## Why
Background code-mode cells can continue running after a new turn starts. Looking up grants and strict review requirements through the active turn can make those cells lose their approved access or use another turn's permissions.
## What changed
- Keep turn-scoped grants and strict review state in `TurnContext`, retained by captured steps and background cells.
- Record permission responses against the requesting turn, including requests made after a later turn starts.
- Share live session-scoped grants across turns while keeping turn-scoped grants isolated.
- Use the originating turn's permissions and review requirements for tool execution, patches, MCP calls, file uploads, and terminal input.
## Testing
Add regression coverage for background cells retaining grants across turn changes, turn versus session scope, permission requests after the next turn starts, and strict review enabled while `write_stdin` is queued.
GitOrigin-RevId: 641502fbfd43553c2c42424d4aaa53ae8020c850
## What changed
Return snapshots and model-visible fragments together from world-state rendering, and use those snapshots for history baselines, step updates, compaction, and new context windows.
Update `WorldStateSectionContribution` so its renderer returns an optional replacement snapshot and an optional fragment. A missing snapshot preserves stored section state, even when retained history requires a fresh render; a null snapshot removes the section. Derive step patches from the history baseline rather than a separately captured live world state.
Adapt skills and Git attribution contributors to the new contract.
## Testing
Add coverage for skipped snapshot updates, explicit section removal, changed-state patch replay, unchanged-state deduplication, and matching live and persisted checkpoints when starting a new context window.
GitOrigin-RevId: af71606a278358ae937853cb76e8a019a501408e
## What changed
When the model catalog is provided in context and model overrides are exposed, tell V2 `spawn_agent` callers to inherit the current model unless the user explicitly asks for a different model. Include this guidance even when spawn metadata is hidden.
## Testing
Extend tool-description tests to cover hidden metadata with both inline and context catalogs, and update request-level assertions for V1 and V2 model override guidance.
GitOrigin-RevId: b70b0f09b0b5987a0eccba578196b8ef7cee4baf
## Why
Refreshing available model descriptions changes the `spawn_agent` tool schema. Keep model choices current while preserving tool definitions and earlier conversation input.
## What changed
- Add the disabled-by-default `model_catalog_in_context` feature for multi-agent V1 and V2. When enabled and model overrides are available, move model listings from tool descriptions into developer `<model_catalog>` messages.
- Include picker-visible, compatible models with descriptions, reasoning efforts, and service tiers in a listing bounded to 1,000 bytes. Point `spawn_agent` guidance to the latest catalog.
- Append updated listings only when their rendered content changes, restore missing listings, and invalidate retained catalogs when they no longer apply.
## Testing
Extend integration coverage for V1 and V2 with the feature enabled and disabled. Verify that catalog refreshes preserve tool definitions and prior input when enabled, append the updated listing once, and retain the existing tool-description behavior when disabled. Add a request-history snapshot for the V1 opt-in path.
GitOrigin-RevId: 67b11b4ad6c35f00d0e29edf6343bb0b4804d797
## What changed
Add a debug-only analytics test that switches accounts after the first isolated event request. Assert that only the first request reaches the server and carries the original account's credentials, so subsequent batches do not send stale credentials after the switch.
Remove an unused `ToolCallSource` import.
GitOrigin-RevId: e66904c7a7176f1eaa37662b836132586328884a
## Why
Login shell startup can reset `PATH`, preventing commands and their children from finding bundled tools such as `rg` in executor-reported directories.
## What changed
When `login_shell_package_path` is enabled, prepend missing executor-reported directories to `PATH` inside the POSIX login shell before running the requested command. Preserve existing entries and the order of newly added directories, and export `PATH` for child commands.
Respect explicit `PATH` overrides and preserve the requested login mode when directories are unusable or `PATH` is read-only. Keep shell diagnostics and `$LINENO` aligned with the original script, including when directory names contain newlines. The feature remains disabled by default.
## Testing
Add shell tests for nested tool lookup, existing entries, quoting, line numbers, and read-only `PATH`. Extend remote execution tests to cover feature gating, explicit overrides, unusable directories, and preservation of the original command in execution events.
GitOrigin-RevId: 301aa34e72cc6292293693250e190c19903f390a
## What changed
Update the replay assertion in the recorder refresh test to compare `executed_tool_call_metadata()` instead of entire response items. This keeps the assertion focused on preserving recorded tool call metadata across a configuration refresh.
GitOrigin-RevId: 763173a918f4e0bc79c3c04466453cafb9629775
## What changed
Forward explicit `cyberAccessProgram` selections for the built-in OpenAI provider when both `api_key_cyber_access_programs` and `api_key_model_discovery` are enabled. The new feature defaults to disabled and can be toggled through the app server's experimental feature enablement API.
