## Why
The pinned V8 can inline `Array.prototype.sort` with incompatible element kinds when a comparator mutates the array, allowing an object to be stored in an integer-elements array.
## What changed
Disable Maglev, Turbolev, and TurboFan array builtin inlining during code-mode runtime initialization until the V8 artifacts include the upstream fix.
## Testing
Add an integration regression test that requests top-tier and Maglev optimization, checks element kinds after comparator mutation, and verifies ordinary numeric sorting still returns `[1,2,3]`.
GitOrigin-RevId: cea38e920245d6a133a5263118dc664fb3e61838
## What changed
- Track the Windows sandbox implementation separately from its legacy setup level.
- Select dedicated proxy listeners for `WindowsMxc` on Windows across sessions, app-server command execution, and the sandbox CLI.
- Rebuild the session proxy when routing changes, retaining its network policy decider.
- Add a sandbox CLI execution path through the MXC sandbox transform when `WindowsMxc` is selected.
## Testing
Extend configuration assertions for the selected sandbox type and the session refresh test to verify dedicated routing and policy decider retention on Windows.
GitOrigin-RevId: 2a22192636c542022ec81a378a16c1bb6867e145
## Why
Disabling a connector's canonical plugin could leave its tools available when another enabled plugin contributed the same connector.
## What changed
Retain `canonical_app_id` in the remote installed-plugin cache and use ownership metadata for the current account when building connector snapshots. A disabled canonical owner now excludes its connector even when another plugin contributes it or the owner's bundle is absent from the host. Match owners by plugin name and marketplace, and ignore ownership metadata when the cache no longer matches the current authentication.
Build these snapshots through `PluginsManager` when the plugins feature is enabled; otherwise use an empty snapshot.
## Testing
Add manager coverage for combined local and canonical exclusions, marketplace matching, and authentication changes. Add an integration test showing that disabling a noncanonical contributor preserves shared calendar tools, disabling the canonical owner hides them, and clearing the exclusion restores them.
GitOrigin-RevId: ee2981d1277825fefb671dd7d1078cd7ea5c0ea5
Expose `shell_startup_script` from `codex-shell-command` and use it for
interactive shell snapshot capture, preserving the existing startup scripts.
The helper returns an empty script for other shell types; callers remain
responsible for login startup flags and shell lifecycle.
GitOrigin-RevId: 8cb64c02c08140d2676e67b9db06c9a77649b3eb
## What changed
- Add `AnalyticsSession` to load local ChatGPT credentials, bind requests to the initial account and user, and reject identity changes before requests or when accepting results.
- Reload credentials and provide bounded recovery for unauthorized requests, using a backend client that disables redirects.
- Add lazy TUI analytics session initialization, account display metadata, and plan-specific credit groupings for future dashboard integration.
## Testing
Add regression tests for account and user changes, missing or API-key-only authentication, credential reloads, recovery after a `401` response, and session initialization after signing in.
GitOrigin-RevId: 2ba0d96fb44936d12d13aedffc3f2e61aedea560
## What changed
- Add daily text token history grouped by model or token type, with date-range and model filtering, freshness metadata, and validation of token counts. Support both grouped and per-model report data, including reported model totals when components are unavailable.
- Add credit formatting helpers that preserve tiny signed adjustments and format integer millionths without floating-point rounding, plus a short date formatter.
## Testing
Add unit tests for token groupings, model filtering, freshness, missing components, explicit zero totals, and credit formatting across tiny refunds and integer limits.
GitOrigin-RevId: 706dcae7995e46707c2f1df9cdf3e06966459dd6
## What changed
Add display models and adapters from typed backend responses for usage, credits, messages, plugins, and skills. Normalize reports into daily histories with grouping labels, units, and freshness timestamps.
Preserve missing values, signed credit adjustments, and full daily totals when grouping usage by task start. Account for unassigned message counts as `Other`, merge duplicate dates, and fill unreported days only for credit reports. Group models contributing less than 1% of relative usage into `Other`.
This adds the data preparation layer for dashboard integration; it is not yet connected to `/usage`.
## Testing
Add unit tests covering missing versus explicit zero values, signed credits, enterprise labels and freshness, usage grouping, duplicate-date message remainders, and unsupported message groupings.
