## Why
An explicit `final_answer` with empty or whitespace-only text could allow queued agent mail to restart the turn instead of leaving it queued for the next turn.
## What changed
Treat explicit `final_answer` messages as terminal regardless of visible text in both completed-item handling and turn-item finalization. Untagged messages still require visible text to defer mailbox delivery; `commentary` and `partial_answer` messages do not defer it.
## Testing
Extend regression coverage for empty and whitespace-only final answers, delivery of queued agent mail on the next turn, and message board notifications arriving before or after an empty final answer.
GitOrigin-RevId: 466f1a9c613e07d67ce45458858ba32d5d23f11d
## Why
Local administrators need to require managed configuration from a specific customer-hosted server before a session can start.
## What changed
- Add a local managed `config_server` requirement with an HTTPS base URL and optional OAuth settings. Validate endpoints and derive the bundle route as `codex/config/bundle` beneath the base URL.
- Replace the entire `config_server` block when a higher-priority requirements layer supplies one, keeping the endpoint and OAuth settings together. Reject this setting in fetched policy.
- Track the applied server through configuration snapshots, role overrides, and refreshes. Reject session startup and managed refreshes when the applied server does not match the requirement; user refreshes retain the session's managed configuration.
## Testing
Add coverage for missing, mismatched, and matching server configuration at session startup, whole-block replacement, rejection of server settings in fetched policy, and preservation across role overrides and refreshes.
GitOrigin-RevId: 51e8a1738dabdb117ae858120f6fb09ae2ff1261
## Why
Remote credential masking previously fell back to unmasked execution whenever custom credential providers were configured.
## What changed
- Transport configured provider rules to the executor-local network proxy, where credential values and destination context are resolved.
- Advertise `credentialMaskingCustomProviders` and negotiate masking support. Keep the warning and unmasked fallback for executors that support only built-in providers.
- Discard provider rules when masking is disabled and omit their contents from debug output.
## Testing
Extend coverage for capability compatibility, provider configuration round trips, and fallback on older executors. Exercise configured-provider masking in remote request history and verify that masked placeholders are restored to real credentials in upstream request headers.
GitOrigin-RevId: b036f56900b343ddccc17b5293c82bc1f3426237
## Why
Executor hooks depended on V1 discovery snapshots, so plugins discovered through V2 could not run their cleanup hooks.
## What changed
Prepare executor hook sources during step setup from either V1 or V2 discovery and capture them in `StepContext` for stop, interrupt, and memory consolidation hooks. Restrict V2 sources to selected plugin installations while preserving plugin enablement, hook admission, MCP routing, and app tool policy checks.
## Testing
Add unit coverage for V2 hook admission, environment routing, disabled plugins, and failed discovery. Add integration coverage showing that `Stop` and `Interrupt` cleanup hooks run with V2 discovery alone and remain silent when the plugin is disabled.
GitOrigin-RevId: a4c0e9c56bdebcdf22cea63f02f8fb4c5eed358e
## Why
A total-duration assertion does not prove that two shell commands overlap and depends on execution speed.
## What changed
Update `shell_tools_run_in_parallel` to wait for both commands to create start markers before releasing them through a shared file. Fail if both commands do not start within five seconds, and verify that each command exits successfully and returns its expected output.
GitOrigin-RevId: ba322157a60951ad5dd2f1b018ddc6007de1de89
## Why
Callbacks from the shared stdio host need to retain each execution's trace context after it yields, without keeping the execution span open until its background cell closes.
## What changed
Capture a W3C trace-context snapshot for each execution and restore it as the parent of tool callback and notification spans. Instrument delegate invocation and its returned future so the context is available on entry and across awaits.
## Testing
Add an integration test with overlapping yielded cells completed in reverse order. Cover sampled, unsampled, and untraced callers, trace isolation, callback and notification parentage, and execution spans finishing while callbacks remain blocked.
GitOrigin-RevId: 57924123d2c2f31bcfaf725688d8bba775235fa0
## Why
Responses Lite includes retained reasoning in its reported token usage even without an `X-Reasoning-Included` header. Adding a separate reasoning estimate can trigger automatic compaction prematurely. Locally recomputed usage also already includes retained reasoning.
## What changed
Initialize reasoning accounting from `use_responses_lite` before each sampling or compaction request, while allowing server events to override it. Mark locally recomputed token usage as including reasoning.