Reject explicit selections in OpenAI API-key sessions when either feature is disabled, instead of silently omitting the program. Leave entitlement and model restrictions to the server, and preserve the requested program when a server rejection triggers transport retries.
## Testing
Add app-server coverage for both feature gates, forwarding all three program values, and server rejection without fallback. Update core coverage for API-key resumes with disabled features and custom-provider omission.
GitOrigin-RevId: aa639afb841aa651b28f6f3f61198299372baa2d
## Why
Persistence and aggregate metadata budgets can omit tool-call observations that are still relevant to the current request, including tool result metadata needed during compaction.
## What changed
- Retain live direct-call observations separately from bounded persisted outputs, keyed by response item ID so reused call IDs cannot mix results.
- Restore those observations for sampling and compaction, pruning them only when sampling confirms they have left the history window. Preserve observations across shortened compaction retries.
- Remove aggregate prompt metadata caps while retaining per-call argument limits and the outgoing message size limit. Invalidate cell completeness when argument normalization truncates a recorded call.
## Testing
Add regression coverage for exhausted persistence budgets, reused call IDs and reversed completion order, shortened compaction retries, and completeness after argument truncation. Extend integration coverage for large Code Mode metadata, provider metadata support, and fork/resume behavior.
GitOrigin-RevId: 004082b69bff9cc8b05f36d1052057f163c67f07
## What changed
- Carry the selected shell and login mode through unified exec using `ShellInvocation`. Use this metadata for shell snapshots and credential brokerage instead of inferring it from command arguments.
- Add `prependPathDirs` to exec-server environment metadata, populated from the executor's package PATH directory. Default to an empty list for older servers and omit empty lists from serialized output.
## Testing
Extend environment metadata round-trip coverage for `prependPathDirs` and the remote exec-server integration test to verify the packaged `codex-path` directory is reported.
GitOrigin-RevId: c571c068effcb305d196a701ad9a335ec7a3f5a2
## Why
Denied-read policies previously kept explicitly approved commands within their original filesystem restrictions, preventing operations that need broader write access, such as updating Git metadata.
## What changed
- Apply broader filesystem permissions after approval of explicit escalation while retaining the sandbox, denied reads, and network policy. Command allow rules alone do not widen filesystem access.
- Reject escalation when the required local sandbox is unavailable or a remote exec server lacks support for preserving the restrictions.
- Track escalated terminal access so subsequent `write_stdin` calls still require review when stdin approval is enabled.
## Testing
Add coverage for approved and denied escalation, allow rules, remote server compatibility, and stdin approval before input delivery. Add a Windows integration test verifying that an approved `git pull` updates Git metadata while exact-path and glob-based read denials remain enforced. Serialize Windows sandbox integration tests across processes to protect shared test account credentials.
GitOrigin-RevId: 5dce6d41487ee4d39bd795c8d086398ab9794d5b
## Why
Configuration reloads must honor current managed restrictions without granting new enterprise MCP authority to existing sessions or overwriting newer configuration with stale snapshots.
## What changed
- Allow enterprise managed authentication only for configured MCP servers. Remove plugin `ema_auth` overlays from the schema and disable servers that still use them.
- Refresh ordinary MCP settings while preserving session settings and initially admitted enterprise registrations. Disable enterprise MCP when its registration changes, policy revokes access, or configuration loading or resolution fails; require a new session to restore enterprise authority.
- Publish refreshes only when their captured configuration is still current, with bounded retries in app-server reloads. Preserve updated managed restrictions even when a refresh is rejected.
- Finish processing other thread refreshes before `config/mcpServer/reload` reports a rejection, and document that an error can accompany partially applied changes.
## Testing
Add regression coverage for stale refreshes, bounded retries, managed-policy revocation, persistent enterprise disablement, ordinary MCP transport changes, and rejection of plugin enterprise authentication. Verify that denied enterprise servers receive no requests.
GitOrigin-RevId: 34429cd339c1ec152a2ee8697cb29f0cff5d9e5f
## Why
Spawning a subagent before an environment was ready dropped the starting environment from the child's selections. The child needs to retain that environment and receive its configuration or failure when preparation finishes.
## What changed
- Pass the spawning step's environment snapshot to children, preserving ready and starting environments and configuration ownership.
- Propagate the original owner's first configuration result through descendants, applying each session's validation and leaving independently configured children unchanged.
- Preserve pending configuration waits across executor retries. Later owner updates do not overwrite the child's inherited configuration.
