## What changed
Add experimental `thread/realtime/list` reads independent of turn pagination or a live runtime. Support session, observation-time, and event-ID filters, with ordering by observation time or committed position.
Keep cursor pagination within a fixed snapshot and expose positions for catching up on events committed later. Return `unsupported`, `pending`, or `ready` coverage so clients can distinguish unavailable history from events awaiting indexing. Limit fork reads to the child's own realtime history.
## Testing
Add SQLite tests for snapshot stability, late-event catch-up, cursor validation, and coverage tracking. Extend app-server tests to cover filtering, exact event lookup, and fork isolation.
GitOrigin-RevId: 8158df53f10d948ede4911654aa8adbc7297b258
## What changed
- Record voice transcripts as `frame` items with a `voice_transcript` channel for eligible threads, while retaining legacy transcript support and the existing app-server live and mixed timeline representation.
- Assign first-observed timestamps that never move backward, retain them through completion, and restore the clock floor from history and compaction checkpoints.
- Flush realtime records before completion notifications, including file and initial directory durability barriers for local rollouts.
- Generate a distinct default session ID for each new call, use the call ID when attaching to an existing call, and derive opening record IDs from session IDs.
- Add protocol types for turn-input acceptance and session-end input receipts, excluding those receipts from live notifications and mixed timelines. Update generated schemas and SDK types.
## Testing
Add coverage for frame serialization and required voice payloads, clock rollback and checkpoint restoration, durability barrier failures and retries, per-call session IDs, and persisted transcript availability immediately after completion.
GitOrigin-RevId: 3f6632b517d563861aee085b723475b8945c391c
## Why
Clients reconciling saved thread IDs need to retrieve matching summaries within the current list filters, including threads beyond the first page of history.
## What changed
- Add `includedThreadIds` with up to 100 entries, applied before pagination alongside existing filters. Exclusions take precedence, and results retain the requested list sort.
- Treat omitted or null inclusions as unrestricted and an empty array as matching nothing. Reject invalid IDs and oversized arrays without truncating them.
- Use indexed metadata and primary-key lookups for local inclusion queries, without scanning rollouts for repairs. IDs absent from the index do not match.
- Update protocol schemas, generated bindings, and documentation, including guidance to verify server support before treating missing saved IDs as removals.
## Testing
Add coverage for saved IDs across project moves and archiving, pagination, exclusions, validation limits, and combinations with search, account, and relationship filters. Add a SQLite query-plan test for primary-key lookups across scopes.
GitOrigin-RevId: 90b02a12aee5716f872a9d5d6168d23cf86c6333
## What changed
- Add hidden app-server options `--plugin-mcp-launch-cwd` and `--mcp-launch-cwd` for host-supplied local stdio server launch directories without writing them to shared configuration.
- Apply these directories when both `mcp_shared_repl_cwd` and `mcp_connection_sharing` are enabled. For configured servers, require a matching executable and preserve any explicit working directory.
- Attach thread-specific sandbox state to direct MCP tool calls for servers advertising support, stripping caller-supplied sandbox and launcher metadata first.
## Testing
Add regression tests for launch-directory feature toggling and executable matching, and for direct MCP calls using each thread's sandbox working directory despite forged caller metadata.
GitOrigin-RevId: d7f78ea92163ec0ee9311f68ef17e87a6694b13b
## Why
Interrupting a turn while a tool awaits approval can leave its rollout trace execution marked as running without an end timestamp.
## What changed
Record an `Aborted` end event when a tool dispatch trace is dropped before producing a result. Make completion and failure methods consume the trace handle so each dispatch is closed once.
## Testing
Add coverage for dropping a pending dispatch and for interrupting a turn with a pending command approval, verifying that replay reports an aborted execution with an end timestamp.
GitOrigin-RevId: 63cf68312fcbff8c6b85a01a7713cf4460c9d795
## Why
Model lookups through the startup catalog can use the wrong provider's capabilities or instructions after a default provider switch or when a thread has its own catalog.
## What changed
- Resolve model metadata for sampling, prediction forks, and memory writes through the owning thread's catalog.
- Make the thread's models manager available to extensions before startup callbacks and use it for guardian sampler configuration.