## Testing
Update the compaction regression test to verify that Responses Lite usage without the header stays below an 81-token limit at 80 tokens and triggers compaction at 81 tokens.
GitOrigin-RevId: 06f9272cb3c259e927941f1d2a1d7096310ffb2c
## What changed
- Store `logs_2.sqlite` in `log_dir` when explicitly configured, unless a managed `sqlite_home` requirement applies. Keep other databases in `sqlite_home` and preserve the existing SQLite log location when `log_dir` is unset.
- Initialize and lock the selected log directory only when opening its database, so an unavailable directory does not prevent authentication commands from loading configuration. Share the cleanup lock across configuration clones and allow failed initialization to be retried.
- Leave existing logs in place. Read legacy logs for diagnostic submissions when the current query returns no logs, attaching them as `codex-logs-legacy.log`. Continue retention cleanup and page reclamation for both locations, with independent maintenance locks and filesystem checks.
## Testing
Add coverage for configuration routing and managed requirements, deferred initialization and lock lifetimes, authentication with an unavailable log directory, legacy log attachments, and cleanup of current and legacy databases.
GitOrigin-RevId: 48216694596d738eff1b3c5eef6c4e7ada6d0137
## What changed
Move the message-board API, types, permissions, storage backends, and tool implementations into the new `codex-message-board` crate. Keep extension registration in `codex-agent-message-board-extension`, and update core and the remote client to use the shared crate directly.
Move the existing board tests with the implementation and add the crate to the Cargo workspace and Bazel build.
GitOrigin-RevId: 33ce527c2bef7f862eba55cb9b32222902ccf4ad
## Why
Mailbox preemption can discard completed response items and lose the response ID needed for incremental continuation. Buffered tool calls must also wait for queued agent messages to be read.
## What changed
- Gracefully interrupt and drain Responses Lite streams, retaining completed items and the response ID for the next request.
- Cancel buffered tool calls before dispatch and suppress partial items that may be discarded during the drain.
- Keep user steering queued until draining finishes. Include pending mail in follow-up requests after disconnects and preserve content-filter recovery guidance.
## Testing
Add WebSocket regression coverage for buffered completion, interrupts without acknowledgement, buffered tools and partial items, user steering during draining, disconnects, and content-filter recovery.
GitOrigin-RevId: c9d3fb87a81850e5686e07f28103e2ff4378ddec
## Why
Failed cloud discovery previously retried before each model step. Apply a cooldown across steps and turns to avoid repeated discovery requests while a provider remains unavailable.
## What changed
- Share per-thread retry backoff logic between cloud skill and plugin catalogs, starting at 30 seconds and doubling to a maximum of 5 minutes.
- Scope cooldowns to authentication and MCP resource generations so account changes and reconnects permit immediate recovery.
- Clear backoff after successful discovery or configuration resets, while allowing cancelled refreshes to retry immediately.
## Testing
Update lifecycle and concurrency tests to cover shared cooldowns, reconnect recovery, and cancellation. Use paused time to verify exponential delays, the 5-minute cap, and backoff across turns.
GitOrigin-RevId: 30dab5ceba51e8ad64c0794c1729719e99f577ce
## Why
A failed provider catalog refresh could discard model metadata and disable tool search on subsequent turns, even after a successful discovery.
## What changed
Keep the last successful catalog, ETag, and original freshness when refreshes fail without an access rejection. Continue invalidating cached catalogs for HTTP `401`/`403`, rejected refresh tokens, and gateway credentials that require login. Distinguish `GatewayLoginRequired` from login in progress so only the former invalidates the catalog.
Successful empty responses remain authoritative, and cached catalogs remain scoped to the provider and authentication identity.
## Testing
Add regression coverage for catalog preservation across refresh errors and restarts, access rejection invalidation, identity isolation, and tool search and instruction stability on the next turn after a failed refresh.
GitOrigin-RevId: 9dd7c73ac2cc1fd49664efd93b839baa94e05c49
## Why
Authentication can change between model steps. Refresh cloud catalogs before the next step so plugin acceptance and skill instructions reflect the current auth scope, including plugins that are no longer available.
## What changed
- Add a `refresh_catalog_for_step` lifecycle hook and rebuild MCP when plugin catalogs change.
