## What changed
Add `cancelled_v2_send_finishes_reload_registration` to verify that cancelling a multi-agent V2 send during an evicted child's reload does not cancel registration. The test checks that the thread-created notification arrives and evicted-environment state is cleared.
Evict and reload the child again with only one child slot available to catch leaked residency pins or reservations, and verify that only the subsequent follow-up message is delivered.
GitOrigin-RevId: ce6ed90d0049245370f26d8dbb35b9f1cd0b3063
## What changed
- Route app-server idle unloading of multi-agent v2 children through local eviction that preserves unread mail and environment selections for reload.
- Hold residency pins through input submission so newly reloaded children cannot be evicted before receiving their work.
- Guard listener cleanup against replacement runtimes and subscriptions, and reject local eviction of host-controlled threads.
## Testing
Add coverage for unsubscribe-driven eviction followed by `followup_task`, verifying restored conversation context and exactly-once delivery of queued mail. Extend tests to check that residency pins block eviction and that rejected host eviction preserves the thread and mailbox.
GitOrigin-RevId: e36723730af683d2081e495e637f0e6d23548b8d
## What changed
Record local MXC availability and the selected Windows sandbox backend at app-server and session startup. Log the backend again when an accepted session settings update changes the Windows sandbox level, using a blocking task for the log write.
Selection entries distinguish `mxc`, `disabled`, `unelevated`, and `elevated` in the sandbox logs under `.sandbox` in Codex home.
## Testing
Update the remote thread persistence assertion to allow the `.sandbox` directory on Windows, since startup logs are not thread persistence artifacts.
GitOrigin-RevId: 4130b59ac7761223775ac9b6afb096abb7fb4615
## Why
Compaction analytics lack a voice session ID. A compaction event can arrive after its voice session has closed or another session has started, so attribution needs to account for when compaction began.
## What changed
Add `voice_session_id` to compaction events. Track realtime session starts, ID updates, and closures, retaining up to 16 recent closed session windows. Resolve the session from the compaction start timestamp, falling back to the turn's voice session ID.
Forward realtime session ID updates from the app server to analytics and update the active turn's attribution.
## Testing
Add coverage for realtime session boundary facts, compaction event serialization, and delayed compaction events across consecutive voice sessions.
GitOrigin-RevId: 981da0ea2c38a87079b6bab33daf2c88fd95160f
## What changed
Add `functions_namespace_functions_description_prefixes` to model tool messages, keyed by unqualified tool name. Prepend this guidance to descriptions in the `functions` namespace across direct declarations, Code Mode documentation, and tool-search results, including custom tools.
Trim prefixes, ignore empty values and unavailable functions, and enforce a combined 256-byte UTF-8 limit including separators for reachable tools. Keep overrides local to each step, preserve search ranking text, and retain runtime caches for unaffected tools.
## Testing
Extend coverage for direct and indirect descriptions, clearing prefixes when switching models, namespace scoping for deferred dynamic tools, and tool-search cache reuse and reset.
GitOrigin-RevId: f434e37cec010764fe3e09fb12c339e933b3c21c
## Why
Disabling `experimental_request_user_input_enabled` previously left `request_user_input_async` available when the model advertised support for it.
## What changed
Require the user input setting to be enabled before registering `request_user_input_async`, while preserving the root-agent restriction and support for both current and legacy model capability names.
## Testing
Add parameterized tests covering enabled and disabled settings, current and legacy capability names, missing capabilities, and subagents. Also verify that `send_message_to_user_async` remains available to root agents independently of the user input setting.
GitOrigin-RevId: 27156a3fe7da38d10fccb6384f28e755c39abc39
## Why
Network domain rules need explicit wildcard semantics independent of filesystem glob syntax, including matching Unicode hosts with `?`.
## What changed
Replace `globset` in network allowlist and denylist matching with a domain matcher. Make `?` consume one Unicode scalar value, retain ASCII case-insensitive matching and existing host normalization, and preserve the distinction between `*.example.com` and `**.example.com`.
