## Why
Read-only MCP discovery and invocation need a consistent policy across requests, connection reuse, and tool catalogs. Reusing an unrestricted connection or cached catalog can bypass filtered discovery.
## What changed
- Thread `requires_read_only_mcp_tools` through MCP configuration and client setup, leaving it disabled by default.
- When enabled, set `openai/readOnly` to `true` in `tools/list` and `tools/call` request metadata, overriding a caller-supplied `false` while preserving other metadata, pagination, and arguments.
- Include the policy in connection identity and bypass shared Apps and persistent tool catalog caches for read-only connections.
## Testing
Add coverage for metadata propagation in legacy and modern protocol modes, preservation through session recovery, and isolation from unrestricted connections and shared Apps catalogs.
GitOrigin-RevId: f4a3a4021a54e302bffd53f08092b080c056246b
## What changed
- Wait for a request tagged with `x-openai-subagent: guardian` before triggering cancellation, disconnection, or timeout in network approval tests.
- Read the last yielded parent request in the tool cancellation test, with an explicit error if no request was captured.
- Disable WebSockets in the issuing-step permissions test to use its HTTP mock server.
GitOrigin-RevId: 35c021e3931ff4a66ca3970f8e39e1d20257be88
## What changed
- Probe for screen readers at startup on macOS, Windows, and Linux, with a 450 ms timeout. Include Windows Narrator detection in the current login session.
- Save `tui.animations = false` when a screen reader is detected and no user animation preference is configured. Preserve explicit preferences and config comments, and retain a session default if saving fails.
- Record the attempt in `tui.screen_reader_detection_done`; either boolean value skips future detection. Allow explicit animation preferences to override the screen-reader default on reload.
## Testing
Add tests for one-time detection, timeouts, preference preservation, temporary CLI overrides, persistence failures, and preference reloads. Verify rendering without animation frame requests and interactive startup that records detection without replacing an explicit preference.
GitOrigin-RevId: f61c19dfd053f97e8cfed68dce7389fa7601120d
## What changed
Extend the sandbox directory ACL test to verify that the real user retains
`WRITE_DAC` on `.sandbox-bin` so its DACL can be refreshed, while the sandbox
group lacks that permission. Cover both `Full` and `ProvisionOnly` setup modes.
GitOrigin-RevId: cff32956ea308803536a47d8cdfc256184346553
## Why
Failures to save `approvals_reviewer` in the TUI hide the underlying configuration error, leaving users without the details needed to fix it.
## What changed
Use `format_config_error` when displaying save failures so the message includes the error chain, including configuration file locations and parse errors.
## Testing
Add a regression test that introduces an unclosed array in `config.toml` after startup, attempts to save the approvals reviewer through the app server, and verifies the rendered error retains the parse failure and its location.
GitOrigin-RevId: bb29b5f8e61569e6c1c23a0c968e64091a95f72d
## Why
Server-level tool exposure settings apply to every connector on the apps server. Individual connectors need a way to opt out of deferred discovery without changing exposure for other apps.
## What changed
Add `apps.<connector_id>.omit_tools_from` with support for `code_mode`, `deferred`, and `direct`. Combine connector omissions with server omissions so app settings preserve server restrictions.
For example, `omit_tools_from = ["deferred"]` makes a connector's tools available without tool search, through direct calls or Code Mode as permitted by the active tool mode and remaining restrictions.
Expose the setting in the app-server protocol, JSON schemas, and generated TypeScript and Python types.
## Testing
Add integration coverage for connector-specific exposure and MCP dispatch across tool modes, server restrictions, and direct-only namespaces. Extend config tests to cover populated, absent, and empty omission lists, and add a Code Mode request-history snapshot.
GitOrigin-RevId: cc99ab290c8a878d06d8d7ccf2d1dbd7c46bfa8a
## Why
Orchestrator skill caches were tied to the entire MCP connection set, so runtime updates could discard cached catalogs and contents even when the Apps connection was reused. Plugin changes still need to refresh those resources without requiring a reconnect.
## What changed
Key orchestrator skill caches by the Apps server connection and an explicit invalidation generation. Preserve cached resources while that identity stays unchanged, and invalidate them on MCP runtime refresh requests or configuration refreshes. Replacing the connection also changes the cache identity.
