## What changed
- Advance the pinned `tokio-tungstenite` and `tungstenite` fork revisions and update the Cargo and Bazel lockfiles.
- Use `OAuthCredentialsStore::File` in the gateway credential test to avoid spending the model discovery deadline on keyring-backed decryption.
GitOrigin-RevId: 2862850215abce478136137b9b68a37f3caaeed4
## What changed
- Expose `RequiredCyberAccessPrograms` so hosts can require an explicit allowed program on a thread. Snapshot the requirement before extension callbacks; hosts must reapply it on cold resume.
- Validate resolved `access_programs` before HTTP and WebSocket model requests, rejecting omitted or disallowed programs. Explicit `Standard` remains distinct from omission. Reject memory summarization and realtime requests when a requirement is present.
- Keep required programs scoped to the parent thread by preventing Guardian reviewers from inheriting its program, including Guardian v2 reviews.
## Testing
Add HTTP and WebSocket coverage for allowed programs, omission, disallowed programs, unsupported providers, and connection reuse. Extend Guardian tests to verify parent-only program scope and that removing the public attachment does not erase the startup snapshot.
GitOrigin-RevId: 9306a9af0e03e7a1728dfeb610cd7ec7517367fd
## What changed
- Configure Bazel to apply `opusic_sys_install_headers.patch` to `opusic-sys` with `-p1`.
- Run the cloud-managed MCP OAuth test with `--no-browser` and keep stdin open until the child exits so EOF cannot race the HTTP callback.
- Serialize the cancelled-refresh test with other auth environment tests and temporarily clear the access-token environment variable.
GitOrigin-RevId: ad76b72ae98320bd0e3ff3231e1ed874332ce38c
## Why
Registry `401` responses during harness key validation previously produced generic relay resets, causing recovery to retry rejected executor credentials instead of surfacing the authentication failure.
## What changed
- Send an authenticated Noise handshake rejection for registry `401` responses without opening an application transport.
- Propagate the rejection as `EnvironmentRegistryAuth` and preserve it in the terminal connection state so recovery stops with a specific authentication error.
- Preserve registry HTTP status codes so `403` responses for stale harness grants and transient service failures can continue through recovery.
## Testing
Add tests that reject tampered authentication rejections and exercise session recovery: `401` stops after one rejected recovery attempt, while `403`, `502`, and `503` retry with fresh harness grants and reconnect successfully.
GitOrigin-RevId: 9a55412e583146c094948618c7c9aeb4fb4b953e
## What changed
- Select fresh authentication for each HTTP operation on eligible OpenAI MCP connections while preserving the connection's credential source and account network policy. Stop redirects when requests carry runtime assertions.
- Pass the owning thread's authentication and runtime context through app discovery, connector metadata, and trusted-access requests. Include the runtime authentication mode in MCP connection and tool-cache identities.
- Give resumed actors analytics clients bound to their own authentication context, and serialize stored-credential reloads with token refresh while preserving host-provided credentials.
## Testing
Add coverage for fresh request assertions, revoked account policies, redirect handling, resumed-actor isolation, and MCP uploads in dual-header and assertion-only modes.
GitOrigin-RevId: f06900a6db61cd6cf53c3aa8075afeec4d5706d9
## What changed
Add `CloudRequestHandle::submit_user_message` to submit a message with a stable ID using `SubmissionMode::Steer`. Return a `CloudUserMessageReceipt` that distinguishes started, steered, and duplicate admissions while preserving server-provided turn status and duplicate identity.
Report preflight rejections and invalid requests as `-32602`, while preserving uncertain admission outcomes as errors without automatic retries. Keep existing `turn/start` callers on `StartIfIdle` with their existing response and error behavior.
## Testing
Add receipt mapping tests and a mock-server worker test covering submission modes, single admission attempts, uncertain outcomes, input validation, and disconnected reply streams.
GitOrigin-RevId: eba120cf47cf0297b072ea373341ead663fb9bc9
## Why
Legacy `.sandbox-bin` ACLs grant `SYSTEM` Modify access without `WRITE_DAC`, preventing the provisioning service from reapplying the bin policy.