- Import external sessions using the destination provider and originator's catalog, loading its offline cache only when no refreshed catalog is available.
## Testing
Add regression coverage for sampling after a default provider switch, parent-specific prediction fork capabilities, thread-scoped model lookups, and imported sessions retaining destination provider instructions and originator.
GitOrigin-RevId: c86081b9e55c5e2b42a7f082966485d7fb5139d4
## Why
A user-configured `model_providers.gcp.base_url` previously blocked GCP setup, requiring manual removal before configuring a project and location.
## What changed
Have `account/gcp/setup` clear the active user configuration’s `base_url` override after obtaining an access token, allowing the requested project and location to determine the Vertex AI endpoint. Continue rejecting configuration layers that would still supply an endpoint override or otherwise conflict with the request. Document this behavior.
## Testing
Update integration tests to cover clearing an existing override on success, preserving it when authentication fails, and rejecting a managed endpoint override.
GitOrigin-RevId: 26a725133d9069ad63dfb0bb06ddf3c5d1545cad
## What changed
Reject workspace routing to `gov.chatgpt.com` when the workspace backend is `NO_CONSTRAINT`, whether the backend comes from the required or effective base URL.
Return an invalid-request error from account reads with `reason: "governmentWorkspaceRequired"` and `action: "relogin"`, prompting users to sign in to a government workspace.
## Testing
Add routing tests covering required and effective government backend URLs, including hostname case and the default HTTPS port.
GitOrigin-RevId: a54b990d2b0dc716122124ee6924538aa06d30d2
## What changed
Add `modelProvider/default/set` with a `providerId` parameter to persist the default provider for new threads and model lists. Return `ConfigWriteResponse`, reject unconfigured providers, and respect managed requirements, read-only configuration, and CLI overrides.
Reload the model catalog on its next read when the default changes effectively. Resolve explicit `model/list` provider selections against the current catalog configuration so clients can continue listing models for a retained provider after switching defaults.
Update the protocol schemas, generated TypeScript and Python types, and app-server documentation.
## Testing
Add coverage for switching defaults and switching back, rejecting unknown providers without changing the catalog, retaining explicit provider selections, reporting CLI overrides, and rejecting writes blocked by configuration restrictions.
GitOrigin-RevId: 3615835f58045d33a21b3c57d47932d6d1e3fb12
## What changed
- Remove `Config::legacy_sandbox_policy` and `Permissions::legacy_sandbox_policy`.
- Update core and TUI tests to use permission profiles and filesystem/network policies directly, with explicit conversion where legacy wire formats are required.
- Report the active sandbox label in app-server resume override mismatch diagnostics.
GitOrigin-RevId: cbc5417944e23404523e69dc5516d66d6bfafefe
## Why
Managed network requirements support both legacy tables and `permissions.network`. Equivalent declarations in one source should be accepted, while older runtime clients still need the top-level network field.
## What changed
- Normalize `network_proxy` and `experimental_network` into `permissions.network` before merging requirements, preserving source attribution and explicit empty allowlist replacements.
- Accept legacy and nested declarations in one source when they describe the same policy, comparing domain and review selectors by their canonical identities. Continue rejecting mixed surfaces across sources.
- Populate the legacy output field for compatibility and preserve legacy selector text when both forms are supplied.
- Include contributing requirement sources in cloud bundle errors without exposing submitted TOML.
## Testing
Add coverage for equivalent and conflicting declarations, empty allowlist overrides, loader compatibility, and debug output. Add a proxy regression test verifying that a saved grant cannot bypass managed loopback restrictions.
GitOrigin-RevId: e0d2a600f5c7c6c07a665ccc0e18a72ff172fd6d
## What changed
- Make `TimeProvider::current_time` and `CodexThread::current_time` synchronous, with clock reads required to avoid yielding or calling back into the session.
- Remove the experimental `currentTime/read` app-server request and its client-backed clock and sleep polling implementation.
- Require a host-provided `TimeProvider` for external clocks. App-server thread startup now fails when `features.current_time_reminder.clock_source = "external"` has no provider.
## Testing
Add coverage for external provider selection and rejection of app-server thread startup without an external provider.
