## What changed
- Use one renderer for captured requests, raw request bodies, and input items. Show only appended items when inputs extend the previous request and settings match; start a new snapshot window otherwise and explain the boundary.
- Add optional request settings and tool inventory deltas. Normalize volatile values with stable labels, preserve multiline content, and fingerprint omitted content so changes remain visible.
- Migrate existing context snapshots and expand compaction snapshots to include request history.
## Testing
Add focused tests for window boundaries, cache key changes, tool deltas, shared item rendering, stable normalization, and fingerprints. Assert that the follow-up request after pre-turn compaction includes the working directory override.
GitOrigin-RevId: 6445b014081208ea432b1f3e2ac835c5e4955cb0
## Why
Windows release packages need the voice helper and native audio libraries. Realtime TLS connections on fresh Windows installations also need platform certificate validation so Windows can retrieve missing trusted roots on demand.
## What changed
- Build and sign the voice helper and audio DLLs for Windows x64 and ARM64, bundle a pinned Microsoft CRT DLL, and verify signatures and runtime receipts before packaging.
- Add verified, pinned Cygwin and native build tools plus MSVC linker, compiler, and path handling fixes for the Windows Bazel builds.
- Include voice resources in primary release archives and WinGet packages. Preserve WinGet executable names, update manifest hashes, and recognize the package root through matching entrypoint metadata. Keep Python runtime wheels voice-free to preserve their existing Windows support floor.
- Use Windows platform TLS validation for realtime WebSockets when no custom CA bundle is configured, preserving custom CA behavior.
## Testing
Add coverage for build-input integrity and unsafe paths, signed Windows runtime assembly, WinGet file and hash preservation, package discovery, and TLS trust selection, untrusted certificate rejection, and hostname validation.
GitOrigin-RevId: 423da35872fa5549d69fd4ca97d922bb49599386
## What changed
Add `create_command_args()` to encode argv, permissions, policy cwd, and optional managed network context through the existing bounded environment transport.
For managed networking, generate a policy that allows IPv4 and IPv6 loopback while denying direct non-loopback egress and general inbound access. Require nonempty, nonzero proxy ports and reject `allow_local_binding=false` at both launcher and policy boundaries because native host-loopback access is bidirectional.
Document the MXC launch contract, platform requirements, and limitations.
## Testing
Add portable tests covering managed network transport and policy translation, plus rejection of missing proxy ports, zero ports, and unsupported local-binding restrictions at both boundaries.
GitOrigin-RevId: 8d31b98f94a2ba3769369aa50de8e53dc143bac4
## What changed
- Bump `quinn-proto` from `0.11.14` to `0.11.15` in the Cargo and Bazel lockfiles.
- Allow `hyperium/h3` as a Git source in `codex-rs/deny.toml` for the pinned revision needed by `CONNECT` request handling until released.
GitOrigin-RevId: 1e977e28d9e57acd8eac6a49a5e15fe04602c38d
## Why
Audio queue saturation and processing delays could terminate voice sessions. Muted sessions also need outgoing audio to keep the peer alive.
## What changed
- Drop stale or excess incoming, capture, render-reference, and playback audio so fresh audio can resume. Reset affected processing state while preserving queue bounds and mute generations.
- Send paced, generated Opus silence while muted, without using device or processing buffers.
- Add fixed helper exit stages and session failure categories to default TUI logs without logging raw native errors, SDP, or device error text. Preserve observed helper exit status for shutdown.
## Testing
Extend tests to cover decoded mute silence and RTP sequence continuity, recovery after stale audio and queue saturation, and shutdown after observing helper output closure. Verify the helper's exit stage when the parent pipe closes during blocked startup.
GitOrigin-RevId: 17d580a72acd4423fb0b4f5107d9b541b964d069
## Why
The TUI should respect the host's accessibility preference even when `tui.animations` is enabled.
## What changed
- Read the system motion preference once at launch on macOS, Windows, and Linux. Changes to that preference require restarting the TUI.
- Suppress animations when reduced motion is requested without changing saved configuration. Preserve configured behavior when detection is unavailable, and limit the Linux portal query to 250 ms.
- Use the effective animation setting for voice controls and transcripts, and honor system reduced motion in the startup composer.
## Testing
Add tests for animation preference resolution and preservation of saved settings, plus composer snapshots without sparkles at widths of 40 and 80 columns.
GitOrigin-RevId: 3ea4e721ae23220a040a06123a27286a8c8f1c7c
## Why
Sandbox policies can exceed Windows command-line limits. Provide an environment transport for these larger MXC launch requests.
## What changed
- Make `MxcCommand` serializable and add JSON encoding and decoding through `CODEX_MXC_LAUNCH_*` environment variables.
- Split payloads into UTF-8-safe chunks of at most 4,096 bytes, with a 1,000,000-byte payload limit and at most 256 chunks.