## What changed
- Grant `SYSTEM` inheritable `WRITE_DAC` access when protecting the sandbox bin so it can update permissions on the directory and its children.
- Before legacy provisioning, repair the old ACL through an authenticated owner handle when `SYSTEM` is denied access. Upgrade only the expected SYSTEM entry in a protected, allow-only ACL, reject unexpected permissions, and verify that `SYSTEM` can reopen the directory with `WRITE_DAC`.
## Testing
Extend ACL coverage to check `SYSTEM` permissions on the bin and existing and newly created runner files. Add an ignored Windows integration test requiring LocalSystem and user-owned legacy homes to cover successful repair, repeated repair, and rejection of an explicit SYSTEM deny entry.
GitOrigin-RevId: 2303cdf5182947c2d044c79ac7027a16f0373c7d
## Why
Explicit cyber access program selections were dropped for requests using `CodexAuth::Headers`, preventing the server from evaluating the requested program.
## What changed
Forward explicit program selections for header-authenticated requests, leaving entitlement decisions to the server.
## Testing
Add integration tests covering explicit selections and omission over HTTP and a reused WebSocket connection, preservation of actor and account headers, and propagation of backend HTTP 403 denials without dropping the selected program.
GitOrigin-RevId: 5e549e87a1420ce8a5f1ce5c704cc6b7630af3ba
## What changed
- Open a sidebar chooser when no side chat exists, with keyboard and mouse controls to start a new side chat while preserving the parent draft.
- Animate sidebar opening and closing, including reversing an unfinished transition, when animations are enabled.
- Show context-aware workspace shortcuts in a floating panel after a short delay, and render presets in the same overlay without moving the composer.
- Prevent chooser input from accepting an approval dialog before it has been painted.
## Testing
Add coverage for chooser activation and draft preservation, sidebar animation reversal, shortcut and preset snapshots, and approval input handling.
GitOrigin-RevId: 014112622a94798f4e611756c55112dfd8016051
## What changed
Require the `openai` provider ID as well as `GuardianNativeMultiAgentHistory` to enable native agent history and review of multi-agent calls. Apply the same check to Guardian prompt construction, collaboration tool registration, and Guardian v2 configuration.
## Testing
Add coverage for fresh and resumed sessions with the feature enabled and disabled on OpenAI, and enabled on Bedrock and LiteLLM. Verify that only OpenAI sessions with the feature enabled request native review and include the agent call as evidence.
GitOrigin-RevId: bfbe547b0544e66763dca7d1e1376f805994bcb2
## Why
Versions of `ignore` differ in whether parallel walks report traversal errors at the depth boundary, making the test's expectation depend on the walker implementation.
## What changed
Keep the denied directory within the bounded scan depth in `unreadable_glob_traversal_errors_fail_closed`. Require both bounded and unbounded scans to fail with the denied path and permission error, replacing the CPU-count-dependent assertion.
GitOrigin-RevId: 4ed97253247e0c032648ebc6d4be2a97c3ab261a
## What changed
Extend `guardian_review` to assess recorded MCP tool calls using the current tool catalog, bindings, and approval policy without executing the call or remembering an approval. Return no assessment when policy or a remembered approval skips review, and reject tools blocked by app configuration.
## Testing
Add a scenario test that compares direct and live MCP review inputs, verifies that neither dispatches the tool, and checks that the current app approval policy can skip review.
GitOrigin-RevId: 05746dd0804a0f96d7946468701d5222171ff64f
## Why
Multi-agent V2 still supplied native tool usage guidance when native tools were disabled, leaving instructions for unavailable tools in model requests.
## What changed
Skip bundled and model catalog role guidance for both root agents and subagents when `disable_native_tools` is enabled. Preserve explicitly configured usage hints.
## Testing
Add coverage for omitted bundled and catalog guidance and preserved configured hints with native tools disabled. Update the request snapshot and assert that spawned agents do not receive native tool call guidance.
