## Why
Selected environments can have different filesystem and network permissions, but context previously described only the primary environment's rules.
## What changed
- Add the disabled-by-default `per_environment_context` feature.
- Group filesystem and network access under each environment ID, including when only one environment is selected. Label shared network requirements separately.
- Scope permission instructions and incremental updates to each environment. Withdraw stale descriptions and use labeled thread defaults when no environment is ready.
- Track approved command prefixes separately so new approvals do not require repeating unchanged permission instructions.
## Testing
Extend rendering and permission snapshots for scoped context, removed scopes, thread defaults, and format transitions. Update the active-turn scenario to cover two environments with different permissions, changing only the second environment's workspace and permissions and restoring its defaults on the next turn.
GitOrigin-RevId: c948089c12da7b15eee378d8c5a23a233d24502b
## Why
Opening another Cloud task can fail while loading its history. Keep the current chat, draft, and reply stream intact until the replacement is ready.
## What changed
- Prepare Cloud resumes with a scoped history handle and commit the attachment only after initial history hydration succeeds.
- Discard abandoned or failed preparations, reuse healthy existing attachments, and preserve buffered events through the handoff.
- Route Command Center task selections through the owning backend, including tasks found only in history search.
## Testing
Add regression coverage for failed history loading preserving the chat and draft, prepared stream handoffs and cancellation, backend routing, and history requests completing while a large reply stream remains unread.
GitOrigin-RevId: 67aab50bad4e9ce9216716da459fd5447f133ae1
## Why
Parsing `git remote -v` can mistake partial clone filter text for remote entries. Large remote URLs can also push turn metadata beyond the Responses API's 8,096-character limit.
## What changed
- Read fetch URLs from NUL-delimited Git configuration, sanitize credentials, and let Git resolve `insteadOf` rewrites and empty URL resets without contacting remotes.
- Resolve ambiguous URLs with bounded concurrency and a shared deadline, and expose an observer that publishes verified URLs as they become available.
- When turn metadata exceeds the limit, fit complete remote URLs into the remaining budget while preserving other metadata. Prioritize `origin`, then shorter entries; omit URLs rather than truncate repository identities. Apply this to both client metadata and compatibility headers.
## Testing
Add regression coverage for partial clone filter injection, URL rewrites and resets, malformed and non-UTF-8 configuration, `GIT_CONFIG` overrides, progressive updates, and long remote URLs. Add metadata tests for the exact size boundary, oversized remote omission, ASCII serialization, and preservation of other fields.
GitOrigin-RevId: 522ffe291db6113ca9856fc98309609c8abe4ac0
## What changed
- Show an archived-thread notice and freeze input while preserving the cached transcript, drafts, pending steers, and question answers.
- Allow `U` to unarchive and resume the displayed thread, and automatically resume it when another client unarchives it.
- Preserve archived state across reconnects and thread selection, and retain drafts when recovery fails or encounters a writer conflict.
- Dismiss transient composer searches and suppress automatic submissions when entering a read-only view.
## Testing
Add regression tests and notice snapshots covering archive recovery, external unarchiving, writer conflicts, reconnects, input preservation, and agent navigation.
GitOrigin-RevId: 695c19790b87df83e51095b400f605e37b309fc1
## What changed
Handle `Ctrl+C` while preparing a Cloud session and before adopting its thread. Clear buffered draft input first; when no draft or modal handles cancellation, request shutdown and abandon the pending switch.
Cancel abandoned Cloud thread-start requests so they cannot replace the active attachment or block subsequent worker commands. Skip queued starts whose caller has already gone away without disturbing existing recovery.
## Testing
Add regression tests for quitting before thread adoption with pending and completed operations, clearing buffered draft input before quitting, and unblocking the Cloud worker after abandoning regular and project thread starts.
GitOrigin-RevId: 11e8cab13f00f4910a382094d5d857faf72a45bc
## What changed
Add experimental `thread/realtime/list` reads independent of turn pagination or a live runtime. Support session, observation-time, and event-ID filters, with ordering by observation time or committed position.