- Reject malformed or duplicate transport entries and remove all transport variables during decoding, including on failure. Preserve unrelated environment variables.
## Testing
Add tests for large Unicode and escaped-argument round trips, stale variable removal, malformed transport rejection and cleanup, and oversized payload rejection without modifying the environment.
GitOrigin-RevId: 0e5ae2535ef313985a95eb8a5fd4884974dfb1eb
## What changed
- Move assessment event construction, metrics, and analytics tracking into `codex-guardian-reviewer` through `ReviewReport`.
- Store denial accounting in thread extension data through `ReviewDenials`, with core retaining turn interruption and lifecycle cleanup.
- Move failed-review record selection and bounded serialization into the extension, with core supplying captured review context.
## Testing
Add coverage that denial accounting clears on turn completion and interruption. Move the oversized-record test into the extension and exercise the new API.
GitOrigin-RevId: 6e5b3d9d4128b356f99b1d0e74a68111e40261ab
## What changed
- Move reviewer configuration overrides, turn request construction, and deadline, cancellation, and completion handling into `codex-guardian-reviewer`.
- Adapt core sessions through `ReviewerRuntime`, keeping context construction, managed constraints, and live network rules in core.
- Make `GuardianReviewSession` crate-private and remove direct reviewer pool initialization and the reviewer dependency from `guardian-v2`.
## Testing
Update the turn-draining test to exercise `wait_for_guardian_review`, checking that prior-turn completion events are ignored and the session remains reusable after draining the current turn.
GitOrigin-RevId: fdf2b335b88b3f405d2370298ee68932808e1186
## Why
Stdio shutdown can hang on open pipes or blocked I/O, and Unix `SIGTERM` needs to run connection cleanup so owned commands terminate and session-end hooks execute.
## What changed
- Handle `SIGTERM` on a dedicated signal thread and close the stdio connection through the existing cleanup path.
- Move blocking stdin and stdout operations to dedicated threads so they do not hold the Tokio runtime open. Cancel message forwarding on `SIGTERM` to release blocked producers.
- When shutdown signal handling is enabled on Unix, start a shared 45-second watchdog on EOF or `SIGTERM`. Preserve the first deadline and exit with status `1` if cleanup or runtime teardown stalls, even when logging is blocked.
## Testing
Add Unix integration coverage for shutdown with open pipes, blocked stdout, blocked stderr, and a stalled filesystem write. Verify command and child-process termination, preserve the EOF deadline when `SIGTERM` follows, and extend session-end hook coverage to `SIGTERM`.
GitOrigin-RevId: 43a80b8277eb50519cdc293eb3b5dc2cad00b3aa
## Why
MXC volume-root grants are nonrecursive, and filesystem deny globs were rejected before launch.
## What changed
- Expand volume-root grants to include existing immediate children, preserving read-only carveouts and denies. Children created directly under a volume root after policy construction are not granted access.
- Normalize filesystem object aliases before and after expansion so generated grants preserve tighter access restrictions.
- Skip unavailable volumes and uninspectable generated children.
- Resolve deny globs into concrete file and directory paths using the Windows sandbox resolver.
## Testing
Add regression tests for read-only children and aliases, normalized root access, uninspectable children, and deny glob expansion alongside explicit denies.
GitOrigin-RevId: 3242e9a30d16581d6fe5b7b6e39e0e0f71ca6ef4
## What changed
Probe the default Windows system config namespace at session start and record `codex.windows_system_config.namespace_squatting_probe` once per process when metrics are available.
When `config.toml` or `requirements.toml` exists, check the containing directories for expected ownership and broad standard-user mutation allow ACEs, including permissions inherited by child files. Report coarse results for missing files, expected directories, unexpected types or owners, mutation permissions, and check errors.
The probe is observational: it does not change configuration loading or enforce a trust decision.
GitOrigin-RevId: e1c79dca5548e16e83c7b84b44ab0de4e2643d0d
## Why
Loaded threads, including idle threads whose rollout files are still deferred, need to survive a managed daemon restart. Shutdown must also remain forceable when rollout I/O is blocked.
## What changed
- Add a hidden `--managed-daemon` option for app-server Unix socket transports. After active turns and admitted requests drain, save loaded persistent root threads before exiting.
- Skip ephemeral threads, non-root agent threads, and threads pending unload. Log persistence failures and continue saving other threads.
- Apply shutdown admission checks to thread and turn settings updates, thread deletion, and archiving.
- Keep force signals and daemon shutdown requests responsive during persistence. Return `AppServerExit::Forced` so executables can exit without waiting for runtime teardown.
## Testing
Add integration coverage for resuming active and idle threads after restart, forcing shutdown during active work, and forcing shutdown with a blocked rollout writer. Extend shutdown rejection coverage to deletion and settings updates.
GitOrigin-RevId: 4344e97d39f9f80c5d84c41c17300fd6aa99b4cc
## What changed
Move the synchronous review loop, outcome mapping, deadline helpers, and session pool into `codex-guardian-reviewer`. Core supplies adapters for evidence capture, authorization checks, session creation, and event publication through the new host interfaces.