## Testing
Extend the production-turn integration test to verify cache reuse across ordinary turns and approval-policy changes, refreshed skill contents after plugin invalidation without reconnecting, and fresh resource requests after a forced reconnect.
GitOrigin-RevId: 43ce059972369c4c735742e8224b60a692244b02
## Why
`CFPreferencesCopyAppValue` also searches user-writable domains. Ordinary user defaults must not supply trusted administrator configuration or override lower requirements layers.
## What changed
- Check `CFPreferencesAppValueIsForced` before reading `config_toml_base64` and `requirements_toml_base64`, and recheck after reading to ignore values that became unforced.
- Wrap returned property-list values as `CFType` and require a `CFString`, returning `InvalidData` for other types without exposing preference contents.
## Testing
Add tests for both preference keys covering unforced and missing values, loss of forced status during a read, preservation of string contents, and rejection of non-string values with diagnostics that omit their contents.
GitOrigin-RevId: 2eff08ba6b073b4c59ca757e054d112d2a5256d0
## Why
Exhausting the handshake failure budget closed the physical relay, disconnecting authenticated streams along with failed attempts.
## What changed
After eight failed handshakes, pause new handshake admission for 10 seconds. Reset incoming handshake attempts before parsing them while existing streams and pending validations continue. Failures during the cooldown do not extend it, and the failure budget resets when handshake admission resumes.
## Testing
Update relay tests to cover duplicate handshakes and early data without disconnecting the relay. Verify that encrypted traffic on an established stream continues during cooldown, rejected attempts skip authorization checks, and new handshakes succeed after cooldown expires.
GitOrigin-RevId: 0a5098ed1b3c31466f9c091f46cbb20415c7aa1d
## Why
The cleanup-hook allowlist for `browser@openai-curated-remote` accepted only `Stop` and `SubagentStop`, leaving its cleanup hook unavailable when a turn was interrupted.
## What changed
Allow `Interrupt` to invoke `browser.turn_ended` through `codex_apps`, retaining the registered browser connector and empty-input requirements.
## Testing
Extend hook metadata tests to cover interrupts, rejecting mismatched connectors and manifest-provided arguments. Extend executor integration coverage to interrupt an active turn and verify that browser app and computer-use cleanup calls use their separate MCP routes.
GitOrigin-RevId: 355801f9ca3086bae80d1e623d0be7e1772a39e1
## What changed
Document the existing `?` wildcard behavior: it matches exactly one character,
including a dot, in allow and deny patterns. For example, `api?.example.com`
matches `api1.example.com`, but not `api.example.com` or `api12.example.com`.
## Testing
Add table-driven tests for both allowlist and denylist compilation, covering
single and repeated `?` wildcards, combinations with `*`, `*.`, and `**.`,
dot matching, and host and pattern normalization.
GitOrigin-RevId: dd5cd1817c6ea0b701335a38a57fbb5e8039c284
## What changed
- Add `ResolvedModelMessages` to resolve catalog text and bundled defaults while preserving explicit empty overrides and their source.
- Move base-instruction rendering, Guardian prompt composition, multi-agent role rendering, and `update_plan` guidance filtering into `codex-prompts`; migrate consumers to the shared APIs.
- Separate permission-profile resolution from prompt composition, and annotate Guardian policy and classifier instructions with content kinds.
## Testing
Add and update coverage for missing versus empty templates, literal overrides, multi-agent role composition, Guardian policy substitution and truncation, and preservation of permission path spellings and order.
GitOrigin-RevId: 52335bb7acec0f432d5c57acb2accd5f0276056e
## What changed
Add `rollout/compress` to trigger a best-effort background compression pass for cold local rollouts, even when `features.local_thread_store_compression` is disabled. The method takes no parameters and immediately returns `{}` to acknowledge scheduling, not completion. Existing worker locks, concurrency limits, and cooldowns still apply.
Require the `experimentalApi` capability and reject non-local thread stores. Document the endpoint and the requirement that clients sharing the Codex home support compressed rollout files.
## Testing
Add integration tests for compression with the startup flag disabled, lossless rollout readback, experimental capability enforcement, and rejection of non-local thread stores.