Keep cursor pagination within a fixed snapshot and expose positions for catching up on events committed later. Return `unsupported`, `pending`, or `ready` coverage so clients can distinguish unavailable history from events awaiting indexing. Limit fork reads to the child's own realtime history.
## Testing
Add SQLite tests for snapshot stability, late-event catch-up, cursor validation, and coverage tracking. Extend app-server tests to cover filtering, exact event lookup, and fork isolation.
GitOrigin-RevId: 8158df53f10d948ede4911654aa8adbc7297b258
## What changed
- Record voice transcripts as `frame` items with a `voice_transcript` channel for eligible threads, while retaining legacy transcript support and the existing app-server live and mixed timeline representation.
- Assign first-observed timestamps that never move backward, retain them through completion, and restore the clock floor from history and compaction checkpoints.
- Flush realtime records before completion notifications, including file and initial directory durability barriers for local rollouts.
- Generate a distinct default session ID for each new call, use the call ID when attaching to an existing call, and derive opening record IDs from session IDs.
- Add protocol types for turn-input acceptance and session-end input receipts, excluding those receipts from live notifications and mixed timelines. Update generated schemas and SDK types.
## Testing
Add coverage for frame serialization and required voice payloads, clock rollback and checkpoint restoration, durability barrier failures and retries, per-call session IDs, and persisted transcript availability immediately after completion.
GitOrigin-RevId: 3f6632b517d563861aee085b723475b8945c391c
Export `serialized_json_bytes` from `codex-utils-string` and update core callers to use the shared helper. Preserve byte counting without retaining the serialized output.
GitOrigin-RevId: 9c75b05592d3171b9a0d54517f8f3a4281fde987
## What changed
- Consume the optional delivery handle directly when recording inter-agent messages.
- Capture compaction resume metadata before constructing the `CompactedItem`.
- Move the existing inter-agent message rollout and resume test into `mail_publication_tests.rs`, preserving its assertions for turn IDs, timestamps, persisted metadata, and restored history.
GitOrigin-RevId: 761a837922377d5a72266d775622211e43fa87d3
## What changed
Add the token-budget setting `context_window_as_tool_output`, defaulting to `false`. When enabled, render agent identity, context window IDs, and associated hints as an `agent.thread_hint` tool output. Use the same format for agent identity updates in forked threads.
Preserve this setting when applying model token-budget defaults without treating it as an explicit budget override.
## Testing
Update fork scenario snapshots to cover tool output rendering, including a child agent's window hint after its inherited parent context and a prediction fork above the compaction threshold.
GitOrigin-RevId: e1a7089935bd0aed44ffd15f0ae3ec41a2607218
## Why
Hosts need to refresh cloud plugin and skill catalogs without starting a turn or waiting for step preparation.
## What changed
- Add `CodexThread::refresh_cloud_plugins()` and a turn-independent extension callback that bypass cached catalog reuse and failure cooldowns.
- Run catalog contributors concurrently while serializing publication with step snapshot capture. Invalidate MCP resource caches before explicit discovery and schedule MCP reconciliation afterward.
- Accept complete and partial catalogs, report discovery errors, and keep failed or cancelled refreshes retryable.
- Allow hosts to gate cloud plugin discovery through effective configuration.
## Testing
Add coverage for discovery before turn admission, catalog replacement and reuse, immediate retry after failure, concurrent contributors, and cancellation-safe publication and invalidation.
GitOrigin-RevId: 83e847fcab6562581af2c9e831b1d2a310f2b270
## Why
Clients reconciling saved thread IDs need to retrieve matching summaries within the current list filters, including threads beyond the first page of history.
## What changed
- Add `includedThreadIds` with up to 100 entries, applied before pagination alongside existing filters. Exclusions take precedence, and results retain the requested list sort.
- Treat omitted or null inclusions as unrestricted and an empty array as matching nothing. Reject invalid IDs and oversized arrays without truncating them.
- Use indexed metadata and primary-key lookups for local inclusion queries, without scanning rollouts for repairs. IDs absent from the index do not match.