GitOrigin-RevId: 09479d6eb28453b343dee78b3673092e73ae5d73
## Why
Paginated MCP server status requests previously discovered all configured servers before selecting the response page, causing unnecessary connections to servers outside that page.
## What changed
Select and deduplicate server identities before discovery, then collect status only for servers on the requested page. Include thread runtime statuses when selecting pages and preserve separate entries for same-named servers in different environments. Empty pages skip discovery.
## Testing
Add coverage that counts MCP initialization requests across successive pages and an empty final page. Extend environment inventory coverage to verify that pagination preserves each registration's identity, authentication status, and tools.
GitOrigin-RevId: 0c9c9ca6c8016147eb9a12b53ffe533ac3334444
## Why
Relative attachment paths in queued submissions should refer to files in the thread's working directory, even when the app server runs from a different directory.
## What changed
Resolve relative `LocalImage` and `LocalAudio` paths against the loaded thread's current working directory or the stored working directory for an unloaded thread when adding or updating queued submissions. Preserve absolute paths and reject relative paths that cannot be resolved to an absolute path.
## Testing
Add a regression test for queue add and update with different images sharing the same filename in the thread and server working directories. Verify that the relative path selects the thread's image and that explicit absolute paths retain their meaning.
GitOrigin-RevId: 3c1a48693c031f1c650650a9b3a7059fb962ba5c
## What changed
Allow `thread/inject_items` to accept wrapped items with `retention: "default"` or `retention: "always"`, while preserving support for raw response items. Persist explicit policies separately from legacy client-authored metadata.
Carry explicitly retained items through local and remote compaction, context-window changes, and child-agent creation, subject to retention budgets. Preserve history order and keep retained tool exchanges together; require matching calls and outputs to be adjacent in the injection request and both marked `always`.
Update Quinn dependencies and record exceptions for additional Hickory DNSSEC advisories where DNSSEC is disabled.
## Testing
Update injection tests for explicit retention metadata and extend the compaction scenario to cover a retained tool exchange across repeated compaction and restart.
GitOrigin-RevId: 1195a4ed62dc162a62e58bc2ad733262fbabea27
## What changed
- Make `McpManager::runtime_config` accept `McpServerContributionContext` and honor its originator, selected environments, and disabled plugin IDs.
- Add `McpServerContributionContext::for_host` to carry thread initialization data, originator, and session source without live extension state or discovery.
- Pass explicit global contexts from threadless discovery and control paths.
## Testing
Extend the thread manager test to cover host-only contribution identity, originator headers, and server restrictions for disabled plugins and pending environments.
GitOrigin-RevId: 04ea2c8951187d9014867f0020223b6a7dd94d8d
## Why
An unset voice preference should use the call destination's default. Changed or cleared preferences should also take effect on the next V3 call, even when the thread retains an older setting.
## What changed
- Use `gpt-live-1.1-codex` as the default V3 realtime model.
- Preserve an unset voice until request serialization, defaulting V3 API calls to `marin` and ChatGPT calls to `cove`, while honoring explicit voice selections.
- Reload current voice settings when starting a new V3 call through the app server, including cleared preferences.
- Populate the TUI voice picker from the V3 catalog, add `marin` to that catalog, and remove voice-catalog lookups from call startup and preference saving.
## Testing
Add regression coverage for API and ChatGPT voice defaults, explicit overrides, changed and cleared settings, and TUI call requests and voice selection.
GitOrigin-RevId: d0dd4dcd4bcad9ab869d7bf524e7095a88ffcfaa
## Why
MCP servers registered under the same name in different environments need distinct inventory, routing, and status reporting.
## What changed
- Keep MCP inventory and runtime status keyed by registration scope so same-named servers remain separate.
- Add optional `environmentId` selectors for status lookup, tool calls, resource reads, and OAuth login. Omitting the selector preserves existing name-only routing.
- Carry environment identity through startup notifications, elicitation requests, and tool-call history, and display it in the TUI.
- Support `/mcp login <name> --environment <id>` and update generated protocol schemas and SDK types.
## Testing
Add integration coverage for two environments with identically named MCP servers, tools, and resource URIs. Verify separate inventory, explicit environment routing, legacy routing when the selector is omitted, and errors for unknown environments. Update protocol and TUI tests for environment identity.
