## What changed
Add `codex-message-board-mcp` with a `MessageBoardMcpServer` that exposes selected message-board tools through `rmcp::ServerHandler`. Reuse the existing tool schemas, validation, permission checks, output budgets, and storage behavior.
Bind the board connection and caller identity when constructing the adapter, leaving authentication and transport setup to the host. Return JSON text with matching structured content for object results, map validation and permission failures to MCP tool errors, and report unknown tools as protocol errors.
Scope request deduplication to each MCP session so reused JSON-RPC IDs on new connections do not collide with earlier posts. Preserve the distinction between numeric and string request IDs.
## Testing
Add integration tests for tool discovery, bounded results, caller identity validation, unknown tools, request deduplication within and across sessions, and read-only permission denials. Exercise discovery and calls against both local and in-memory boards.
GitOrigin-RevId: 6c62c340b24198a00d0d3d0487cb2ebc5c397b06
## Why
An unreadable or malformed `auth.json` could be treated as an account mismatch during token refresh or unauthorized recovery, producing a permanent failure.
## What changed
Propagate storage errors from guarded auth reloads as transient failures, preserving cached credentials and allowing recovery to retry. Apply credential-safe error formatting to file deserialization and agent identity JWT decoding.
## Testing
Add regression coverage for empty files, invalid auth fields, and invalid JWT claims. Verify that failures preserve cached tokens, auth change state, and network permits without exposing credential values in errors, and that unauthorized recovery can resume after the file is restored.
GitOrigin-RevId: cd26b5a057e68a3e92ebce593cf7c330e26e7703
## Why
Collapsed patch details should remain accessible while an approval prompt is open, and reviewing them should not leave the transcript stuck behind new output after approval.
## What changed
Allow clicking transcript disclosure controls while a modal prompt is open. When expanding details during patch approval interrupts following the latest output, resume following once that approval ends or advances to another patch. Preserve manual scrolling and text selection instead of automatically jumping to the latest output.
## Testing
Extend patch approval coverage with an inline expansion snapshot and checks for queued approvals and subsequent output. Add a regression test that preserves manual scroll position when approval ends.
GitOrigin-RevId: 249aa6bb2a84364a8cb111454fa5b6a3dce218b3
## What changed
- List sessions from listening backends and the displayed session's backend using their existing connections.
- Give picker views distinct request ID namespaces while keeping connection ownership and event handling with the live sessions.
- Start multi-backend listings without a working-directory filter, since local and remote workspaces cannot share a single path filter.
## Testing
Add coverage for distinct picker request IDs, preserving the live event stream after picker shutdown, listing all providers after a provider switch while retaining the remote working-directory filter, and clearing the pending cursor when a source fails late.
GitOrigin-RevId: a0b8780e1f86dc187f088080d9213afe8e18f77f
## What changed
- Detect Rex from `TERM_PROGRAM=rex` or `TERM=xterm-rex` and report its name in terminal diagnostics.
- Enable Kitty graphics for pets in Rex.
- Use the detected terminal identity for Rex's label-only web links, extending that behavior to detection through `TERM`.
## Testing
Add Rex detection coverage for both environment variables and include Rex in the web-link rendering and Kitty graphics support tests.
GitOrigin-RevId: b237e8a6b3af50a55080573dc1e0badc2c139b42
## Why
`Ctrl+L` discarded the retained transcript along with the terminal display, making earlier exchanges unavailable in the detailed transcript.
## What changed
Keep earlier exchanges accessible through `Ctrl+T` while starting a fresh terminal display with a new header. Treat that header as the boundary for compact scrolling, pinned prompts, and resize replay so cleared content stays hidden in the normal view. Allow the detailed transcript to load older history after clearing.
## Testing
Extend the `Ctrl+L` regression test and add a detailed-transcript snapshot covering retained exchanges, draft preservation, older-history loading, and cleared-content visibility after resizing and replay.
GitOrigin-RevId: f1eb73e903a7957cedafb52678c607858fb2d77f
## What changed
- Show a blue unread dot in both session picker layouts using backend read states.
- Acknowledge the transcript's observed revision after rendering it in a focused terminal, then update the unread indicator from the response.
- Key cached transcripts by backend and thread, reload them when unread revisions differ, and ignore canceled transcript results.
- Include turn errors in transcripts.
## Testing
Extend picker tests to cover unread indicators, selection colors, acknowledgments after rendering, and turn error display.