Reject empty patterns, repeated wildcards outside the supported `**.` prefix, character classes, brace expansions, escapes, slashes, and embedded whitespace when loading policies. Continue allowing global wildcards only in allowlists.
## Testing
Add coverage for Unicode wildcard semantics, unsupported syntax, IPv6 normalization, invalid entries in either policy list, and adversarial matching inputs. Compare the matcher against an independent dynamic-programming implementation over exhaustive short inputs.
GitOrigin-RevId: 64f65fcda1a50998d70e046445d22cd2d2dcf27a
## Why
Windows sandbox setup diagnostics previously displayed only the outer error context, hiding native failure causes needed to diagnose ACL failures.
## What changed
Preserve full error chains in ACL refresh summaries, setup logs, and sandbox binary directory lock failure reports. Include the requested access rights in ACL update open errors, and retain recorded ACL failures even when writing their log entries fails.
## Testing
Add tests covering error chains for ACL checks, grants, and denies; preservation of accumulated failures when logging fails; and native directory-open errors surviving a structured setup report round trip on Windows.
GitOrigin-RevId: 0a44a56b13d13b52b92ec673aaa2da7bc6cf0753
## Why
Full WebSocket requests previously used the generic `other` reason when continuation failed because request properties or input changed, obscuring why incremental reuse was unavailable.
## What changed
- Report specific reasons for changed request properties, shortened or mismatched input, and missing response state or response IDs.
- Add `previous_item_type` and `current_item_type` labels to continuation metrics and failure traces. Diagnostics use bounded labels without request contents or identifiers.
- Centralize response item type names in `ResponseItem::item_type()` and reuse them for output logging.
## Testing
Add coverage for unavailable response state and empty response IDs. Expand WebSocket tests to check fallback reasons and item types for rewritten or shortened input, replaced input, changed model, and changed output schema, including precedence when multiple properties change.
GitOrigin-RevId: 3951853dfe87d40b7046af6f6a8efd5d4f5b06d1
## What changed
Record `codex.tools.incremental_updates` through session telemetry with an `action` tag for `added`, `removed`, and `schema_changed`. Definition changes include description edits.
Exclude initial catalogs, unchanged tools, and namespace headers from the counts. Count each removed namespace member even when the removal notice lists only the namespace.
## Testing
Extend the namespace transition snapshot test with in-memory metric assertions covering additions, removals, definition changes, and excluded initial or unchanged catalogs.
GitOrigin-RevId: 0fadb40a3aa7abf5ef1757811ebfb5749505b3d9
## Why
Truncating recorded arguments does not lose the call inventory. Clearing `tool_calls_complete` in that case incorrectly treats retained calls and tool names as incomplete.
## What changed
Define `tool_calls_complete` as completeness of the ordered call inventory, independent of recorded arguments. Preserve it for direct tool outputs and Code Mode cells when argument limits or message budgets truncate arguments, including across later waits. Continue clearing completeness when calls are omitted or tool names are truncated.
## Testing
Update protocol, recorder, and integration tests to verify completeness survives argument truncation and message budgeting. Add coverage confirming that omitted calls and truncated tool names still clear completeness.
GitOrigin-RevId: 1534dbfabbd1291b840dd6fb6738ed51bcd4c0c4
## Why
`MODULE.bazel` already references `mxc-sdk_utf8_resources.patch`, but the patch file and its Bazel export are missing.
## What changed
Add and export the patch to pass `/c65001` to the Windows resource compiler when embedding `mxc-sdk` binary version information, selecting UTF-8 as the resource code page.
GitOrigin-RevId: 80cd64e6a8056c61868b5e20fd8e2fee69c1b96b
## Why
Prediction forks need to preserve the parent's effective context and request settings to maximize prompt-cache reuse.