## Testing
Add regression coverage for fresh and forked subagents, readiness through turn-settings updates, failure propagation to children and grandchildren, child configuration precedence, and executor retries. Add a request snapshot showing a child using `wait_for_environment` before execution tools become available.
GitOrigin-RevId: a2afed740391f88d195596cfe28e418332b60d43
## Why
Microsoft Store PowerShell cannot run under MXC. The existing fallback to an unpackaged PowerShell executable only applied to the elevated Windows sandbox.
## What changed
Extend local PowerShell fallback discovery to MXC in `unified_exec`, using the executor's Windows sandbox selection. Keep discovery local and automatic `-NoProfile` insertion specific to the elevated sandbox. Skip this preparation for non-Windows target paths.
## Testing
Extend command-preparation tests to cover MXC and add a Windows integration test that replaces a Store PowerShell path before launch, writes a file successfully, and verifies `windows_mxc` sandbox metadata.
GitOrigin-RevId: 6c581396525a8fec7e1fb538b3e63b0de2ddb926
## Why
Guardian denial-limit interruptions lack a structured error identifying the cause. Make this opt-in because older clients may not recognize the new error in shared history.
## What changed
- Add `auto_review.circuit_break_action = "strict"` to attach `TooManyDenials` to the interrupted turn. The default leaves the error unset.
- Expose `turn.error.codexErrorInfo = "tooManyDenials"` in app-server notifications and saved history, and update protocol schemas and generated types.
- Preserve the warning, denial limit, and interrupted status without emitting a separate error notification.
## Testing
Add an integration test covering omitted, `default`, and `strict` settings, checking warnings, live turn errors, the absence of separate error notifications, and persisted turn errors after restart.
GitOrigin-RevId: cb5d379e64728d4d7b9daf834c13756e4a70db31
## Why
Guardian needs the assistant's delivered question to interpret a user's reply. Messages sent through nested Code Mode tools must remain available as review context, and approvals based on earlier context must become stale when a new delivery is confirmed. Assistant messages do not themselves grant authorization.
## What changed
- Capture successful hosted User Messaging sends after input rewriting and before result callbacks or post-tool hooks.
- Retain bounded delivery text in acceptance order, persist it through cancellation and shutdown, and preserve it across compaction and resume with an older-client-compatible rollout encoding.
- Track assistant review context separately from user authorization, invalidating pending and cached approvals for both local and worker reviews when that context changes.
- Associate retained deliveries with the correct instruction or communication boundary during rollback.
## Testing
Add coverage for nested messaging review context, fast replies and communication ordering, shutdown persistence, stale local and worker approvals, rollout compatibility, and rollback retention.
GitOrigin-RevId: 1bc1ec9e8947560b99f4b39a42ddb9f2099f519b
## Why
When a nested code-mode call's recorded arguments were truncated and attached to an output before its result arrived, the recorder could no longer attach the result metadata to that call.
## What changed
Retain validated call bindings so late result metadata updates the original output across retries and subsequent waits. Keep truncated arguments and incomplete call inventories intact, and apply existing metadata budgets.
Invalidate late metadata bindings when duplicate IDs, reused cells, conflicting outputs, or changed call inventories make attribution ambiguous. Clear stale pending calls when a cell ID is reused, and avoid counting duplicate pending IDs against capacity more than once.
## Testing
Add recorder regression tests for late metadata across retries, compaction, waits, and cell closure, plus ambiguous bindings and budget limits. Add a code-mode integration test that delays a tool result until its truncated call has been recorded and verifies metadata remains attached to the original output across later waits.
GitOrigin-RevId: 7398beaaa1a513147deebdea7aa841513a79d06b
## Why
An execution environment's enabled proxy configuration was reduced to traffic restrictions, leaving restricted commands offline without a controller proxy or an approved network grant.
## What changed
Carry `NetworkProxyConfig.enabled` into `EnvironmentNetworkPolicy.requires_proxy` and honor it when activating managed networking. This lets environment owners require filtered proxy access while direct network access remains restricted. Policies without an explicit proxy requirement retain the existing activation behavior.
## Testing
Extend remote command coverage to check allowed and denied proxy requests without a controller proxy, and verify that direct network access remains blocked.
GitOrigin-RevId: 7cc0063a0d1118de56b1bd30036338cf14360f6a
## Why
User input queued during a long-running code-mode `exec` or `wait` can remain pending until the call returns. Allow these calls to yield early so Codex can receive the new input while the cell continues running.
## What changed
- Add the `instant_interrupt` feature flag, disabled by default.
- Watch queued user input for each sampling request and pass a shared preemption signal to code-mode `exec` and `wait` calls, including calls received later in the same response.