Have `guardian-v2` initialize the reviewer pool and host separately, with the pool managing prewarming, session reuse, concurrent forks, invalidation, and shutdown.
## Testing
Extend the app-server reviewer lifecycle test to cover interrupted concurrent reviews as well as completed reviews, including resuming a reviewer after parent shutdown. Adapt core reviewer tests to use the pool and factory interfaces.
GitOrigin-RevId: 2d69bd20c169b20534764b98cbdb63f38564a530
## What changed
- Let higher-priority providers in `features.network_proxy.credentials` displace lower-priority providers with overlapping `env` sources, including in profiles. Preserve inherited settings when providers swap sources, and compare environment names case-insensitively on Windows.
- Preserve provider definitions across ordered batch remaps and persist displaced-provider removals without overwriting unrelated sibling updates.
- Validate remapped providers using the credential broker's compilation rules before persisting writes, while allowing incomplete drafts and explicit deletions.
- Omit displaced providers from config origins and report writes overridden by another provider's source ownership.
- Build trusted credential-broker configuration before merging managed layers for project discovery, preserving remapped providers' environment protections.
## Testing
Add unit and config RPC regression tests for source precedence, source swaps, ordered edits, concurrent sibling updates, atomic rejection of invalid remaps, persistence, and override reporting. Add a macOS managed-config regression test for remapped provider bindings during project discovery.
GitOrigin-RevId: b7d402727acf4e5b0f25946db1cf18811f5e2679
## What changed
Move assessment parsing and schema, model selection, review outcomes, retry handling, and rejection circuit breakers into `codex-guardian-reviewer`. Update core to use the extracted APIs while retaining session execution and decision enforcement in the host.
## Testing
Move existing assessment, circuit breaker, and retry tests into the new crate, including coverage for transient errors, cancellation, and deadlines.
GitOrigin-RevId: 96ec9989a0066acb012bf3bec0b9f7d8bf11a4ef
## Why
Diagnostic attachment reads assume the queued file path still exists and contains plain bytes. Compressed rollouts can therefore be omitted when only the logical `.jsonl` path is available, or attached as compressed data when a `.jsonl.zst` path is supplied.
## What changed
- Read rollout attachments through a bounded decoder that resolves plain or compressed representations without materializing a durable JSONL file.
- Use canonical `.jsonl` filenames for attachments and app-server report metadata, while preserving filename overrides.
- Apply size limits to decoded bytes and preserve JSONL prefix truncation.
## Testing
Add regression tests for compressed attachments, representation changes after queuing, plain-sibling preference, filename overrides, decoded size limits, truncation, nonregular files, and unrelated `.zst` attachments.
GitOrigin-RevId: b30f7dd08a741b0c99283460a1ce8933d2920ddf
## Why
Credential brokerage must retain trusted destination hints even when shell environment policy hides them from child processes. Snapshot replay also needs to preserve credential aliases when tokens are short or captured dummy values change.
## What changed
- Add `features.network_proxy.credentials` and preserve provider settings when toggling the proxy. Prevent project configuration from overriding providers or their credential and destination environment variables.
- Use provider metadata throughout snapshot capture and replay, and pass hidden destination context to the broker without exposing it in the child environment.
- Rewrite aliases containing short credentials or previously captured dummies, respecting environment filters and explicit overrides.
- Preserve case-distinct `shell_environment_policy.set` keys so Windows credential ambiguity checks survive configuration merging and permission profile changes.
- Restore independent MITM settings when credential brokerage is disabled.
## Testing
Add regression coverage for custom providers, hidden destination hints, Bash and Zsh alias replay, configuration edits and merging, Windows ambiguity handling, and credential protection during approved execution.
GitOrigin-RevId: b2bd935d2d8555be56baf8feb1a8e5b3a0c666bc
## What changed
- Discover configured provider credentials in child environment values even when canonical credential variables are absent. Match complete tokens while preserving regex word boundaries and avoiding ambiguous or overlapping provider matches.
- Replace and restore credentials by their original spans, preserving adjacent tokens and generated dummy aliases across destination rebinding. Reject dummy values that embed another provider's credentials.
- Extend text virtualization and provider source checks to configured credentials, including short credentials with distinctive prefixes, while preserving operational paths.
- Expose trusted provider metadata and active bindings through `CredentialBrokerEnvironment`, and remove marked configured credential variables when stripping the managed proxy environment.
## Testing
Add regression tests for alias discovery, regex boundaries and alternatives, overlapping and adjacent credentials, destination rebinding, dummy restoration, disallowed credential sources, and operational path preservation.
GitOrigin-RevId: dd85c595ce9550fbfdb07ef296a23e458ca165dd
## What changed
- Add `credential_providers` configuration for environment variables, credential patterns, static or environment-derived URL prefixes, and bearer, token, Basic, or custom header authentication.