GitOrigin-RevId: 931f46a9a6521b4cda2fc26051e7a305cbf6fa6c
## What changed
Add `Client::get_account_analytics` with public `AnalyticsReport`, `AnalyticsResponse`, and analytics models for token usage, credits, workspace messages, plugins, and skills. Select report-specific routes and query parameters for both `api/codex` and `wham` paths.
Preserve backend attribution, optional amounts, and signed credit values. Keep string values open for forward compatibility, and return a generic decoding error without including the response body.
## Testing
Add HTTP contract tests covering report routing and decoding, plugin query parameters, signed credit events, new string values, and rejection of mismatched response shapes without exposing the body in the error.
GitOrigin-RevId: 196ff7f49c3f9d8a029398d09af14449c5d04207
## Why
`allowedWindowsSandboxImplementations` uses the legacy setup-mode type, which cannot represent `mxc`.
## What changed
- Introduce `WindowsSandboxImplementation` with `elevated`, `unelevated`, and `mxc` variants for configuration requirements, and update the generated schemas and TypeScript and Python types.
- Keep `WindowsSandboxSetupMode` limited to `elevated` and `unelevated`, and update the requirements mapping and its test assertions to use the new type.
- Document that clients selecting `mxc` skip the legacy setup and readiness APIs and use the standard `command/exec` streaming and process-control path.
GitOrigin-RevId: c926e853f0bbdb29d4b437866c284c1394a7ea13
## What changed
- Replace dedicated Guardian endpoints with `/responses`, sending `x-codex-guardian: reviewer` or `x-codex-guardian: classifier` for eligible Codex backend requests over HTTP and WebSocket.
- Add model-scoped thread headers, recheck backend authentication on each request attempt, and reconnect WebSockets when the applicable headers change.
- Retain `features.guardianv2.free_guardian` for configuration compatibility while removing its routing gate; the backend now controls Guardian billing.
## Testing
Update tests for reviewer and classifier headers, model and authentication scoping, HTTP fallback, WebSocket reuse, and parent-response metadata across retries.
GitOrigin-RevId: 1c2b3c458ab77fb40aae4ee6784f6d827c60e76c
## Why
MXC is a sandbox implementation, not a restricted-token sandbox level. Executor requests need to represent that choice separately from `WindowsSandboxLevel`.
## What changed
- Introduce `WindowsSandboxSelection` for executor sandbox contexts and remove `Mxc` from `WindowsSandboxLevel`.
- Preserve the `windowsSandboxLevel` wire field and its serialized values for compatibility.
- Share sandbox selection between executor process launches and filesystem helpers, and use the new selection in capability discovery and skill reads.
- Disable Windows sandbox selection for executor paths that do not use Windows path conventions.
## Testing
Extend coverage for MXC wire serialization, Windows skill-read sandbox checks, and capability discovery with distinct permissions. Exercise remote filesystem write restrictions with both restricted-token and MXC sandboxes, including rejection when native MXC is unavailable.
GitOrigin-RevId: 266211377bcb138a0dc75861e9ff2225fa37a53d
## What changed
Move concrete reviewer settings into `guardian-v2` and replace `ReviewerConfigOverrides` with a `ReviewerConfig` callback stored in thread extension data. Apply the callback to each captured parent configuration before preparing context and checking session reuse.
Keep model selection, policy prompt construction, and live network state in the core adapter. Preserve the existing read-only reviewer settings and share `reviewer_permission_profile` with inherited environment configuration.
## Testing
Update existing Guardian configuration, session reuse, and prewarming tests to use the extension's actual configuration builder, including compiling the shared source in core's test host.
GitOrigin-RevId: dfa1dae9f8d4469f2e4f6e64ab842cc662970898
## What changed
- Record `auth_or_link` for Codex app calls with trusted connector authentication failure metadata, capturing it before result callbacks or model-facing rewrites. Propagate the classification to MCP tool-call and app-usage analytics.
- Record `approval` when a dispatched approval request is denied, times out, or aborts, covering both MCP elicitation and legacy user-input approvals.
## Testing
Add unit and turn-level coverage for authentication failures, metadata removal by callbacks, successful and rejected approvals, and closed approval response channels. Verify event counts, classification, and exclusion of sensitive test values and authentication URLs from analytics payloads.
