## What changed
Add `thread/memory/read` to return `{summary}` for a thread that has been started or resumed. Read `memory_summary.md` from the thread's resolved memory version, honoring thread-specific configuration overrides without falling back to another version.
Return `null` when memory use is disabled or the selected summary is missing, unreadable, or blank.
## Testing
Extend app-server integration coverage to check explicit and automatic memory version selection, disabled memory use, and missing summaries without fallback.
GitOrigin-RevId: b218f31e379c69ccbacb444bb9d6ee920cd4882b
## Why
Concurrent imports and consolidation can modify the same memory workspace, leaving a partial import across memory versions or interfering with consolidation snapshots and baselines.
## What changed
- Add a cross-process workspace lock shared by memory imports and consolidation.
- Acquire locks for every import destination before modifying any workspace. Return a retryable busy error if a destination is locked, and skip consolidation when its workspace is busy.
- Hold locks through import completion even if the caller drops the future, and through consolidation agent termination and baseline finalization.
## Testing
Add an app-server integration test that blocks an active consolidation, verifies import rejection without partial writes or snapshot changes, then retries successfully and confirms imported resources remain visible to the next consolidation.
GitOrigin-RevId: c4ce945f916dcb4d75a3190ea869751fac51de83
## Why
Recording evidence on a message board needs a write operation that does not automatically subscribe the author or notify existing subscribers.
## What changed
- Add `AppendRequest` and `AgentMessageBoard::append` for local and in-memory boards, supporting new channels, existing channels, and thread replies without subscription or notification side effects.
- Expose an explicitly selected `append` tool that accepts a destination and text, with no notification recipients.
- Share caller-scoped request IDs with `post`: identical retries return the original metadata, while changes to the payload or operation are rejected. Local appends retain write permission checks and durable storage.
- Reject remote appends as unsupported without issuing an HTTP request.
## Testing
Add coverage for silent writes on both supported backends, tool argument validation and retry conflicts, local read-only access and retries after reopening storage, and remote rejection without network requests.
GitOrigin-RevId: 01fb9d3e2cfcb3de362b28f2bf2ee83bafada80d
## What changed
Add the `codex-guardian-v3` crate to the Cargo workspace with a Bazel target. Expose helpers to configure the `guardian` storage namespace and construct a `LocalBoard` for the owning main thread's session ID.
GitOrigin-RevId: 3314711475a7024380a3f0beb8f5ddfc4ff19723
## What changed
Register `guardianv3` as an under-development feature disabled by default. Accept either a boolean toggle or a table with an optional `enabled` field, and include both forms in the configuration schema.
## Testing
Add coverage for boolean and table configuration, default behavior, and profile overrides, including inheritance when a profile omits `enabled`.
GitOrigin-RevId: 75333be61b2e336e22fef907d6363b70f9f7225b
## Why
Concurrent tests can reuse a closed file descriptor number, causing cleanup assertions that require `EBADF` to fail even when the inherited directory descriptor was closed.
## What changed
Capture the inherited directory's device and inode before mount verification. Check `/proc/self/fd` afterward and accept either a missing descriptor or one referring to a different inode, while still rejecting a leaked descriptor to the original directory. Apply this check to successful verification and rejected mount markers.
GitOrigin-RevId: 42ff3aebcee9c37c481772f8a425a8643708c426
## Why
The steering test needs to deliver guidance after the first Responses request starts and ensure it is routed before releasing the blocked response. A steering acknowledgement alone does not establish that routing has completed.
## What changed
Wait for the first request before triggering the scripted steering call with an audio frame, then wait for its `handoff_request` notification before unblocking the response. Assert that the steering text is absent from the first Responses request and present in the second.
GitOrigin-RevId: d62f9785624e92774a45857923dab2b903854aea
## Why
Provider errors with code `model_not_found` should end the turn immediately and preserve the provider's message instead of triggering retries.
## What changed
- Recognize `model_not_found` in HTTP 400, 403, and 404 responses and in streamed `error` and `response.failed` events.
- Preserve the provider message and any available HTTP status, and expose `modelNotFound` through the app-server protocol and generated schemas and SDK types.
## Testing
Add coverage for HTTP classification, statusless stream errors, and terminal failures without retries across HTTP, SSE, and WebSocket responses. Verify that `thread/read` preserves the error reported by the live notification.