GitOrigin-RevId: 074a3db10549438cb6aff33eb7bed10791adae4d
## What changed
- Replace individual JSON payload files with numbered Zstandard shards in trace schema v3. Add `PayloadReader` to resolve payload references, cache decoded shards, and validate payloads during replay.
- Capture exact outgoing HTTP bodies and WebSocket messages alongside prepared prompts. Preserve full formatted context for continuations from unrecorded WebSocket warmups while retaining the actual incremental request.
- Flush payload records before publishing references and seal the final shard before recording completion. Replace `recording_complete` with `recording_status` to distinguish unclosed recordings, closed recordings with partial payloads, and complete recordings.
Reduce trace bundles with the binary that recorded them.
## Testing
Add coverage for shard rotation, oversized records, live reads, cache eviction, and malformed or corrupt payloads. Extend HTTP and WebSocket integration assertions to verify captured requests and prepared prompts, including warmup continuations.
GitOrigin-RevId: 40ce3c11383f48e08f52e7120b706c61a449df9c
## What changed
Capture `codex_app_used_dictation` as per-input metadata, with patches taking precedence over replacements, and remove the key from metadata forwarded to Responses. Record attribution when user-origin input is accepted into turn history.
Add `used_dictation` to turn analytics: report `true` if any accepted input used dictation, `false` only when every accepted input has known non-dictation attribution, and omit the field otherwise.
## Testing
Add coverage for per-input extraction, patch precedence, and turn-level aggregation. Extend the app-server steering test to verify that dictation attribution reaches analytics while the metadata key is excluded from Responses requests.
GitOrigin-RevId: 0a55687a7dd61f00e9b188f89810e52bd941490b
## What changed
- Update the workspace, Bazel toolchain and lockfile, CI and release workflows, and Windows setup script from Rust `1.95.0` to `1.99.1`.
- Adapt Rust code to the updated toolchain and Clippy lints, including `try_update` for atomics, `as_chunks` for fixed-size slices, and targeted allowances for generated tonic services.
- Refresh the halfwidth sound mark rendering snapshot to use literal characters in debug output.
GitOrigin-RevId: 5852029f687436dc814c2bca68141ee1f4a67d49
## Why
Plan items used a single ID derived from the turn ID, so multiple completed plans within one turn shared an ID across retries or tool continuations.
## What changed
Generate UUIDv7 plan item IDs and carry an unfinished plan's ID across model requests within a turn. Once a plan completes, assign a fresh ID to the next plan.
## Testing
Add unit and integration coverage for unfinished retries, retries after plan completion, and tool continuations, including matching streamed events to saved completions. Update the app-server test to check plan IDs against the start notification.
GitOrigin-RevId: 87b4b3e6bd74224ea96f4308f739bcd2efb62299
## Why
Listing threads by ascending `recency_at` can omit `next_cursor` when rollout files have not yet been indexed in SQLite, preventing clients from fetching the remaining threads.
## What changed
Scan and index one extra rollout for ascending recency listings when SQLite is available, so the database can detect another page. Trim filesystem results to the requested page size for this sort order.
## Testing
Add a regression test that creates two unindexed rollouts after startup backfill and lists them with a provider filter and a page size of one. Verify both threads are returned in order, with a cursor only on the first page.
GitOrigin-RevId: 09354055b6e60666a493d9411ed3eb9778b73c0a
## What changed
Route direct reviews through the reusable Guardian session so sequential `thread/guardianReview` calls on the same loaded thread can share review history with live approvals. Keep the reviewer conversation separate from the actor and follow the parent thread's persistence settings. Retries reassess the final call under the current policy.
## Testing
Extend app-server coverage to verify history reuse within a parent thread and isolation between parents. Extend the core scenario and snapshot to cover sequential direct reviews without executing the recorded commands.
GitOrigin-RevId: 5f10a04aec43a9351e38575265cb6b5ff06530a5
## What changed
Use `legacy_sandbox_policy_label` from the active permission profile to check sandbox overrides when resuming a loaded thread. Continue accepting `external-sandbox` for `danger-full-access` requests, and construct the legacy sandbox policy only when reporting a mismatch.