- Yield running cell IDs without stopping the cells, allowing subsequent `wait` calls to collect their results.
## Testing
Add integration coverage for enabled and disabled behavior, repeated steering during `exec` and `wait`, input deferred during compaction, and later calls in the same response. Verify that direct tool results and queued user messages are preserved, and add a scenario snapshot showing continuation after a cell yields.
GitOrigin-RevId: e33466a980d98e113bfb6c6a45c59de0cc7b3c1d
## What changed
Add an optional `preempt` signal to `CodeModeSession::execute` and `CodeModeSession::wait` so callers can end an observation early while the cell continues running and remains available for later waits.
Support the signal in the in-process runtime and across both remote transports: `operation/yield` with the negotiated `yield-observation` capability for stdio, and `YieldObservation` for gRPC. Preserve signals received before gRPC observation registration, and retain normal timeout behavior for older hosts that lack support.
## Testing
Add runtime and transport tests covering early execute and wait yields followed by successful cell completion, yields before observation registration, and suppression of yield frames for older stdio hosts.
GitOrigin-RevId: 3f8049d8f0582be6b8f0832cc03f2d974a0b8f18
## What changed
- Record successful spawn phase durations in `codex.multi_agent.spawn.phase.duration_ms`, covering residency reservation and fork context when applicable, child creation, durability waits, input admission, and total latency.
- Count spawn failures from the V1 and V2 tool handlers in `codex.multi_agent.spawn.failure`, grouped by bounded error categories.
- Use bounded labels for fork mode, multi-agent version, product SKU, and successful-spawn history mode. Emit phase timings only after a successful spawn.
## Testing
Add in-memory metrics tests for phase durations and labels, plus a tool-handler test verifying that a thread-limit failure emits one counter increment with the expected labels.
GitOrigin-RevId: 04cba9042b9b34acdf57376ace5288c3f741f3b2
## What changed
Prepare each MCP call from the selected server's current client and catalog instead of building a full runtime binding. Match the advertised tool by server, tool name, and connector ID, and enforce current tool filters and model visibility.
Preserve the advertised `callable_namespace` and `callable_name` while using current schema, annotations, approval metadata, timeout, and permission authority for execution.
GitOrigin-RevId: 703a90926fc72bd446d83ac974162aee6439f363
## Why
Removing tool-result metadata alone can leave requests above the 15 MiB message budget when recorded tool calls and arguments occupy the remaining space. If trimming loses calls or arguments from a Code Mode cell, later waits must not report its call inventory as complete.
## What changed
- Bound all optional tool-call observations against the serialized HTTP or WebSocket message size, preserving ordinary tool outputs and continuation history.
- Shed generic result metadata, sources, and recorded arguments before resource-access evidence, retaining tool names and smaller metadata where possible.
- Invalidate completeness across affected cell outputs and later waits when the outgoing copy loses calls or arguments.
- Preserve size-limit omission markers for direct tool-result metadata when they fit, while continuing to exclude that metadata from custom providers.
## Testing
Add regression coverage for HTTP and WebSocket message budgets, unchanged tool results and history, resource-evidence retention, direct-call omission markers, and Code Mode waits after argument truncation.
GitOrigin-RevId: 538dc9d8c11b0830ec70327422f98a1803122e85
## Why
Fixed schema budgets can strip parameter descriptions from large MCP tools or render their Code Mode input types as `unknown`. Allow larger budgets to preserve that guidance.
## What changed
- Add `mcp_servers.<name>.tool_input_schema_max_bytes` to configure the UTF-8 byte threshold for best-effort input schema compaction, retaining the 5,000-byte default.
- Add `features.code_mode.tool_input_schema_max_bytes` for rendered input types. Use the largest of the 16,000-byte default, the Code Mode setting, and the ordinary MCP server's explicit setting.
- Apply rendering budgets to prompt declarations and the runtime tool catalog, and avoid reusing cached declarations after the Code Mode budget changes.
## Testing
Add coverage for UTF-8 compaction thresholds, budget precedence, configuration round trips, and preservation of parameter guidance in both the Code Mode prompt and `ALL_TOOLS`.
GitOrigin-RevId: 0ef2823a614d4794e636f518b09c0b03a5239b45
## Why
The `attribution_error` status does not explain why MCP attribution is incomplete. Preserve a diagnostic reason so callers can distinguish history and recorder errors from request serialization failures.
## What changed
- Add optional `error_reason` diagnostics to `McpAttribution`, retaining the first recorder error through checkpoints, compaction, resume, and fork.