- Generate matching dummy credentials and restrict replacement to authorized schemes, hosts, ports, and path prefixes. Scope credentials and destination history to each environment.
- Preserve real credentials for destinations that bypass the proxy with `allow_local_binding`, while providing snapshot redaction and alias matching.
- Validate provider definitions and preserve unchanged providers across configuration reloads.
## Testing
Add coverage for dummy generation, authentication translation, URL restrictions, environment isolation, configuration reloads, and credential restoration for local proxy bypass.
GitOrigin-RevId: 5d60ecc684cf4e9aa7637af33af12179aa0c672a
## What changed
Support `model_providers.amazon-bedrock.aws.credential_export` with `command`, `args`, and `timeout_ms` to supply SigV4 signing credentials from a command's JSON output. Accept both flat credential-process output and nested STS `Credentials` objects.
Cache credentials in memory, refresh before expiration, and share exports across sessions with matching AWS configuration. On recoverable authentication failures, run the optional `aws.auth_refresh` command before exporting fresh credentials, coalescing concurrent recovery attempts.
Bound command execution time and output size, and keep credential values out of errors. Reject combining `aws.credential_export` with `aws.profile`. Bedrock setup and login reject changes while an exporter is configured, preserving configuration and saved credentials.
## Testing
Add coverage for output formats, expiration, credential precedence, caching, concurrent recovery, command failures, and secret redaction. Integration tests verify request signing with rotated credentials, bounded recovery attempts, and setup/login rejection across configuration layers.
GitOrigin-RevId: 4ef799f88ab5e3b2578f8f41a5e56e4f30e2cd81
## Why
Switching providers or authentication could reuse a previous identity's model catalog, including its default service tier. An in-flight refresh could also overwrite a newer account's catalog after cache storage completed.
## What changed
- Require a matching provider and auth identity for disk and in-memory catalog reuse. Treat legacy entries without an identity as cache misses and fall back to bundled metadata when the in-memory identity no longer matches.
- Recheck identity after fetching and storing a catalog before publishing it.
- Renew cache freshness only when the client version, identity, and ETag match the stored entry.
- Update cache fixtures to include the configured provider and auth identity.
## Testing
Add regression coverage for provider and auth switches, credential rotation, legacy and mismatched cache entries, conditional TTL renewal, and an account switch during cache storage. Verify that API-key requests do not inherit a ChatGPT catalog's default `service_tier`, while explicit tier selection still works.
GitOrigin-RevId: e15d7ffff238d951d7a1c6a68381cbb479994146
## What changed
Add a SHA-256 identity derived from provider routing, headers, and authentication scope. Return it with each model catalog response and persist it in `ModelsCacheEntry`. ChatGPT credentials with stable account and user metadata retain the same identity across token refreshes; opaque API credentials contribute to the digest.
## Testing
Add identity tests covering account, user, email, plan, auth mode, provider routing, headers, and API credential changes, plus stability across ChatGPT token refreshes. Update cache tests to include the persisted identity.
GitOrigin-RevId: 3f51c6cabcb01bc03505150a768a61dfe5d6569f
## Why
A descendant outside an MCP server's process group can keep stderr open after the server exits, leaving the reader task and its file descriptor alive.
## What changed
Signal the local stderr reader during explicit shutdown and when the process handle is dropped. Allow up to 250 ms to drain queued diagnostics before closing the reader, even if stderr never reaches EOF.
## Testing
Add a Unix regression test covering explicit shutdown and client drop with a descendant that keeps stderr open. Verify that file descriptor counts return to baseline while the descendant remains alive and that queued diagnostics are logged.
GitOrigin-RevId: 1b544e8dba2b5616db6739d075e7232564c92884
## What changed
Add `policy::build_request` to `codex-rs/mxc-sandbox` to translate `MxcCommand` permissions into native MXC execution requests. Preserve filesystem denies, read-only carveouts, and protected metadata paths, and resolve overlapping grants using canonical path identities.
Map network permissions to ingress, egress, and loopback policies; quote arguments for Windows process creation; and disable DACL mutation fallback. Reject unsupported symbolic roots and deny globs, empty commands, relative working directories, and non-Unicode request paths.
## Testing
Enable unit tests and add coverage for filesystem grants and carveouts, disabled DACL mutation, deny-glob rejection, relative working directories, and non-Unicode paths.
GitOrigin-RevId: 3e647ed5fa932ab9d528eb44a49dd9283ef50481
## Why
Enterprise sign-in needs to keep browser completion separate from credential storage so callers can recheck the active account and configuration before saving a grant. Logout must also prevent an earlier sign-in from restoring credentials, including from another process sharing `CODEX_HOME`.
## What changed
- Add enterprise login APIs in `rmcp-client` that return an authorization URL and stage validated credentials for an explicit `commit_if` call. Store grants only in the keyring after rechecking caller authority under the credential lock.