## What changed
- Add `experimentalPredictionMode` to `thread/fork` for ephemeral forks of loaded, persisted parents. Reject configuration overrides, `path`, `lastTurnId`, and `beforeTurnId` in this mode.
- Inherit the parent's effective configuration, tools, environments, collaboration settings, disabled plugins, and persisted history.
- Enable `features.reasoning_effort_override` on the fork while preserving the parent's request-effort baseline, including when overrides were disabled on the parent.
- Report the fork's effective model, service tier, and reasoning effort in the response.
## Testing
Add coverage for matching parent and fork requests and prompt-cache keys across legacy and paginated history, invalid fork parameters, and reasoning-effort inheritance. Add a context snapshot for identical parent and fork continuations.
GitOrigin-RevId: 46b41f2ac331562b441dadff1a0a9f926c94880d
## Why
Global requests can inherit project settings from the app-server's launch directory. This can prevent marketplace removal or expose project-only feature settings, and config reloads can fail if that directory is deleted.
## What changed
- Load configuration without project context when no working directory is supplied, using `CODEX_HOME` to materialize `Config.cwd`.
- Use global configuration for marketplace mutations, marketplace upgrade reloads, and MCP requests without thread context.
- Pass the launch directory explicitly during startup to preserve project-aware startup configuration.
## Testing
Update regression tests to verify that marketplace removal ignores launch-project configuration and leaves the project config intact. Extend feature-list coverage to verify that global requests ignore project features, thread requests retain them, and global requests work after the launch directory is deleted on Unix.
GitOrigin-RevId: b77063a7ea0b09fd0a79cfc4040db9f1d02606b3
## What changed
Add the `codex.tools.registered` histogram to count finalized tool registrations by `exposure` and `tool_mode`, including zero counts for empty exposure categories. Record it once per sampling request before transport retries, excluding hosted tools. These counts describe the registered inventory, not model visibility or tool reachability.
## Testing
Add an integration test covering a stream retry, direct and deferred namespace tools, a model-only tool, and hosted web search. Verify that registrations are recorded once, hosted tools are excluded, and metric labels contain no tool names or descriptions.
GitOrigin-RevId: 02b450743886e3d487d6c3bcda12eb65f6d1104b
## Why
Rendering an entire question title as one terminal line removes line endings and misaligns hyperlink source ranges with the visible text.
## What changed
Wrap and annotate each logical line of asynchronous question titles separately, preserving blank lines and handling both LF and CRLF endings while retaining complete hyperlink destinations.
## Testing
Add a rendering regression test and snapshot covering multiline titles with code fences, Unicode text, and a URL. Check LF and CRLF rendering equivalence and hyperlink destinations at narrow and wide widths.
GitOrigin-RevId: ccd7256dbaed91ce98374e52b17d3a1b87645574
## Why
Generated app IDs produce opaque plugin mention labels. A selected `@foo` plugin mention also prevented a separate `$foo` skill mention from being submitted.
## What changed
- Use eligible display names, such as `@Postman`, for plugins named `app-` followed by 32 lowercase hexadecimal characters, while preserving the plugin binding. Accept 1–64 ASCII letters, digits, underscores, or hyphens, excluding common environment variable names; otherwise retain the existing naming fallback.
- Only `$` mention bindings suppress automatic skill selection, allowing `@foo $foo` to submit both the plugin and the skill.
## Testing
Add naming tests for accepted display names and fallback cases, a composer snapshot verifying `@Postman` and its plugin binding, and a submission regression test for a plugin and skill sharing the name `foo`.
GitOrigin-RevId: aa8c98f293d12e62d32d43206e076cbe1fcb2a3b
## Why
Detect changes to the default model-visible prefix relative to a released CLI, requiring those changes to be gated behind a default-off feature key.