- Update protocol schemas, generated bindings, and documentation, including guidance to verify server support before treating missing saved IDs as removals.
## Testing
Add coverage for saved IDs across project moves and archiving, pagination, exclusions, validation limits, and combinations with search, account, and relationship filters. Add a SQLite query-plan test for primary-key lookups across scopes.
GitOrigin-RevId: 90b02a12aee5716f872a9d5d6168d23cf86c6333
## What changed
- Add hidden app-server options `--plugin-mcp-launch-cwd` and `--mcp-launch-cwd` for host-supplied local stdio server launch directories without writing them to shared configuration.
- Apply these directories when both `mcp_shared_repl_cwd` and `mcp_connection_sharing` are enabled. For configured servers, require a matching executable and preserve any explicit working directory.
- Attach thread-specific sandbox state to direct MCP tool calls for servers advertising support, stripping caller-supplied sandbox and launcher metadata first.
## Testing
Add regression tests for launch-directory feature toggling and executable matching, and for direct MCP calls using each thread's sandbox working directory despite forged caller metadata.
GitOrigin-RevId: d7f78ea92163ec0ee9311f68ef17e87a6694b13b
## What changed
- Save default provider selections through `modelProvider/default/set` instead of a generic configuration write.
- Use provider display names in save notices, falling back to the provider ID when the name is blank. Replace the restart hint with “New chats now use {name}.”
- Prompt users to update the connected app server when it does not support the default provider RPC.
## Testing
Update provider tests and snapshots to verify the dedicated RPC, display-name confirmation, and upgrade guidance. Check that only ambiguous write failures invalidate the model catalog.
GitOrigin-RevId: cd383a8b85b5d497e7707691cc0b994110716a09
## Why
Bundled `turn_ended` hooks can start an unused REPL server solely to clean it up, even though its deferred startup means there is no process to clean up.
## What changed
Allow bundled cleanup calls for `node_repl` and `cua_repl` to return an empty successful result when startup has never been requested. Limit this behavior to configured, unshared local stdio connections using the legacy MCP protocol. Other calls continue to wait for server startup.
## Testing
Add coverage for the connection eligibility checks and extend subagent hook tests to verify that bundled cleanup leaves unused REPL servers dormant while ordinary hooks can still start cached tools hidden from the model.
GitOrigin-RevId: 0a07772fccd670c53348ff7a702b4bee353e263c
## Why
Interrupting a turn while a tool awaits approval can leave its rollout trace execution marked as running without an end timestamp.
## What changed
Record an `Aborted` end event when a tool dispatch trace is dropped before producing a result. Make completion and failure methods consume the trace handle so each dispatch is closed once.
## Testing
Add coverage for dropping a pending dispatch and for interrupting a turn with a pending command approval, verifying that replay reports an aborted execution with an end timestamp.
GitOrigin-RevId: 63cf68312fcbff8c6b85a01a7713cf4460c9d795
## What changed
- Record acquisition counts, wait durations, and hold durations for file and secrets store locks, tagged by store, lock mode, operation, and originating client. Acquisition metrics also report outcome and contention.
- Preserve the resolved credential store's originating client across storage operations and lock release, and exclude nonblocking probes from lock metrics.
- Add `record_global_duration` for standalone durations with the existing buffering limits and metrics opt-out behavior.
## Testing
Extend tests to verify lock metrics for shared and exclusive access, contention, timeouts, probe exclusion, and originating-client attribution. Add coverage for standalone duration buffering, validation, and opt-out behavior.
GitOrigin-RevId: 96de8bd195477d61bc8cd966c5fbf72ae7156273
## Why
Installing a plugin without connector tools must still refresh a cached cloud skill catalog so its skills are visible to the next inference.
## What changed
- Rely on step preparation for cloud plugin and skill discovery, removing their turn-start callbacks and the `requires_mcp_runtime` lifecycle hook.
- Request an MCP runtime refresh after every completed plugin install, including skills-only installs.