GitOrigin-RevId: be73a3b3f37f3adc54512de8256abf684d5d8112
## What changed
Add an optional `protocol_mode` to `McpServerContribution::HostedApps` and apply it when registering the server. Preserve the hosted Apps default when no override is provided.
## Testing
Add an integration test that selects MCP `2026-07-28` with the global feature disabled and completes a native user verification flow, including resuming the tool call with the verification response. Extend capability tests to confirm that the override preserves hosted Apps user verification without granting it to ordinary extension registrations.
GitOrigin-RevId: e8662c45f964c00b0bb4503bbcfd8432d7e2fa70
## Why
Executor skill discovery enabled every discovered skill, with no provider option for callers to disable selected skills.
## What changed
Add `ExecutorSkillProvider::with_disabled_skill_paths` to accept `SKILL.md` paths grouped by environment ID. Mark matching catalog entries disabled in both discovery routes so they are omitted from model context. Skills remain enabled by default, and paths configured for another environment have no effect.
## Testing
Extend catalog tests to cover default enablement, matching paths, and environment isolation across both discovery routes. Add a model-context snapshot test confirming that an active skill appears while a disabled skill is omitted.
GitOrigin-RevId: 7426eb94566db2bcf7e49a5dee28673ab743ad25
## Why
Permission shortcuts updated local permission state as soon as the server accepted the settings request, before receiving the server's settings notification.
## What changed
Use `select_permission_profile` for session-only permission shortcuts so local permissions follow the server's `ThreadSettingsUpdated` notification. Report the selection as requested while it is pending, and use the shared rejection messages. Include the full error chain when permission selection fails.
## Testing
Update shortcut tests to verify that local permissions remain unchanged until the settings notification arrives, pending state clears afterward, and `config.toml` remains unchanged. Update rejection snapshots for unsupported servers and server errors.
GitOrigin-RevId: 0ecd3d8b0698a039bf354d83b25b64b4c38fb45f
## Why
Realtime connections construct API providers directly, bypassing the residency override applied by higher-level model provider code. Configured provider headers could therefore take precedence over managed residency requirements.
## What changed
Apply the shared process-wide residency requirement in `ModelProviderInfo::to_api_provider`. With `enforce_residency = "us"`, the managed value overrides both static and environment-supplied residency headers, including for realtime WebSocket connections and WebRTC calls and sideband connections. Preserve unrelated headers and configured residency values when no managed requirement is set.
Share the residency policy with default HTTP headers, remove redundant enforcement at callers, and recover the stored policy from poisoned locks.
## Testing
Add a provider unit test for managed and unmanaged header behavior without mutating provider configuration. Add realtime integration coverage across WebSocket and WebRTC transports, managed and unmanaged residency, and static and environment-supplied headers.
GitOrigin-RevId: 98ceb456cc97f88241df5a829c72288aa5e66aec
## What changed
Capture result metadata for host-owned app calls when analytics and executed tool call metadata recording are enabled. Respect both `analytics.enabled = false` and host-disabled analytics, using the prepared call's ownership to determine eligibility.
Disable incremental WebSocket request reuse when raw result metadata or its call binding changes, so late results attached to an already-sent output are included in the next request. Continue allowing reuse when only other metadata changes or result metadata is filtered out for the endpoint.
## Testing
Extend coverage for direct and code-mode calls, analytics settings and host overrides, runtime recording changes, and prepared call ownership. Add metadata comparison and WebSocket reuse tests, and verify that raw response item notifications continue to omit result metadata.
GitOrigin-RevId: 411843fbff3749ee96fd6f0ebc591362942a4555
## What changed
Add `codex_history::CompactionCheckpoint` to keep a checkpoint and its recorded producer model hash together, with shared checks for usability and reviewer compatibility.
Replace `ConversationHistorySnapshot::latest_compaction_model_hash()` with `latest_compaction()` and use the shared abstraction in Guardian context selection, review sessions, and parent compaction reuse. Preserve selection of the latest checkpoint even when unusable, and leave missing producer metadata unknown.
## Testing
Add coverage showing that the latest checkpoint retains its own provenance even with missing or empty encrypted content, and that compatibility requires matching producer and reviewer hashes. Adapt existing history, migration, and parent compaction tests to the new API.