GitOrigin-RevId: 6f2facabc95e78cbf64af19636a4daf488bbcc51
## Why
Idle reads from local MCP servers on Windows can occupy Tokio's blocking threads and delay unrelated filesystem operations.
## What changed
Use IOCP-backed named pipes for local MCP server stdin, stdout, and stderr on Windows. Connect child endpoints before launch, restrict pipe access to the owner and SYSTEM, and reject remote clients. Preserve the shared legacy and modern protocol framing.
## Testing
Add Windows regression tests to verify that idle MCP reads leave blocking I/O available in both protocol modes and that child output handles support querying the pipe mode.
GitOrigin-RevId: ca39b940a54427a2cd7bab5291011b0b09143b3f
## What changed
Expose `AgentTurnOutcomeReporter` for hosts to install through `StartThreadOptions::thread_extension_init`. Await its callback after emitting the terminal turn event, independently of native parent notifications, so hosts can handle result delivery and retries.
Track outstanding outcome handoffs and wait for them during graceful shutdown before running thread-stop hooks. Prevent new turns from starting once handoff registration closes.
## Testing
Add integration coverage for completed and errored outcomes, turn lineage, queued follow-up turns, and shutdown waiting for handoffs. Extend Guardian tests to verify that strict safety stops reach the reporter while default interruptions remain silent.
GitOrigin-RevId: 0d825f6208f0250969734488881f32fd1dcd7509
## What changed
- Add Space to set the default provider from Model providers settings, persisting `model_provider` on the connected server. Keep provider details available and disable selection when server configuration or client launch settings fix the provider.
- Apply the choice to `/new` while preserving the current chat. Refresh account details for new chats and reject account data that does not match the started provider.
- Block stale `/model` choices during saves and after confirmed or uncertain provider changes, including across reconnects. Tell users to restart the app server and TUI to refresh the model list, and discard queued picker actions from another backend or chat.
## Testing
Add coverage for provider saves, retry after disconnection, concurrent-save prevention, stale model choices, and account/provider matching, with updated provider-picker snapshots.
GitOrigin-RevId: af6d149f7de7a2eaa09a31935f7088faa64d6a59
Document that `AgentMessageBoard` notification delivery follows the host's
scheduling and wake policy and may buffer notifications for idle recipients.
Link to `MessageBoardHost` for the delivery contract.
GitOrigin-RevId: fb085fe2c43c74b85b4e6fe471e7d4ae216bf3db
## What changed
Replace external `rg` scans and the fallback walker with an in-process `ignore` walker for bubblewrap deny-glob expansion. Remove scanner lookup and dependency tracking from sandbox integrity checks.
Include hidden and ignored files, respect scan depth limits, and fail closed on traversal errors. Anchor patterns to their static search roots and preserve literal leading `#`, leading `!`, trailing spaces, and unclosed character classes. Follow explicit symlink roots while skipping child symlinks, and mask canonical targets of matched paths.
## Testing
Extend unit and sandbox integration coverage for glob syntax, depth limits, traversal failures, symlink handling, commands launched from `/`, and operation without executing `rg`.
GitOrigin-RevId: 1767d7f37acb149457642bf24ee5971a28696438
## Why
Matches in parent directory names can crowd matching filenames out of limited search results. For example, searching for `ViewModel` should keep `ChatViewModel.kt` visible even when many directories are named `viewmodel`.
## What changed
- Rank basename matches before applying the result limit for single positive fuzzy queries without path separators.
- Prefer exact filenames, then the strongest exact directory match, then other matching filenames. Leave additional directory matches ranked by their paths.
- Compute highlight indices from the basename for promoted results and return scores that reflect the new ranking.
- Rank snapshots in resumable time slices so new queries and cancellation can interrupt the work.
## Testing
Add regression coverage for filename matches surviving the result limit, exact file and directory priority, path queries, and resuming partial rankings. Update app-server score expectations while preserving highlight indices.