GitOrigin-RevId: 493df2a2923f346a0f644f1f26ab8b6b9b8888e0
## What changed
- Add `AllowedTools` to the extension API, captured once at thread startup to restrict which tools can be advertised or executed. An empty list disables all tools; an absent value preserves ordinary tool setup. Callers must supply the list again when resuming a thread.
- Filter tool registration and hosted tool specifications before Code Mode and discovery. Match names with their namespaces and require generated tools such as `exec` and `wait` to be explicitly allowed.
- Move Guardian reviewer tool selection into the allowlist while retaining feature and sandbox restrictions, with a fallback for older reviewer sessions.
## Testing
Add coverage for selected, empty, and absent allowlists across tool sources and Code Mode. Add managed-thread tests verifying advertised tools, rejection of excluded calls, and that replacing extension state after startup cannot change the captured allowlist.
GitOrigin-RevId: 33c1722c4241f368963d8385fa0415112e16a72d
## What changed
Introduce `ReviewRequest` in `codex-guardian-reviewer` to own contributor routing, cached approvals, synchronous fallback, and review cancellation. Keep action validation and session-specific preparation in the host.
Track the complete approval operation through parent shutdown, driving cancellation through reporting and reviewer cleanup before releasing it. Preserve fresh-review requirements and validate cached approvals before recording their outcome.
## Testing
Extend coverage for cancellation before routing and during cached approval, parent shutdown cleanup, and required fresh review overriding a cached allow result with matching assessment events and a denial warning.
GitOrigin-RevId: 8dcf26cc3660e91ef94e28e0bee7327ebe34ae6c
## What changed
Replace duplicated model-selection fields in `GuardianReviewSessionConfig` and `GuardianReviewSessionParams` with the existing `ReviewModel` struct. Read model settings and selection metadata from that struct for session execution, analytics, and failed-review records, and update the existing test fixtures accordingly.
GitOrigin-RevId: 1da2001e68168ec40a3d726694eb5fd0445aa3d7
## What changed
Remove core guardian tests for transcript numbering and unpaired tool outputs. Extend `guardian-context` coverage to assert that named image-only tool outputs retain their source and use `[non-text output]` for both sync and async contexts, with tool calls included or excluded.
GitOrigin-RevId: ba483e8f6e335697106a987051687a12ad2fde01
## What changed
Make `parse_guardian_assessment`, the rejection circuit breaker types and methods, and `AUTO_REVIEW_DENIAL_WINDOW_SIZE` crate-visible with `pub(crate)`. Update their re-exports in `guardian-reviewer` to match.
GitOrigin-RevId: 39521c7859936ebc9af570d7f1ad7b2348f3673d
## What changed
- Mark `guardian_ext` as a removed compatibility flag.
- Remove `InternalSessionSpawner`, `InternalSessionSpawnFuture`, `ApprovalReviewInput`, and `ApprovalReviewError` from the extension API, along with the spawner test.
- Remove `NodeReplReviewEvidence::review_inputs` and make the core re-exports of `NodeReplReviewEvidenceMode` crate-private.
GitOrigin-RevId: 1c532bc57264644cf521ef8077285a9b8ed67391
## What changed
- Make `SynchronousReview` own assessment events, telemetry, warnings, evidence-recording decisions, and consecutive-denial accounting.
- Keep action preparation, stale-approval validation, evidence storage, and event publication in the host adapter.
- Extract `Session::interrupt_turn_with_warning` to apply extension-requested interruptions to the selected active turn and emit the interrupted thread-idle lifecycle event.
## Testing
Adapt session tests to verify that extension interruptions emit the thread-idle lifecycle event and survive shutdown of the calling runtime.
GitOrigin-RevId: b234ad86206fedc2434f48fc44dc57679443c69f
## What changed
Extract V2 interruption validation and dispatch into `AgentControl::interrupt_spawned_agent`, returning the agent path and previous status with typed validation and runtime errors. Update the `interrupt_agent` tool handler to delegate to it while retaining tool error mapping and activity emission.
Preserve rejection of root and self targets and successful handling of unloaded or already-dead runtimes without reloading them.