- Require a registered client ID, published metadata matching the configured issuer, HTTP loopback callbacks, a refresh token, and a valid OIDC identity assertion. Request `openid` and `offline_access` with `prompt=consent`, and omit MCP resource indicators from authorization and code exchange.
- Persist a login generation under the credential lock so logout invalidates pending and staged sign-ins across processes, even when no grant is stored.
- Keep credentials and account identifiers out of enterprise error chains and logs, and avoid logging callback payloads when the receiver has closed.
## Testing
Add coverage for discovery validation, loopback callbacks, PKCE, staged keyring storage, cancellation, stale attempts, cross-process logout, and error/log privacy. Preserve ordinary MCP OAuth login without a refresh token, and adjust the terminal polling test deadline to include the minimum empty-poll wait.
GitOrigin-RevId: 2a27b9a26505a2f6fdecce8877f6e2c21e148f72
## What changed
- Add `memories.version` with `v1` as the default and `v2` as an opt-in selection.
- Route memory generation, summaries, and retrieval tools through the selected version. Store `v2` artifacts in `memories_v2` and lazily create a separate SQLite database, keeping jobs and outputs isolated while sharing the thread catalog.
- Preserve the initial memory version across extension config updates so summaries and retrieval tools use the same namespace.
- Clear both versions on memory reset and remove thread memory from both stores on thread deletion. Recognize both artifact roots in shell usage telemetry.
## Testing
Add regression coverage for version defaults and validation, independent job claims and outputs, deletion and reset across versions, and shell usage classification for both memory roots.
GitOrigin-RevId: aa799bf87ab6ec10c8f5668213931e57547d080b
## Why
The user-verification API previously returned an unsupported provider on macOS. Enable native verification using biometric-protected credentials.
## What changed
- Implement credential status, creation, reuse, deletion, and challenge signing with P-256 Secure Enclave keys in the Data Protection Keychain.
- Require biometric authentication through the key's access-control policy and use a fresh `LAContext` for each signature.
- Report Touch ID hardware support independently of enrollment and current readiness, and map native failures to structured verification errors.
- Serialize credential operations across processes with cancellable file-lock waits. Invalidate pending authentication on cancellation and wait for the signer to exit before releasing the lock.
## Testing
Add unit tests for lock contention and cancellation, authentication teardown and late-result rejection, native error classification, and validation of Secure Enclave key attributes.
GitOrigin-RevId: 93268962cd824b2befc1a0c54b99dcb77a0f1044
## What changed
Represent host-verified tool metadata as `TrustedTool` in `codex-guardian-context` and collect it through an async-only context section. Route Guardian v2 sampling through that section while preserving separate developer-message delivery and the 512-token rendering budget. Omit tool metadata from debug output.
## Testing
Move the rendering-budget test into the shared crate, extend registry coverage for async-only collection and debug redaction, and narrow the scoped approval test to messages tagged `guardian.trusted_tool`.
GitOrigin-RevId: ee7cb4e9b9ceced70438cb58060d1a2973e1dc6a
## What changed
- Add feature-gated `/voice`, `/voice mute`, and `/voice stop` commands with local WebRTC audio and app-server signaling.
- Show live transcripts, conversation status, and microphone and speaker levels. Preserve captions and undelivered answers across thread switches.
- Speak final answers from voice handoffs while keeping delegated reasoning and commentary hidden and typed answers unspoken.
- Retry eligible startup failures once and clean up voice sessions on thread switches and disconnects.
- Stop voice and block late handoffs after a misalignment policy violation. Remove realtime event payloads and spoken text from receipt and debug logs.
## Testing
Add coverage for voice command mapping, rejected starts, disconnect cleanup, delegated final-answer speech, late handoff rejection, and transcript and footer rendering.
GitOrigin-RevId: 11def1f86b0e023b21d0d92072d6636ccad89815
## What changed
- Store the shared `GuardianReviewSessionManager` in thread extension data and let the Guardian extension spawn and fork reviewers through `ThreadManager`, independently of async scorer startup.
- Preserve reviewer reuse, concurrent forks, cancellation, inherited environments, and user instructions. Gate managed reviewer startup on parent registration and remove terminated reviewers from the manager.
- Retain the `guardian` subagent identity in saved conversations. Reject resume of live Guardian reviewers and reject client archive or delete of live owner-managed workers with JSON-RPC error `-32600`; allow normal access after the owner releases them.
- Keep standalone reviewer support for inline delegates and remove duplicated extension prompt and configuration code.
## Testing
Add app-server tests covering reviewer reuse and concurrent forks, inherited instructions and prompt cache keys, live resume and removal rejection, saved reviewer discovery and resume after parent shutdown, and strict Guardian assessment inside an inline review.
GitOrigin-RevId: 4f9893c1ade151eacb4c11ffeae3d9e9ec019187
## Why
An installer can retarget the selected executable symlink or junction while an app server is running. Recording the launch-time identity preserves which binary was started after that path changes.