GitOrigin-RevId: 41b3420581b4f6490859e809245370b737889544
## Why
A tool can start before an assistant message finishes streaming. The TUI needs to incorporate the completed text without duplicating the reply or leaving Markdown split across interrupted fragments. Some streams also include initial text in `item/started` before sending deltas.
## What changed
- Display initial assistant text from `item/started`, avoiding duplicate starts for the same message.
- Track interrupted replies by turn and item ID, then replace their flushed fragments with the completed message at the reply's original position, preserving intervening tool order.
- Re-render the completed Markdown and update transcript views and scrollback.
## Testing
Extend streaming tests to cover initial text, resumed deltas, Markdown spanning a tool interruption, and matching live and replayed transcripts. Expand completion-repair cases to cover missing text and resumed fragments.
GitOrigin-RevId: 7f35e52d0bca2100baf722d7ef4922cd127bbc45
## Why
Reasoning summaries can arrive with item start or completion events rather than streamed deltas. The TUI can miss or truncate these summaries, and replay after a voice handoff can hide reasoning that started before the handoff.
## What changed
- Initialize reasoning from item start payloads and reconcile live and replayed completions with their full summaries. Preserve streamed text when completion payloads are empty, and continue honoring `show_raw_agent_reasoning`.
- Retain active reasoning payloads across refreshes without resetting an already active item when its start event is replayed.
- Preserve the typed origin of reasoning started before a voice handoff and filter later delegated reasoning starts from buffered replay.
## Testing
Extend regression coverage for summaries supplied at start or completion, partial streamed summaries, active reasoning after refresh, and replay that retains pre-handoff summaries while hiding delegated reasoning even after the handoff marker is evicted.
GitOrigin-RevId: 724b9fc58e10f4d87dabd3d9930e252270855a4f
## What changed
- Map thread listing and creation, paginated turn and item history, and turn submission and interruption to Cloud operations.
- Mark listed and activated threads as using paginated history, and warn when history items cannot be displayed.
- Reject unsupported filters, custom settings, and structured input. Require stable submission IDs and avoid returning a running turn for duplicate or queued submissions.
- Forward optional `turn_trigger` values through the Cloud client.
## Testing
Add coverage for resume-picker pagination, unsupported filters, submission IDs and settings, duplicate and queued admissions, and `turn_trigger` wire encoding.
GitOrigin-RevId: dcbd87d8190786da65e343a3a0f8d849b24a5b26
Give each independent MCP server and session setup its own test identity
and timeout budget by replacing nested loops with `test_case::test_matrix`.
Preserve all 64 configuration combinations and the existing assertions for
direct tool exposure, tool search availability, and advertised tool calls.
GitOrigin-RevId: 74ef56d34b6bab3038b70d7d84183f7d104788a2
Move channel notification formatting into `PostPreview::notification_text()` and use it in the local message-board host. Preserve the notification fields, preview text, and `read_post` hint for truncated posts.
GitOrigin-RevId: fd3596c45194c958817a24f8fc35a886f766a84b
## What changed
Remove `summarize_sandbox_policy` and its public export from `codex-utils-sandbox-summary`, leaving `summarize_permission_profile` as the summary API. Migrate the external-sandbox, read-only, and workspace-write summary tests to permission profiles.
GitOrigin-RevId: 2ea039a2573e05c17edb8356aa7e04e065ef592a
## What changed
Add a `Housekeeper` that uses an isolated reviewer runtime to route captured original evidence into topic channels and update their discovery descriptions. Keep originals intact and batch inputs within the selected model's tool-output budget.
Validate routing responses before writing to the message board. Advance the evidence cursor only after all writes succeed, stop the worker after an error, and return the runtime disposition so callers can manage session reuse.
## Testing
Add integration coverage for routing originals to multiple channels, updating descriptions, preserving capture boundaries, batching within the input budget, and leaving the cursor unchanged on write failure.
GitOrigin-RevId: 670508c7ecf2ddffdd2946f1b25dd7e071318c5a
## Why
Evidence capture previously reloaded the full history without tracking consumer progress. Live consumers need to read new originals from activation onward and acknowledge them after downstream writes succeed.