GitOrigin-RevId: 98e794644edf979c98fcc8294baa48ff82ea0ed0
## Why
Built-in permission selections in connected TUI threads previously applied local settings directly. Use server-confirmed settings so the TUI adopts the authoritative permissions and refreshes cached network configuration.
## What changed
- Send built-in permission selections through the existing app-server settings API, including selections after Windows sandbox setup. Allow built-in selections during a running turn.
- Block task creation and switching while permission updates are pending, restoring submitted text to the composer when necessary.
- Refresh local permissions, approval settings, runtime overrides, and network configuration when the server confirms a built-in selection.
- Submit a pending initial prompt when the selected permissions already match the current settings.
## Testing
Add regression tests for server-confirmed built-in selection during a running turn, blocked task switches, stale proxy removal, and pending prompt submission when permissions already match. Update background-task tests to wait for settings confirmation.
GitOrigin-RevId: 76e71a8c278c37c0a7ce7c0246da7d185e12ee7a
## Why
With `NonfatalClockReadErrors` enabled, a clock failure after a successful read could be suppressed if an earlier failure had already been reported in the same turn and context window. This left the model without a fresh notice that the clock was unavailable again.
## What changed
Clear `last_clock_failure` after a successful clock read so a subsequent outage produces a new notice while consecutive failures remain deduplicated.
## Testing
Add a regression test that scripts two failures, a successful read, and another failure within one turn. It verifies that the consecutive failures share one notice, recovery delivers a time reminder, and the later failure adds a new notice.
GitOrigin-RevId: f2a9c4d7b63f2e8408a47b1803b0bc4577f23f32
## Why
An omitted controller socket policy was treated as an explicit denial, preventing execution environments from supplying their own Unix socket grants.
## What changed
- Preserve omission of `dangerously_allow_all_unix_sockets` separately from `false`, and retain explicitly empty `unix_sockets` maps.
- Defer to attachment socket permissions when the controller supplies neither setting. Continue enforcing explicit restrictions, socket denials, and managed requirements.
- Resolve omitted values to `false` for ordinary execution and remote configuration, preserving the default for commands without attachment grants.
- Add debug logging for effective environment and remote execution network policies.
## Testing
Add regression coverage for omitted, explicit, finite, empty, and managed socket policies through remote launch configuration, including live policy replacement and serialization round trips. Adjust remote environment tests to tolerate child-completion ordering and box large cold-resume test futures to reduce Windows stack usage.
GitOrigin-RevId: 98a88d01cbb91aea1faaa03b3c414ef3be7af398
## What changed
Move request sending, redirect handling, and rustls fallback from `route_aware_client_pool.rs` into `route_aware_client_pool/execution.rs`, preserving existing behavior. Give the moved methods parent-module visibility and import `MAX_REDIRECTS` explicitly in the existing tests.
GitOrigin-RevId: 41be33a9250f09f562fb18a77fdb8fd9398cb49a
## What changed
Move duplicated action preparation into `codex_guardian_context::action_for_review`, shared by approval rendering and cached-evidence size checks. Preserve the existing behavior: omit top-level `tool_description` and `connector_description` metadata from MCP tool calls while keeping tool arguments intact.
## Testing
Add unit tests verifying that MCP arguments retain description fields, including nested fields, and that other action types remain unchanged.
GitOrigin-RevId: 8e890fb263556596f695177f917750377c04d43c
## What changed
Introduce `ReviewTurnResult` and `ReviewSessionResult` to carry review outcomes, session disposition, and completion or analytics data. Propagate `SessionDisposition` directly through review execution and pooling, replacing boolean reuse flags and positional tuple access while preserving existing behavior.
Update existing review-session tests to assert the named fields and explicit session dispositions.
GitOrigin-RevId: 93eea8b482cd592167956444042becc1ef5f2eb5
## Why
Network access and Unix-socket allowlists must not let commands with filesystem restrictions reach the privileged app-server RPC transport.
## What changed
- Bind Unix control sockets in a fixed, user-owned directory with mode `0700`, independent of environment settings, and expose the advertised paths as symlinks. Preserve existing parent permissions, reject unsafe parents, and serialize socket setup and publication.
- Mask the socket directory in Linux bubblewrap sandboxes after each bind that exposes it. Reject host mount aliases and nested mounts that compromise isolation.
- Deny access to the directory and outbound connections to its sockets in macOS Seatbelt policies, including when network access or Unix-socket allowlists grant broader access.