## What changed
- Resolve the executable path before launching on all platforms and store an optional executable identity in app-server PID records. Continue accepting older records without this field and expose the identity only for an active process.
- Use BLAKE3 for executable identity digests and make `ExecutableIdentity` serializable.
- Schedule updater checks with an explicit deadline in `tokio::select!`, preserving persisted update intervals, settings-error retries, and termination handling.
## Testing
Add a Unix test that verifies the recorded identity matches the resolved launch binary, differs from a retargeted symlink's binary, and remains optional when reading legacy PID records.
GitOrigin-RevId: 4821130b9a5e75b417a8e39c583b30427a872ff8
## What changed
- Introduce `codex-user-verification` with a provider interface for credential status, creation, deletion, and challenge signing. Include typed errors, shared cancellation guards, and hashed account-user key namespaces.
- Add P-256 public-key encoding as unpadded base64url SPKI DER, derive credential IDs from its SHA-256 digest, and redact proof fields in debug output.
- Add app-server helpers to validate challenge and display-text bounds and map provider errors to typed RPC errors without exposing provider diagnostics.
The platform implementation reports verification as unsupported. App-server requests still return typed unavailability, with the message updated to mention build or account availability.
## Testing
Add tests for credential encoding and signature verification, invalid curve points, cancellation across guard clones, stable and distinct account namespaces, and invalid challenge or display values. Update the app-server unavailability test for the revised message.
GitOrigin-RevId: fe4a4eb37c68d7fdc547704e76aa257abf3e9c81
## Why
Executor compatibility checks need a build identity that distinguishes commits
and compiler targets independently of the package release version.
## What changed
- Add optional `providerId` to exec-server environment metadata, cached at startup
and returned by initialization and `environment/info`.
- Derive the ID as SHA-256 of `git:<lowercase commit>:<target>`. It identifies a
standard build configuration, not exact executable bytes, and is omitted when
the commit stamp or target is unavailable or invalid.
- Embed the compiler target in `BuildInfo`, preserve compatibility with historical
metadata without a target, and stamp Cargo release builds with `STABLE_GIT_COMMIT`.
- Group Bazel build-script argument files under one `--arg-file` flag to reduce
Windows command-line length while preserving file order.
## Testing
Add deterministic build-ID vectors across targets, commit normalization and invalid
input coverage, and historical metadata compatibility tests. Extend exec-server
coverage for metadata caching and ensure runtime environment overrides cannot
replace the executor's build identity.
GitOrigin-RevId: 125a18c23de7ad006571940ba305836376c983f4
## What changed
Route managed Windows app-server shutdown through `/daemon/shutdown` on the local control socket. Require the server's PID and acknowledge it before triggering shutdown through the existing drain logic. Enable the endpoint only for managed Windows launches via `CODEX_DAEMON_SHUTDOWN_SOCKET`.
Watch running-turn changes whenever shutdown is requested so socket-triggered shutdown can finish draining. Keep the updater's file-based shutdown mechanism and retain forced termination as the manager's timeout fallback.
## Testing
Add a transport test covering rejection of unmanaged shutdown requests and mismatched PIDs, plus acknowledgment before emitting the shutdown event.
GitOrigin-RevId: 3e95dc1914f61e8a131f9b6fd56b6c63688d1744
## Why
The voice host drained incoming RTP packets without playing them. Route received audio through decoding and speaker output while preserving speaker suppression boundaries.
## What changed
- Add a GStreamer pipeline with RTP jitter buffering, Opus decoding, conversion, and resampling into the native speaker sink.
- Rebuild playout when the speaker is re-enabled, reject packets received before the new pipeline started, and discard queued audio and echo references on speaker transitions while preserving capture history.
- Limit each receive pass to 64 packets so incoming media cannot indefinitely delay audio controls.
- Prevent retired sink failures from failing a new speaker generation, and retain the last coherent playback delay estimate during callback contention.
## Testing
Add tests for real Opus playback and stale packet rejection, combined microphone mute and speaker suppression, retired sink failures, delay contention, and echo-reference reset without losing capture history.
GitOrigin-RevId: c91c94a2ba2347ac98af4e7fd1dc331ae766cc45
## What changed
- Add a `GstAudioSink` subclass backed by a bounded mono `F32LE` playback writer, with partial writes, cancellation on speaker epoch changes, and delay accounting for queued samples and pending device output.
- Recreate the CPAL output stream and discard buffered audio when speaker controls change the epoch, preventing stale audio from surviving suppression.
- Add GStreamer dependencies, adjust Windows Bazel native-tool selection, and allow the helper handshake time to load startup-linked libraries.
- Separate installed-client tests from protocol lifecycle tests and supply native startup libraries in test packages.
## Testing
Add unit coverage for partial writes, sample accounting, suppression cancellation, stale writers, device delay, invalid samples, and stalled consumption.