## What changed
- Add an in-memory `EvidenceCursor` that starts at the current complete tail without backfilling, captures a fixed unread range, and supports partial acknowledgements. Reads leave progress unchanged.
- Add `ThreadStore::read_original_history` to read original records and their source positions through a fixed cutoff. Local storage supports append-only paginated root histories, including compressed rollouts, and defers unfinished records.
- Reject unsupported histories and invalid ranges, and retain source ordinals as evidence IDs.
## Testing
Add coverage for partial records, compressed suffixes, fixed cutoffs, mismatched thread positions, and truncation. Extend evidence tests to cover activation without backfill, partial acknowledgements, later appends, stale captures, and unchanged cursor progress after capture errors.
GitOrigin-RevId: c7a13749fedc4f44fadddc9dd9875043bccebd95
## What changed
Add `EvidenceSnapshot::capture` to read original evidence from `ThreadStore` into an immutable snapshot with root-history ordinals. Preserve accepted user messages, assistant messages, tool activity, verified answers, delivered assistant messages, and host-annotated approvals without changing their contents or provenance.
Exclude generated context and compaction output. Reject forked or reverted histories, inherited or ambiguously attributed user messages, and incomplete retained evidence. Capture currently supports append-only root histories and requires the host to flush pending originals first.
## Testing
Add an integration test covering content preservation, generated-context filtering, approval provenance, isolation from later appends, and rejection of ambiguous user messages.
GitOrigin-RevId: f464a2714c2678bcffe7abf0a8224196bfe48692
## What changed
When `features.guardian_denial_reconsideration` is enabled, retry the first terminal denial once using the unchanged inference request. Buffer provisional output so only the selected response enters reviewer history, while allowing tool calls to proceed normally.
Preserve the original denial if the retry fails or times out, and continue to honor cancellation. Account for token usage from both attempts, including failed reviews.
Remove `auto_review.experimental_denial_reconsideration_prompt` and warn when it remains in configuration.
## Testing
Update the Guardian scenario and snapshot to verify identical retry inputs, retained tool evidence, and reuse of the selected assessment in a subsequent review, with asynchronous compaction enabled.
GitOrigin-RevId: cc4e303d40a02acc824c8b4b954852325e64ad52
## Why
Guardian scoring and cached approvals need to use the requesting turn's captured policy even when the live thread configuration changes. Newly tightened mandatory review requirements must still prevent cached approvals.
## What changed
- Pass captured turn configuration through tool lifecycle and approval review inputs, and use it to resolve Guardian policy and classifier instructions.
- Apply current reviewer and model requirements before scoring and cached approval, including rechecking restrictions after collecting score authorization.
- Count computer-use JavaScript execution attempts even when background scoring is disabled, so a synchronous call consumes the initial-call allowance.
- Retain runtime configuration snapshots when applying agent role overrides, and share Guardian policy text resolution between configuration loading and runtime publication.
## Testing
Add and extend regression coverage for captured policy instructions, reviewer restrictions, stale cached evidence, and a synchronous computer-use call followed by an adaptive turn.
GitOrigin-RevId: 24ed4a1b6ce1733ad775790f30e440da614f9cd6
## Why
`pin-utils` 0.1.0 is unmaintained with no patched release and remains a transitive dependency through AWS Smithy and `loom` under `tokio-graceful`.
## What changed
Add `RUSTSEC-2026-0441` to the ignore lists in `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml`. Document the dependency paths and remove the exception when they drop `pin-utils`.
GitOrigin-RevId: 803d519ad3ad044d49d73ff2a172c6e0b01fc8d3
## Why
A Code Mode script can start a command without returning its session handle. Make retained sessions visible to the model so it can find running commands and collect exited results with `write_stdin`.
## What changed
- Add the disabled-by-default `command_sessions_world_state` feature.
- Publish snapshots of up to 16 retained sessions with their IDs, running or exited status, and whether they are in use. Report omitted sessions and suppress unchanged updates.
- Preserve session visibility when `write_stdin` is unavailable and refresh snapshots after compaction. Clear stale session handles after restart or when the feature is disabled.