GitOrigin-RevId: 893bbc4f464596d0fee032a71702a4a4f6becf5c
## What changed
- Use cancellation guards to tie reusable reviewers and temporary forks to their lifetimes, including when a review future is dropped. Replace cancelled reusable reviewers before reuse.
- Share `ReviewerTasks` between the pool and `ThreadManager`, and wait for tracked cleanup during pool shutdown. Remove the separate session shutdown protocol.
- Move denial cleanup from core task handling into Guardian's turn start, stop, and abort hooks. Expose `install_reviewer` to register both thread and turn lifecycle contributors together.
## Testing
Add an integration test that exercises stale denial cleanup at turn start, completion, and interruption, including starting another turn after interruption.
GitOrigin-RevId: 85badb235309c1e1576547d1746f7ee9fc66d545
## What changed
Extract target validation, runtime reloading, and message delivery from the V2 tool handler into `AgentControl::deliver_message`. Keep target resolution, analytics, and tool-facing error mapping in the handler.
Represent plaintext and encrypted payloads with `AgentMessage`, sharing communication construction with agent spawning. Preserve queue-only and follow-up turn semantics, target checks before reload, and turn metadata propagation.
GitOrigin-RevId: a88bcede015a17f6c11c7cad95ee58add5dc2820
## What changed
Move shared spawn and resume configuration helpers into `agent::child_config` and route both multi-agent versions through `prepare_agent_spawn_config`.
Preserve each version's role and model precedence, full-history inheritance, service-tier selection, runtime policy, and default-role metadata for reloads. Return configuration errors as strings and convert them to `FunctionCallError::RespondToModel` at tool-handler boundaries.
GitOrigin-RevId: 9d539050aa44f94043a6487f1f6f1037de1d15ca
## What changed
Add an optional `elicitation_type` to app-used and MCP tool-call events, with `auth_or_link` and `approval` classifications and `null` for unclassified calls. Existing core app-use tracking passes `None`.
Expose an API to queue MCP classifications by thread, turn, and item before completion. Preserve them across turn completion, consume them on item completion, and clear them on thread closure. Bound pending classifications to 256 entries, evicting the oldest when full.
## Testing
Add coverage for serialization, first-classification retention during app-use deduplication, per-call classification across turn completion, pending-state eviction and cleanup, and exclusion of tool arguments from emitted events.
GitOrigin-RevId: 185a2ccb38153e123fc731231edff0259a26bce3
## Why
The TUI renders supported inline math as Unicode but leaves display equations to ordinary Markdown rendering. Display fractions need spatial layout, and streamed equations must remain mutable while their closing delimiter is pending.
## What changed
- Render supported standalone `$$...$$` and `\[...\]` equations as Unicode, with stacked fractions and aligned baselines.
- Fall back to source for unsupported expressions, nested fractions, and spatial layouts that exceed the available width or occur inside lists or block quotes.
- Preview unfinished display math as wrapped source and hold it out of scrollback within the conversion budget, then render it when closed.
- Preserve display delimiter boundaries across incremental rendering and bound lookahead for rejected openers so shell `echo $$` does not retain the entire response.
## Testing
Add snapshots and regression tests for display layouts, narrow widths, literal fallback, streaming closure, resize reflow, raw source preservation, shell dollars, and bounded incremental rendering.
GitOrigin-RevId: ab54675f2e27a243f5d7165c76d9d7355f9fabd1
## Why
`slow_down` errors were treated as terminal server overloads, while exhausted credit balances and spend limits fell through to retryable stream errors.
## What changed
- Classify `slow_down` as a retryable rate limit in HTTP 503 responses and SSE failures, preserving the server message and parsing retry delays from SSE error messages.
- Map `credit_balance_exhausted`, `organization_spend_limit_exceeded`, and `project_spend_limit_exceeded` SSE errors to quota exhaustion so they terminate without retries.
## Testing
Extend tests to cover HTTP error classification and retryability, `slow_down` stream retry exhaustion and message-provided delays, and a single `UsageLimitExceeded` error with no retries for each quota error code.
GitOrigin-RevId: 7985eba71ba4a6fe897a45957e448fadd42f3963
## What changed
Add `codex app-server daemon update --from-cli` to copy and pin the invoking CLI's complete package, including downgrades and local builds. Require interactive confirmation or `--yes`, and warn that restarting a running daemon may interrupt work.