- Require bubblewrap for filesystem-restricted Linux execution. Users with `features.use_legacy_landlock` enabled must disable it for these policies.
## Testing
Add regression coverage for direct and symlink socket access, hardlink attempts, Linux host-process links and bind-mount aliases, and continued use of unrelated and sandbox-local sockets. Add transport coverage for parent permissions, concurrent restart after a stale symlink, and cleanup that preserves a replacement at the advertised path.
GitOrigin-RevId: 53372c27eea278d964f2cf68aed24323ef3b7082
## Why
Task attachment awaits server requests while the event handler cannot process scheduled frames. Prompts and chat widget replacement can also clear the terminal during loading.
## What changed
Draw a bold `Loading task…` message immediately when attaching a task, and redraw it after folder selection, trust prompts, and chat widget replacement. Schedule a frame to restore the normal view afterward.
## Testing
Extend the cold-resume test to verify that a loading message appears before server requests complete, survives widget replacement, and is replaced on the next draw.
GitOrigin-RevId: cb2e73efe38758025964aa53f52127a2b2609fca
## Why
The default resolver misses macOS supplemental resolvers and VPN split DNS, preventing Codex from reaching hosts that depend on those DNS settings.
## What changed
Use `tokio::net::lookup_host` for IPv4 and IPv6 lookups in the macOS TCP connector, including connections to upstream proxies. Preserve existing checks on resolved destination addresses and reject unsupported TXT lookups without falling back to a different resolver.
## Testing
Add macOS tests for IPv4 and IPv6 localhost resolution and connections, local-network rejection, and resolving the upstream proxy instead of the destination.
GitOrigin-RevId: 3c7fc4f8b309e26b02923d8fafd4e1f1e1f7755f
## Why
Permission profile changes reloaded configuration without the thread's session overrides, so profiles defined at thread start could be unavailable to `thread/settings/update`.
## What changed
Reload permission configuration with the thread's merged, enabled `SessionFlags` layers, the effective working directory, and the requested profile. Preserve sandbox executable paths through `ConfigManager`.
## Testing
Add regression coverage for switching away from and back to session-defined and disk-defined profiles, including top-level profile selection. Add a config manager test for merging session layers, excluding disabled layers, and retaining filesystem access to the exec wrapper directory.
GitOrigin-RevId: b0271e28a90cd55d3faf5fdf5f044d768395b0b6
## Why
History paging failures can prevent the TUI from opening a conversation that is already open elsewhere, even when its prompts and final replies are available through turn summaries.
## What changed
- When paginated read-only history loading fails, request the latest 100 turns from `thread/turns/list` with `itemsView: summary` and display them in chronological order.
- Clear history pagination state and show a notice that intermediate messages and tool activity are unavailable. Surface the notice during startup, session selection, and command center selection.
- Show a concise retry message when the command center cannot load the conversation, preserving the current conversation.
## Testing
Extend read-only history tests to cover summary recovery, the 100-turn limit and ordering, the user notice, and preservation of the current conversation when both history loading methods fail.
GitOrigin-RevId: c9f06ad58ed5573ce0b4578f429558bfd475830f
## Why
Hiding the selected task can reset selection to the current task or first row, interrupting navigation through the list.
## What changed
Select the next visible task before hiding the selected task, falling back to the previous task at the end of the list. Follow the active grouping and search filter. Preserve the existing rename cancellation behavior when hiding a rename target so its draft cannot transfer to a neighboring task.
## Testing
Add regression tests and a selection snapshot covering project, status, and model grouping, filtered and unfiltered lists, custom hide bindings, hiding all visible tasks, and hiding a task with an unsubmitted rename draft.
GitOrigin-RevId: e5ca6b2a9955622bcf60e68621322b3abd801a7f
## What changed
- Emit one read counter and duration observation per rollout reader, tagged by format, outcome, failure stage, and error kind. Distinguish EOF, partial reads, and failures, including failed opens.
- Accumulate time spent in completed open/retry and read calls, excluding caller processing and canceled calls, without exporting a metric for each JSONL record.
- Record materialization duration when decompressing a rollout for append, for both successful decompression and failures.