GitOrigin-RevId: edad152ed3f7086dfd3b2e8245d62febc5c9322b
## What changed
- Display blue filled dots for unread results and gray hollow dots for read idle tasks, preserving status text on narrow rows.
- Load unread state with thread listings and update markers from read-state notifications and refreshes.
- Acknowledge the observed receipt revision when a conversation is rendered in a focused, unobstructed view, including read-only snapshots, without clearing newer results.
## Testing
Extend rendering snapshots and tests for stale unread markers and read-only snapshot receipts.
GitOrigin-RevId: 2dc676c3ffe1e887a5bbf131c88891057386ffc8
## What changed
- Show draft attachment thumbnails in reference order in inline and fullscreen views on supported terminals with local workspaces. Display a `+N` count for attachments that do not fit, and preserve editable image references when previews are unavailable or space is limited.
- Refresh previews when attached files change, apply image orientation metadata, and clear frame graphics before terminal handoffs, screen switches, and shutdown.
- Finish CLI subcommand dispatch before polling interactive TUI events.
## Testing
Add a regression test and snapshot covering thumbnail order, overflow, resizing, attachment deletion, file replacement, and fallback behavior in both inline and fullscreen views.
GitOrigin-RevId: 1ea7c89e089cecc390e145c1790b6ede8bad8d5e
## What changed
Replace the duplicate `AttachedImage` type with `LocalImageAttachment`. Return borrowed attachment slices and move attachment vectors directly when taking submissions or capturing history-search drafts, avoiding conversion and cloning. Use `local_image_paths()` in request-user-input and MCP elicitation drafts to copy only the paths they need.
GitOrigin-RevId: b19451f633a479893fc97b8e2b51eb6b38838235
## Why
ChatGPT credentials can rotate while a remote executor is idle. Registry requests need to follow stored rotations without continuing after logout or switching the executor's identity. Concurrent refreshes must also avoid overwriting newer credentials.
## What changed
- Reload and validate ChatGPT credentials before registry requests, pinning the credential mode, account, user, and workspace policy. Reuse cached metadata for unchanged personal access tokens.
- Retry registration when temporary credential resolution failures prevent a request from being sent. Bound credential resolution and block reuse of a token generation whose refresh outcome is unknown.
- Restrict supported authentication modes before executor startup loads credentials or cloud configuration.
- Serialize persistent credential writes across cooperating processes and compare stored credentials before committing refreshed tokens.
- Replace `auth.json` atomically so overlapping readers see a complete document, preserving symlink targets and protecting file permissions, including Windows access controls.
## Testing
Add coverage for credential rotation, logout, identity changes, cancelled refresh callers, temporary metadata failures, registration retries, concurrent credential writes, and atomic file replacement.
GitOrigin-RevId: 6b210944bf8eba2f45bc27113f901d2c3cb06b48
## Why
Embedded app-server sessions disabled task tools and exposed only worktree tools through MCP, preventing tasks from using tools such as `set_thread_title`.
## What changed
- Expose task tools and available worktree tools together under the `codex_tui` MCP namespace, replacing the embedded session's `codex_worktrees` namespace.
- Allow embedded sessions to dispatch `codex_tui` dynamic tools when MCP is not configured, while retaining the MCP requirement for delegation tools.
- Persist local task-tool reference capabilities for embedded sessions as well.
## Testing
Update coverage for embedded dynamic-tool namespace dispatch and task-tool availability after starting and resuming threads. Extend the model-driven worktree test to rename another task through `set_thread_title` and snapshot the combined MCP tool set.
GitOrigin-RevId: 31f37df69b4e86045953cad418a95c04cd1f35ec
## Why
The agent command center previously required a shared background server, preventing embedded sessions from opening it and rejecting `codex agents --no-daemon`.
## What changed
- Allow `codex agents --no-daemon` to use an embedded app server and open the command center without a shared server.
- Route `codex agents` through the normal daemon startup, eligibility, and compatibility checks, including embedded fallback where applicable.
- Return embedded sessions to the command center when canceling directory trust or archived-session confirmation.
## Testing
Add CLI coverage for `--no-daemon` before and after `agents`, plus an integration test that verifies embedded mode is used even when a daemon is running. Update archived-session tests to expect cancellation to return to the command center.