- Reuse successful discovery within a turn and auth scope, serialize concurrent refreshes, and allow retries after failures or cancellation. Limit cloud skill discovery warnings to once per turn.
- Skip cloud discovery during prewarm and other context-only captures, and check hosted plugins even when no executor roots are selected.
## Testing
Add regression coverage for mid-turn auth rotation and plugin removal, serialized refreshes and retries, stale discovery results, and prewarm boundaries.
GitOrigin-RevId: 355681e84dc765e8dc1a04608779d95c706c2188
## What changed
Add a save RPC that accepts the existing report options and an absolute `savePath` on the server host. Save the report, selected attachments, and a manifest without uploading, and return `savedPath`, `threadId`, and `promptHash`. Local exports remain available when uploads are disabled by configuration.
Publish archives atomically without replacing existing files. Bound uncompressed contents to 200 MiB and attachments to 128, preserve duplicate attachment names safely, and fail without publishing a partial ZIP when a selected file cannot be read. Honor `includeLogs` and omit automatic rollouts for untouched threads without materializing them.
Update protocol schemas and generated TypeScript and Python types.
## Testing
Add coverage for local-only saves, disabled uploads, path validation, overwrite protection, log consent, archive budgets, duplicate names, missing files, and rollout selection before materialization and after writer shutdown.
GitOrigin-RevId: 222c0fe7ab923904de9c8a9f12ad27f7a0104875
## Why
Resuming a thread can replace saved model settings with global defaults. A selected service tier can also be lost when the current model does not support it.
## What changed
- Restore saved service tier, reasoning summary, and personality on resume unless the caller explicitly overrides them, respecting thread ownership of settings snapshots.
- Retain the selected service tier for persistence, settings notifications, and resume comparisons while filtering the effective tier against the current model's capabilities.
- Carry the runtime model, service tier, and personality into thread revert reconstruction.
- Persist initial thread settings before user input during MCP startup so an interrupted first turn retains its settings checkpoint.
## Testing
Extend regression coverage for cold resume and explicit overrides, unsupported service tiers, settings preservation during revert, and settings checkpoints before user input when MCP startup is interrupted.
GitOrigin-RevId: e5ec012a5678048c5eedd443e524f38c142bf9fd
## What changed
- Extend app-server tests for account credential reuse, refresh races, stale bearer rejection, retry exhaustion, and step-up failures at the identity provider and resource authorization server.
- Assert token-exchange request fields and enterprise protocol negotiation while preserving the ordinary MCP handshake.
- Add core scenarios for permission and tool-policy refreshes, policy revocation, and thread removal, including cancellation of in-flight enterprise calls.
- Snapshot conversation history after revocation to verify that prior calls remain visible and ordinary tools continue working.
- Allow the existing startup-failure test to wait through the MCP startup deadline.
GitOrigin-RevId: 31cf71a28f91bd30746b74df8fa669edb6bc23a1
## What changed
- Prefer an eligible account grant over saved enterprise credentials, with a fallback to saved enterprise sign-in during initial connection if the account grant is rejected.
- Remember rejected account grants per enterprise MCP registration across threads and report authentication failures as requiring reauthentication. Keep administrator configuration errors distinct from sign-in failures.
- Compare account grants independently of access and ID token rotation, recheck the latest identity eligibility after exchange, and retry once when the refresh grant changes.
- Make MCP authentication status reflect usable account grants, saved enterprise credentials, and completed connection failures.
## Testing
Extend regression coverage for enterprise sign-in failures and recovery, MCP authentication status, account grant identity across token refreshes, and retries after transient credential failures.
GitOrigin-RevId: eeac65f668d5d2d55e9d8bf4547fbcbdd6a6c42d
## What changed
Store `RolloutItem::SessionMeta` and `RolloutItem::Compacted` payloads in `Box` values and update their producers, consumers, and test fixtures. Preserve the existing serialized rollout format.
GitOrigin-RevId: 59fcc4beb47d23160872dcb6e95ace9b142d3d11
## Why
Disabled or failed protected shell snapshots prevent commands from running when credential masking is enabled.
## What changed
Restore unmasked credentials and continue execution when a protected shell snapshot is unavailable. Log and emit a warning explaining that the command will run with unmasked credentials.
## Testing
Extend `brokered_shell_snapshot_fallback` coverage for disabled and failed snapshots, including managed feature settings. Verify the warning, successful execution with restored credentials, continued filesystem sandbox and network policy enforcement, and masking recovery after snapshot storage is repaired.