GitOrigin-RevId: 88f824ac03c8c9669915b1e40c67b76c08326fbe
## Why
External-agent memory imports previously wrote only to the v1 workspace and queued only v1 consolidation, leaving the v2 pipeline without imported resources.
## What changed
- Always import selected resources into `memories_v2`. Also update `memories` when v1 is selected or a legacy workspace exists.
- Read `memories.version` for detection and import, detect pending changes across the applicable namespaces, and enqueue consolidation separately for each updated namespace.
- Combine project results across namespaces so cleanup in either can succeed while failures in either are reported.
- Adapt imported-memory consolidation instructions to the active pipeline's output format.
## Testing
Expand app-server integration coverage for v2 profiles, explicit v1 selection, default profiles, and existing legacy workspaces. Verify resource copies, consolidation queues, repeat detection, and cleanup of deleted or unscoped projects.
GitOrigin-RevId: 7e9206942d63fd55b7f2a7f5f9210b687da6a973
## What changed
Add `auto_review.timeout_ms` to configure the overall Guardian review budget, including setup and retries. Keep the default at 90,000 milliseconds; setting it to `0` disables the review deadline while preserving cancellation, retry attempt limits, and independent transport timeouts.
Carry the configured deadline through review execution and report the configured budget in review telemetry, using zero for unlimited reviews.
## Testing
Add coverage for shared setup budgets, configured timeouts, cancellation with unlimited reviews, and retry attempt limits without a deadline.
GitOrigin-RevId: 00404e0cb2f2cfaf6de183d6e27f5e4a371942a8
## What changed
Add optional `threadSource` to `thread/sample` requests and apply it to the ephemeral fork. Keep `thread_sample` as the default when omitted.
## Testing
Extend sampling tests to assert that turn metadata includes the supplied thread source and retains the default when no source is provided.
GitOrigin-RevId: 8ea941c932267e3bcb9e6b086764ac2795d6edef
## What changed
- Add `attachToSource` to `thread/fork` to persist a fork attached to its source without emitting `thread/started`. Attached forks require local storage and cannot use `ephemeral` or `deferGoalContinuation`.
- Hide attached threads from ordinary listings and add `attachedToThreadId` to `thread/list` for explicit discovery, including empty threads. Keep this relationship separate from spawned-agent parent and ancestor filters.
- Persist attachment metadata in rollouts and SQLite so it survives restarts and database recovery. Reject source deletion until its attached threads are deleted.
## Testing
Add coverage for legacy and paginated history, restart and missing or corrupt database recovery, filtered listings and pagination, resume, conflicting options, and deletion safeguards across store instances.
GitOrigin-RevId: 589f3174fc36f6054e75d65818360695645a5913
## What changed
- Include ready environments' configured hooks in lifecycle events and execute command hooks using each owner's shell, working directory, shell environment policy, and managed network policy.
- Resolve tool environments before `PreToolUse` and use those targets for tool hooks, execution, and permission review. Route MCP hooks by server ownership and file-copy hooks to both endpoints.
- Preserve environment, MCP server, and terminal session selectors across hook input rewrites, rejecting attempts to switch targets.
## Testing
Add regression coverage for permission-request selector preservation, MCP resource hook ownership, and file-copy hooks that rewrite paths while preserving source and target environments.
GitOrigin-RevId: 31a3a6830523965285dab451cfc866c620ef6c83
## Why
Repeated image outputs in different request payloads could fail replay with a call ID reuse error even when their content was unchanged.
## What changed
- Hash canonical JSON for non-text content parts and compare their `content_sha256` values independently of payload location.
- Preserve empty content arrays as empty bodies so they also match across snapshots.
## Testing
Add a regression test verifying that repeated image and empty tool outputs reuse conversation items, while changed image content with the same call and item IDs still fails replay.
GitOrigin-RevId: 07699312675764079f679fd2c12ba6679332d709
## Why
A pending agent-message wake can outlive an interrupt or a switch to Plan mode while model discovery is waiting. It must recheck whether it can start before consuming queued messages.
## What changed
- Revalidate reserved wakes after discovery and build the turn with the configuration selected during admission.
- Mark interrupted wake reservations as stopped so later agent messages cannot restart automatic work, while preserving queued messages for explicit turns.
- Keep finishing turns marked as running until completion is persisted, protecting their rollout writer from capacity eviction.