## What changed
Add `prompt_prefix_matches_release` to compare instructions, tools, and input preceding the user message using the same client and inputs. Each binary uses its bundled model catalog and feature defaults. The comparison removes response item IDs and transport metadata and normalizes fixture paths and session identifiers while preserving prompt text, whitespace, tool descriptions, schemas, and array ordering.
Use the released binary supplied by `CONTRACT_EXECUTOR_BIN` when available; otherwise, compare two runs of the current binary to check determinism.
GitOrigin-RevId: 1a69fb3abb6fc3df90a095e01bcf0d5de1818fac
## What changed
- Add Cargo and Bazel build matrices for Linux, macOS, and Windows, carrying both through signing, packaging, and artifact verification.
- Publish Bazel binaries, packages, and symbols with a `-bazel` suffix while preserving Cargo artifact names. Keep Python runtime wheels and the Windows installer on the Cargo path.
- Use `--config=release` for native voice builds and Windows voice tests, set the macOS voice build minimum to 14.0, and increase the Windows binary build timeout to 120 minutes while both build paths coexist.
GitOrigin-RevId: 77bcdd7b2a573d0ae2a4c3392e0708445b386f23
## What changed
Add a `build-system` input to `build-codex-packages`, defaulting to `cargo`, and extract binary builds into dedicated Cargo and Bazel actions. The Bazel path stages binaries and symbols for the shared CLI and app-server packaging and smoke-test steps, with support for `release` and `debug` build modes.
Resolve the package source root before invoking nested actions, and use Bash to export the Bazel repository cache path.
GitOrigin-RevId: ebd5e7c84451733419838da5956dc090cd09b19a
## What changed
- Add `runtime_package` targets for combined, primary, app-server, and Windows helper bundles, plus per-binary release archives.
- Apply release settings automatically and retain unstripped binaries with macOS dSYM or Windows PDB symbols. Require platform-specific symbols and validate that dSYM bundles contain nonempty DWARF data.
- Support a `debug` build mode for faster package smoke builds and configure platform-specific release settings, including native Windows MSVC toolchains.
- Add a composite action that refreshes Cargo workspace metadata, builds the selected archive, and extracts writable files for existing signing and packaging steps.
GitOrigin-RevId: 21109875cde228aaef67b2ba9812b3e4854aee84
## Why
Cargo and Bazel embed different PDB filenames in the Windows code-mode host executable. The package smoke test must support both names while verifying that the debug symbols match the packaged executable.
## What changed
- Keep the archived PDB and copy it to `codex_code_mode_host.pdb`, allowing `dumpbin /PDBPATH` to resolve either name. Accept either path in the assertion.
- Set `sandbox_workspace_write.writable_roots = []` explicitly in the smoke-test configuration.
GitOrigin-RevId: fc2610f580dad49e38848582bc63f1f829cb766d
## Why
Bazel release builds need Cargo-compatible Rust and native build-script settings. Platform-specific issues also include Windows command-line limits, MSVC runtime conflicts with V8's allocator, and a missing V8 `__clear_cache` symbol on ARM64 musl.
## What changed
- Add `--config=release` settings for thin LTO, four target codegen units, and disabled debug assertions and overflow checks, with separate settings for build tools.
- Add opt-in Cargo release profile support for build-script optimization and debug information, preserving explicit C/C++ flags. Give optimized Bubblewrap builds `-O3`, debug symbols, and enabled native assertions.
- Statically link the MSVC CRT for Rust and C/C++ target and host dependencies, and disable SQLite intrinsics on x64 MSVC to avoid startup crashes on older CPUs.
- Let the Rust process wrapper read its arguments from a multiline parameter file to avoid Windows command-line limits.
- Select the ARM64 musl V8 archive containing compiler-rt builtins and raise the Rust recursion limit to `256` in the app-server client, exec, and TUI entry points for release compilation.