GitOrigin-RevId: 28561e571b2a043d0b6cfa248c9ba2a61dd558ba
## What changed
Add an `incremental_tools` attribute to `codex.tools.registered` using the effective mode for the current sampling request. Compute the mode once and reuse it for registration metrics and prompt construction across transport retries.
## Testing
Extend integration tests to verify the attribute for incremental and non-incremental requests, including when the feature flag is enabled but the Responses API does not support incremental tools. Assert registration sample counts and retain coverage that stream retries do not duplicate registration metrics.
GitOrigin-RevId: e5b7a1075fe722ef6bdf900ae07e2b1b06aecfb5
## What changed
- Update Cargo and Bazel toolchain pins, CI and release workflows, and Windows setup from Rust `1.95.0` to `1.99.1`.
- Adapt Rust code to updated APIs and lint requirements, including `try_update` and `as_chunks`, and refresh the halfwidth sound marks snapshot.
- Update `webpki-root-certs` from `1.0.5` to `1.0.10` in the Cargo and Bazel lockfiles.
GitOrigin-RevId: e1aaed63b7e72bb8c8bbe25b32c6329c9a37b6c3
## Why
Agent Plugin manifests previously skipped app declarations, including service-generated declarations installed with remote curated plugins. This prevented those plugins from using app routing and suppressing matching direct MCP connections.
## What changed
- Recognize app declarations for Agent Plugins from `openai-curated-remote` across loading, capability summaries, plugin details, tool suggestions, and install authentication.
- Apply app routing to suppress same-name MCP servers when an app route is available. Keep unrelated MCP servers available and preserve direct MCP access in API-key mode.
- Keep app declarations inactive for Agent Plugins from other marketplaces.
## Testing
Add coverage for marketplace and authentication routing, service-generated app declarations during installation with both manifest formats, and app tools reaching turns. Verify that disabling Apps does not restore matching direct MCP connections.
GitOrigin-RevId: 791739569f0e01c898040bc2d028cf517f767e00
## What changed
Add `MessageLifecycleContributor` hooks to capture extension state when local agent control publishes a message and notify contributors when the recipient commits it to history, before sampling.
Carry shared delivery state through submissions, input queues, and mailbox eviction with `PendingAgentMessage`. Notify consumption at most once per delivery, release captured state when consumed or abandoned, and drop pending mail outside queue locks. Preserve the serialized message format without republishing restored history.
## Testing
Extend the mailbox eviction test to verify that publication state survives eviction and retained messages are consumed before the first resumed model sample.
GitOrigin-RevId: 9a1f6832bd48ec646a3fd179485c095e8dcc72cc
## Why
Input injected before `wait_agent` or `clock.sleep` begins must still interrupt the wait and reach the next model request.
## What changed
Track notifying response-item injections as pending steering activity. Reset that state when pending input is consumed or cleared so later passive context does not interrupt waits.
## Testing
Extend wait and sleep tests to cover injections queued before the wait and delivered while waiting, alongside user steering. Add queue coverage for pending injection detection and reset after consumption.
GitOrigin-RevId: 90f8d968336082c76271d1ca4f81b855bafc72c6
## What changed
Classify messages from code-mode collaboration calls as `AgentMessage::Plaintext` so they receive the context wrapper for plaintext messages. Apply this to `spawn_agent`, `send_message`, and `followup_task`.
## Testing
Add a regression test that spawns an agent through `exec` and verifies that the child receives the task as plaintext with sender and recipient attribution.
GitOrigin-RevId: 495c70ea13fd2bb06989e5aacab60beed0c19a56
## What changed
- Add `--cloud-skills-snapshot PATH` to load a cloud skill catalog and resource contents from JSON once at app-server startup, without contacting a live skill service.
- Expose snapshot skills through the native `skills.list` and `skills.read` interface, preserving aliases and prompt visibility. Reads remain available after the snapshot file is removed.
- Validate package boundaries, required resources, duplicate packages, and size limits; fail startup for missing or invalid snapshots.
- Keep frozen cloud catalog and read caches independent of live MCP resource changes.
## Testing
Add provider, cache, app-server, and core scenario tests covering validation, exact resource contents, authority boundaries, startup failures, and listing and reading frozen skills alongside a named executor.