## Testing
Add regression tests for interrupts and Plan-mode changes during discovery, queued-message preservation, explicit follow-ups with `wake_on_agent_messages` disabled, and completion status and persistence with the feature enabled and disabled.
GitOrigin-RevId: afe1d57063a5ec491e8b16d6c62135caa69c0a3c
## What changed
- Add loaders that select `config_server` when configured and otherwise use the existing ChatGPT bundle source. Fetch custom bundles from `<base_url>/codex/config/bundle` without redirects or request logging.
- Support optional OAuth sessions without interactive login during bundle fetches, recover credentials after a `401`, and scope cached bundles to the endpoint and authorization identity.
- Restrict bootstrap network access to configuration and OAuth endpoints using local administrator rules when available.
- Return generic bundle validation errors so invalid TOML, requirements, and provider settings do not expose configuration contents.
## Testing
Add tests for missing configuration-server sign-in, replacement OAuth credentials, endpoint-specific cache reuse, and validation errors that omit sensitive values while preserving cached bundles.
GitOrigin-RevId: 56590a9e66340540666ca21590bef46c495e0e33
## What changed
- Read optional tool descriptions and parameter schemas for `history`, `notes`, `new_context`, and `get_context_remaining` from the acting model's catalog messages.
- Support catalog namespace descriptions for history and notes, preserving explicit empty and whitespace descriptions.
- Share catalog override handling across native tools and MCP resource helpers. Keep bundled schemas when overrides are invalid, preserve encrypted parameters, and leave tool identity and transport fields unchanged.
## Testing
Add coverage for sparse catalog serialization, schema fallback and encryption preservation, per-step tool definitions, and context tool updates when switching models. Extend outgoing-request tests to verify history and notes overrides while retaining history image attachments.
GitOrigin-RevId: 1adac8b5009f95c91adba491f20a4e2e2dc91475
## Why
Model output alone does not establish that an item entered conversation history. Treating every response item as accepted can include discarded attempts, while relying on a later request misses accepted final output when a turn ends or is interrupted.
## What changed
- Record `HistoryItemAccepted` events and retain Responses item IDs, generating missing IDs consistently across item events.
- Build thread conversation history from request inputs, compaction checkpoints, and explicit acceptance. Keep unaccepted output accessible through its inference call.
- Preserve inference provenance across retries and late response records without overwriting newer request or compaction snapshots.
- Mark turns with errors as failed. Bump trace schemas to version 2 and reject incompatible bundles and event schemas during replay.
## Testing
Add reducer coverage for discarded attempts with identical text, late responses, compaction, inherited context, and legacy bundle rejection. Add CLI integration tests that run `debug trace-reduce` after success, stream failure, and interruption followed by shutdown, including responses without provider item IDs.
GitOrigin-RevId: 8e387a91d9b3f704df82847d630e6f0b08f998b3
## What changed
Add optional `writable_root` and `writable_roots` templates to model-catalog permission messages. Select the template by the number of displayed roots and substitute exactly one `{{ roots }}` placeholder with the existing formatted path list.
Fall back to the bundled sentence for missing, empty, invalid, or oversized templates. Preserve path contents, permission-path limits, and denied-read instructions. Update the permission wording when the selected model changes.
## Testing
Add coverage for template validation and size limits, singular/plural selection after path truncation, path preservation, sparse serialization, and model switches that append changed permissions once while preserving request history.
GitOrigin-RevId: 4dcfb7ff70b91db3dba3dda684b355b920e07974
## Why
The `Cwd` session filter included sessions from linked worktrees, leaving no way to restrict the picker to the current directory. Project grouping also combined tasks across linked worktrees.
## What changed
- Keep `Cwd` filtering and directory-scoped `resume --last` and `fork --last` lookups limited to the current directory.
- Add an explicit `Repo` picker filter when multiple local worktrees are available, including sessions from corresponding directories across linked worktrees. Cycle between `Cwd`, `Repo`, and `All` in either direction.
- Add `Directory` grouping to the agent command center alongside `Project`, `Status`, and `Model`. Keep this choice in memory without writing a configuration value older clients cannot read.
## Testing
Extend coverage for directory and repository filtering, pagination scope, linked-worktree grouping, directory aliases, grouping persistence, and adjacent selection after task removal. Update picker and command center snapshots.
GitOrigin-RevId: 59603c9c5136db43124102b3277d1d1dab36bb87
## What changed
- Add discovery and listing APIs for environment-owned required hooks, with command and MCP execution routed to the owning environment.