## Testing
Add regression coverage for skills becoming visible immediately after a connector-free install. Update lifecycle tests to cover discovery after MCP reconciliation, prewarm skipping discovery, cancellation allowing subsequent preparation, and reuse of unchanged connections. Use deterministic DNS lookups in network proxy authorization tests.
GitOrigin-RevId: 76036bd29253fb8987e606c3c28411c689590fc4
## What changed
Require `x-portals-auth-mode: oauth` in CONNECT metadata when the TCP tunnel listener connects to a known Portals gateway. Reject missing or non-OAuth metadata before reading credentials.
Remove local tunnel JWT type and version checks and treat tokens as opaque bearer credentials. Drop the unused `base64` dependency from `codex-tcp-tunnel`.
## Testing
Replace JWT validation tests with coverage that rejects missing OAuth metadata and accepts OAuth metadata with an opaque access token.
GitOrigin-RevId: 746816f0227280524c019dd90df203b182934751
## What changed
Enable `incremental_tools_legacy` by default so both Amazon Bedrock providers publish tool declarations through `additional_tools` input items. Users can still opt out by setting `incremental_tools_legacy = false`.
## Testing
Update the incremental tool scenarios to cover the default behavior and explicit opt-out for both Bedrock providers. Adjust the Bedrock multi-agent test to verify collaboration tools in `additional_tools` declarations.
GitOrigin-RevId: 7a54aed24039d178f9b7d7f5a3f49fe4d588ffa7
## Why
Collapsing a tool group while reading its expanded details can leave the scroll anchor beyond the new bottom limit, leaving available transcript space unfilled.
## What changed
Clamp the reading position to the bottom limit during collapse layout and persist it after the final viewport height is known. Keep activity focus and reading mode intact, including when copy confirmation changes the composer layout.
## Testing
Add regression coverage for collapsing a scrolled tool group, preserving the resulting view across renders, and rendering a collapsed group with clipboard confirmation.
GitOrigin-RevId: f48271720f7b400736bc02b08b6eafefdb60ac63
## What changed
- Add configurable `pager.mark_markdown`, bound to the leader followed by `v`, to mark the table cell under the selection caret.
- Use arrows or `hjkl` to extend a rectangular cell selection, `o` to swap corners, and `y` to copy. Press `v` to select text within the active cell without including neighboring cells, including across wrapped lines.
- Show table-specific footer hints and route the marking chord in both the main transcript and transcript overlays.
## Testing
Add coverage for cell rectangles, header-only selections, empty cells, wrapped text, Unicode and escaped pipes, Markdown copying, search cancellation, mouse takeover, and chord routing with remapped find and leader keys.
GitOrigin-RevId: 81ed9e52092bba3c7ef064e95043d2c070df0f4c
## Why
Model lookups through the startup catalog can use the wrong provider's capabilities or instructions after a default provider switch or when a thread has its own catalog.
## What changed
- Resolve model metadata for sampling, prediction forks, and memory writes through the owning thread's catalog.
- Make the thread's models manager available to extensions before startup callbacks and use it for guardian sampler configuration.
- Import external sessions using the destination provider and originator's catalog, loading its offline cache only when no refreshed catalog is available.
## Testing
Add regression coverage for sampling after a default provider switch, parent-specific prediction fork capabilities, thread-scoped model lookups, and imported sessions retaining destination provider instructions and originator.
GitOrigin-RevId: c86081b9e55c5e2b42a7f082966485d7fb5139d4
## Why
A user-configured `model_providers.gcp.base_url` previously blocked GCP setup, requiring manual removal before configuring a project and location.
## What changed
Have `account/gcp/setup` clear the active user configuration’s `base_url` override after obtaining an access token, allowing the requested project and location to determine the Vertex AI endpoint. Continue rejecting configuration layers that would still supply an endpoint override or otherwise conflict with the request. Document this behavior.
## Testing
Update integration tests to cover clearing an existing override on success, preserving it when authentication fails, and rejecting a managed endpoint override.