GitOrigin-RevId: 0f923323394692d2e1f39bafe637c70ce305dc3d
## What changed
Consolidate cache refresh entry points around an explicit refresh mode, derive plugin keys from the configured sources, and share request matching and batch outcome handling. Clarify pending refresh state and extract the worker notification callback helper.
## Testing
Add an app-server regression test verifying that the first full plugin list installs a newly published plugin version while preserving cached contents for a plugin whose version is unchanged.
GitOrigin-RevId: 85d91ec7675e98f7430a8bd9c699118c7feb06c4
## Why
Allow collector credentials to refresh without rebuilding OpenTelemetry providers.
## What changed
Add `otel.headers_helper`, a command run from `CODEX_HOME` that returns a JSON object of header strings. Share its results across explicitly configured HTTP log, trace, and metric exporters. Refresh every 29 minutes by default, configurable through `otel.headers_helper_refresh_interval_ms`.
Helper headers override matching static headers. Failed refreshes block affected exports until the helper recovers, and HTTP redirects are disabled when helper headers are used. Repository-local configuration cannot set the helper; exporters set by admin requirements, gRPC exporters, and built-in analytics do not use it. Helper execution respects network policy.
## Testing
Add tests for shared execution, credential refresh and recovery, blocked exports after failure, network restrictions, and configuration validation. Collector tests cover header precedence across all three signals using JSON and binary HTTP encodings, including exclusion of an admin-managed exporter.
GitOrigin-RevId: 89018ac09c2c99523d3f92bf77048e7ed9dae5f2
## Why
A recovery turn can occupy the core turn slot before `TurnStarted` is published and thread statuses reflect it. During this window, `thread/resume` with configuration overrides could treat an unsubscribed thread as idle and shut it down, interrupting recovery.
## What changed
Require the core turn slot to be empty before replacing a loaded thread during resume. Expose `CodexThread::has_active_turn()` and reuse it in the residency unload check.
## Testing
Add a regression test that blocks paginated history writes to hold a recovery turn before status publication, reconnects with a configuration override, and verifies that the client receives completion for the preserved recovery turn.
GitOrigin-RevId: f295038c8502a9b2849ddc08614db4a3cb5610cf
## What changed
Add `biometricType` to `userVerification/verify` responses as context alongside the signed `proof`. Successful Touch ID protected signing reports `"fingerprint"`; an unknown method reports `null`. Responses from older servers that omit the field remain supported.
Carry the native method through the verification provider and app-server protocol, and update the experimental protocol exports and API documentation.
## Testing
Add coverage for responses without `biometricType` and for returning `"fingerprint"` separately from the proof. Update existing verification coverage to check the `null` case.
GitOrigin-RevId: c82e84a325a4d9ab1e5262e5100ffc1a043bd97e
## Why
MCP servers discovered on different executors can share a name. Resolving them by name alone exposes only one server and prevents tools and resources from being addressed independently.
## What changed
- Add the disabled-by-default `multi_environment_mcp` feature to expose environment-scoped servers, including multiple installations of the same plugin.
- Carry exact `McpServerKey` identities through catalogs, connections, tool calls, resources, and approval tracking. Give environment-scoped tools stable namespaces derived from their environment.
- Include `environment_id` in scoped resource listings and accept it in resource requests. Require it for environment-owned servers when multiple environments are selected.
- Preserve server ownership through hooks and use the owning environment's permissions for scoped elicitation review.
## Testing
Add coverage for same-named servers across environments, independent calls and approvals, resource selection, plugin discovery, and rejection of hook changes to the tool environment.
GitOrigin-RevId: 5593372b06a15c16aa3220faa3b19f5d3b20e67e
## Why
An immediate request after `start` could compete with the pending `initialized`
notification for channel capacity and fail with `WouldBlock`.
## What changed
Wait for an acknowledgment that `initialized` has been processed before returning
from `start`. Shut down the runtime if sending the notification or receiving its
acknowledgment fails. Ordinary notifications remain fire-and-forget.
## Testing
Require the first request after startup to succeed without retries with channel
capacities of zero (clamped to one) and one.