GitOrigin-RevId: d438a5d678121db3e17515fc5edcd00d4e20b900
## Why
Synchronous auth header construction could silently return no credentials when managed authentication became unavailable. Callers need an error to avoid sending requests with missing or partial authentication.
## What changed
- Make `AuthProvider::add_auth_headers`, `to_auth_headers`, and auth header telemetry fallible, and propagate failures through request and WebSocket setup.
- Return a transient error when managed authentication is unavailable, and preserve network policy denials through auth error conversion.
- Retry transient MCP authentication errors while treating build errors and policy denials as terminal.
- Cancel local MCP event streams before resolving authentication so cleanup still works when credentials become unavailable.
## Testing
Add regression coverage for rejected partial authentication, async header resolution, terminal auth errors without sending requests, managed account changes, MCP retry classification, and local stream cancellation after authentication becomes unavailable.
GitOrigin-RevId: 39d981e232cba1e302de502a2fa6239101114ed1
## What changed
Record `codex.guardian.turn.blocking_ms` when a turn completes or aborts, with an `outcome` label. Count overlapping approval waits once, exclude idle gaps, and split pending reviews across the active turns they span. Use each turn's telemetry so samples retain the servicing turn's model attribution.
## Testing
Add unit coverage for overlapping waits, idle gaps, late turn completion, and duplicate stops. Extend integration coverage to verify attribution across turns and model changes for yielded command reviews and MCP elicitation, including aborted turns.
GitOrigin-RevId: a3e6a0c32a06fe58ea93119ecd941076100fb82c
## What changed
Expose `PromptCacheKey` through `StartThreadOptions` with three policies: retain the default session-derived key, send a custom key, or omit `prompt_cache_key` from model requests. Keep session identity headers independent of this policy.
Propagate the policy to child agents, delegated sessions, and guardian review sessions. Hosts must reapply the policy when resuming a thread from storage.
## Testing
Add coverage for all three policies across turns, including unchanged session and thread headers. Extend subagent coverage to verify inheritance of the default and omitted-key policies.
GitOrigin-RevId: f9e8ab31fcf568636f9712726760e4e9a4672428
## Why
Polling a failed background compaction consumes the closed oneshot receiver.
Keeping that receiver in session state can cause a later await to panic instead
of falling back to foreground compaction.
## What changed
Remove the receiver from session state before polling it, restoring it only when
its result is still pending. Discard closed receivers so compaction can fall back
normally.
## Testing
Add a regression scenario where background compaction fails before the next
checkpoint and automatic compaction falls back successfully.
GitOrigin-RevId: 1461bb403f4b0b8b7e171d1b3cba41411f2014b4
## What changed
Default `features.multi_agent_v2.preserve_fork_prefix` to `true`, so full-history forks retain the parent's model-visible history and append child instructions. Keep `preserve_fork_prefix = false` as an explicit opt-out for instruction filtering, and update the configuration schema documentation.
## Testing
Update coverage to verify inherited prefixes across child and grandchild forks, child instruction ordering after compaction, and explicit filtering opt-outs.
GitOrigin-RevId: f14eae5b924cdeac555d112d0aba3fbbb063b0ea
## What changed
Add `experimentalDisablePredictionMcp` to `thread/fork` and `disableMcp` to `thread/sample`. Disable MCP servers when requested and the inherited history contains incremental tools on Responses Lite. The fork option requires `experimentalPredictionMode: true`.
Apply disablement through a thread-local policy that excludes configured MCP servers and runtime contributions, including after MCP refresh. Preserve the inherited history prefix and append tool-removal instructions without changing the parent's tools.
## Testing
Add coverage for prediction forks with legacy and paginated history, flag validation, conditional disablement, MCP refresh, and sample/fork request parity. Add a request-history snapshot covering preserved history, tool removal across child turns, and unchanged parent tools.
GitOrigin-RevId: e31d602480e6550ed130d8152f538b8668280fa0
## Why
Cancelled or timed-out Guardian reviews can admit transcript evidence without completing a review. Reusing that session can leave subsequent reviews without the evidence they need.
## What changed
Mark interrupted reviews for rollback to the last completed review instead of reusing their live context. Preserve committed review history and replay pending evidence on the next review.