GitOrigin-RevId: 26a725133d9069ad63dfb0bb06ddf3c5d1545cad
## Why
Pasted Windows drive paths were mapped unconditionally to `/mnt/<drive>`, even when that mount was unavailable or WSL used a different mapping.
## What changed
Use `/bin/wslpath -u` with a one-second deadline and require an absolute result. Fall back to `/mnt/<drive>` only when the helper is missing and `/proc/self/mountinfo` confirms the mount exists. Reject fallback paths that traverse above the drive root and return no path when conversion fails.
Share the bounded subprocess output helper with tmux probing.
## Testing
Update coverage for quoted and unquoted Windows paths with spaces. Add fallback tests for a mounted drive, a missing drive mount, and traversal above the drive root.
GitOrigin-RevId: f6a05045b2108722a686e9e5b766fc8cb233bea0
## What changed
Reject workspace routing to `gov.chatgpt.com` when the workspace backend is `NO_CONSTRAINT`, whether the backend comes from the required or effective base URL.
Return an invalid-request error from account reads with `reason: "governmentWorkspaceRequired"` and `action: "relogin"`, prompting users to sign in to a government workspace.
## Testing
Add routing tests covering required and effective government backend URLs, including hostname case and the default HTTPS port.
GitOrigin-RevId: a54b990d2b0dc716122124ee6924538aa06d30d2
## What changed
Add `account.rate_limits` to the statusline snapshot, including the `codex` limit's name, primary and secondary usage percentages, window lengths, and Unix reset timestamps. Emit an empty array when no Codex rate-limit windows are available, and exclude other limit IDs.
Preserve raw reset timestamps alongside the formatted display values.
## Testing
Extend serialization assertions to cover both rate-limit windows, a missing reset timestamp, exclusion of other limit IDs, and the empty-array default.
GitOrigin-RevId: f775c281a17ea2b72cbca810db397f00f16ea5e9
## What changed
Include the cached workspace headline as `account.workspace.headline` in the structured status-line snapshot. Serialize `account` as an empty object when no headline is available.
## Testing
Extend status-line tests to assert headline serialization and the empty `account` object.
GitOrigin-RevId: 50a923ff3f8bc2fdb0bab3487547979e6d837980
## Why
Workspace headline request counters restart when the chat widget is replaced, allowing a response for the previous widget to match a new pending request. Archived headlines can also be selected for the status line.
## What changed
- Use UUIDs for workspace headline requests and reject refresh events and responses that do not match the current widget's pending request.
- Skip archived messages when selecting the first non-empty workspace headline.
## Testing
Add a regression test verifying that a replacement widget rejects the previous widget's response while retaining its own pending request. Extend headline selection coverage to include an archived headline before the active one.
GitOrigin-RevId: 44b98ab8c6cb70b7cf8e8b9341f27c99c1e1490a
## Why
A replacement chat widget can receive a previous widget's usage result for the same thread. Statusline state also lacks the estimated costs available in the built-in status line.
## What changed
- Add optional `thread.usage.cost.total_cost_usd` and `total_credits` fields, using the built-in status line's plan-specific values. Convert micro-units to ordinary units and omit unavailable or negative values.
- Use UUIDs for thread usage requests and verify that each request is still pending before fetching usage or accepting its result.
## Testing
Add regression coverage for rejecting a previous widget's usage result and assertions for serialized costs across supported enterprise plans.
GitOrigin-RevId: 91c3f7cead0249b673979d17cc108ceae1088df2
## What changed
Add `thread.usage.context` with optional `context_window_size`, `used_tokens`, and `used_percentage` fields. Use the latest token report for context usage and the built-in footer's window size and percentage calculations. Omit unavailable fields, including the percentage when the context window is unknown.
## Testing
Extend statusline state tests to cover missing usage, unknown context windows, and footer-consistent percentages, with context usage distinct from cumulative token totals.
GitOrigin-RevId: 699b65f6c047e76fcc7d1ba729eebd19a19e4bcd
## What changed
Add `thread.usage.total` to the provider-facing statusline snapshot with total input, cache-read input, cache-write input, other input, and output token counts. Preserve cache-write counts when converting app-server token reports for the TUI.