## Testing
Add an end-to-end scenario and model-visible history snapshot covering a dropped command handle, unchanged state, unavailable polling, compaction, exit and result collection, and stale-handle cleanup after restart.
GitOrigin-RevId: 45704d8c6403149997231aafb8496c12879aff23
## What changed
Remove `dynamic_network_policy`, which only converted `SandboxPolicy` to `NetworkSandboxPolicy`. Update the Seatbelt network policy tests to call `dynamic_network_policy_for_network` directly with explicit `Restricted` or `Enabled` policies, preserving the existing assertions.
GitOrigin-RevId: 8d712cc542a07e516de677d69499aff7f3918354
## What changed
Allow experimental clients to request `deferOutput: {"commandExecution": true}` in `thread/items/list` for a specific `turnId`. Completed commands with a recorded completion time, exit code zero, and nonempty saved output return `outputDeferred: true` and `item.aggregatedOutput: null`. Clients can retrieve the complete output through `thread/items/read` using the turn and item IDs.
Keep full output by default and for listings across turns. Make conversion from `ThreadItemEntry` to `ThreadItem` fallible so Rust consumers detect deferred output instead of treating an incomplete item as complete.
## Testing
Add integration coverage for experimental capability gating, default and disabled options, command status and output eligibility, listings across turns, deferred-item conversion, and full output retrieval by item ID.
GitOrigin-RevId: d6bfac34bb68f7e3b327fd5553270ed6d0fe87cf
## What changed
Add the disabled-by-default `async_compaction_root_only` feature flag. When enabled, it restricts background compaction to root sessions, excluding non-root agents. Expose the flag in the configuration schema.
## Testing
Add a parameterized test covering root session eligibility and eligibility for review subagents and guardian sessions with the flag enabled and disabled.
GitOrigin-RevId: b4cce3f24f7f418ae61a82a7aef310f849cfd532
## What changed
Add configurable pane actions with default leader shortcuts:
- `leader z` zooms or restores the focused conversation pane.
- `leader ,`, `leader .`, and `leader =` minimize, maximize, or equalize pane widths within layout limits.
- `leader shift-h` and `leader shift-l` move the divider while the side pane has focus.
- `leader r` enters resize mode, highlighting the divider and showing keyboard hints. Arrow keys or `h`/`l` move it one column; Shift+Left/Right move it ten columns. Enter or Esc saves the width to `tui.sidebar_width_percent`.
Discard resize previews when terminal focus is lost or the split layout becomes unavailable. Preserve exact column widths at the current terminal size for presets and completed keyboard resizing, avoiding percentage-rounding drift.
## Testing
Extend TUI tests and snapshots to cover zoom and restore, width presets, divider movement, resize previews and persistence, and interrupted resizing. Extend keymap tests to cover zoom binding conflicts and custom chords.
GitOrigin-RevId: 7dd823fd8c2a0c90368c66f254c4fdd7c863c8a8
## Why
Shared hosts serve independent chats and their subagents. Larger callback workloads need room for unrelated work and control messages, while gRPC completion bursts can exhaust HTTP/2's small-DATA-frame budget and disconnect shared sessions.
## What changed
- Raise the active-cell limit from 128 to 2,048 and the pending delegate callback limit from 1,024 to 4,096. Expand request and transport queues to leave room for completion bursts and control traffic.
- Negotiate larger callback budgets through the stdio `delegate-capacity-4096` capability and gRPC `max_pending_delegate_calls` field. Preserve the 1,024-callback budget for legacy clients and enforce both session and shared host limits on gRPC.
- Limit concurrent gRPC completion RPCs to 64 across a provider's sessions, allowing queued completions to be canceled without waiting for delivery capacity.
## Testing
Add stdio and gRPC integration tests covering 256 cells and 4,096 callbacks across shared sessions while unrelated work completes. Add tests for callback budget isolation and reuse, rejection of zero capacity, and cancellation of queued completions. Include an ignored resource-intensive test for full host capacity.