## Testing
Add cancellation and timeout regression coverage that verifies encrypted evidence appears exactly once in the next review, the last completed review survives rollback, and interrupted or denied commands do not execute. Update session disposition assertions and make the program-change session reuse test wait for review completion before releasing the classifier result.
GitOrigin-RevId: f39552b24db5309cffddd9eda97280256be3e97b
## Why
Enterprise-managed MCP authentication requires the thread's admitted connection. Bulk `mcpServerStatus/list` requests need to use that connection to report the enterprise server's catalog consistently with single-server requests.
## What changed
- Read enterprise server metadata from the thread runtime when listing all MCP servers, preserving ordinary server discovery.
- Check the expected server registration before discovery so edited or disabled registrations cannot reuse an old connection's catalog.
## Testing
Add coverage for bulk and single-server status consistency, catalog metadata, and registration changes. Extend enterprise authentication lifecycle tests to cover bearer renewal, grant replacement, and logout during a pending exchange. Add a scenario asserting that enterprise sign-in failure preserves ordinary MCP tool schemas, calls, and model history.
GitOrigin-RevId: 3bf3bd672511d0c753cd95ec777892f72bd6eb89
## Why
Full-transcript fallback can select encrypted agent messages already present in the reviewer's history. These duplicates should not consume the input budget or displace new evidence.
## What changed
- Reconcile native agent messages with the effective reviewer history and earlier messages in the pending input before budgeting, including after compaction.
- Deduplicate messages with nonempty IDs while preserving messages without IDs. Allow delivery again when the prior copy is absent from the current history.
- Reject conflicting authors, recipients, or content under the same ID without modifying the pending context.
## Testing
Add coverage for duplicate admission, conflicting payloads, redelivery after history removal, and retained reviewer requests. Extend the history eviction regression to verify that full-transcript fallback reuses the reviewer and preserves a single encrypted agent message.
GitOrigin-RevId: 97e90f6359a7cf5a75d1c5967fc98cd885afb4e4
## Why
Temporary environment attachments for a parent turn should not become a
subagent's persistent environments. Children also need to retain their
configured executor bindings when their runtime is evicted and reloaded.
## What changed
- Add the disabled-by-default `subagent_thread_environments` feature flag.
When enabled, both subagent implementations inherit configured thread
environments captured with the invoking step, excluding turn-only attachments.
- Track configured bindings separately from active turn attachments, preserving
pending configuration ownership and sharing completed executor startup.
- Retain configured selections and bindings across idle eviction. Reload children
using retained bindings when the parent changes workspace, while continuing to
validate current parent roots and permissions for matching workspaces.
## Testing
Extend regression coverage for configured, empty, forked, pending, and legacy
inheritance; temporary attachment removal across eviction; and reload behavior
with changed workspaces, deferred startup, and restricted permissions.
GitOrigin-RevId: 15692ecd99deb38002014b44fd859d793bd54373
## What changed
Mark `incremental_tools` as stable and enable it by default. Responses Lite sessions now append tool catalog updates to request history without requiring an explicit feature opt-in.
## Testing
Run the incremental catalog scenario with the default configuration. Update assertions and snapshots for empty Responses Lite prewarm input, tool declarations on the first turn, preserved compaction history, and tool changes across model switches and child agents.
GitOrigin-RevId: 27aa6b8499d76ab12167470748452f47e14dd900
## What changed
Add `approved_prefixes` to catalog permission messages, with `{{ approved_prefixes }}` substitution for the approved command list. An empty template suppresses the section; missing or null values retain the bundled template.
For `on-request` approvals, append an explicitly supplied prefix template even when the catalog also supplies approval instructions. Use the template for bundled `on-request` and granular approval instructions as well.
## Testing
Extend the remote model catalog integration test to cover custom prefix rendering alongside catalog approval instructions and suppression with an empty template.
GitOrigin-RevId: 82dd6f83caa56cab0a2f6343bf912efe2cb97d64
## Why
Skill tools depended on World State rendering to initialize their catalogs and could return `skill catalog is not ready for this step` before rendering completed.
## What changed
- Add an asynchronous `ToolContributor::prepare_for_step` hook and await all contributors before constructing tools.
- Prepare immutable skill catalogs, aliases, plugin policy, and configuration for each step. Tools, invocation detection, and World State rendering consume the prepared state without relying on rendering to perform discovery.
- Apply configuration reloads to subsequent steps while preserving live authorization checks for skill reads.