Validate and stage the package before stopping the daemon, recheck the selection and running state after confirmation, and restart only a previously running daemon. Migrate legacy daemon installations to the dedicated package directory while preserving the standalone CLI selection. Explicit replacements disable automatic package updates.
## Testing
Add coverage for cancellation, packages changed during confirmation, version pinning, and legacy migration. Extend CLI integration tests to verify noninteractive confirmation requirements, rejection of incomplete packages without stopping the daemon, and successful replacement and restart.
GitOrigin-RevId: 2d971d6f0259aa576a15a8b115ca9d0e89060fdf
## What changed
Copy the source thread's current attachments when creating a non-ephemeral fork, including forks at an earlier turn. Copies receive new attachment IDs and creation timestamps while preserving resource identities and payloads. Attachment membership can then change independently on either thread; referenced resources are not copied.
Await the atomic copy before publishing the fork. If copying fails, log the error and allow the conversation fork to succeed without attachments. Resuming a fork does not copy attachments again.
Document that clients should use `forkedFromId` on `thread/started` and fetch the fork's attachments with `thread/attachment/list`; copying does not emit per-attachment updates.
## Testing
Add coverage for atomic rollback, independent attachment membership, inheritance across history cutoffs, successful conversation forks after copy failures, and resuming without restoring removed attachments.
GitOrigin-RevId: 939d2c6a3073ccfcd922380c6beda45d3deac606
## Why
Registering the service-bearing package can restart the provisioning service once for each managed sandbox account. A restart can interrupt the response after runtime readiness has been revoked, preventing the refresh from completing.
## What changed
- Retry registered sandbox refresh requests after response pipe disconnections, allowing up to two service restarts within the original deadline. Require a different service process ID and authenticate it against the running service before resending.
- Allow refresh to resume without `ready_package` when account ownership is complete, teardown is not underway, and the existing owner, package family, live account SIDs, and settings checks pass. Runtime execution still requires readiness for the current package.
- Keep authentication failures, failed writes, explicit replies, and protocol errors outside the retry path.
## Testing
Add regression tests for disconnect classification, the two-restart budget, deadline expiry, and authentication failure before writing. Extend ownership tests to distinguish resumable registration from runtime readiness and reject incomplete accounts or retirement state.
GitOrigin-RevId: d932f179b31752fe918297b7b12e5077c17b19e5
## Why
Daemon lifecycle commands previously required a standalone managed installation. A complete CLI package can supply the daemon executable and helpers without requiring a separate installer run.
## What changed
- Let `codex app-server daemon start`, `restart`, and `bootstrap` copy the invoking package into `CODEX_HOME/packages/app-server-daemon` when no daemon installation exists.
- Validate the package's platform, required helpers, executable identity, and copied contents before selecting the staged release.
- Preserve existing dedicated and legacy daemon selections, reject broken selections instead of replacing them, and leave the CLI package and selection unchanged.
- Preserve standalone release pins and latest-channel eligibility, and select dedicated releases using Unix symlinks or Windows junctions.
## Testing
Add package preparation tests for complete copies, incomplete packages, broken selections, legacy preservation, and update-channel handling. Add Windows junction creation and retargeting coverage, plus CLI integration tests that launch the copied package through `start`, `restart`, and `bootstrap`.
GitOrigin-RevId: abd2f4f82eae0885434ea30603c2c1c0ca760bef
## What changed
Replace `AttachmentStore::persist` with `upload` and `resolve`. Uploads return inline bytes or a file ID; resolution returns optional file metadata and a download URL only when a minimum URL lifetime is requested. Add image dimensions, digest, size, MIME type, and categorized errors to the API.
Make `InlineAttachmentStore` return the original bytes and report `NotFound` when resolving file IDs. Redact attachment bytes and file URLs in debug output.
Pass the configured image store from the thread manager into sessions and inherit it in delegated sessions. Allow `TestCodexBuilder` to accept a custom image store.
## Testing
Update unit coverage for preserving PNG and JPEG bytes, redacting bytes and URLs in debug output, and rejecting file resolution in the inline store.