GitOrigin-RevId: e85bfa24cc46cc8a735b464d80adf8066a6a6d3a
## Why
Pets were unavailable in tmux even when fullscreen Codex could render Kitty images through passthrough.
## What changed
- Enable pet images and picker previews in fullscreen tmux panes with Kitty passthrough, and update the unavailable notice to recommend fullscreen mode with `allow-passthrough all`.
- Use pane-specific image IDs and virtual placements for pets and previews, reserving separate IDs from transcript images. Repaint underlying text when pet placeholders move or disappear.
- Draw pets and previews when refreshing the fullscreen transcript, and consume preview areas once per render.
## Testing
Extend the owned-screen lifecycle test to verify that preparing fullscreen enables the Kitty protocol in tmux and returning to scrollback disables it. Update `/pets` notice assertions and the popup snapshot.
GitOrigin-RevId: 02c838ceb06abcbb45314e1d38ff4cde77221426
## What changed
Enable composer and transcript image previews in owned-screen mode under tmux when the client is Ghostty or Kitty, RGB is supported, and `allow-passthrough` is `all`.
Use Kitty virtual placements and Unicode placeholders so images move with their pane. Allocate image IDs per pane and repaint the viewport when replacing or removing images to clear stale placeholders.
## Testing
Extend image rendering tests to cover tmux virtual placements, placeholder snapshots, redraw retention, and overlay cleanup. Add probe coverage for pane-specific image IDs and rejection of visible-only passthrough.
GitOrigin-RevId: d34abacabfabc47a4354eab016ee4370835cadc9
## What changed
- Share the harness runtime identity with analytics delivery and turn-cost queries, and resolve request authentication together with its account-bound transport policy.
- Add runtime authentication to ChatGPT request helpers and `codex cloud`, including environment discovery. Resolve environment credentials for each request and honor CLI configuration overrides when loading cloud authentication.
- Preserve custom-backend authentication, validate runtime destinations, and keep cloud requests from following redirects.
- Forward only organization and project selectors from model-provider headers to API-key analytics requests.
## Testing
Add regression coverage for runtime request signing, credential refresh, account and resource selection, redirect credential handling, custom destinations, and cloud credential-store overrides.
GitOrigin-RevId: 75f33961ee6482881e9ff9817e99d977f31b65b8
## What changed
- Add `--chatgpt-token-stdin` for remote HTTPS registration and optional `--chatgpt-account-id`, which must match the token's account claim when present. Read a bounded, newline-terminated token from a pipe without persisting it to `auth.json`.
- Load managed configuration using the supplied account, enforce account restrictions, and preserve configured policy-server authentication. Skip ChatGPT policy lookup only for known plans that do not require managed configuration.
- Allow `--exit-on-stdin-close` to cancel pending policy loading, and redact the registration bearer from registry diagnostics.
- Reject incompatible stdin credential options, including flags placed on opposite sides of `forward`, and disallow ChatGPT token stdin authentication with `forward`.
## Testing
Add coverage for account-claim validation, policy selection, policy-server sign-in requirements, shutdown during policy loading, credential flag conflicts, and bearer redaction.
GitOrigin-RevId: b6b50565e1f150b96edf3cee796909a991f1b47f
## What changed
- Use the shared runtime and effective configuration for account API clients and remote plugin requests, including standalone plugin commands.
- Support dual-header and assertion-only authentication for remote plugins and MCP file uploads when runtime agent instances are enabled.
- Keep plugin credentials and caches scoped to the thread's account when resuming with different credentials. Bind request pools and multi-step plugin storage operations to the selected account so account replacement revokes stale operations.
- Protect runtime credentials on cross-origin redirects while preserving configured routing policies and legacy authentication for custom backends.
- Apply server-provided `upload_headers` to file storage uploads.
## Testing
Add coverage for shared runtime registration, both authentication modes, configuration reloads, resumed-thread account selection, account replacement during plugin uploads and downloads, and credential stripping on redirects. Extend file upload tests to verify runtime assertions and storage-only upload headers.