GitOrigin-RevId: c48c48d2fee00659cf6f8a4039a6745385cb77cd
## What changed
- Add `RealtimeWebrtcSession` and cloneable handles for startup, answer negotiation, audio controls, level meters, and error reporting.
- Open devices after answer negotiation and apply the latest controls before enabling audio. Preserve subsequent control transitions in order and close the session if the command queue fills.
- Cancel pending work on explicit close, external cancellation, or final handle drop, with a shared runtime keeping helper reaping alive.
- Add audio-state polling to consume microphone and speaker peaks and detect helper, device, or connection failures.
- Check packaged helper/runtime availability and initialize build information in the standalone TUI for the helper handshake.
## Testing
Add unit and helper-process integration tests covering startup control ordering, queue overflow, cancellation, helper reaping and loss, package availability, SDP debug redaction, and peak accumulation, clamping, and consumption.
GitOrigin-RevId: 458cd80353697f7411cee785f380d1d53aef8416
## Why
`voice-host` previously drained captured audio locally without sending it to the peer. Connect capture to the outgoing media track while preserving mute boundaries and limiting stale audio.
## What changed
- Resample capture and render references to 48 kHz with Rubato, apply Sonora echo cancellation, noise suppression, and gain control, and encode capture as 20 ms mono Opus packets.
- Attach an Opus track to the WebRTC peer and advance RTP timestamps across mute gaps without introducing sequence-number gaps.
- Prioritize queued controls and shutdown between sends. Clear pending audio and processing history on microphone mute transitions, reject delayed pre-unmute buffers, and reset partial history after capture gaps.
- Size bounded capture and render queues for device rates, validate callback timing, enforce a 500 ms processing deadline, and time out stalled sends after 100 ms.
Receive/decode and TUI integration remain unimplemented. The bundled Opus encoder build requires CMake and a C compiler.
## Testing
Add synthetic-audio tests for Opus decoding at 44.1 and 48 kHz input rates, echo reduction, capture gaps, stale audio, queue capacity, and control priority. A loopback WebRTC test verifies RTP delivery, decoded signal, mute isolation, and timestamp and sequence continuity across mute gaps.
GitOrigin-RevId: 38b8438577cfadb8124f8aeb426dffbab4845964
## What changed
- Add `openDevices` and `setAudioControls` to the helper protocol. Open the default microphone and speaker after runtime initialization and transport negotiation, initially muted and suppressed.
- Use CPAL on macOS, GNU Linux, and MSVC Windows, with native audio dependencies confined to `codex-voice-host`. Add ALSA development dependencies to Linux CI.
- Pack callback samples into preallocated, bounded queues and service devices every 5 ms. Reject incompatible callback configurations, invalidate queued audio on control transitions, and reject capture backlog after unmute using device timestamps.
- Handle recoverable stream underruns and overruns without terminating the helper; terminate on device failure, active audio queue overflow, or stale queued audio.
Device opening only establishes local device readiness. Capture and rendered audio references are drained locally; encoding, decoding, and peer audio are not connected by this change.
## Testing
Add unit tests for mute boundaries, stale playback invalidation, sample bounds, partial-block packing and timestamps, callback size and timing limits, startup silence, queue overflow, and recoverable stream errors.
GitOrigin-RevId: 108aea3d411ef6c12908fe5fb67aaf9cddf4475f
## Why
`--worktree` previously supported only `codex exec` and `codex exec fork`. Interactive sessions need the same managed checkout support, with configuration and policy resolved for the destination before starting a turn.
## What changed
- Enable `codex --worktree` and `codex fork --worktree <session-id>` behind the `worktrees` feature, restricted to local sessions. Interactive forks require an explicit session selector.
- Resolve interactive and exec worktree forks from the session's latest saved working directory unless `--cd` is supplied. Keep relative `--add-dir` paths anchored to the invocation directory.
- Load interactive destination configuration before telemetry and login policy initialization, and bind checkout ownership before the first turn.
- Reject explicitly untrusted sources, including when destination cloud policy or refreshed configuration reveals distrust. Retain unbound interactive checkouts after startup failure and report manual recovery instructions.
## Testing
Add CLI integration and TUI tests for startup and named forks, destination instructions and configuration, ownership before the first request, trust enforcement, and retained-checkout recovery. Extend exec coverage for saved fork directories, explicit `--cd`, relative writable roots, and cloud policy rejection.
GitOrigin-RevId: 371583f7feca73b218a4ff188b2b85812c8439e6
## What changed
Remove the `codex mcp-server` subcommand and the standalone `codex-mcp-server` crate, including its tests, interface documentation, build dependencies, and run recipe.
## Testing
Update the strict configuration test to use `codex exec hello`, preserving coverage for rejecting unknown configuration overrides.