GitOrigin-RevId: 3bdf18a00456eae2e4d38103d12126e039d44119
## Why
Command-center navigation required a shared app server, leaving embedded sessions without the same way to switch between chats. Archiving or deleting an embedded session also exited the TUI.
## What changed
- Enable command-center navigation and session listing for embedded sessions, including navigation from read-only conversations and the safety precaution menu.
- Return to the command center after archiving or deleting a session.
- Retain thread subscriptions when forking, including on embedded servers.
- Confirm before quitting an embedded server would stop running sessions or side conversations.
- Construct large startup and event-loop futures outside their callers' stack frames before boxing them.
## Testing
Add regression coverage for embedded session switching with background approvals and draft restoration, plus confirmation before quitting with a running side conversation. Update navigation, archive/delete, fork, and UI snapshot tests for the new behavior.
GitOrigin-RevId: 96bac48cccf85b685b58934d23dd1db93b663751
## Why
Archiving or deleting a thread in the command center shuts down side conversations belonging to other threads.
## What changed
Limit side conversation shutdown to those whose parents belong to the affected thread's known subtree. Proceed once those conversations close successfully, even if unrelated side conversations remain. Continue shutting down all side conversations on exit.
## Testing
Extend the delete lifecycle test to verify that an unrelated side conversation remains open after deletion.
GitOrigin-RevId: f27efcd1fc49cf5c617c9fa454d83eed91ae185f
## Why
Long realtime conversations could lose speech when active transcripts and handoff transcript fields were truncated.
## What changed
- Record completed V3 transcript chunks in model and client history once the active transcript exceeds 4 KiB, without triggering inference.
- Keep unfinished utterances pending to preserve conversation order, and persist completed chunks before subsequent handoffs.
- Preserve full V3 transcript text at handoff and session-end tail flush, and avoid adding handoff input already recorded in transcript history.
## Testing
Add integration coverage for long transcripts, XML escaping, recording before handoff without inference, repeated handoff input, and both session-end tail flush settings.
GitOrigin-RevId: 62218b811809c4cf5b16fb0247a335eb474f9ab9
## What changed
Allow gateway OAuth configuration to select `credentials_store = "file"` to persist credentials in plaintext at `$CODEX_HOME/secrets/gateway_oauth.json`. Keep `keyring` as the default.
Read, update, and delete file-backed credentials by credential ID, using atomic writes and the existing cross-process lock. Preserve the serialized provider identity when using the default store.
## Testing
Add an app-server test that completes gateway OAuth login with file storage, verifies Unix file permissions are `0600`, and checks that login remains successful after a server restart.
GitOrigin-RevId: dc1d17922bd80bf65034cbc5aa3d97959e962dcc
## Why
Switching model providers can hide saved chats from resume lookup or prevent them from opening. Keep their history readable when the server rejects resuming because of a provider mismatch, missing configuration, or policy conflict.
## What changed
- Include all providers in the resume picker, named resume lookup, and `resume --last`, while retaining provider filtering for fork lookup.
- Open chats with provider errors as read-only history and show an explanation with recovery shortcuts: `c` to continue in a new chat, `n` to start fresh, and `Esc` to choose another chat.
- Continuing in a new chat prepares an editable, unsent prompt referencing the saved conversation.
- Preserve drafts and rejected prompts or steers, suppress automatic submission, and retry provider admission when reopening the chat.
## Testing
Add coverage for cross-provider discovery, read-only history, configuration recovery, continuation drafts, rejected input recovery, error rendering, and Escape handling during transcript browsing.
GitOrigin-RevId: 5aaa7a404b9a6231101599adef18d2f1e4a8020a
## What changed
- Add a non-inlined `TryFrom<toml::Value>` implementation for `ConfigToml` and route callers through it to share the generated deserializer in `codex-config`.
- Reuse the ignored-field deserialization helper for strict validation, returning path-aware errors while preserving existing fallbacks for CLI validation and ignored-config warnings.
GitOrigin-RevId: 0208b314416ad4d3d7fbf3a30560a0c8c4035abd
## Why
Older executors sandbox reads whenever a policy is supplied, even when the policy allows unrestricted reads. This can interfere with loading skills across executor versions.
## What changed
- Omit sandbox contexts from remote read operations when reads are unrestricted and explicit permission paths are valid for the target path convention. Retain contexts that require executor-side path validation.