GitOrigin-RevId: f313e0048925998d84394c7e5a278e0d39d86a45
## What changed
- Capture `CODEX_WINDOWS_REGISTERED_CORE=1` at startup and propagate the selected runtime to sandbox wrappers.
- Launch registered runners through service-recorded execution aliases, validating ownership, OS package identity, and the staged runner image before sending commands. Require service provisioning without falling back to copied helpers or `PATH` lookup.
- Preserve package context for sandboxed child processes and descendants so they can launch executables from the protected package directory.
- Refresh stale package registrations during readiness checks without blocking unrelated RPCs, and reconcile effective proxy settings through the service.
- Resolve setup ownership from the process token and avoid treating the server directory as a writable workspace when setup omits `cwd`.
- Record startup and command outcomes by runtime.
## Testing
Add coverage for runtime selection, package query validation, helper resolution, setup roots, proxy reconciliation, and command result reporting. Add an ignored integration test for environment forwarding, output, and exit status that requires an installed test MSIX and service provisioning in a Windows VM.
GitOrigin-RevId: 976d64039d611be4406c3d0e354820775f8eb6e4
## Why
Interrupted or failed turns can discard buffered answer or plan source, leaving incomplete math content missing from the transcript or unable to reflow correctly.
## What changed
Flush and consolidate both answer and plan streams before `finalize_turn` clears streaming state. Reuse the same helper for normal completion, preserving received source for terminal resizing and raw output mode changes.
## Testing
Add regression coverage for interrupted answers and plans, failed plans, and policy errors with unfinished math blocks, with and without a trailing newline. Verify source preservation and stable content across width and raw output mode changes, with narrow transcript snapshots. Update the usage activity test to verify that history insertion waits for stream consolidation.
GitOrigin-RevId: 1ae0c192e2fee00dc0b5ee2ac07f3d5f2313ad1b
## Why
Seatbelt ignored Unix socket permissions in `ManagedNetworkSandboxContext`, which could omit allowed sockets or inherit a live proxy's broader permissions.
## What changed
Use the prepared context's `allow_unix_sockets` and `dangerously_allow_all_unix_sockets` settings when present, falling back to the live proxy only when no prepared context exists. Normalize allowlisted paths and preserve explicit extra socket allowances.
## Testing
Add regression coverage for prepared-policy precedence, empty allowlists, invalid relative paths, and explicit extra allowances. Extend macOS exec-server tests to cover prepared and executor-local proxy socket permissions, including explicit allow-all behavior without unrestricted network access.
GitOrigin-RevId: 3372e1f2f1b161e60bde585db8d70b4e3a0b1854
## Why
The daemon shares the standalone CLI package, coupling daemon updates to the visible CLI installation. A dedicated package lets daemon updates preserve the CLI selection and shell profile.
## What changed
- Add dedicated daemon package selection and separate daemon and updater PID files, with diagnostics for the new files.
- Make `codex app-server daemon update` migrate eligible legacy stable latest-channel installations to a dedicated package. Prepare and validate the release and its package-ownership support before switching; preserve settings and whether the daemon was running. Scheduled updates keep legacy installations in place.
- Add daemon-only and deferred-selection modes to the shell and PowerShell installers, leaving the visible CLI installation unchanged.
- Coordinate migration with installer locks, refresh package selection after acquiring lifecycle locks, and reject package changes during update downloads.
## Testing
Add coverage for running and stopped migrations, incompatible installers and releases, package-selection races, daemon-only updates, and a capability probe that does not start an updater. Add a shell installer regression test verifying that daemon installation preserves the visible CLI and shell profile.
GitOrigin-RevId: 1ec0f358f8f6ebde7daddb74e880cc8d2235d647
Update the image generation tool guidelines to avoid printing full results
or base64 image data with `text()` or `notify()`. Recommend printing only
small metadata when needed.
GitOrigin-RevId: f62b67b384dd39a1cc1adad0956b6fcf69d09c72
## What changed
Represent images in `ContentItem` and `FunctionCallOutputContentItem` with `ImageReference::Inline`, flattened to preserve the existing `image_url` wire format. Update image producers and consumers and regenerate app-server schemas and SDK artifacts.
Preserve the Python SDK's `InputImageContentItem` and `InputImageFunctionCallOutputContentItem` class names during generation.