GitOrigin-RevId: 8f61e62b8735c36209ee92e04a0e0339a70badc5
## What changed
Expose resolved Cargo package names in `DEP_DATA`, set `CARGO_PKG_NAME` for Rust compilation, and pass the package name to build scripts. Propagate `rustc_env` to generated binary targets so they receive the same package metadata as libraries.
## Testing
Strengthen the packaged CLI smoke test to require `--version` to print exactly `codex-cli <version>`, using the workspace package version from `codex-rs/Cargo.toml`.
GitOrigin-RevId: 274b741067af76313358f44c1bd9b2521938fa9c
## What changed
Wire existing sandbox integrity checks into local command preparation, exec-server process preparation, and sandboxed filesystem helper and file-open operations. Make execution request preparation asynchronous so callers can await the checks.
The checks remain observational: failures and timeouts do not prevent command execution.
## Testing
Add regression tests that launch a real command after checker preparation fails or exceeds its timeout, verifying successful output and exit status.
GitOrigin-RevId: a82399f8aeb8b08f9965e6121b4c7f460552af3f
## What changed
Export `run_integrity_checks` from `exec-server` to check whether the effective filesystem policy permits writing containment dependencies on Linux, macOS, and Windows. Run preparation and checks on a blocking worker, limit waiting to five seconds, and keep results observational without affecting execution.
Skip mismatched sandbox backends, full-disk-write policies, and `EscalatedSandboxWithRestrictions` overrides. Continue checking ordinary configured policies with root write access and deny restrictions.
Record check outcomes, preparation time, and total duration with bounded metric tags that omit filesystem paths.
## Testing
Add coverage for findings, clean results, missing dependencies, preparation errors, eligibility rules, and timeouts. Verify that timed-out workers emit no late results and that metrics contain no filesystem paths.
GitOrigin-RevId: a234f4a2f629f9bb090da622cea352c99456cb00
## What changed
Enable the exec server's `sandbox_integrity` module on macOS and select the Seatbelt backend. Inventory the Codex executable and the system Seatbelt executable as critical dependencies.
Preserve the filesystem sandbox policy unchanged: Seatbelt handles deny globs as native patterns, so no snapshot scan is needed.
GitOrigin-RevId: 78299dd61e168f5ce34454c8b3bb887e67c5f342
## What changed
Add Linux dependency discovery and policy preparation to `exec-server`'s sandbox integrity module. Inventory bundled and system `bwrap` candidates and the deny-glob scanner using the launcher's location and the command's `PATH` and working directory.
Resolve `:tmpdir` and tilde-prefixed deny globs using the command's `TMPDIR` and `HOME`, with account home-directory fallback. Reuse Linux sandbox helpers to expand deny globs in the command's explicit environment.
## Testing
Add Linux tests covering symlinked launchers, relative and empty `PATH` entries, and empty, relative, and tilde-prefixed `TMPDIR` values alongside home-relative deny globs.
GitOrigin-RevId: fe404fa4be77ece677b22d52d77a7234dbf0cffe
## What changed
Mark `code_mode_interrupt` as stable and enable it by default, so interrupting a turn terminates active code mode cells and nested tool calls.
## Testing
Update the existing interruption test to use the feature default instead of explicitly enabling `CodeModeInterrupt`. It verifies that active cells and nested tools are aborted while stored session values remain available.
GitOrigin-RevId: 17be94f208713bc232e2292feb48261938254db3
## What changed
Add Windows MXC backend helpers to inventory the Codex executable, sandbox
launcher, and available `rg` scanner when deny globs are configured. Prepare
filesystem policies for inspection by reusing MXC temporary-directory and volume
resolution and replacing deny globs with concrete path snapshots.
Allow Windows deny-glob resolution to run its scanner with an explicit command
environment and working directory, including an empty environment. The integrity
helpers are not yet invoked by an execution runner.
## Testing
Add a backend test verifying that deny-glob snapshots replace the original
patterns, including empty snapshots, and affect `FileContentsChecker` results.