- Check remote `windows_mxc` support before sending MXC sandbox contexts for reads or capability discovery, returning an update-executor error when unsupported.
## Testing
Add coverage for permission path validation across read operations, unsupported MXC requests, and skill loading over Noise with mismatched app and executor versions, including selected skill roots with capability discovery disabled.
GitOrigin-RevId: 4a2a7ccaa2ba4daac657bd84aea603404452be45
## Why
Cyber access program selection was restricted to the `openai` provider ID, preventing custom providers from accepting explicit program selections.
## What changed
- Add `capabilities.cyber_access_programs` to provider configuration and preserve it through remote thread configuration. Default to enabled for `openai` and disabled for other provider IDs, with explicit overrides taking precedence.
- Use the capability when forwarding `access_programs.cyber` and determining Daybreak availability in exec and the TUI. Refresh TUI eligibility when the server changes the selected provider.
- Preserve authentication, API-key feature gates, and catalog access checks; the capability does not grant program access.
## Testing
Add coverage for capability defaults and overrides, configuration round trips, custom-provider requests with both authentication types, API-key feature gating, compaction, WebSocket response reuse, exec selection, and TUI provider changes.
GitOrigin-RevId: 579f7c33c9e857ff5fedd08311aa8e3129740c1f
## Why
Standalone web search must use the same permission mode as hosted search. Permission changes during a turn should take effect on the next turn, without changing web access for searches in the active turn.
## What changed
Pass the turn's `WebSearchMode` to the web search extension and use it to determine tool availability and `external_web_access`, while retaining provider support checks and thread-level search settings.
## Testing
Add an app-server regression test that switches from cached search to Full Access while a turn is paused. Searches before and after the update keep `external_web_access` disabled in that turn; the next turn enables it.
GitOrigin-RevId: 9e3b8598f2e491388b7e7d4840c849155ae95e88
## What changed
Allow shared network constraints in `[permissions.network]` in `requirements.toml`, alongside `[permissions.filesystem]`. Apply them throughout configuration loading, network approvals, Windows sandbox policy validation, and `configRequirements/read`, and show their source in `/debug-config`.
Retain `[network_proxy]` and `[experimental_network]`, but reject mixing either with `[permissions.network]`, even across requirements layers. Preserve independent network and filesystem precedence and source attribution, and report unknown nested network fields.
Reserve `network` as a managed requirements table name and reject empty or profile-shaped tables with migration guidance. Profiles named `network` remain valid in `config.toml`. Document that policy publishers must keep using `[experimental_network]` until all readers support the chosen replacement.
## Testing
Add coverage for layered constraints and source attribution, conflicting spellings, profile-name migration errors, unknown-field diagnostics, and cloud validation. Extend API, project discovery, network approval, and Windows policy tests to cover `[permissions.network]`, and verify managed proxy settings remain independent of disabled feature configuration.
GitOrigin-RevId: 994dfca9abf5a7aea914276c0ded8b40d7ed0372
## Why
A completion marker missing its final newline can make an incomplete trace appear complete. Opaque JSON payload validation can also miss invalid UTF-8 inside strings.
## What changed
Require a newline-terminated `RecordingCompleted` record before setting `recording_complete`. Read raw payloads as UTF-8 text before validating their JSON structure.
## Testing
Extend the lifecycle replay test to cover a completion marker missing its final newline and an opaque payload containing invalid UTF-8.
GitOrigin-RevId: a0007ff449cdefeb44065ed9165ef60bf720dad9
## Why
The SIGTERM cleanup test depends on the OS scheduling the shell within the production grace period. Tracing tests also need fixture creation and cleanup to use the appropriate subscriber.
## What changed
- Pause Tokio time while waiting for the shell's cleanup marker, keeping the cancellation future runnable to prevent automatic clock advancement, then resume time after execution.
- Adjust subscriber setup and fixture lifetimes in session and tool dispatch tests so instrumented resources are created and dropped under the appropriate subscriber.
GitOrigin-RevId: 12c654a031a8a4e61fc66488a5f687852f5ca099
## Why
MXC requires deny paths to have existing parent directories, even when the denied path itself does not exist.
## What changed
Create missing parent directories before expanding deny globs and volume grants on Windows. If creation fails, return a policy resolution error with guidance to create the directory manually or correct the path or permissions.
## Testing
Extend policy tests to cover missing deny parents, preserved read-only carveouts during volume expansion, and parent denies expressed as explicit paths or glob patterns. Verify that parent directories are created without creating the denied child.