## Testing
Add coverage for preparation completing before tool construction and World State rendering, skill tools working before rendering, catalogs remaining stable across steps, and configuration reloads during discovery.
GitOrigin-RevId: 1fb95c58c412488353f3bd4403824d6d1476d3d0
## What changed
Stop emitting the warning about long threads and repeated compactions after successful context compaction. Update compaction, resume/fork, and window-header tests to wait for turn completion without expecting the warning.
GitOrigin-RevId: 707dc2dd21765ec46522276715c96cf7a112654d
## What changed
- Record review attempt counts and final outcomes with a `retried` tag.
- Measure retry waits by failure reason and whether the wait ends in a retry, cancellation, or deadline; count retries only when another attempt will run.
- Count required synchronous reviews with the `required_sync` route.
- Use the originating turn's telemetry for Guardian reviews so metrics retain that turn's model attribution.
## Testing
Add metric assertions for attempt counts, retry outcomes, and waits interrupted by cancellation or deadlines. Extend the delayed cached-score integration test to verify route and retry-wait metrics use the originating turn's model after a model override.
GitOrigin-RevId: 681a719ad5dd9e4436cb37b6f5f972cb11a5c890
## What changed
- Remove `subagent_thread_environments` and the separate configured environment bindings. Spawned agents inherit the invoking step's environment snapshot.
- Retain environment selections across child eviction without retaining executor bindings. Reload V2 children against the parent's captured environments, requiring matching environment IDs, working directories, and workspace roots while preserving permission validation.
GitOrigin-RevId: d820c63ea20f5834ed88071d16c60683f2545406
## Why
A skill can be available from Cloud and multiple executor environments. Reading its instructions needs to expose where supporting files live and allow discovery of locations omitted by response limits. Package aliases also need to keep identifying the same roots as catalogs change.
## What changed
- With executor capability discovery V2, add `skills.installations` to list enabled locations with source filtering and pagination, without reading skill contents.
- Let `skills.read` select Cloud or a specific executor environment through `source`. Return bounded installation metadata and an `installations_truncated` flag so callers can retrieve omitted locations.
- Share bounded, append-only alias assignments between catalog rendering and tools within a live thread. Preserve each step's alias snapshot and render only root mappings used by its catalog entries.
- Use discovery-root metadata when constructing executor skill locators, with a fallback when it is absent. Preserve the legacy read response and tool set outside discovery V2.
## Testing
Add coverage for installation filtering and pagination, response budgets, source-specific reads and cursors, and alias stability across catalog and plugin changes. Add an end-to-end scenario that discovers an omitted installation and reads its instructions from the selected environment.
GitOrigin-RevId: a04e51e8242b21288d9d7b822780f9f1e093151d
## Why
Temporary environment attachments for a parent's turn should not become a child's persistent environment configuration or survive child eviction.
## What changed
- Add the default-disabled `subagent_thread_environments` feature flag. When enabled, subagents inherit configured thread environments captured with the spawning step instead of active turn selections.
- Track configured bindings separately from turn attachments, preserving pending configuration ownership when turn selections change.
- Retain configured bindings across child eviction and reload, excluding temporary attachments. Preserve the child's workspace when the parent switches workspaces, while enforcing current roots and permissions when the parent still configures the same workspace.
## Testing
Extend coverage for both multi-agent versions, forked children, empty configured environments, pending configuration, and legacy inheritance. Add eviction and reload cases covering temporary attachments, workspace changes, deferred executor startup, and permission validation.
GitOrigin-RevId: 4533645503d5f863a9ccc064386ed7ca169d98b7
## What changed
- Build executor skill catalogs from discovery V2 inventories without reopening host paths or falling back to legacy discovery.
- Merge Cloud and executor skills by remote plugin identity and skill name, retaining Cloud metadata and accepted provider read routes. Apply plugin selection and disablement before merging.
- Share a stable catalog across each step's rendering, list/read tools, and explicit and implicit skill invocations.
- Preserve unmatched executor entries when Cloud catalogs are unavailable or partial; only complete Cloud catalogs disable unmatched remote entries.
- Bind discovery caches to captured environments and executor sessions, and refresh MCP when V2 inventories change. Preserve pending invalidations when forced MCP refreshes fail.
## Testing
Add regression coverage for V2 inventory sharing and refresh, environment isolation, catalog merging, partial Cloud results, disabled plugins, and catalog consistency across steps and read routes.
