's HTTP client factory.
- Guard OTLP log, trace, and metric exports with revocable permits, disable them under destination restrictions, and make managed HTTP exports cancellable. Suppress global Statsig settings while managed policy is active.
## Testing
Add coverage for metadata credential request cancellation, allowed and denied SigV4 destinations, AWS credential precedence and endpoint configuration, and blocked credential exporter recovery. Update telemetry tests for account transitions and managed-policy Statsig suppression.
GitOrigin-RevId: d8a2018bfbbe971ec430699b0d3f86a7a9e1e072
## What changed
- Load `application.network` requirements at startup and explicit config/account reloads, applying local policy before authentication and cloud configuration bootstrap.
- Block traffic when policy loading fails, cancel requests that a new policy no longer permits, and reject configuration loads based on superseded policy snapshots. Local requirements edits take effect on the next explicit reload or restart.
- Bind authenticated clients to the current account and revoke them when account ownership changes. Carry policy enforcement through backend requests, realtime connections, workload identity exchanges, and code-mode gRPC streams while preserving gRPC trailers.
- Treat denied credential refreshes as policy errors without retrying them or invalidating stored credentials.
## Testing
Add regression coverage for startup restrictions, reload ordering, cancellation after restrictive or malformed requirements edits, account revocation, gRPC destination denial, workload identity cancellation, and credential preservation after denied OAuth refresh.
GitOrigin-RevId: 0cb4c720a906397e9df06675f01ecf60d741101f
## What changed
- Switch the GPT-6, GPT-5.6, GPT-5.5, and auto-review catalog entries to `shell_command` and expand their plan availability.
- Mark `gpt-6-astra` as supporting reasoning-effort updates and disable its experimental-context flag. Add explicit capability and instruction defaults to other entries.
- Update Astra's messaging guidance to recognize authorization from explicitly invoked skills or plugins, with attribution in the final response, and simplify its Default-mode clarification instructions.
- Revise auto-review guidance on autonomy, assumptions, and actions within the user's requested scope.
- Refresh seven scenario snapshots to reflect the updated prompts.
GitOrigin-RevId: b7ed8c413f6451008c982024506009b170e6311e
## Why
A single blob upload failure previously aborted the file upload, even for a temporary `503` response or an interrupted stream.
## What changed
- Retry `503` responses and timeout, connection, body, or request errors, with at most five attempts within a shared five-minute deadline.
- Honor `x-ms-retry-after-ms` and `Retry-After`, falling back to backoff when no valid server delay is available.
- Reopen the contents for each retry while reusing the same file record and upload URL. Preserve the initial read permission check and reopen MCP file streams under the same sandbox policy.
- Record retry, recovery, and terminal failure events with a fresh client request ID for each attempt.
## Testing
Add coverage for recovery after `503` responses and interrupted streams, attempt and deadline limits, non-retryable responses, retry delay parsing, and unique request IDs. Extend the restricted-read MCP upload test to verify that both attempts send the complete file contents.
GitOrigin-RevId: 78089ecfd5076313f5784cbbc864df12d082e3b1
## What changed
Add `backend_reasoning_status`, disabled by default, to relay public reasoning summaries during active, server-managed realtime V3 delegations.
Use the last non-empty summary from each completed reasoning item, truncate it to 256 bytes at a character boundary, and append it as `[STATUS]` context on the `commentary` channel. Discard queued updates if their delegation is no longer active.
## Testing
Add an integration test covering enabled and disabled behavior, selection of the latest non-empty summary, exclusion of raw reasoning and partial summaries, and delivery without triggering `response.create` or changing the model's reasoning-summary setting.
GitOrigin-RevId: 75ce87dbbbab15a6d9d0ad0b23737738837192fd
## What changed
Add the default-off `features.prefer_mxc` flag to select MXC for local Windows execution when native support is available and effective network settings do not explicitly forbid local binding. Otherwise, retain the configured backend and legacy setup behavior.
Resolve the preference during config loading and use the effective local backend for execution, network proxy setup, sandbox diagnostics, and `windowsSandbox/readiness`. Preserve the configured backend for remote executors and `config/read`. Explicit `windows.sandbox = "mxc"` remains strict, and command failures do not trigger backend fallback.
## Testing
Add coverage for preference resolution, startup readiness without rewriting configuration, local and remote backend selection across environment updates and child threads, and workspace-write permission context in an agent turn.
GitOrigin-RevId: b51178f0371d38ebb58e41af54a068fca67fa316
## Why
Restoring persisted V2 agent identities reads descendant metadata serially, making each storage read wait for the previous one.
## What changed
Read up to eight descendants concurrently while registering identities in graph order, preserving path and nickname reservation order. Skip identities already registered and continue restoring after individual read failures.