GitOrigin-RevId: d852444bef51e5d5449c4228a31d01c0e6f982dc
## Why
Enabled rollout tracing could silently fail to initialize, and a terminal task status did not establish whether all recording had finished. Trace consumers need to distinguish a complete recording from a partial bundle, including when a task is interrupted.
## What changed
- Fail thread startup or resume if an enabled recorder cannot initialize, while cleaning up session resources.
- Stop recording after the first write or serialization failure and preserve that failure across shared producers.
- Append a closing record when the last writer handle is released without recording errors. Expose `recording_complete` in `state.json` independently of task success, and mark submission-channel closure as an aborted rollout.
- Reject replay logs with missing or reordered events, mismatched rollout IDs, events after completion, or missing or invalid JSON payloads. Valid prefixes remain replayable with `recording_complete` set to `false`.
## Testing
Add coverage for startup failure and recovery, shared-writer failures, finalization after child handles close, incomplete logs, and missing or malformed payloads. Extend session and CLI tests to check recording completion after shutdown, interruption, stream failure, and submission-channel closure.
GitOrigin-RevId: 30d62fa95912fb0442ad1199776d110884066c30
## Why
Remote plugin bundle download URLs can contain signature tokens in query parameters. Including the full URL in errors or debug output exposes those tokens.
## What changed
Omit the download URL from `ValidatedRemotePluginBundle` debug output. Report download hosts instead of full URLs, strip URLs from underlying HTTP errors, and report only the scheme for unsupported final URLs. Invalid URL errors retain the parse error without echoing the input.
## Testing
Extend tests to check that signature tokens stay out of bundle debug output, unsupported final URL errors, and app-server installation errors while preserving signed request URLs and HTTP status diagnostics.
GitOrigin-RevId: 8edda4847feae4f2bcb12fbb414a3a25bde53814
## What changed
Include `tool_name` in MCP tool approval elicitation metadata and forward available `readOnlyHint`, `destructiveHint`, `idempotentHint`, and `openWorldHint` values under `tool_annotations`. Omit unspecified hints and the annotation title.
Reuse the stored tool approval metadata when available so annotation hints reach the approval request.
## Testing
Extend unit tests to cover tool names, annotation hints, and omission of unspecified hints. Update integration coverage to verify that the approval tool name matches the executed MCP call and that `readOnlyHint` is preserved.
GitOrigin-RevId: f082fe7fd87fde9f4895149e09210c7cb9d1e582
## What changed
Add the disabled-by-default `code_mode_host_output_truncation` feature flag. When enabled, Core requests server-side output truncation for its built-in code-mode session providers over both stdio and gRPC. Injected providers retain control of their session settings, and explicit session options pass through unchanged.
## Testing
Add coverage for both transports verifying that the host's output-limit notice survives a zero-token observation budget. Extend the shared-provider test to exercise an injected provider with the new flag enabled.
GitOrigin-RevId: edbb65e930bf544e3d2f8384767037a6fb82d451
## What changed
- Add “System proxy” to `/experimental` for opting into macOS or Windows system proxy settings. Keep `respect_system_proxy` disabled by default.
- Update doctor’s macOS proxy guidance to point to `/experimental` and `codex features enable respect_system_proxy`, and tell users to restart Codex after changing the setting.
## Testing
Add snapshots for the experimental setting and doctor guidance, plus a Responses test verifying that `x-codex-beta-features` includes `respect_system_proxy` only when enabled.
GitOrigin-RevId: caa3e1a7cbe222069f35022b06c59da578b8a4dd
## Why
Standalone web search errors currently abort the turn as fatal failures, preventing the model from responding to them.
## What changed
Return client setup errors to the model and represent failed search requests as unsuccessful tool outputs. Failed requests still emit search completion events and retain external-context handling. Limit error messages to 1,024 bytes, truncating at a UTF-8 character boundary with a truncation marker.
## Testing
Add coverage for failure status reporting and UTF-8-safe error truncation. Extend workspace routing tests to verify that a rejected redirect returns a bounded diagnostic to the model, allows the turn to complete, emits search lifecycle events, and marks thread memory as polluted.