GitOrigin-RevId: 409c527663d230d76d65be3bf0a37959f694d77e
## What changed
Export `FileContentsChecker` and structured integrity findings from `codex-rs/sandboxing` to identify existing containment dependency files whose contents are writable under a prepared filesystem policy. Findings include the requested target, its resolved path, and the write roots that permit modification.
Resolve symlinks in targets, write roots, and read-only carveouts, and respect protected metadata paths and deny globs matching resolved contents. Missing targets produce no finding; non-file targets return an error. Callers remain responsible for dependency inventory, reporting, enforcement, and handling full-disk write access.
## Testing
Add unit tests covering write grants, read-only and denied carveouts, overlapping grants, deny globs, symlink resolution, protected metadata, and missing targets.
GitOrigin-RevId: 4f52faed822a1bbb4ed33a9975af0718a5f85662
## Why
Prepared MCP calls cloned `ToolInfo` already stored in the binding's model-visible catalog, duplicating tool metadata.
## What changed
Store the binding catalog in an `Arc<[ToolInfo]>` and let prepared calls reference its entries by index. Keep separately owned metadata for tools hidden from the model and calls prepared outside the binding catalog.
## Testing
Extend the binding test to assert that advertised and prepared tool metadata share the same address, while preserving ready-client catalog selection and hidden-tool behavior when tool names collide.
GitOrigin-RevId: 24b92f7e1dbb421c9ebce875b9b1024f7d697c5e
## Why
Opening active EXE/DLL files with `MAXIMUM_ALLOWED` can request access that causes sharing violations during sandbox runtime ACL repair.
## What changed
Restrict `MAXIMUM_ALLOWED` opens to directories that need to suppress child ACL propagation. For files, request `READ_CONTROL | WRITE_DAC` only when an ACL update is needed.
Preserve the non-inheriting grant behavior from https://github.com/openai/codex/pull/49690, including existing permissions, deny ACEs, and null DACLs.
## Testing
Extend the Windows runtime repair regression test to hold `node.exe` open with `FILE_SHARE_READ` throughout repair and revalidation, while checking read/execute access and preserved denials.
GitOrigin-RevId: 2e087b51adc0221d0eda061fa0a34d2e98409662
## What changed
- Replace the separate MXC crates with the pinned `mxc-sdk` 1.0.0 dependency and update Cargo and Bazel lockfiles.
- Use the cached PSEC API-set check for availability and the SDK's native deny-path capability check before launch. Native creation and request-specific capabilities are validated at launch.
- Map empty environments to `None` to retain Windows user-profile defaults, while keeping nonempty environments explicit. Document the SDK's `SystemRoot` and `LOCALAPPDATA` requirements.
- Configure Bazel's LLVM resource compiler for Windows GNU builds, document Cargo's `RC_PATH` requirement, and add `libproc` and `libsandbox` to the macOS SDK libraries.
## Testing
Update the request-building test to verify that nonempty environments remain explicit and empty environments become `None`.
GitOrigin-RevId: f3ccbb92ceaa71f16c5d6cb185a7602a5bb8da53
## What changed
Enable `instant_interrupt` by default so new user input can preempt responses and yield foreground code-mode observations. Keep the feature marked as under development and update feature-policy tests to allow this exception.
Explicitly disable instant interrupts in core, TUI, and Python SDK tests that depend on responses completing before steering or processing subsequent input.
GitOrigin-RevId: a8cab2d6c445bfdbd10b0b2abcf7893d32ee8595
## Why
User-verification cancellations previously discarded failure reasons, leaving MCP servers unable to distinguish user cancellation from unavailable approval, interruption, or invalid proof.
## What changed
- Carry a bounded `openai/userVerificationReason` value in response `_meta` for verification failures, declines, and cancellations across the TUI, app server, and MCP client.
- Preserve recognized reasons and classify invalid responses, missing or invalid proofs, response errors, closed response channels, interruptions, and unavailable approval.