GitOrigin-RevId: 3d1e257863ffa696a63040172df54d8234d56ed5
## Why
A compression run can report `completed` after hitting its time budget or encountering file, scan, or cleanup errors. The run metrics do not distinguish these cases from a clean, complete pass.
## What changed
- Add `completion_reason` (`time_budget` or `scan_finished`) and `file_errors`, `scan_errors`, and `cleanup_errors` tags to completed run counts and durations, preserving `status=completed`.
- Record scan failures and additional stale-temp cleanup failures with operation stages and bounded I/O error kinds, and track recoverable errors in the run summary.
GitOrigin-RevId: bb6c33890371a2cdb02bc6ccc82a5df343b823b5
## Why
Memory usage telemetry identifies artifact kinds but does not distinguish reads from `memories` and `memories_v2`.
## What changed
Return each artifact's memory version from shell command classification and add a `memory_version` tag (`v1` or `v2`) to usage counters. Normalize Windows path separators before classifying memory paths.
## Testing
Extend regression coverage for both memory versions with Unix and PowerShell reads, and add a test for commands that read artifacts from both roots.
GitOrigin-RevId: 68eaab3af0317613e4969e8c4e5478b18255ca52
## What changed
- Extend `GuardianModelPolicy` with controls for uncategorized tools, unscored actions, the initial computer-use call allowance, and sandboxed command coverage.
- Add `GuardianPolicyLoader` in `codex-config` to translate legacy settings, preserve catalog policy precedence, and enforce reviewer requirements. Apply live model review requirements through `ConfigRequirements::constrain_guardian_policy`.
- Use the shared model policy for Guardian scoring and approval, replacing the extension-local policy wrapper while retaining legacy defaults.
## Testing
Add configuration tests for catalog precedence, legacy scope fallback, required-model constraints, and legacy computer-use opt-in and feature gating. Adapt existing extension tests to consume the shared policy.
GitOrigin-RevId: 6fed1c3a831964ad28ea7de5cb19e74e323c1204
## What changed
Emit a `codex.memory.storage_bytes` histogram after successful phase-two consolidation, including runs with no workspace changes. Sum regular-file sizes recursively from filesystem metadata, excluding `.git` entries and symbolic links. Stop the phase-two duration timer before measuring storage.
## Testing
Add coverage for both memory versions, nested files, UTF-8 byte counts, Git metadata exclusion, and Unix symbolic links, including broken links and directory loops. Extend the workspace baseline reset test to verify the remaining storage size.
GitOrigin-RevId: 9170c34d656728897790decd2e2cabb38a81836f
## Why
Reusing a Guardian reviewer could trigger a model catalog refresh during the previous-model compaction check, even when the model was unchanged and no compaction compatibility change required compaction.
## What changed
Return early from the previous-model compaction check for Guardian sessions when the model slug is unchanged and the compaction compatibility hashes do not require compaction.
## Testing
Add a regression test with an expired model catalog cache that verifies two approvals reuse the same Guardian reviewer, both reviews and the parent turn complete, and no additional model catalog request occurs.
GitOrigin-RevId: cc1cdc5f89c6f9ec03f1bedfb78cad9780825733
## Why
Model catalog decode errors can include the full response body and payload values from deserialization errors. Catalog request deadlines also report a generic timeout instead of a request timeout.
## What changed
- Report only the JSON error category, line, column, and response byte count when model catalog decoding fails.
- Return `CodexErr::RequestTimeout` when the model catalog refresh deadline expires.
## Testing
Add regression tests for invalid response shapes, large payload values, malformed and truncated JSON, and a delayed catalog response that must return `RequestTimeout`.
GitOrigin-RevId: 6fe5111a3e3b113d79942b3c213f8e94d773eb5a
## Why
Code Mode wrappers should preserve cached scores for nested actions so adaptive review can reuse them across cells.
## What changed
Remove `code_mode` from `GuardianModelPolicy` and its approval scopes. Skip scoring and cache invalidation for direct Code Mode `exec` wrappers under model policies, leaving nested tools governed by their own categories. Preserve legacy wrapper scoring behavior.
## Testing
Expand app-server coverage for score reuse across cells, synchronous nested reviews, required model policies, and legacy configurations. Retain checks that ordinary tools named `exec` or MCP tools named `wait` invalidate cached scores.