GitOrigin-RevId: 842bdcbc9e19364dd69a9abf9e48330b7425a76c
## What changed
- Use V2 discovery inventories for plugin MCP contributions when supplied, including empty or failed inventories; retain legacy discovery when no V2 snapshot is supplied.
- Merge plugins by canonical identity, using cloud metadata and enablement for remote plugins and attaching executor installations only when versions match. Preserve configured executor-local plugins and executor enablement when cloud data is unavailable.
- Keep installation order stable across refreshes and run merged MCP declarations on the first retained executor installation while preserving attribution for the others.
- Carry local and remote identities through selected-plugin snapshots, skill attribution, and active-plugin telemetry. Track disabled plugin IDs alongside disabled roots.
- Preserve a complete cloud catalog when a partial refresh arrives, and cap tool-description plugin attribution at 1,024 bytes while retaining all plugin associations.
## Testing
Add coverage for catalog parsing and reconciliation, enablement and discovery-mode selection, installation refresh ordering, executor-specific MCP normalization, selected-plugin snapshots, and bounded UTF-8 attribution text.
GitOrigin-RevId: a8ad352de6a2b8dc4bfd1ff6a5c62ee8ed1d1664
## Why
Turn recovery and retries after a server overload can leave consecutive reasoning effort updates in history when settings change without an intervening message. Requests should use the latest update in each consecutive run.
## What changed
Coalesce adjacent `configuration_update` items when building Responses requests with reasoning effort overrides enabled, retaining the latest update. Preserve saved history and updates separated by other input items.
## Testing
Extend integration coverage for recovery with unchanged or changed effort, retries after a server overload, and WebSocket continuation and replay after coalescing. Verify that requests retain the latest adjacent update while saved history keeps all updates.
GitOrigin-RevId: bcf97db4c93dac5f466bd276176ac9d238329ecd
## Why
MCP tool hooks need to invoke model-hidden tools even when a subagent's cached server has not started. Their timeout must also cover server startup.
## What changed
- Let cached servers with allowed model-hidden tools remain dormant until called.
- Wait for the selected server when executing an MCP hook, leaving unrelated cached servers dormant, and apply the hook timeout to the entire operation.
- Capture tool namespace attribution after startup and retain it only while catalog revisions remain unchanged.
- Validate the server, environment, and tool filter before starting a server or capturing attribution.
## Testing
Extend integration coverage for cached subagent hooks under both startup readiness modes, startup timeouts without context injection, and namespace attribution for hook and token-budget context while keeping tools hidden from the model. Verify that a direct call starts a cached server whose tools are hidden from model exposure.
GitOrigin-RevId: 7a54b69aa2515722aeb925e03e1667bf63aa67ca
## What changed
- Add `PreModelRequest` and `PostModelRequest` hooks around model request attempts, including retries. Pass model, session, turn, and optional subagent context; report completion, failure, or cancellation with errors and token usage when available.
- Treat hook output as diagnostic data without allowing it to veto requests or alter model context. Wait for synchronous post-request hooks before dispatching tools, while asynchronous hooks allow streaming tool dispatch to continue.
- Apply memory-consolidation hook filtering and expose the new events through configuration, protocol schemas, generated clients, and the hooks browser.
## Testing
Add integration coverage for failures and retries, ignored control directives, cancellation, synchronous and asynchronous tool ordering, interrupted-turn resume and token accounting, and memory-consolidation filtering. Update hook schema fixtures and hooks browser snapshots.
GitOrigin-RevId: 6ed7b39fc8bb94cf467e350d07d97fcc729c21ce
## Why
A worker can finish after its parent has returned a final answer. Agent messages without `trigger_turn` previously needed an outstanding durable sleep to wake an idle session.
## What changed
Add the disabled-by-default `wake_on_agent_messages` feature to start a new root turn when agent mail arrives through direct delivery or the host mailbox. Reuse the previous turn context for messages without `trigger_turn`. Keep these automatic wakes disabled for interrupted sessions, Plan mode, and child agents.
## Testing
Add coverage for both delivery paths waking a completed root exactly once, child completion waking a parent after its final answer, and the interruption, Plan mode, and child-agent boundaries.
GitOrigin-RevId: f1a4fc7c22be8ca46b2173a85445126cbdd6c4b6
eknight-oai