- Discard unknown reasons and unrelated metadata. Keep proof material out of decline and cancellation responses, and keep display messages and raw error diagnostics out of response metadata.
## Testing
Add and update tests for typed failure propagation, metadata filtering, invalid proofs, response-channel failures, interrupted requests, and unavailable approval, including TUI RPC and native MCP response coverage.
GitOrigin-RevId: 6b7f855ce8eb13e759b5b86d0dc2b1afdfcff7b3
Remove repeated `selected_capability_roots` initializers from two
`TurnEnvironmentSelection` fixtures so the registry test can compile.
GitOrigin-RevId: bef3fba18dd786b80610703a37d6d3243cf33401
## What changed
Add the `ultrafast` service tier to bundled catalogs for `openai.gpt-6.1-sol` on Bedrock Mantle and `global.openai.gpt-6.1-sol` and `us.openai.gpt-6.1-sol` on Bedrock Runtime. This exposes `/ultrafast` for these models while keeping tier selection opt-in.
## Testing
Extend catalog, app-server, core request, and TUI tests to cover GPT-6.1 Sol tier discovery and selection across all three model IDs, including toggling back to the default tier and honoring custom catalog commands.
GitOrigin-RevId: b5bbde8615b73a1d73eb16db7952b10d044b9fa6
## What changed
Move `SandboxOverride` into the shared protocol and carry the controller's selection through tool attempts, execution requests, and exec-server process and filesystem sandbox preparation. Include it as `sandboxOverride` in filesystem sandbox contexts for observation without granting broader permissions or altering sandbox commands.
Default missing values to `NoOverride` and omit that value when serializing to preserve compatibility with existing requests.
## Testing
Extend tests to cover override propagation, wire round-trips for all three variants, and deserialization of requests without `sandboxOverride`.
GitOrigin-RevId: 2f438cf4aef1134e3149959d14aa731682168ae5
## Why
Tokio runtime tracing can cause SQLite log writes to enqueue more writes and exporter activity to generate further OTLP exports.
## What changed
- Exclude `tokio` and `runtime` spans from OTLP export alongside `h2` spans.
- Limit `tokio::` and `runtime::` targets to `INFO` in the default log filter, and reject their `TRACE` events directly in the SQLite sink even without an outer filter.
- Box and pin the session-loop future before spawning it.
- Reorder tracing and Tokio test attributes, restrict the skills concurrency test's subscriber to the catalog-refresh span, and use the default log filter in the SQLite formatter comparison test.
GitOrigin-RevId: f545013a2469088d7f9890c1f46bb93eb5446d2d
## What changed
Update the bundled `openai-docs` references to cover GPT-6 Astra, GPT-6.1 Sol, GPT-6 Sol, and GPT-6 Luna with model-specific reasoning, tool-calling, parameter, and data residency guidance.
Require verification of the exact target's availability and compatibility, preserve explicitly requested models, and use live guidance for model selection. Replace fixed role mappings with verified targets and clarify when to load migration and prompting fallbacks.
GitOrigin-RevId: 59067d0fc97af36d2e5b6508c45488181c6a4ace
## What changed
Consume enabled tool definitions and borrow their metadata when installing `tools` and `ALL_TOOLS`, avoiding copies of the tool catalog. Retain only tool names and kinds in runtime callback state, preserving each cell's original callback indices for its lifetime.
GitOrigin-RevId: 62eaf62abce6de1a0cd5cdb3332fbed754a23993
## What changed
Remove the duplicate tool metadata stored in `CachedMcpHandler` and compare incoming metadata directly with `McpHandler::tool_info()`.
Preserve complete agent plugin namespace descriptions in the handler, applying the existing 1,000-byte limit when building tool specs and search metadata. Truncation continues to respect UTF-8 character boundaries.
## Testing
Extend the agent plugin namespace description test to verify that the handler retains the full description while search output remains bounded.