Omit totals when usage is unavailable, the breakdown is invalid, or the report represents a synthetic context fill. Keep measured zero totals.
## Testing
Add coverage for the reported token breakdown, cache counts exceeding total input, synthetic context fills, and measured zero usage.
GitOrigin-RevId: 6c506af30d6e51a49a780a0316304ef9c067fe43
## Why
The primary executor's working directory can differ from the app-server's. Displaying the app-server directory can misidentify the workspace, and abbreviating a remote path using the TUI's home directory can be misleading.
## What changed
- Carry the primary environment's working directory through thread initialization, restoration, and settings updates.
- Use it for the status line and terminal title's current-directory item, and expose it as `thread.workspace.cwd` in the statusline state.
- Preserve the known environment directory when settings omit environments; fall back to the app-server directory when the environment list is empty.
- Apply home-directory abbreviation only to server-local workspaces on local connections.
## Testing
Add regression coverage for remote executor paths, omitted and empty environment settings, local-only directory abbreviation, and workspace state for inactive threads. Update the resumed-thread snapshot to display the executor directory.
GitOrigin-RevId: 9f3bcad186e07f942ea00d1f4233cf09f022571f
## What changed
Add a serializable `StatuslineState` containing app and status-line configuration, thread identity, agent state, model settings, approvals, and permissions. Reuse the displayed status line's run-state and profile logic, and serialize status-line items with their canonical configuration IDs.
Omit the snapshot for read-only history or when no thread is attached. Omit service-tier, approval, and permission fields until thread settings are confirmed. Use an inferred child thread's reported model and reasoning effort without inheriting the parent's collaboration mode.
## Testing
Add coverage for serialized settings and canonical item IDs, inferred child-thread values, settings confirmation, and snapshot availability before and after interactive resume.
GitOrigin-RevId: 512bdff9b92d886a7764f16955206109f56437d3
## What changed
- Point `Apply for Daybreak` to `https://chatgpt.com/admin/status-and-access`.
- Point the Astra notice’s `Learn more` link to the Daybreak overview’s model-specific reduced-refusals section.
- Update notice snapshots to reflect the new URLs and line wrapping.
GitOrigin-RevId: 14068e8d6e56ec1a3bf3a0f896b5c36204a9eff8
## Why
Encrypted MCP OAuth reads hold a shared file lock while accessing the keyring, blocking writers until the keyring lookup and decryption finish.
## What changed
- Add `LocalSecretsSnapshot` to capture ciphertext under the file lock, then release shared read locks before keyring access and decryption. Keep exclusive locks across conditional credential updates.
- Reuse the loaded passphrase when updating existing secrets, avoiding a second keyring lookup. Return an error when an existing encrypted file has no keyring passphrase instead of generating a replacement.
- Update login storage error fixtures to use directory reads that fail consistently across platforms.
## Testing
Add regression coverage for releasing read locks during keyring access, updating secrets with one keyring lookup, rejecting missing passphrases on cached reads, and reading captured snapshots after later writes.
GitOrigin-RevId: add8f60dba52f71c8f8bc10ae8b8ae2f3379ccac
## What changed
- Keep partial cloud skill and plugin catalogs, and catalogs with warnings, usable while retrying discovery with exponential backoff. Start retries after 5 seconds and cap the delay at 5 minutes; clear backoff after a complete, warning-free result.
- Replace previous catalog entries with each accepted result, including partial results, and clear cached cloud skill resources when publishing a replacement.
- Check catalog freshness across turns and steps using auth and resource identity. Auth or resource changes bypass retry cooldowns, including within the same turn.
## Testing
Add and update tests for retry delays and recovery, concurrent refreshes, auth and resource invalidation, partial catalog replacement, and cloud skill read-cache replacement.
GitOrigin-RevId: 0ce5a9d5596e8a73d7084abbbaeb4fb8cda84aa0
## Why
When an Apps `tools/list` response supplies connector names and descriptions in shared `openai/apps` metadata, tools need those fields restored to expose the correct namespaces and descriptions to the model.