GitOrigin-RevId: 68aef81051a6f9bf919fffda52f372b108fce805
Replace loopback TCP sockets with an in-memory duplex connection in
`malformed_handshakes_preserve_active_streams_and_admission_recovers`
so Tokio can advance deadlines after both peers become idle.
Service keepalive pings while waiting for the handshake failure cooldown,
and remove the blocking clock guard and switches to real time for validation
timeouts and connection shutdown.
GitOrigin-RevId: 5c468ee9f150f701a819936322430e23ef3046a7
## What changed
Add a Model providers entry under Sessions to browse the connected app server's provider catalog. Show the current chat's provider and the default for new chats, with scrollable details for endpoints, authentication settings, and provider-specific configuration. Browsing does not change the active provider.
Handle loading, dismissal, stale responses, disconnected servers, and unsupported server versions. Refresh an open provider list when the first chat attaches.
## Testing
Add tests and snapshots covering provider lists, scrollable details, initial chat attachment, nested views, stale results after dismissal and reopening, and unsupported server methods.
GitOrigin-RevId: 2deb4e286b2648d9f459e403361e5501db98ca96
## Why
Decimal IDs of up to three digits fit in a single token. Issuing shorter IDs first keeps identifiers compact in model context.
## What changed
Add `codex-utils-model-facing-id` with deterministic, seed-based ID generation. Each salt prefixes the displayed ID and derives a separate sequence from the session seed. The generator shuffles decimal pools, exhausting `000`–`999` before issuing six-digit suffixes, then expanding in groups of three digits.
Support serializable, versioned snapshots that resume at the next unissued ID, plus suffix-only formatting for protocols that supply their own prefix.
## Testing
Add integration tests for pool exhaustion, stable outputs across pool boundaries, serialization and restore, salt-based seed derivation, invalid snapshots, and wraparound after the last `u64` ordinal.
GitOrigin-RevId: 80ffbf861106980b731d34a61ca2b9448d3bbb0d
## What changed
- Support `canonical_matching=True` in `prefix_rule` and `canonical_matching = true` in managed TOML prefix rules. Apply Unicode canonical caseless matching to every prefix token, including alternatives, while keeping exact matching as the default.
- Match case and canonically equivalent Unicode spellings, such as `bash` and `bAſh`, without resolving executables on the filesystem.
- Preserve managed restrictions when checking absolute-path rule amendments, and enforce applicable `host_executable` path allowlists during basename fallback.
## Testing
Add coverage for case folding, Unicode normalization, token alternatives, exact-match defaults, and host executable allowlists. Extend managed-policy and shell-execution tests to cover canonical matching.
GitOrigin-RevId: c2f79069dc38d55c77028c457b22beb468d5c571
## What changed
- Expose `AgentSessionReader` and `AgentRef` for read-only access to host-owned agent session membership.
- Read direct children when rendering V2 environment context, using the existing roster size limits. Refresh membership when rebuilding context after compaction, and omit the roster if the provider is absent or the read fails.
- Preserve unrecorded initial input across suspension or interruption while waiting for a roster read. Resolve the roster before advancing the compaction window.
## Testing
Add coverage for roster refreshes after compaction, unchanged environments avoiding extra reads, unavailable rosters, recoverable input during blocked reads, and stale compaction results rejected after a concurrent history replacement.
GitOrigin-RevId: 3c7e3822af09e9295d405e53dabb87b020c8f00c
## What changed
Add optional executor workspace roots to `SandboxTransformRequest` and resolve symbolic workspace rules after merging additional permissions. Preserve explicit deny rules and treat an empty root list as granting no workspace access.
Route Windows restricted-token preparation through the shared transform path and use explicit roots when building its direct-spawn wrapper. Update Windows MXC debug launches to bind configured roots before adding the managed CA read grant.
## Testing
Extend sandbox manager tests to cover workspace and subpath expansion, empty root lists, deny preservation, and the roots and write permissions serialized into the Windows wrapper.
GitOrigin-RevId: 0bebdb08b67cbbc182c18b031b9d13a21a799682
Charlie Marsh