## Testing
Add a cold-resume regression test that gates child metadata reads to verify overlap, completes reads out of order to check deterministic path reservation, and injects a read failure. It also verifies that child runtimes remain unloaded until requested.
GitOrigin-RevId: ae90f24875966be83208884937621a6a9eb0d848
## Why
Resuming a compacted thread should use the compaction and its newer records without depending on older turn contexts or restoring stale state from before the compaction.
## What changed
- Stop paginated model-context scans at the newest compaction with `replacement_history` and `window_number`. Fall back to full replay if the newest compaction lacks either field.
- Align reconstruction with that boundary and restore `last_started_turn_id`, previous turn settings, and the multi-agent version from compaction resume metadata. Allow newer completed turns to override the saved settings.
- Keep canonical session metadata alongside the bounded replay and use the same scan boundary for subagent rollout migration.
## Testing
Add coverage for cold resume after mid-turn compaction, bounded/full replay equivalence, missing companion state, settings precedence, and incomplete-compaction fallback.
GitOrigin-RevId: f836464bb5cadd9be4a4e05b5d1679223713fc87
## Why
`invalid_prompt` responses were classified as generic invalid requests, losing the server's specific error classification.
## What changed
Add `InvalidPrompt` variants to the API and core error types and serialize the core protocol classification as `invalid_prompt`. Recognize the code in HTTP 400 responses, wrapped WebSocket errors, and SSE `response.failed` events while preserving server messages and keeping the error non-retryable. Map it to `other` in the app-server v2 protocol.
## Testing
Extend coverage for typed error mapping, missing and blank messages, protocol conversion, and guardian retry handling. Exercise HTTP and SSE failures in core integration tests, asserting the error message, serialized classification, and a single request without retry.
GitOrigin-RevId: 5d9a299a013b06158a4dc27a4054f3dbc5fd0f4d
## Why
Cloud skill discovery ran on every turn, even when the Apps resource generation and authentication scope were unchanged.
## What changed
- Reuse warning-free catalogs, including empty catalogs, while their authentication scope and Apps resource cache key remain current.
- Refresh after invalidation and retry failed or partial discovery on the next turn.
- Reject discovery results if the Apps resource cache key changes during discovery.
## Testing
Update lifecycle tests to verify cached turns avoid catalog listings and skill reads, while connection and authentication changes trigger refreshes. Update the referenced-resource test to verify partial discovery retries on the next turn without an explicit MCP refresh.
GitOrigin-RevId: ac47d5202d76703c4946afef3b1a48eaf05b54c2
## What changed
Emit `<recommended_plugins>` with the `developer` role and append it to the shared developer message after other context. Retain recognition of legacy user-role recommendations in existing rollouts.
## Testing
Add a startup context snapshot and assertions that recommendations share the developer message with permissions instructions. Update core and app-server tests to check developer-role recommendations, including across successive model requests.
GitOrigin-RevId: 0326ff347e86ec38b948f93e39e90e6a88a8730c
## Why
Forked subagent startup serializes history persistence and spawn-edge writes. Cancellation during startup can also leave a provisional child behind.
## What changed
- Defer copied-history durability so it can run alongside spawn-edge persistence, while still awaiting both before submitting the child's initial input.
- Commit agent and residency reservations and notify clients only after initial input is accepted.
- Guard provisional children so cancellation or startup failure removes and shuts them down, discards their stored state, and closes their spawn edge after any pending edge write finishes.
## Testing
Add coverage for cancellation at the child-history durability barrier, checking child termination, removal, and edge closure. Extend fork-context tests in legacy and paginated history modes to verify inherited context can be read from storage after spawn acknowledgment without flushing the live child first.
GitOrigin-RevId: e02dda57efc32b7237bb7af0ce5e5844922890c3
## What changed
Skip the thread store title lookup when initializing an ephemeral fork, leaving its thread name unset.
## Testing
Add a regression test that forks an ephemeral thread from history and verifies that the in-memory thread store's `read_thread` count does not increase.
GitOrigin-RevId: 81180c4a836c932584d2cb94c0816eae33b04af3
## Why
Callers need to interrupt a specific active turn without discarding queued input. Tool callbacks must be able to await the interruption decision without blocking task cancellation.
## What changed
- Add `CodexThread::interrupt_if_no_pending_input` and `Op::InterruptIfNoPendingInput`.
- Check the turn identity and pending user input or mailbox items before taking the active task. Leave the turn running for stale or abandoned requests.
- Acknowledge the decision before joining cancellation, and unblock pending submissions when the active task is cancelled.
## Testing
Add regression coverage for successful interruption, stale turns, preservation of queued user input and agent mail, abandoned requests, and cancellation while the submission queue is full.
GitOrigin-RevId: 42e31c09369fb070ba1b4b3c64ef45334dd872d8
vkg-oai