## What changed
Match tools to shared connector metadata by `connector_id` on each response page and copy nonempty names and descriptions into tool metadata before conversion. Restrict this handling to Codex Apps; regular MCP servers use the standard tool listing path.
## Testing
Add a regression test with two tool pages that verifies both connectors' namespaces and descriptions appear in the model's tools state.
GitOrigin-RevId: d4c8b44007773ff65d3e366669ee5c705a480cb1
## What changed
Add `modelProvider/default/set` with a `providerId` parameter to persist the default provider for new threads and model lists. Return `ConfigWriteResponse`, reject unconfigured providers, and respect managed requirements, read-only configuration, and CLI overrides.
Reload the model catalog on its next read when the default changes effectively. Resolve explicit `model/list` provider selections against the current catalog configuration so clients can continue listing models for a retained provider after switching defaults.
Update the protocol schemas, generated TypeScript and Python types, and app-server documentation.
## Testing
Add coverage for switching defaults and switching back, rejecting unknown providers without changing the catalog, retaining explicit provider selections, reporting CLI overrides, and rejecting writes blocked by configuration restrictions.
GitOrigin-RevId: 3615835f58045d33a21b3c57d47932d6d1e3fb12
## What changed
- Remove `Config::legacy_sandbox_policy` and `Permissions::legacy_sandbox_policy`.
- Update core and TUI tests to use permission profiles and filesystem/network policies directly, with explicit conversion where legacy wire formats are required.
- Report the active sandbox label in app-server resume override mismatch diagnostics.
GitOrigin-RevId: cbc5417944e23404523e69dc5516d66d6bfafefe
## What changed
- Add the disabled-by-default `file_backed_tool_audio` feature to prepare fresh function and custom tool audio through the attachment store before persistence. Store returned file IDs in history and preserve them on replay without uploading again.
- Validate and budget mixed text and audio output before uploading retained clips, preserving audio token charges and producer limits. Resolve tool audio durations before continuation compaction checks.
- Keep inline audio on backend upload failures and use text placeholders for invalid or rejected clips. Replace unavailable tool audio files with placeholders in prompts while retaining the original history, so restored files can be used again.
- Treat file-backed tool audio as a competing source when attributing audio or unknown-file errors to user uploads.
## Testing
Add coverage for direct tool and Code Mode audio across follow-up turns, file expiration, restoration, and resume in both legacy and paginated history. Extend tests for truncation before upload, upload failure handling, bounded error placeholders, and error attribution.
GitOrigin-RevId: 66c1e7699c7d92f98c3a2d0f5cecbbd63147eb6c
## What changed
Add `release_id: Option<String>` to `PluginSourceLocation::Cloud` to carry the opaque release ID selected by the cloud catalog for a plugin declaration. Update catalog and discovery test fixtures to supply the new field, including a populated release ID in catalog reconciliation tests.
GitOrigin-RevId: 1d60e25bd5fb8efd84e6e825305ad68b847fc1ee
## Why
Managed network requirements support both legacy tables and `permissions.network`. Equivalent declarations in one source should be accepted, while older runtime clients still need the top-level network field.
## What changed
- Normalize `network_proxy` and `experimental_network` into `permissions.network` before merging requirements, preserving source attribution and explicit empty allowlist replacements.
- Accept legacy and nested declarations in one source when they describe the same policy, comparing domain and review selectors by their canonical identities. Continue rejecting mixed surfaces across sources.
- Populate the legacy output field for compatibility and preserve legacy selector text when both forms are supplied.
- Include contributing requirement sources in cloud bundle errors without exposing submitted TOML.
## Testing
Add coverage for equivalent and conflicting declarations, empty allowlist overrides, loader compatibility, and debug output. Add a proxy regression test verifying that a saved grant cannot bypass managed loopback restrictions.
GitOrigin-RevId: e0d2a600f5c7c6c07a665ccc0e18a72ff172fd6d
## Why
Compaction can drop active client context while deduplication prevents unchanged values from being sent again on subsequent turns.