GitOrigin-RevId: 7a0692e5330f3d4b4bda988ecbe7061bc8b2318c
## What changed
Add `codex tcp-tunnel` and the `codex-tcp-tunnel` crate to forward loopback TCP connections to an explicit target through a TLS-verified HTTP/3 CONNECT proxy.
- Require the proxy origin to match an approved HTTPS origin in a supplied policy file.
- Read bearer tokens and optional bounded, non-forwarding `x-` headers from stdin. Support token updates for new connections, `LISTENING` and `AUTH_UPDATED` notifications, and shutdown when the control pipe closes in token-update mode.
- Preserve the listener across proxy reconnects without replaying TCP streams, and let accepted streams continue while a proxy drains.
## Testing
Add tests for hidden CLI parsing, proxy and target validation, credential renewal, control-pipe closure, and invalid input without secret disclosure. A local HTTP/3 proxy test covers token replacement, transport recovery without stream replay, and graceful draining.
GitOrigin-RevId: c6af3025301c61e9fe90940cf5a6df0039465e69
## Why
Probing Windows network paths can send ambient credentials, even during metadata checks. Entries in `project_doc_fallback_filenames` must be validated before filesystem probes.
## What changed
Ignore entries containing path syntax according to the executor's OS, rather than the host's. Reject `.` and `..`, slashes, and NUL characters on all executors; also reject backslashes and colons on Windows. Log a warning for rejected entries and continue considering valid filenames.
## Testing
Add tests that verify invalid entries never reach metadata probes under POSIX and Windows path conventions, preserve backslashes and colons in POSIX filenames, and confirm valid fallback instructions still load alongside invalid entries.
GitOrigin-RevId: 4369e9b97ae6a3560d09e79efd8c85adac3d1d90
## Why
Executor profile roots can use path conventions that are not native to the current host. Converting them to host paths during configuration or turn reconstruction can reject or drop those roots, while case-insensitive comparison can hide Windows path spelling changes.
## What changed
- Store profile roots as URI-backed `ProfileWorkspaceRoot` values throughout permission snapshots and thread settings, preserving spelling in equality and deduplication.
- Keep effective workspace roots as `PathUri` values for permission materialization and status summaries. Convert Windows sandbox root hints to native paths only at native Windows sandbox boundaries, rejecting incompatible roots.
- Omit the legacy rollout `workspace_roots` field when profile roots cannot be represented as host paths, retaining the compiled permission profile.
## Testing
Add regression coverage for Windows and UNC root spelling changes, settings restoration and turn recording with foreign roots, executor-root status display, and backend-specific Windows root conversion.
GitOrigin-RevId: 903c068fd74959bdd10e7cb1141aa42b953a59a4
## Why
Local daemon version warnings direct users to a shell command. Provide an update flow from the TUI with an explicit choice of package source and confirmation before exiting.
## What changed
- Add `/daemon` with options to install the latest public stable release or use the current CLI package. Point local server version notices to the menu.
- Default confirmation to Cancel and explain restart, interruption, and relaunch behavior. After confirmation, exit the TUI and run the update through the launching CLI executable, propagating failures.
- Keep maintenance available when disconnected or using the embedded server. Disable updates for remote connections or a missing CLI executable, and disable copying the CLI build when no local package is available.
## Testing
Add menu snapshots and interaction tests covering both update sources, cancellation, and unavailable actions. Add a Unix CLI handoff test verifying the selected executable, command arguments, and failure propagation.
GitOrigin-RevId: 06b485feb5650673ec7dd00adda01fedb8909393
## Why
Permission summaries must preserve executor paths without interpreting them in the host's filesystem namespace.
## What changed
Accept `PathUri` values and summarize permission profiles directly instead of converting them to a legacy sandbox policy. Render additional workspace roots using their inferred native path convention, and update the exec and TUI callers.
Keep workspace subpath writes and writes outside the working directory classified as `custom permissions` when the working directory itself is not writable.
## Testing
Add coverage for POSIX, Windows drive, and UNC workspace paths, including encoded spaces and case-distinct roots, plus opaque workspace subpath writes.
GitOrigin-RevId: ff2c456e2a720e7216f13e0241b3a935cc925d00
## What changed
Keep `shutdown_signal()` pinned across `tokio::select!` iterations and reset it only when it completes, so other events do not cancel and recreate the pending signal listener.