GitOrigin-RevId: 9fb308990afa2ce0db5d9beed9bc66d9c1500418
## What changed
Add `codex.additional_context` to count submitted entries, including unchanged entries, and `codex.additional_context.value_bytes` to measure UTF-8 value sizes before and after the existing truncation limit. Sizes exclude message wrappers and include the truncation marker after truncation.
Tag metrics with context kind, truncation status, and an explicitly supplied name when present; never use opaque source keys as tags. Record metrics through the current turn's telemetry.
## Testing
Add integration coverage for message and tool-output formats, repeated submissions, truncation boundaries, empty and multibyte values, optional name tags, and turn-specific model attribution.
GitOrigin-RevId: 463f257af27be58c372970fac853b85fde495dd5
## Why
Standalone web search could send requests to the bootstrap backend instead of the discovered workspace backend, bypassing workspace routing.
## What changed
Use the thread's shared `WorkspaceRoutingContext` when preparing search requests so they use the resolved backend, authentication, residency, and account routing headers. Reject redirects when required by the resolved routing policy or account routing header, and preserve the established routing context across configuration changes.
## Testing
Add an app-server integration test that verifies search reaches the discovered HTTPS backend with the expected credentials and routing headers, without contacting the bootstrap search endpoint. Add a regression test that verifies configuration changes preserve the thread's routing context.
GitOrigin-RevId: 67160f1b3e54231dc100ce3ed4cfcea965b56d26
## What changed
Update the `openai-docs` skill's model migration guidance to use the retiring model's documented replacement from the API deprecations page when no explicit target is given. Fall back to the latest-model resolver when no replacement is documented or the migration is not prompted by a deprecation.
GitOrigin-RevId: db51a2a034118f05fc6b9b30c763231205b784e5
## What changed
Append pasted text to the skills search query and immediately refresh the filtered list. Normalize whitespace for a single-line query and ignore whitespace-only pastes.
## Testing
Extend the filtering test to cover pasting after typed text, verify the rendered search results with a snapshot, and check that whitespace-only pastes leave the view unchanged.
GitOrigin-RevId: fa82d2b5f1c78a7c3a7f61fc2d4f24c94c960386
## Why
Creating child history before persisting its parent-child relationship can leave history that parent subtree deletion cannot discover, especially when fork startup copies history. A relationship write failure must reject the spawn before child storage is created.
## What changed
- Reserve the child thread ID and persist its spawn edge before starting the child. Propagate persistence failures to the caller.
- Keep pending relationship writes owned through caller cancellation, and wait for them to finish before closing the edge during cleanup, including when a write commits but reports an error.
- Skip edge cleanup when publication was skipped, and reject IDs belonging to running threads before publication.
## Testing
Add regression coverage for cancellation before commit or acknowledgement, errors after commit, skipped publication, and duplicate child IDs. Integration tests cover fresh children and full-history forks, verifying that failed publication leaves no child history, execution, or creation notification and preserves unrelated history during parent deletion.
GitOrigin-RevId: 6e2e3f32d9558091312651ab47aa845d7d13b4ca
## Why
The startup command list was shown even when tooltips were disabled.
## What changed
Show the getting-started help only when `show_tooltips` is enabled. Keep regular tooltips and model-change notices suppressed on the first session event.
## Testing
Extend the first-event test to cover both tooltip preferences and update the startup header snapshot.
GitOrigin-RevId: 7b4a043737053f1a078cb21528dc459f0cfd762b
## Why
Host-side truncation can bound Code Mode output before it crosses the transport, including script errors that would otherwise exceed the frame limit.
## What changed
- Negotiate server-side output truncation for stdio and gRPC sessions, with client-side fallback for older hosts.
- Forward output budgets for execution, waiting, and termination when server-side truncation is selected. Avoid truncating host-formatted output or appending script errors a second time.
- Preserve the negotiated mode across reconnects and reject hosts that cannot maintain it.
## Testing
Add transport and integration coverage for output budgets, oversized script errors, reconnect compatibility, and preservation of output-limit notices with a zero-token budget.
GitOrigin-RevId: 2075101e4845eca64f45491c27a3b326788645c8
## What changed
Export `ElasticBudgetConfig`, named `ElasticSection` groups, and validated `ElasticSectionLimits` for optional evidence. Each group can specify a minimum token reservation and a per-entry text cap.
Validate limits during construction and deserialization: both values must be positive, and the entry cap must fit within the minimum reservation and the existing text-part delivery allowance. Reject unknown configuration fields.