- Identify missing or invalid checkpoints, conflicting sources, invalid sources, and poisoned recorder state. Use `restored_error_unknown` for older error checkpoints without a reason.
- Distinguish `payload_too_large` from `serialization_failed` in request metadata fallbacks.
- Tolerate missing, unknown, or malformed diagnostic reasons when reading history, without letting diagnostics determine attribution status.
## Testing
Add coverage for reason preservation, recorder poisoning, backward-compatible checkpoint decoding, resume and cold-fork restoration, and request metadata serialization, including oversized payloads.
GitOrigin-RevId: 389b9446fae119f793978f3e7e4a926677e84d8c
## Why
Local `apply_patch` permission checks can treat a macOS system alias and its canonical spelling as different locations, sending writes covered by temporary-directory grants for unnecessary approval.
## What changed
- Normalize trusted top-level aliases in local policy roots and patch targets, reusing a prepared matcher for permission requests and patch safety checks.
- Share alias normalization with Seatbelt and the macOS executor sandbox while preserving mutable symlinks and missing descendants.
- Preserve read-only and deny precedence, protected metadata restrictions, and remote URI matching. Propagate normalization failures from fallible permission checks.
## Testing
Add macOS regressions for multi-file patches with missing parent directories through both direct `apply_patch` calls and shell interception, asserting automatic approval and file contents. Add unit coverage for alias restriction precedence, mutable symlink preservation, missing descendants, and remote permission isolation.
GitOrigin-RevId: 0822ff951eaab728cb1ad91281745fa1b8809f15
## Why
Asynchronous Guardian scoring omitted the target environment's denied-read restrictions, and cached score authorization did not include that permission context. A score from one environment could therefore be reused for an action in another environment with different restrictions.
## What changed
- Share permission resolution between synchronous review and asynchronous scoring, including resolving `write_stdin` targets from the owning terminal session.
- Include environment identity and denied-read paths/globs in async scoring context and cached score authorization.
- Fall back to synchronous review when permission evidence cannot be resolved or exceeds the async limit of 3,000 bytes, rather than omitting restrictions.
## Testing
Add regression coverage for rejecting cached scores with different environments or denied paths, passing the target environment's restrictions to the classifier, and rejecting oversized async permission evidence.
GitOrigin-RevId: 14b6f3454bbea458be037560eb1da47d22874df1
## What changed
Use the model catalog's `send_user_message_async.parameters` override for the `request_user_input_async` tool schema. Fall back to the bundled schema when the override is absent or invalid, logging a warning for invalid overrides while preserving the catalog description.
## Testing
Extend integration coverage for catalog schemas, empty and invalid overrides, and schema updates during mid-turn model changes. Update the asynchronous question-and-answer scenario to verify that requests carry the catalog schema while work continues and the user's answer arrives.
GitOrigin-RevId: c51a90d3266daaba1e7001aa4026964f84dfb206
## Why
The 32 KiB per-result cap and 128 KiB aggregate budget discard tool metadata even when the outgoing request has room to retain it.
## What changed
- Remove the per-result capture cap and raise the aggregate executed-tool metadata budget to 2 MiB.
- Apply a 15 MiB soft budget to serialized HTTP requests and WebSocket messages, using the actual WebSocket delta. Trim optional result metadata on the wire copy while preserving ordinary content and logical history.
- Prioritize `openai/resource_access` metadata during trimming, and include `overage_bytes` in omission markers.
- Record bytes removed by metadata budgets in `codex.tool_metadata.shed_bytes`, tagged by stage.
## Testing
Add coverage for HTTP and WebSocket message boundaries, resource preservation, residual marker removal, unchanged history, and shedding metrics. Update direct-tool and code-mode tests to verify metadata survives beyond the previous limits.
GitOrigin-RevId: ed00996b77945300f60db1e52eff22b4de2707c1
## What changed
Use `KNOWN_PRODUCT_SKUS` in `SessionTelemetry::with_product_sku`, preserving the existing mapping: `codex` stays `codex`, missing or empty values omit the label, and all other values become `other`.
Remove the registry test `dispatch_uses_the_invoking_turn_product_sku` and its unused imports.
GitOrigin-RevId: b4ad6cbc6205aa35fb2866d72f7205814f5b3566
## Why
Tool telemetry needs to distinguish product SKUs without turning arbitrary configuration values into metric labels.
## What changed
- Read `apps_mcp_product_sku` from the invoking turn when dispatching tools, replacing any stale SKU in the telemetry metadata.
- Add `product_sku` to tool call count and duration metrics and tool result log and trace events.
- Preserve `codex`, map other nonempty values to `other`, and omit the attribute for empty or missing values.