## What changed
Track additional context by history item ID and restore active items when installing complete or prefix compaction results. Preserve their history order, refresh retained items with their original bounded payloads, and leave queued updates to arrive with their input.
## Testing
Add regression coverage for local compaction with message context and remote compaction with tool-output context. Verify that current context survives exactly once, stale values are absent, and restored context precedes the preserved user prompt.
GitOrigin-RevId: a3114f387c6a4ae1a2d1651993d0f7a101be7dd5
## Why
The bounded submission channel reserves all slots at session startup, including space for a full `Submission` in each slot.
## What changed
Send `Box<Submission>` through the channel so each slot reserves only pointer-sized payload storage, allocating full submissions as needed. Update submission producers, delegate forwarding, and test helpers to pass boxed submissions, and unbox them in the submission loop.
GitOrigin-RevId: d8d9c613683076d74fcb3e2f2cb6244c5857bca2
## What changed
Add `codex-windows-sandbox-service` to the Windows package build binary list and include its release files in the combined Bazel runtime archive.
GitOrigin-RevId: 3438aae09cc605303145ac220766a8e71ea284ff
## Why
Cached recommendations can keep offering a plugin after installation. Refreshing the shared catalog during step preparation can also leave the recommendation prompt and install handler with different candidates.
## What changed
- Check `tooling_changed_at` before reusing recommendations, with a one-second reuse window and a 250 ms deadline that includes authentication. Refresh the catalog when the marker changes, preserving cached recommendations on failure and retrying on a later poll.
- Scope recommendation and featured-plugin caches by product, backend, and account identity, and share concurrent recommendation refreshes.
- Use the same recommendation snapshot for a step's prompt and install handler, while allowing later steps to observe updated recommendations.
## Testing
Add coverage for marker changes, missing markers, refresh failures, concurrent and cancelled requests, and the authentication deadline. Extend integration tests to verify consistent step candidates and stop offering an installed plugin while preserving the original recommendation block in conversation history.
GitOrigin-RevId: 44fa6723a623d9604f0c768118bc6889d2d3b693
## Why
Cloud plugin discovery previously ran each turn even when authentication and Apps resources were unchanged.
## What changed
- Reuse complete, warning-free catalogs across turns, including empty catalogs, while authentication and the Apps resource cache key match.
- Retry partial catalogs and catalogs with warnings on subsequent turns, preserving failure backoff.
- Reject discovery results if authentication or Apps resources changed while discovery was in flight. Hosts must invalidate Apps resources when the remote plugin catalog changes.
## Testing
Extend lifecycle tests to cover populated and empty cache reuse, resource and auth invalidation during discovery, and reuse of the empty catalog after plugin revocation.
GitOrigin-RevId: f0f0f4fd5a83179d722ba3cb917deec7eef18458
## What changed
- Add `code_mode.heartbeat_interval_s` to configure heartbeats after inactivity on session-event and tool-call streams. The default value of `0` disables heartbeats.
- Pass the interval through session options and gRPC requests, preserving provider defaults when overriding it.
- Ignore heartbeat messages in the client without admitting tool callbacks, and reject tool-call heartbeats that carry invocation data.
## Testing
Add coverage for disabled heartbeats, repeated idle heartbeats and timer resets after traffic, callback handling, and configuration loading. Extend TCP integration tests to verify heartbeats on both streams and continued session operation after idle periods.
GitOrigin-RevId: bf0b6d3081b5541837d07f35931e0dd3e5472c3b
## What changed
Recognize `orbit_cca`, `orbit_cca_web`, `orbit_cca_desktop`, and
`orbit_cca_mobile` as separate model catalog originators, giving each its
own manager and disk cache.
## Testing
Extend catalog isolation coverage to the Orbit originators, including cache
reuse after manager recreation and avoiding redundant refreshes when the
catalog ETag is unchanged.
GitOrigin-RevId: 9507daae5c418212c9fed1be76df9aaa43c9d73f
sayan-oai