GitOrigin-RevId: 119a9a4375109f6b85aee0a9a4f8398a69269567
## Why
Normalizing whitespace before matching prevents thread search from producing snippets for queries containing repeated spaces, newlines, or tabs.
## What changed
Match against the original conversation text and select the surrounding excerpt before normalizing whitespace for display.
## Testing
Extend `thread_search_matches_json_escaped_content` to cover repeated spaces, newlines, and tabs alongside quotes and backslashes, and assert that the returned snippet has normalized whitespace.
GitOrigin-RevId: fffdcc8d246e7603a52c32bb5239b9873f8179fc
## What changed
Make “Yes, clear context and implement” save the approved plan as an app-server attachment and submit a short prompt referencing it. Add the experimental `thread/prepareApprovedPlan` request to verify that the fresh thread's executor can read the file and that its contents match the approved plan.
If the attachment cannot be written or read, inject the complete plan as `proposed_plan` tool output within the model's context and truncation limits. If the complete plan cannot fit, report an error and keep the current session. Clear the UI and switch threads only after plan preparation succeeds.
## Testing
Add TUI tests covering a large plan read from its attachment, complete fallback context when attachment writes or reads fail, and preservation of the original session when the fallback is too large. Snapshot the fresh thread's initial request.
GitOrigin-RevId: b717f30359256994c6efb3f4fe7f87aabe8936af
## Why
Lowercasing alone misses caseless matches such as Greek sigma variants and `ss` matching `ß` in `thread/searchOccurrences`.
## What changed
Use Unicode default case folding after lowercasing both search terms and text. Map folded matches back to source character boundaries so snippets highlight the original text correctly, including characters that expand during folding.
## Testing
Extend the app-server search integration test to cover sigma variants, `ss` matching `ß`, newer Unicode case mappings, and UTF-16 match ranges in text containing an emoji.
GitOrigin-RevId: 6c4937d475daf51d3cd7784b48f5f4a8ce5fa82a
## What changed
Carry `ContextWindowId` through session metadata, compaction checkpoints, rollout recording, and thread creation instead of converting IDs to strings. Add deserialization and JSON schema support while preserving the serialized string format and legacy numeric compaction IDs.
Validate deserialized IDs as UUIDv7 values before restoring context windows, preserving the existing handling of unsupported IDs.
GitOrigin-RevId: fda329d0654f438171a955c9f75550817c32c047
## What changed
Add the disabled-by-default `daybreak_program_propagation` feature to capture a parent's saved Daybreak choice when spawning native helpers. Retain the choice and account identity for helper turns and nested spawns, while preserving explicit `cyber_access_program` overrides. A helper's own saved preference takes precedence on later turns.
Read pending metadata before persisted metadata so preferences survive thread materialization, with stored choices taking precedence. Share this resolution logic with `thread/read` and support refreshing the feature through user configuration.
## Testing
Add coverage for saved and pending preferences, unset choices, explicit overrides, failed metadata reads, nested spawns, parent unloading, feature withdrawal, and preference changes between helper turns.
GitOrigin-RevId: b3b349da8cb3d48154cddf058890587385efcda2
## Why
Converting message content to tool output previously reduced file-backed audio to a text file ID, losing its audio type.
## What changed
- Allow `input_audio` tool output items to carry either `audio_url` or `file_id`, preserving both forms during content conversion.
- Account for file-backed tool audio in history estimates and output truncation, and prepare only inline audio data.
- Reject uploaded audio in raw function and custom tool output injection, extending the existing requirement to submit uploaded audio through typed turn input.
- Regenerate app-server schemas and TypeScript/Python types while preserving the Python inline audio class name.
## Testing
Add coverage for tool audio wire-format round trips, repeated file audio sharing text and audio output budgets, and rejection of raw uploaded audio injection across messages and tool outputs. Extend Python SDK coverage for the inline tool audio shape.
GitOrigin-RevId: f4704466e6151662d2c8b8dc3f5ca2ab2f5710a2
## Why
Background plugin cache refreshes fetched recommendations even when plugin recommendations were disabled.
## What changed
Pass the effective recommendation feature state into `PluginsConfigInput` and skip recommendation cache warming unless apps, plugins, and either `tool_suggest` or `recommended_plugins` are enabled. Installed-plugin cache refreshes continue independently.