## Testing
Add coverage for SKU separation on a shared metrics client, normalization, and successful and failing dispatches with stale telemetry metadata. Extend export routing tests to check SKU attributes in logs and matching traces.
GitOrigin-RevId: 3fc58c9f7245fd5b65f7cba122e08d7ea838b2d6
## Why
Exceeding the aggregate metadata budget previously replaced all tool result metadata with omission markers, discarding small results unnecessarily. Oversized results also lost resource-access evidence even when that evidence alone would fit.
## What changed
- Raise the executed-tool-call metadata budget per request from 32 KiB to 128 KiB while retaining the 32 KiB per-result limit.
- Reduce the largest result metadata first and stop once the request fits, preserving smaller results.
- Retain `openai/resource_access` when full metadata exceeds capture, request, or direct-call retained-history limits. Keep resource lists intact, and discard optional result metadata before sacrificing call records, source evidence, or completion markers.
## Testing
Add regression coverage for selective reduction, resource-access retention, serialized request size, and direct-call and Code Mode behavior. Update compaction and truncation tests for the larger request budget.
GitOrigin-RevId: 698e47dcbdd3351e9a031e45ea39053608a5a0e4
## What changed
Remove the session-level capture mode and make thread-owned retained context the default throughout history management. Simplify input ordering, compaction identity preservation, fork handling, and approval freshness checks by removing legacy capture branches.
Keep checkpoint compatibility review separate: unknown or incompatible checkpoints can still use legacy review while retaining user evidence. Set the already-removed `guardianv2.thread_context` feature's default to false and remove redundant opt-out test variants.
## Testing
Update checkpoint tests to exercise legacy review through restored checkpoint data. Adapt existing compaction, resume, rollback, and fork tests to use unconditional context capture.
GitOrigin-RevId: ab23a0d7aca71d5a103458cff8b0c68137dd9708
## What changed
Use retained root context for subagent authorization reviews, removing the separate legacy history path. Remove the runtime `request_user_input` answer buffer and its response counter; authorization versions now track the user-message revision and retained-context completeness.
## Testing
Update authorization and input-handler tests to exercise retained context, and add coverage for the `user_messaging` connector in subagent reviews.
GitOrigin-RevId: 00ad151cf71b843af0e82ae90cbcf559d0c65f89
## Why
MCP resource helpers use fixed descriptions and parameter schemas, preventing the model catalog from supplying model-specific guidance.
## What changed
Add `model_messages.tools.mcp_resources` entries for `list_mcp_resources`, `list_mcp_resource_templates`, and `read_mcp_resource`. Resolve these entries for the current model when constructing tool specs for direct calls and Code Mode.
Descriptions and parameter schemas override independently. Preserve bundled defaults for missing fields and fall back to bundled parameters with a warning when a supplied schema is invalid. MCP resource execution remains unchanged.
## Testing
Add unit coverage for independent overrides, literal descriptions, and invalid-schema fallback. Add integration coverage for resource discovery and reading through direct calls and Code Mode, plus assertions that resource tool specs follow model changes between steps.
GitOrigin-RevId: 40b5beddb38b2b61c19dc9cd6013d6ba5d756dbc
## Why
Tool lifecycle observers need visibility into calls rejected before execution starts and timing that remains available on cancellation, independently of tracing settings.
## What changed
- Add `on_tool_dispatch` and `on_tool_timing` callbacks to `ToolLifecycleContributor`, with thread, turn, and call IDs for correlation.
- Report direct calls before readiness, dispatch waiting, and hooks. Report handler duration when dispatch completes or is dropped, excluding readiness and gate waiting and returning zero if the call never passes the gate.
- Expose code-mode host durations as a separate `HostOperation` timing boundary. Exclude nested code-mode calls from dispatch and handler timing observations to avoid double counting.
## Testing
Add tests for callback ordering on completed and rejected calls, timing on cancellation, zero handler duration before gate admission without tracing, and code-mode host timing without nested dispatch or handler timing observations.
GitOrigin-RevId: 97998b5094564c13cb2cfad089bb0a9d6615eb5c
## Why
The Browser connector on `codex_apps` needs the computer-use policies and review handling already applied to `node_repl` and `cua_repl`.
## What changed
- Classify `connector_openai_browser` using registered tool metadata and preserve its computer-use scope through Guardian review.
- Extend confirmation-policy forwarding, review evidence capture, JavaScript execution tracking, and initial-call approval handling to the Browser connector.
- Correlate Browser elicitations with live invocations so nested actions retain their own review identity while assessments are attributed to the originating call. Require verified Browser identity for strict nested review.