## Testing
Update the WebSocket drain interruption test to use gated responses and keep a second turn active until the `turn/interrupt` reply arrives, preventing shutdown from racing the reply.
GitOrigin-RevId: c939d84ed0e09c2ee49229e81a3becdfa6a4c7f1
## What changed
Use `thread/revert` to remove the selected turn and subsequent history, then restore the selected prompt in the composer. Keep the thread identity, settings, goal, and unrelated thread channels intact. Show a notice that conversation history was reverted and file changes are unchanged.
Resolve selections against persisted history, accounting for partially loaded transcripts and hidden review prompts. Reject stale selections and mid-turn steers. Refresh replay state and pagination after a revert, clear queued input and obsolete actions, and require a session reload when the revert cannot be confirmed.
## Testing
Add regression coverage for reverting earlier and first visible prompts in place, preserving unloaded history and thread state, rejecting steers in clipped history, and clearing streaming output, queued input, and stale approval actions.
GitOrigin-RevId: d3f0342539392bdbfec925d0c3d6f67369937f1b
## Why
WSLg's duplicate distro root can expose filesystem contents outside the sandbox's path masks.
## What changed
- Detect the duplicate root using filesystem identity, with mount metadata as a fallback, and hide it after applying filesystem grants and denials.
- Reject explicit grants, working directories, and executable paths that use the WSLg alias, directing users to the primary filesystem paths.
- Hide host procfs when a fresh procfs cannot be mounted so process roots cannot restore access to the masked view.
## Testing
Add regression tests for duplicate-root detection, mask ordering, existing ancestor masks, alias rejection, and unrestricted filesystem behavior. Add a WSLg runtime test covering masking with and without fresh procfs, continued access to an allowed file, and rejection of an executable using the alias.
GitOrigin-RevId: 9ea31724c00fb24e3a504b6658339e8dfea35343
## Why
Users need to change the active session's model and reasoning effort without replacing saved defaults for future threads.
## What changed
- Add an `s` shortcut to final model and reasoning choices, with footer hints and a session-only confirmation.
- Apply the selection to the active thread while preserving saved configuration, including separate Plan mode defaults.
- Restore Plan mode reasoning effort with thread input state and suppress the shortcut when it conflicts with configured list bindings.
## Testing
Add coverage for picker shortcuts, active-thread updates, unchanged configuration and fresh-thread defaults, Plan mode restoration, and shortcut conflicts. Update picker snapshots to show the new hints.
GitOrigin-RevId: 07fd129021cc076e3a9bdee04b71979212788eb4
## Why
The TUI's Windows sandbox turn-context override was ignored by `thread/settings/update`, and onboarding derived sandbox state from local configuration instead of the app server's effective configuration.
## What changed
- Read Windows sandbox configuration from the app server before showing the onboarding sandbox creation hint. Show the hint only when the read succeeds and the sandbox is disabled.
- Remove `windows_sandbox_level` from `AppCommand::OverrideTurnContext` and stop sending sandbox-only overrides after setup or feature changes.
- Rely on the effective configuration refresh after setup instead of updating local sandbox flags manually.
## Testing
Update the trust-directory rendering test and snapshot to cover the sandbox creation hint.
GitOrigin-RevId: 2ee6b0634812e7b39fd73dab3ae344729910ba70
## Why
Clock provider failures can abort a turn while preparing time context or running clock tools. Allow turns to continue with an explicit indication that the current time is unavailable.
## What changed
- Add `features.nonfatal_clock_read_errors`, disabled by default, to report clock failures to the model without failing the turn.
- Emit a generic `failed to read current time` notice for context reads and tool errors, without exposing provider error details. Deduplicate context notices per turn and compaction window, and remove inherited notices from forked subagent context.
- Omit unavailable environment dates and explicitly clear previously visible dates with `<current_date status="unavailable" />`.
- Return external sleep clock failures to the model when the feature is enabled, preserving sleep item completion notifications.
## Testing
Add coverage for continued inference after clock failures, notice deduplication across compaction, subagent notice filtering, environment date removal and recovery, and sleep failures during initial and polling reads.
GitOrigin-RevId: a39c3723c06a6f786d8ad59d667e8b9f626c973e