Disable `tool_suggest` and `recommended_plugins` by default in core and app-server test helpers, with explicit overrides for recommendation tests.
## Testing
Update cache-warming and external-login recommendation tests to opt in explicitly. Update config RPC assertions to verify the test helpers' session flag overrides.
GitOrigin-RevId: dc04e2847c94e2b15842fcd95cc0cf1f104e1fac
## Why
An aborted turn could remain active, and a late abort for an unknown turn could interrupt a different turn with an explicit ID.
## What changed
Finalize the active turn after applying an abort. Only fall back to the active turn when the abort lacks a turn ID or the active turn has a generated ID.
## Testing
Extend regression coverage to verify that a late abort preserves a review turn's ID and completed status, and that repeating `turn/interrupt` returns `no active turn to interrupt`.
GitOrigin-RevId: 73072dda7879bd50b1013f4a0bbf1b68546f2619
## What changed
Add experimental `environments` fields to `turn/settings/update` and `thread/settings/update`. Turn updates apply to later steps of the running turn; thread updates apply to future turns. Omission or `null` preserves the selection, while `[]` clears it. Providing `cwd` in a thread update without an environment list selects the defaults for that directory.
Include the ordered environment selection in `thread/settings/updated`. Wait for Core to accept thread settings updates before returning success, and return rejections as request errors.
## Testing
Add integration coverage for attaching, replacing, preserving, and clearing environments; rejected updates; and the distinction between later steps and future turns.
GitOrigin-RevId: bfebeda57c676be94427aeb0c567c0b94fd9c387
## Why
`thread/sample` previously required the source's latest turn to finish before it could be sampled.
## What changed
Add `allowInProgressTurn`, defaulting to `false`, to sample a snapshot of the latest turn while the source continues running. The requested turn must still be the latest, but source history changes during sampling no longer invalidate the result when this option is enabled.
For an in-progress snapshot, include a context note explaining that the source was not stopped and pending tool calls may appear as `aborted` in the copy. Suppress the copy's default interruption message.
## Testing
Add coverage for sampling running turns in legacy and paginated history modes, including pending tool calls and mid-turn compaction. Verify that the source continues independently and that finished-turn samples retain their existing context.
GitOrigin-RevId: 771b979bf677e4ff0686476bfaf21aff92f7e7ac
## Why
Title and content searches exclude attached threads, preventing clients from finding their saved conversations alongside ordinary threads.
## What changed
- Add `includeAttachedThreads` to `thread/list` and `thread/search`. For `thread/list`, require a non-empty `searchTerm` and preserve the usual provider and source filters.
- Expose `attachedToThreadId` on thread responses to identify the owning parent independently of fork and subagent lineage.
- Support inclusive searches through SQLite and filesystem fallback, repairing missing database entries with saved thread names during title searches.
## Testing
Add regression coverage for opt-in title and content searches, attached-parent metadata after restart, default search filters, filesystem searches without SQLite, and discovery and repair of unindexed title matches.
GitOrigin-RevId: ac12ec3c730ad7f1722bdf8e21600d17f12017f0
## Why
Reference-backed forks can lack a local opening user message, causing them to disappear from thread listings or lose their inherited preview when a new turn is written. Compaction can also remove the opening message from the model context used to prepare a fork.
## What changed
- Persist inherited previews and preserve them when recording new turns and merging thread-list metadata.
- Include reference-backed forks with inherited history in thread listings before their first local message.
- Recover opening previews from transcript history within the requested fork boundary when compaction omits them from model context.
- Use the shared `user_message_preview` helper when deriving previews from rollout items.
## Testing
Extend thread-fork integration tests to check previews in listings before and after a new turn, after reopening, and when forking at a boundary after compaction.
GitOrigin-RevId: 5962cf71ea7104f07c9013cc77259b105e4c60d7
## What changed
Use eligible installed marketplaces as Git clone references to avoid fetching objects already available locally. Limit fetch negotiation to the recorded installation commit so local branch revisions are not advertised, and use `--dissociate` to keep the upgraded checkout self-contained.
Enable reuse only with Git 2.20 or newer and a recognized release version. Fall back to a fresh clone if reference cloning fails, and retain existing ref and sparse-checkout behavior.