GitOrigin-RevId: 8688b1f41862d7c2073ea2812a257c0087c55d9c
## What changed
Write Default and Plan directly into the default mode instructions and use the text without template rendering. Remove the mode-name formatting helpers and the `codex-utils-template` dependency from `codex-models-manager`.
Update the instruction test to retain checks for `request_user_input` availability guidance while removing placeholder assertions.
GitOrigin-RevId: d6afa478c30f991baa9ef4d5459e84354f29ce17
## What changed
- Introduce an async-question editor component with per-question drafts, navigation, replay deduplication, and submit or queue handling using the shared composer.
- Add bounded `AnsweredQuestion` framing that truncates question text at a UTF-8 boundary and flattens line breaks before prepending it to an answer.
- Add `prompt_stack_back` and `skip_question` keybinding actions and the `tui.question_esc_back` setting. Normalize `Ctrl+]` and `Ctrl+5` for key matching and conflict detection, and let default question shortcuts yield to explicit bindings.
- Flush buffered typing in both the main composer and the covering view so background input cannot keep the draw loop waiting.
The async-question component is not yet connected to the TUI event flow.
## Testing
Add regression coverage for bounded Unicode question framing, question-shortcut conflicts, and paste-buffer flushing in background and covering editors.
GitOrigin-RevId: 4098043cf588ddafc05c27505645495edd690cb9
## What changed
- Configure the CLI and app server to use `tikv-jemallocator` on
`x86_64-unknown-linux-musl` and `aarch64-unknown-linux-musl`.
- Keep the dependency and global allocator selection scoped to those targets.
GitOrigin-RevId: 93c54c90d9acb7e48edffd032cd8ec685a782210
## What changed
- Add rendered HTML alongside the original Markdown when copying a whole response through the native clipboard, so rich-text destinations preserve headings, lists, tables, code, and other formatting.
- Keep code-block, blockquote, transcript, terminal, and WSL clipboard copies as plain text.
- Escape raw HTML, omit remote image sources, and render unsupported link destinations as visible text when producing clipboard HTML.
## Testing
- Add coverage for rich formatting, local and unsafe links, inert images, fenced tables, copy selection formats, and clipboard fallbacks.
GitOrigin-RevId: c6f5edd88b65f9e9b1ddc5618442868cf47ee560
## What changed
- Add `codex-mxc-sandbox` with native MXC availability detection and a launcher that inherits standard I/O and waits for the sandboxed process.
- Reject unsupported learning-mode and fallback policies, and verify deny-path support before launch.
- Route the existing Windows MXC availability metric through the new crate and move its Windows linking dependencies alongside the adapter.
GitOrigin-RevId: e2a220b85718e00b0e710c30bbe66b6c56958176
## Why
Allow remote exec servers to connect directly to AWS-hosted registries that
authenticate registry requests and WebSocket handshakes with AWS SigV4.
## What changed
- Add `--remote-transport direct` with SigV4 profile, region, and service
options while keeping Noise as the default transport.
- Register the `direct_jsonrpc_v1` transport and carry plain exec-server
JSON-RPC messages over the authenticated WebSocket.
- Reuse direct registrations across transient disconnects, refresh them after
a `409 Conflict`, and require TLS for non-loopback endpoints.
## Testing
- Cover CLI validation and SigV4 request signing.
- Exercise direct registration, handshake retry behavior, JSON-RPC
interoperability, and process recovery after reconnecting.
GitOrigin-RevId: 0755df330ba3abe5db0a516fdaa49338d9bbe2d2
## What changed
- Add helper protocol requests to create a WebRTC offer, apply an answer, and report readiness once the ordered `oai-events` data channel opens.
- Support UDP and TCP candidates while bounding signaling size, remote candidates, inbound TCP streams, and WebRTC buffers. Redact session descriptions and peer errors from diagnostics.
- Close unexpected remote data channels and tear down the peer during helper shutdown, including when the parent pipe is lost during startup.
## Testing
- Exercise offer/answer negotiation and clean shutdown over real UDP and TCP sockets.
- Cover signaling validation, candidate and connection limits, early packet loss, slow TCP connection setup, and blocked-startup parent loss.
GitOrigin-RevId: 5f5e60a3a4d1d8eaca2e4724e66284f54061b6af
## What changed
- Add the experimental `worktrees` feature and a shared `--worktree` flag for new and forked `codex exec` sessions.
- Create each enabled session in a managed Git worktree, use that checkout as the session working directory, and bind the checkout to the new thread.
- Share the configured worktree pool with Desktop while leaving automatic cleanup disabled for CLI allocations.
- Reject unsupported commands, remote execution, ignored user configuration, ephemeral sessions, and use without the feature enabled before allocating a worktree.
## Testing
- Cover flag placement and inheritance, supported and rejected command combinations, worktree allocation and thread ownership, configuration gating, and compatibility with existing worktree-backed sessions.
GitOrigin-RevId: 011ff4639b09e8992c50d7b823df23e71798670e