## Testing
Add a regression test for stable Python image class names and adapt existing image tests to the shared representation.
GitOrigin-RevId: c38a780ac3314c2ac2deb3afc1b93b94b6f93fec
## What changed
- Add an explicit `registered_core` provisioning mode that registers the app package for both managed sandbox accounts and records their runner aliases. Authenticate callers against the service's package family and installed version.
- Persist runtime ownership and publish readiness only after both registrations and AppData metadata grants succeed. Prevent legacy setup or another owner from replacing registered sandbox accounts, and restrict `refresh_only` requests to an existing ready setup.
- Scope service and pipe names by package identity.
- Preserve registrations across package updates and clean them up when the owner uninstalls the app. Fence provisioning during teardown and defer package removal until native cleanup succeeds and the service exits.
## Testing
Add tests for registration opt-in, ownership and readiness checks, legacy setup isolation, metadata ACL preservation, listener shutdown handling, and the cleanup finalizer's commit barrier and UTF-8 input.
GitOrigin-RevId: 69e52f7463285b51f3bef831f071245f0eca0838
## Why
Guardian reviews must stop when their parent shuts down or their history is reset. Shutdown must also finish reviewer cleanup before closing the parent's persistent history, including when a review is waiting to retry after a rate limit.
## What changed
- Let the Guardian extension own reviewer startup, prewarming, and shutdown through `ThreadManager`, tracking and joining outstanding work during teardown.
- Cancel reviews on history reset or parent shutdown and reject decisions returned after cancellation, including cached extension decisions.
- Keep background prewarm previews from overwriting the active turn's model metadata.
## Testing
Extend regression coverage to verify reviewer cleanup after parent shutdown, prompt shutdown during a 60-second Guardian retry with the network request denied, and preservation of active model review requirements during prewarming.
GitOrigin-RevId: 05efc369b9a1642a10365eac8a09da77f3f6e28c
## What changed
Add `tool_event_type` to tool analytics events, using exact call ID evidence to distinguish `model_tool_call` from `inner_tool_call`. Serialize `null` when evidence is missing or conflicting at emission time; later evidence does not revise emitted events.
Classify sampled code-mode `exec` and `wait` calls as model calls and dispatched child calls as inner calls, without inferring origin from cell associations or parent lineage.
## Testing
Add coverage for exact and ambiguous origin evidence and late sampling evidence. Extend serialization, code-mode, collaborator, and subagent tests to check the classification.
GitOrigin-RevId: a41085b4665b28b20026aa2bcb10ff7fa8af8778
## Why
Linux proxy-routed sandboxing denied standalone Unix sockets even when the effective network policy enabled `dangerously_allow_all_unix_sockets`.
## What changed
- Carry Unix socket permissions in `ManagedNetworkSandboxContext` and pass the prepared context through Linux sandbox launches with `--managed-network`.
- Allow `AF_UNIX` socket creation in proxy-routed mode when `dangerously_allow_all_unix_sockets` is enabled, while preserving network namespace isolation and restrictions on other socket families.
- Keep standalone Unix sockets denied by default and for path-only grants. Default missing fields in older serialized contexts to restrictive values.
## Testing
Add coverage for policy preparation and transport, legacy deserialization, and malformed policy rejection. Add a Linux integration test covering default denial, path-only denial, and explicit allow-all access, while checking that direct TCP access and `AF_NETLINK`/`AF_VSOCK` sockets remain blocked.
GitOrigin-RevId: 2695b945ad3e59fcb3faf7662d852a26650af16c
## What changed
- Share process package-family queries, token user SID extraction, and account-name lookup through `codex_windows_sandbox`, and use them in the provisioning service.
- Bound token query sizes and validate SID pointers, revisions, and lengths before copying SIDs into owned storage.
- Use a drop guard to balance firewall COM initialization, and track the package lifecycle directory guard separately so cleanup releases it while keeping ancestor and home handles pinned.
## Testing
Add tests that verify copied SIDs outlive their query buffers and reject truncated token data, malformed SIDs, and invalid SID pointers.
GitOrigin-RevId: 2b893e4524d3e00cb114df05215beef7b9eebbe9
## What changed
- Add experimental `account/read.workspaceRouting` metadata containing the selected ChatGPT workspace ID, resolved HTTPS backend origin, and routing override (`us`, `us_cr`, or `NO_CONSTRAINT`).