- Use each environment's working directory in hook input, withhold controller transcript paths, and prevent environment hooks from granting permission requests.
- Resolve `command_windows` against the environment's platform and, when hooks are enabled, reject unloadable required hooks before accepting environment configurations at startup or readiness.
## Testing
Add regression coverage for invalid managed hook matchers at startup and readiness, successful readiness after correction, and per-hook working directory and transcript path scoping for `SubagentStop`.
GitOrigin-RevId: 1ac0ab3778ba608c72e5917fcbaebcc1d454887f
## What changed
- Add `environment_hooks` to `EnvironmentConfig` for hooks from an environment's effective managed requirements. Initialize it empty for inferred thread configurations and report the handler count in debug output.
- Move `HookEventsToml`, `MatcherGroup`, and `HookHandlerConfig` into `codex_protocol::hooks`, with re-exports from `codex_config::hook_config`.
- Validate MCP hook input recursively to reject nulls and integers outside the signed 64-bit range without converting through `toml::Value`.
GitOrigin-RevId: 410506c8e2b89c9519c81d86b44ccd760d751693
## What changed
Add a test-only MITM CA constructor and local TLS origin fixtures to exercise AWS SigV4 forwarding:
- Check `aoss` payload hashes and credential replacement for GET and POST requests, while preserving unsigned requests and requests using another access key.
- Verify rejection of unsupported HTTP/1.1 framing and signing headers, and check the forwarded body, payload hash, and signed header presence at an HTTP/2 origin.
- Verify that draining signed request bodies releases buffering capacity before response headers arrive, allowing a ninth request to complete while eight responses remain pending.
GitOrigin-RevId: 4da0a77baace31486e77ad97d9581ec9f51bb34e
## What changed
- Add `masked` after the provider prefix in built-in dummy credentials, followed by at least 22 random alphanumeric characters. Stop copying punctuation from the real credential.
- Check built-in dummy candidates against observed credential owners and discoverable configured-provider aliases, and reject overlaps with existing dummy credentials. Allow configured patterns to match a built-in dummy's format when no credential identity collides.
## Testing
Extend regression coverage for short and opaque credentials, fresh dummy values, known and late credential collisions, alias discovery, header injection, and text restoration. Verify that explicit authorization values remain unchanged even when they resemble masked credentials.
GitOrigin-RevId: 5080176f3ecbcdbb18943eab30136e15a4a3985e
## What changed
Introduce a `BundleSource` interface for authentication, cache identity, bundle fetching, and unauthorized-request recovery. Move ChatGPT plan eligibility and credential recovery into `ChatGptSource`, while keeping validation, caching, and retry orchestration in the shared service.
Support source-specific cache namespaces while preserving the existing ChatGPT cache location. Retain one authentication recovery context across all retries of a bundle fetch.
## Testing
Extend the external authentication test to verify that recovery happens only once per bundle fetch, including when an intervening request failure triggers a retry.
GitOrigin-RevId: f5009f72dc4479f96d4ed1da9232f250988444a5
## Why
The sequential token fixture rewrites shared files when resolving credentials. Concurrent credential resolution needs a fixture that can return the same token independently for each caller.
## What changed
Add `ProviderAuthCommandFixture::fixed_token`, which reads a token file using `cat` on Unix or `cmd.exe` on Windows without modifying it. Use it in the Vertex command-auth and guardian-request tests.
GitOrigin-RevId: 5bf5134f113b546a643a47012281fb960e885b15
Update both `call_tool` invocations in `dropping_tool_call_cancels_remote_request` to pass `|_| Ok(None)`, matching the metadata callback API while continuing to omit metadata.
GitOrigin-RevId: 9d0f3e3108fe81972ce4fd4cca13f4b7febcc616
## What changed
Select an originator-specific models manager before resolving thread model metadata. Supported originators send their own `originator` header and use separate in-memory catalogs and disk caches, so each thread receives the corresponding model instructions and tools.
Reuse managers for repeated originators and share the API-key model discovery setting across them. Unsupported originators retain the default manager and catalog.
## Testing
Add coverage for originator headers, concurrent catalog isolation, cache reuse across restarts, shared discovery policy, and the instructions and tools sent in actual turns.
GitOrigin-RevId: ae4aa51c8df2813a72fc8aed8978fd630e467069
## Why
Consecutive user prompts in the rich transcript have extra blank spacing that breaks up their shared background.