- Include the Browser connector in computer-use policy prompts and bundled model messages.
## Testing
Add integration coverage for ordinary and strict Browser nested reviews, including policy injection and action attribution. Verify strict review declines requests with missing or unknown invocation correlation or a non-Browser registration.
GitOrigin-RevId: b04af6fb9db1bac2203dc4265913d210746df90b
## What changed
Add `model_messages.tools.indirect_description_prefixes` with selectors for exact namespaces and configured MCP server names. Apply the selected model's guidance to namespace documentation embedded in `CodeModeOnly` prompts, `ALL_TOOLS` descriptions, and namespaces returned by tool search.
Trim prefix values, treat empty values as no prefix, and reject conflicting selectors for the same namespace. Apply prefixes during rendering so model changes take effect without altering direct tool specifications, search ranking, or tool dispatch.
## Testing
Add unit tests for prefix normalization, namespace grouping, MCP server mapping, and conflicts. Add scenarios covering both Code Mode variants, clearing prefixes on model changes, unchanged tool dispatch, and conflict rejection before a model request.
GitOrigin-RevId: 0c7ce6d418c775945c2ccfdab3c605fa4d431b55
## Why
Actions targeting a secondary environment could be reviewed with the primary environment's denied-read restrictions. Each review needs the permission context of the environment that owns the action, including when a Guardian session is reused across environments.
## What changed
- Carry `environment_id` through environment-scoped approval requests and their planned-action JSON.
- Select and label permission context using the target environment, explicitly stating when it has no denied-read paths or globs.
- Reject reviews for unavailable target environments and reject environment IDs longer than 256 bytes before Guardian inference, while preserving manual approval routing for oversized IDs.
## Testing
Add coverage for `exec_command`, `apply_patch`, and `request_permissions` reviews switching environments while preserving the existing review prefix. Extend tests for environment-specific restrictions, unavailable environments, action serialization, and the 256-byte ID boundary.
GitOrigin-RevId: ad3292edddb1c6f5b180142c6857cba6f1308328
## Why
Messages sent through the singular `user_message` connector were omitted from Guardian's delivered assistant message evidence because only `user_messaging` tool names were recognized.
## What changed
Accept both namespaced and flat `user_message` forms of `send_message` alongside the existing `user_messaging` forms.
## Testing
Extend Guardian subagent authorization tests to cover the singular connector and flat tool names, including blocked post-tool hooks and cancellation before confirmation. Add a negative case ensuring `send_message_to_thread` is not treated as delivered message evidence.
GitOrigin-RevId: 68495642ef4b78eec71df4fee2bacfda407adc47
## Why
Command execution analytics lack the observed sandbox backend. Older execution servers may omit this information, so an unknown backend must remain distinguishable from an explicitly unsandboxed process.
## What changed
- Carry optional `sandbox_type` metadata through command execution items and emit its metric tag as `sandbox_backend` in analytics.
- Propagate the observed backend through unified execution completion and failure events, including asynchronous exits.
- Preserve missing backend information as `None` and mark executed user shell commands as `Some(SandboxType::None)`.
- Exclude the metadata from serialized command items and generated schemas and TypeScript types.
## Testing
Extend tests for missing and explicit executor backends, backend propagation on failed execution, and analytics payloads, including platform-specific backend tags in app-server integration coverage.
GitOrigin-RevId: 178fe46824a6194910802ec02168ed40ee0b2019
## What changed
Add `features.multi_agent_v2.disable_direct_message`, defaulting to `false`. When enabled, omit `send_message` and `followup_task` while preserving spawning, automatic child results, and the remaining agent management tools.
Require an available message-board `post` tool when this option is enabled for sessions using multi-agent v2 collaboration tools, exempting internal worker sessions.
## Testing
Extend configuration parsing tests and run the message-board subscription/resume scenario with direct messaging both enabled and disabled. Verify post search, subscription behavior, and which collaboration tools are exposed.
GitOrigin-RevId: 72ec22ef0b92fa81e02cdeb058d8b4f93aca3be6
## Why
V2 tools and model context need to use the controller's agent tree even when the session's local runtime has no registry entries.
## What changed
- Add target resolution and direct-child path lookup to `AgentControl`.
- Move lazy root registration into the controller's resolution and listing methods.
- Build V2 subagent context from controller-provided paths, keeping formatting and size limits in the session layer and preserving loaded-first ordering.
## Testing
Extend the V2 spawn and messaging test with an empty session-local registry to cover relative-path resolution, message delivery, and subagent environment context through the controller.
GitOrigin-RevId: c935b34a6d3314e968ba451ff981cf2a223bbfa8
## Why
When unified exec cannot create a process, command lifecycle events are missing, leaving clients without a command failure notification.