GitOrigin-RevId: d0a9d5f6796143315235e658e77e059657e85f13
## Why
Guardian cannot capture sender instructions from another host when the sender thread is absent from the receiver's local runtime.
## What changed
Fall back to the authenticated thread store to reconstruct sender history without resuming the sender. Respect compaction and rollback, and label persisted evidence to indicate that newer unpersisted messages may be missing.
Limit storage reads to five seconds and capture sender context before acquiring the active-turn lock. Bind the captured evidence to the turn that accepts the delivery, allowing an existing turn to finish while the read is pending.
## Testing
Add cross-host scenarios for legacy and paginated history that verify sender evidence reaches only Guardian and excludes rolled-back permissions. Add a gated storage-read test that verifies turn completion remains unblocked and evidence is bound to the newly accepted turn.
GitOrigin-RevId: fe896f4e82fe3e32017fe4884846f3fa90a87949
Background discovery can cache a successful response before the test mounts
its unauthorized-response mock, bypassing the intended token refresh.
Mount the `401` mock before invalidating the route cached during login in
`external_auth_refreshes_on_unauthorized`.
GitOrigin-RevId: 8c280ca7287dab09230d534a44ca80d0835d2ef2
## What changed
Apply `code_mode_tool_description_first` when preparing nested tool definitions for Code Mode execution and tool search. When enabled, place each tool's description before its namespace description; otherwise, preserve namespace-first ordering.
Reuse cached MCP definitions only when both the input schema budget and description-order setting match.
## Testing
Extend deferred app tool integration tests to cover both description orders with and without ranked search, including consistency between search results and `ALL_TOOLS`. Extend the MCP cache test to reject reuse when the description-order setting changes.
GitOrigin-RevId: 1e3f84d2d95c200aef21ad710d367274b2169b4b
## What changed
Register `code_mode_tool_description_first` as an under-development feature, disabled by default, for placing tool descriptions before namespace descriptions in Code Mode. Add the boolean option to the configuration schema.
GitOrigin-RevId: 5d7e2f7cef87a040f9d96b0d97c2697880c12c17
Replace fixed 500 ms sleeps in `helper_attempt_is_shared_after_cancellation` with polling of the helper completion marker every 10 ms, bounded by a five-second timeout.
This lets the test observe completion independently of the cancelled headers or refresh request without assuming the helper finishes within 500 ms. Preserve the assertions that subsequent calls reuse the same helper attempt.
GitOrigin-RevId: 2612679aff756306ea3e05ef7bb9b4db02633fd5
## Why
Authorization updates during a pending Guardian approval can invalidate its decision. Retries need the updated guidance without inheriting the invalidated review or losing earlier valid context.
## What changed
- Validate authorization while the reviewer is reserved, before publishing its history checkpoint.
- Roll back stale attempts to the last committed review, preserving earlier valid reviews across repeated invalidations.
- Pin the issuing action's repository instruction snapshot for reviewers and retries, avoiding fresh instruction discovery through disconnected executors.
- Treat stale authorization as a request for a new review rather than a failed decision.
## Testing
Add regression coverage for repeated approval invalidation, retention of earlier valid context, exclusion of stale decisions, and execution of the pending action exactly once. Extend the disconnected-executor test to verify that retries retain repository instructions and use updated authorization.
GitOrigin-RevId: 0bff6cc551fee1f0905082eb97ccdecaa8628867
## Why
Elevated Windows sandbox tests share machine-wide accounts. Running them in the sharded core suite can consume test deadlines while shards wait for the account lock.
## What changed
Move the Windows sandbox tests into the Windows-only `windows_sandbox` integration-test binary. Update the nextest account-sharing group to select the entire binary instead of individual test names, so tests queue before their timeouts start. Keep the existing guard for coordination with other test binaries.
GitOrigin-RevId: 613925c9398b5acc8440fa34c658680f31f65c8b
jif