## What changed
- Join adjacent visible user prompts into one background block, skipping hidden entries when determining adjacency.
- Keep prompts separated when intervening content becomes visible through detailed mode or search, and restore grouping when it is hidden again.
- Preserve selectable source offsets and joined spacing when text is rewrapped, and reuse cached layouts when checking adjacency.
## Testing
Add regression tests for prompt grouping, layout cache reuse, source offsets across rewrapping, detailed reasoning, and search-driven visibility. Update transcript snapshots to reflect the tighter spacing.
GitOrigin-RevId: faca8001244b0ac883d9d670864c8f7856ac2bad
## What changed
Add an optional `NetworkPolicyMetadataProvider` to the MCP runtime. Advertise `codex/network-policy-meta` only to trusted ChatGPT origins when a provider is available, and attach policy metadata only when the sending session also advertises support.
Strip caller-supplied policy metadata and derive restrictions from the call's captured permission profile and server environment. Resolve metadata against each session's capabilities, including after recovery, while retaining one policy snapshot per call. Fail the call before sending if policy resolution fails. Existing runtime callers leave the provider unset.
## Testing
Add tests for capability negotiation, trusted-origin restrictions, forged metadata removal, both tool dispatch paths, and policy snapshot reuse. Add HTTP session-recovery coverage for changing capabilities and policy-resolution failures while preserving caller metadata and read-only restrictions.
GitOrigin-RevId: 4b978f986abc0475fc67659be98fc01a2d6ce7cd
## Why
The network proxy previously required AWS signing requests to have an empty body or use `UNSIGNED-PAYLOAD`, preventing signing of nonempty payloads.
## What changed
- Buffer and hash request bodies before signing, then forward the original bytes.
- Add `max_body_bytes` with an 8 MiB default and a 16 MiB maximum, plus a 30-second body read timeout.
- Limit concurrent buffering to eight requests with a five-second capacity wait. Retain reservations while forwarded body data remains alive.
- Reject trailers and mismatched content lengths for buffered payloads while preserving streaming for explicitly unsigned payloads.
## Testing
Add coverage for payload hashing and forwarding, body limits and timeouts, fragmented body collection, and buffer reservation lifetimes. Extend signing tests for S3 path and query canonicalization, header replacement, and secret exclusion from trace logs.
GitOrigin-RevId: 48c18442fa90ae3efb1a4a99a168d07e1be2c496
## Why
Aborting a refresh task is asynchronous, so yielding once before checking `is_finished()` does not guarantee cancellation has completed.
## What changed
Return the refresh task's `JoinHandle` from `cloud_config_bundle_loader_for_service` and retain its `AbortHandle` in the loader lifetime. Update `each_loader_owns_refresh_until_its_last_clone_is_dropped` to await each task and assert cancellation after dropping its last loader clone, while still checking that the replacement loader's task remains active.
GitOrigin-RevId: 2eb65211aefc21f9195ff766d8793f4b8f5a74c4
## Why
A requirements denial on a custom `codex_apps` registration could block the trusted hosted Apps replacement. Requirements filtering also lost whether a server had been explicitly disabled, which must remain effective across runtime overlays.
## What changed
- Track explicit disables separately from requirements denials, retaining the requirement source across catalog rebuilds and server materialization.
- Allow trusted host-owned Apps to bypass a previous registration's requirements denial while preserving explicit disables and blocking later custom replacements.
- Preserve combined explicit and requirements disables during repeated filtering, and reject those servers when preparing standalone MCP login HTTP clients.
## Testing
Extend regression coverage for hosted Apps replacements, later custom replacements, cloud catalog refreshes, repeated requirements filtering, and standalone login rejection.
GitOrigin-RevId: 736a13c40fbf7436b4d0682f70c335f33f45962f
## What changed
- Support `model_provider = "gcp"` with a Vertex AI endpoint derived from `GOOGLE_CLOUD_PROJECT` and `GOOGLE_CLOUD_LOCATION`, defaulting to the `global` location.
- Obtain credentials through `gcloud auth application-default print-access-token` by default, and allow `base_url`, `auth`, and `http_headers` overrides under `model_providers.gcp`.
- Use a static model catalog tailored to Vertex AI, preserve function tools, namespaces, and client-side tool search, and support remote compaction V2. Disable unsupported reasoning summaries, Responses Lite, custom tools, web search, and image generation.