## What changed
Emit start and failure events for terminal process-creation errors in both regular and zsh-fork execution. Report no process ID, an exit code of `-1`, zero duration, and the launch diagnostic, while retaining plugin attribution. Once event publication starts, let it finish even if the caller is cancelled.
Preserve approval rejection handling and retryable sandbox denials.
## Testing
Extend app-server tests to cover pipe and PTY launch failures, plugin attribution on failed launches, and zsh-fork launch failures after approval. Assert failure metadata and check for duplicate lifecycle notifications while retaining approval-decline coverage.
GitOrigin-RevId: 26ed191fc69b903ea4710dd1a6c3b031e8caa4eb
## What changed
- Store `Arc<dyn AgentControl>` in session services and route agent tools, turn admission, usage accounting, completion notifications, and shared settings through the trait.
- Add `AgentControlInit` so delegated and guardian sessions inherit the parent's controller and local runtime.
- Move local registry and context helpers to `LocalAgentRuntime`, keep resume, close, inspection, and status subscriptions on the local controller, and simplify synchronous and infallible trait methods.
GitOrigin-RevId: ad3f213eb483ac524bde56d769f20a78f20989a0
## What changed
- Add `environments` to `TurnSettingsUpdate` to replace the selection for subsequent steps without changing future turns.
- Capture model settings and environments together so combined updates apply or reject atomically, while existing steps retain their captured selection.
- Validate environment IDs, working directories, configuration ownership, and permission requirements against the running turn's selections.
- Preserve executor startup behavior when switching environments and use the step's local working directory for tool hooks.
## Testing
Add coverage for workspace switching and restoration on the next turn, atomic model and environment updates, permission validation, executor connection waits, and replacement of pending environment selections.
GitOrigin-RevId: 02b5c57a78fd594b2aed84fc09d9e99eb97be28c
## Why
Compaction companion records do not represent all resume state, including the last started turn and previous turn settings. The selected multi-agent runtime also needs a persisted value when no companion turn context is present.
## What changed
- Add optional `resume_metadata` to `CompactedItem`, recording the multi-agent version, last started turn ID, and previous turn settings. Preserve the distinction between absent metadata and explicitly empty values while retaining compatibility with older records.
- Capture this metadata under the settings persistence lock alongside the compaction checkpoint.
- Rewrite inherited metadata to use the child agent's runtime, and clear previous turn settings when the child must rebuild context.
- Clear pending continuation state before delivering acceptance of standalone settings updates, while holding the persistence lock.
## Testing
Add coverage for metadata round trips with empty values, legacy reader compatibility, checkpoint companion records, inherited fork metadata, and continuation invalidation while settings event delivery is blocked.
GitOrigin-RevId: f30b7feaa7e2fdb5b65fc3c53b37fd7a7fe27903
## What changed
Extract `LocalAgentRuntime` from `LocalAgentControl` to hold the shared registry, residency state, execution limiter, rollout budget, service tier, instruction provider, and thread-manager bindings. Keep session identity on the controller handle.
Store the runtime in `SessionServices` and use it to bind controllers for child startup, resume, delegation, and guardian reviews. Route ownership checks and residency handling through the shared runtime, preserving registry identity across handles. Update existing test fixtures to keep the controller and runtime paired.
GitOrigin-RevId: 846094657cbdf736da3149f0a1c96b4e01423dfe
## What changed
Move `spawn`, `send`, and `inspect` into the `AgentControl` implementation for `LocalAgentControl`, removing the forwarding methods and the `spawn_request` module. Update tool handlers and existing tests to use the trait methods, and remove redundant boxing at spawn call sites.
Preserve spawn validation, message attribution, runtime loading, and queue-only delivery semantics.
GitOrigin-RevId: 6027d4d97d0dfb6763dc97ef92a2d7ef58de945d
## What changed
- Return `StatusSubscription` streams of `AgentInfo` snapshots from local status subscriptions, including agent metadata and configuration.
- Emit the initial snapshot before subsequent coalesced updates. Use a weak thread reference and retain the last observed configuration so published final updates remain available after the runtime is dropped.
- Update completion notifications and `wait_agent` to consume snapshot streams, propagate subscription errors from `wait_agent`, and fall back to the latest status when a stream ends.
## Testing
Update the shutdown subscription test to verify that shutdown before the first poll preserves the initial `PendingInit` snapshot followed by `Shutdown`.
GitOrigin-RevId: beb46952cbcc9bddf65a4d6603fea939d5ace8b9
Adam Perry @ OpenAI