## Testing
Add coverage for installation-commit negotiation, exclusion of local branch revisions, self-contained object stores, fallback with older or unknown Git versions and shallow references, and Git release parsing.
GitOrigin-RevId: 8d0f6a4bed7e7e2a3136e3912ba2f92150be9354
## What changed
Return first-party provider models in catalog order while retaining priority-based default selection and existing filtering. Apply this ordering only to provider-origin catalogs for the OpenAI provider using Codex backend routes or `model_catalog_url`. Bundled, configured, and third-party catalogs retain priority ordering.
## Testing
Add coverage showing that catalog display order can differ from priority order while the recommended model remains the default. Update custom-provider coverage to verify priority ordering with a reversed catalog response.
GitOrigin-RevId: 9c2361e070ba424c092a282ca7f1cf9952d270b3
## What changed
Move `ThreadMetadataBuilder` into its own module, make its fields private, and replace direct field assignments with fluent `with_*` methods. Initialize `updated_at` and `recency_at` from the creation time and default the approval mode to `OnRequest`.
Update `apply_rollout_items` to accept a boxed `ThreadMetadata` seed, keeping callers' async frames small while preserving existing database fields except for the seed rollout path. Add `build_thread_metadata` to use the state runtime's configured provider, and use `thread_id_from_rollout_path` directly for the doctor's filename fallback.
GitOrigin-RevId: a27e4c6b22832e902922dbdd60d7f5c11b4a1a83
## Why
Forked and recovered sessions can restore a tool call before its output has been recorded. Missing outputs for these calls should be treated as interrupted work rather than an error.
## What changed
Track the restored history's sequence cutoff so custom tool and local shell calls in that history can receive synthetic `aborted` outputs without reporting a missing-output error. Keep the existing checks for newly recorded calls and clamp the cutoff when history is replaced.
## Testing
Extend the active-turn fork test with a pending `apply_patch` call and verify that the fork's model input includes its `aborted` output.
GitOrigin-RevId: d989fa0991db72f0f8fa8a6d5de403fb307c40c7
## Why
An explicit denial from a workspace inference hook should stop the request, including retries and compaction model fallback.
## What changed
Recognize `inference_hook_denied` provider errors and preserve the provider's message, with a fallback when none is supplied. Expose the distinct `inferenceHookDenied` error through the app-server protocol and generated schemas and SDK types. Treat the denial as non-retryable during turns, compaction, and guardian review.
## Testing
Add coverage for terminal denials over HTTP, SSE, and WebSocket, error serialization and persistence in `thread/read`, and compaction failures that preserve token usage and history without retrying or falling back to another model.
GitOrigin-RevId: 2ebd480f01e52f4e6bd3db8a0f92d5814d18ccb1
## Why
MCP requests need to retain inbound W3C trace context even when no OpenTelemetry tracing layer is installed.
## What changed
- Carry validated request trace context through app-server MCP tasks, connection startup, and resource listing tasks, while preferring active span context.
- Forward fallback `traceparent` and `tracestate` headers for MCP HTTP requests, including discovery and initialization.
- Use HTTP trace headers as a fallback for exec-server RPC calls when active span context is unavailable.
## Testing
Add an app-server integration test that disables trace exporting and verifies that `mcpServer/resource/read` forwards the inbound `traceparent` and `tracestate` to the MCP server.
GitOrigin-RevId: c886a55ce0a3992f1b2e04614efec80a20cb4b49
## What changed
- Track and log `McpRefreshReason` values for runtime refreshes, including invalidations received during thread startup and forced refreshes. Restore claimed reasons when a refresh is cancelled before publication, while preserving concurrent invalidations.
- Correlate installed-plugin metadata invalidations with downstream MCP refreshes using a shared change ID. Log changed field names by plugin ID, additions, removals, and reordering without logging field values.
- Record whether background installed-plugin bundle updates were requested by startup, plugin listing, or installation.
## Testing
Add coverage for metadata change attribution across membership changes and reordering, and for retaining refresh causes across cancellation and concurrent invalidation.
GitOrigin-RevId: 3d4485ccfcc1d8788eb9909a060ac200c467af13
Zahan Malkani