- Expose a `gcp` account type through the app-server protocol and generated clients without resolving credentials during account reads or requiring OpenAI authentication.
## Testing
Add coverage for endpoint resolution, configuration overrides, model catalog filtering, authenticated requests, unsupported request fields, missing credentials, account reporting across provider changes, and automatic remote compaction.
GitOrigin-RevId: 97a3158269e6dbc2605e2cf576998e09817ea12a
## Why
The URL parser treats backslashes as HTTP(S) path separators, while Git/libcurl does not. This difference can make a marketplace URL appear to match an allowed host pattern while Git connects to a different host.
## What changed
Reject HTTP(S) URLs containing literal backslashes in userinfo when checking marketplace host patterns. Continue allowing encoded backslashes in userinfo and backslashes in paths or query strings.
## Testing
Expand regression coverage to verify that denied URLs never invoke the cloner, create the marketplace install directory, or write configuration. Extend host-pattern tests to cover accepted HTTP(S) URL variants.
GitOrigin-RevId: cfdd29d6e83fb1718b505abaae85d37257317953
## Why
Resuming a thread with unchanged settings appended another `ThreadSettingsApplied` event to its rollout.
## What changed
Compare the effective settings with the latest persisted settings for the same thread before writing a checkpoint. Persist settings when they differ or no matching checkpoint exists, even if no turn follows the resume.
## Testing
Add a regression test that restarts the app server, resumes a materialized thread without overrides, and verifies that its persisted settings events remain unchanged.
GitOrigin-RevId: c545791ed3bb4020fa3da6d233607a9ba73e5c8d
## What changed
Move inline crate tests into `lib_tests.rs` and nest related test suites under each crate's `tests` module. Update imports, subprocess test filters, logging targets, and snapshot names to match the new module paths.
Keep test helpers accessible where needed and preserve the schema writer's exact test name used by release tooling.
GitOrigin-RevId: de55eaae66dce4941abb33dd0b2f170093daa8f9
Add `yield_control()` after phase 2 in
`code_mode_can_yield_and_resume_with_wait` so the intermediate output is
returned explicitly. Increase both `wait` calls' `yield_time_ms` from 1,000
to 10,000 to allow more time for each phase to produce its output.
GitOrigin-RevId: 3626a64ae0269c22ad634ec2e3fd5e27942f649f
## Why
Prompt telemetry can include full user text. Emitting it before hook acceptance logs prompts that `UserPromptSubmit` hooks subsequently block.
## What changed
Move prompt telemetry from input submission to hook acceptance, including queued and steered input. Preserve telemetry for accepted Guardian review prompts that are converted to response items during finalization.
## Testing
Extend hook regression tests to assert that blocked prompts are absent from telemetry and rollouts, while accepted queued prompts are logged exactly once. Extend Guardian review coverage to assert exactly one prompt event across inspection steps.
GitOrigin-RevId: aa71f98de2356dd08f62ff492e897ab3a43b54c9
Timestamp synthetic frames in `real_encoder_produces_twenty_millisecond_opus_packets`
from a single start time using each block's sample offset and input rate. This
keeps the test audio contiguous even when the test thread is descheduled.
GitOrigin-RevId: e66440fcc3b3c965a7b1b22b61246c2a622a9cc9
## Why
Resuming a paginated thread rechecks stored history after loading configuration. Unchanged model context can be reused instead of loading it again.
## What changed
Retain the prepared model context across configuration loading and reuse it when the thread ID, rollout path, and history revision still match. Add `ThreadStore::is_model_context_current` to validate revisions, with a fresh read when validation fails or is unavailable.
## Testing
Add coverage for revision invalidation after history is appended or removed. Extend resume tests to cover paginated history, concurrent metadata and lifecycle changes, workspace-root changes, and preservation of saved user messages in model requests.
GitOrigin-RevId: bad2ca0caddb63523264ac530ffb801db3961f2b
Resolve `codex-windows-sandbox-setup` with `codex_utils_cargo_bin::cargo_bin` so the manifest test supports both Cargo binary paths and Bazel runfiles.
GitOrigin-RevId: 23e62800cdd5994eb18fa47fcc1479f4ce10c42e
## Why
Profiles without a v1 memory workspace have no legacy context to preserve or consolidate before using v2.