- Discover and cache routing through `accounts/check` for saved logins, new logins, and workspace switches. Return `null` for signed-out accounts, API-only accounts, and saved credentials without a selected workspace.
- Validate discovered origins against required `chatgpt_base_url` origins. Return errors for failed or malformed discovery and retry on later reads.
- Wait for requirements and routing before publishing account updates, including to newly initialized connections. Clear routing on logout, discard stale discovery results, and guard queued notifications against account changes.
## Testing
Add unit and integration coverage for origin resolution and validation, discovery failures and retries, startup discovery, workspace switching, logout, configuration changes during discovery, and authentication changes while notifications wait for queue capacity.
GitOrigin-RevId: 2c5367bb01dd7543b08d374f44444323e40f1981
## What changed
- Report `windows_mxc` from native MXC availability on Windows.
- Allow MXC TTY launches and managed networking, using dedicated proxy listeners without requiring a shared-ingress restricting SID.
- Reject MXC custom `argv0` and private-desktop launches, and continue failing closed when native MXC is unavailable.
## Testing
Extend the Windows remote sandbox process-write test to cover MXC with both pipes and ConPTY. Retain coverage for rejecting MXC requests when native support is unavailable.
GitOrigin-RevId: 80c5f319b9066d06b26f0a7eb7119a109e6ebef7
## What changed
Replace `ReviewerSessionFactory` with a startup callback installed through
`ReviewerPool::new`. Review requests supply shared setup data and reuse context,
while the pool uses its callback to create both reusable and forked reviewers.
Update Guardian session setup, prewarming, and existing test fixtures to use the
new pool API.
GitOrigin-RevId: fa171503afcee8bdbdf6822573bea8ded50ce117
Add `base64` and `serde_json` as workspace dependencies of
`codex-windows-sandbox-service` and update `Cargo.lock`. Temporarily exclude
both dependencies from `cargo-shear` checks until they are used.
GitOrigin-RevId: f77a0ba13cfa9ba2315dcf00a80163afff32d0b4
## Why
Resuming a thread initialized its collaboration mode to Default, losing the saved Plan mode and its developer instructions. Reconnecting clients also lacked a server-reported mode to reconcile changes made by another client.
## What changed
- Restore the saved collaboration mode from the latest matching `ThreadSettingsApplied` event, falling back to the last legacy `TurnContext`. Apply the effective model and reasoning effort while retaining the saved mode and developer instructions.
- Include `collaborationMode` in `thread/resume` responses and update the generated schemas and bindings.
- Use the restored mode in the TUI, including the first prompt after resume. Prefer the server's mode when restoring disconnected input, while preserving the local selection for older servers that omit it.
## Testing
Add regression coverage for persisted and legacy collaboration modes, model and reasoning-effort overrides, the resumed Plan mode display and first prompt, and reconnect behavior with and without a server-reported mode.
GitOrigin-RevId: ed064516e7fae1c1668152ab448f510cbcacfe06
## Why
Inline delegates have no entry in the thread registry, so reviewer creation cannot depend on looking up the parent or waiting for its thread-ready notification.
## What changed
- Capture parent identity, authentication, shared agent control, originator, and inherited instructions in `StartThreadOptions` so `ThreadManager` can start a child without a registered parent.
- Route Guardian reviewer creation through this path, remove the standalone fallback and readiness gate, and require a Guardian extension host.
- Install explicit reviewer hosts in unit tests and the Guardian reviewer extension in the integration test harness, using `ExtensionRegistry::to_builder()` to preserve existing contributors.
## Testing
Extend the thread-manager regression test to remove the parent from the registry before starting a child, then verify inherited lineage, originator, session identity, and authentication, and exclusion from the public thread list.
GitOrigin-RevId: 468ded6fdce7520cb39d55c1a884dcfa5aaea2d9
The provider requirement change test asserts that no traffic reaches the
replacement provider. Start a dedicated server with
`MockServer::builder().start()` and include unexpected request methods and
URL paths in assertion failures.
GitOrigin-RevId: 4020c43c0ec0472fe54d4003bff120349ddd5597