This adds configuration types only; elastic allocation is not activated.
## Testing
Add a serialization round-trip test and deserialization checks for zero limits, entry caps above the minimum reservation, and entry caps above the delivery allowance.
GitOrigin-RevId: c869018cfc0d96377b1adbfbdd98e1d88bd1b32a
Register `incremental_exec_tools` as an under-development feature, disabled
by default, and expose it in the configuration schema.
GitOrigin-RevId: 444767b7a46e3ada7efb3f6c4fb570feb299e0c7
## What changed
Move the model client's request-preparation loop into the shared `prepare_provider_request` helper and add `RequestAuthChange` to classify auth state changes. For managed auth, retry preparation when credentials change and reject account changes, including when the provider starts or stops exposing an auth manager during setup.
Capture the auth owner and credential generations together and pass them into the preparation callback so the resulting client setup records the state used for that attempt.
## Testing
Add a test verifying that an explicit provider bearer token survives a workspace switch during setup without retrying preparation.
GitOrigin-RevId: ed8710d1c344b48ebf6182e25e6269214dd2d3fe
## What changed
Expose `thread/guardianReview` to review an idle thread's final injected `exec_command` without executing it. Return the call ID and Guardian assessment, or `null` for the assessment when exec policy skips approval.
Subscribe the requesting connection to the thread, enforce input and model-provider restrictions, and cancel an in-flight review when the connection disconnects so the thread is released promptly.
## Testing
Add integration coverage for assessment responses, policy-skipped reviews, model-provider enforcement, and WebSocket disconnect cancellation.
GitOrigin-RevId: e8ad5598e8f101a937447ebe26136310bb76c8d1
## Why
`libz-sys` 1.1.29 is pulled in through `curl-sys`/`curl` in `codex-http-client` only on Windows, where it skips the affected probe. The lockfile also pins `cc` to 1.2.55, below 1.6.0.
## What changed
Add `RUSTSEC-2026-0418` to the `cargo-audit` and `cargo-deny` ignore lists with the rationale. Remove the exception when `libz-sys` reaches 1.1.31 or later, and reassess if it is used on Unix with `cc` 1.6.0 or later.
GitOrigin-RevId: 0e2ffb4686d9c77dfd7f1312aef6a093a803f832
Use `gpt-6-luna` for memory extraction and `gpt-6.1-terra` for memory
consolidation when the provider does not require a backend-specific model ID.
GitOrigin-RevId: 51419103b090d66af21e092983658da1285f6660
## Why
The schema exporter sits on application builds' critical path, but compiling it as a test harness also compiles and registers unit tests that schema generation does not need.
## What changed
Build the exporter with `--cfg=test` to retain test-only schema derives without the test harness, and disable its debug metadata. Run schema generation directly on a thread with an 8 MiB stack.
Share the environment-driven schema writer with the existing ignored test, allow a configurable crate root in `schema_sources`, and switch the public schema bundle to the dedicated generator.
GitOrigin-RevId: 317e24f77e153b9ba0c5c583837eed3bcd3774fd
## What changed
- Match final serving assessments to their response and output item, then retain them with tool invocations and code cells across waits.
- Use matching assessments instead of asynchronous scoring for adaptive review: low-risk actions can skip synchronous review, while elevated-risk actions require it.
- Revalidate captured authorization and policy before approval. Require fresh review for stale or incomplete authorization, preserve explicit review requirements, and discard assessments when hooks rewrite tool input.
- Keep asynchronous scoring as the fallback when an assessment is missing or does not match.
## Testing
Add integration coverage for direct and nested tool calls, hook rewrites, explicit escalation, interrupted responses, catalog-driven policy, incomplete authorization, and assessment retention across code-cell yields and waits.
GitOrigin-RevId: 4346a227204137f018c03c34b302d6f1e9592c96
Expose `MAX_TEXT_PART_ESTIMATED_TOKENS` from `codex-guardian-context` and use it for native tool calls, transcript entries, and delivery-size assertions. Keep the existing 9,000-token limit while replacing duplicated limits in code and tests.
GitOrigin-RevId: 90cb98eea9bade34f18db0d1666ed7ed1e93febe
Set `native_call` to `None` in the `ToolCall` and `ToolInvocation` fixtures used by the agent host invocation and spawn tests.
GitOrigin-RevId: 2a6f9ccb95d99297085a2861bb44e5ce7599715c
jif