## What changed
- Select v2 when memories are enabled and the `memories` directory is absent. Preserve explicit `memories.version` settings, the `memories.dual_write = false` opt-out, and the v1 default for existing workspaces or filesystem check errors.
- Report `v2_ready` immediately for profiles without a v1 workspace. Keep the consolidation count and valid-summary requirements for profiles with a v1 workspace.
- Make resetting an absent memory workspace a no-op so it does not create an unused v1 directory.
## Testing
Extend coverage for default and explicit version selection, opt-outs, version-specific memory reads, fresh-profile readiness and reset behavior, and running only the v2 pipeline for fresh profiles.
GitOrigin-RevId: a8fb0844962ae9266ffbe88af97e8dc4a99ac15f
## Why
A concurrent fork can retain locks from a previous cleanup pass until exec,
causing the next pass to skip cleanup and fail the test's assertions.
## What changed
Wait for and explicitly release both staging locks before each cleanup pass in
`cleanup_reclaims_unpublished_and_aged_legacy_clones`. Run the existing age
scenarios in a loop and report the age when legacy directory assertions fail.
GitOrigin-RevId: 115d887e6b74159f22a2f675237e3b3356ab0308
## Why
Allow workloads to make AWS requests with placeholder credentials while keeping real AWS credentials in the trusted proxy process.
## What changed
- Add an `aws_sigv4` hook action with a placeholder access key ID, region, service, HTTPS port, and credential sources from proxy environment variables or files.
- Re-sign matching requests after network and hook authorization and header transformations, using the configured credentials and optional session token.
- Support empty payloads and explicitly unsigned payloads, including streaming unsigned S3 uploads. Reject selected requests with incompatible credential scopes, presigned URLs, unsupported streaming signatures, or ambiguous framing through the hook denial path.
- Mark generated credential headers as sensitive and suppress signing SDK trace events that could expose credentials.
## Testing
Add tests for the published AWS IAM signature vector, unsigned S3 uploads with a session token, and rejection of invalid transport, credential scopes, signing inputs, and unsupported bodies.
GitOrigin-RevId: ab4fbbc00ba40a5bb309add521fea6ee2ff6e79e
## What changed
Promote `reasoning_effort_override` to stable and enable it by default, allowing supported models to receive reasoning effort changes through configuration updates in conversation history.
Update request-history snapshots to include the configuration updates, and remove explicit feature enablement from the reasoning effort override test builder so the suite exercises the default.
GitOrigin-RevId: 6ce16d7f985c33f008e5230fc9bae09cdaf141d5
## Why
Managed network policies need to require approval for selected hosts even when an exact or wildcard allow rule matches them.
## What changed
- Add `experimental_network.review_domains` to managed requirements and route matching hosts through the existing network approval flow. Explicit denials retain precedence, and approved connections still undergo DNS and local-address checks.
- Preserve review patterns across environment policy attachments and remote proxy configuration. Reject execution on an exec-server that lacks the `networkProxyReviewDomains` capability when review patterns are present.
- Expose `reviewDomains` through the app-server requirements API and generated schemas, and show `review_domains` in debug configuration output.
- Update approval reasons to say that network access requires approval rather than assuming the host is absent from the allowlist.
## Testing
Extend coverage for review precedence over exact and wildcard allows, explicit denials, DNS checks after local and remote approvals, approval hooks, policy merging, remote configuration round trips, and requirements API serialization.
GitOrigin-RevId: 4a861061a0ed80b3537d3b72f2caecb0db2a4f0b
## Why
Enterprise MCP token exchange and sign-in failures can collapse into generic errors, hiding useful diagnostics such as an OAuth `invalid_scope` rejection or a cancelled sign-in.
## What changed
Introduce `EmaErrorDetail` to carry static operation messages and sanitized SDK diagnostics through token-source errors and enterprise login completion. Exchange failures can report the stage, HTTP status, and allowlisted OAuth error code, such as `IdentityProvider: HTTP 400: invalid_scope`, without retaining arbitrary provider text or raw error chains.
Preserve specific discovery, credential storage, cancellation, and account/configuration mismatch errors instead of replacing them with generic failure messages.
## Testing
Extend tests to cover `invalid_scope` diagnostics, specific sign-in completion errors, and exclusion of credentials from diagnostics even when an outer error context contains sensitive text.
GitOrigin-RevId: e9280a5db3565ea91da0810bab528da5ee088d64
jif