## What changed
- Extend app-server tests for account credential reuse, refresh races, stale bearer rejection, retry exhaustion, and step-up failures at the identity provider and resource authorization server.
- Assert token-exchange request fields and enterprise protocol negotiation while preserving the ordinary MCP handshake.
- Add core scenarios for permission and tool-policy refreshes, policy revocation, and thread removal, including cancellation of in-flight enterprise calls.
- Snapshot conversation history after revocation to verify that prior calls remain visible and ordinary tools continue working.
- Allow the existing startup-failure test to wait through the MCP startup deadline.
GitOrigin-RevId: 31cf71a28f91bd30746b74df8fa669edb6bc23a1
## What changed
- Prefer an eligible account grant over saved enterprise credentials, with a fallback to saved enterprise sign-in during initial connection if the account grant is rejected.
- Remember rejected account grants per enterprise MCP registration across threads and report authentication failures as requiring reauthentication. Keep administrator configuration errors distinct from sign-in failures.
- Compare account grants independently of access and ID token rotation, recheck the latest identity eligibility after exchange, and retry once when the refresh grant changes.
- Make MCP authentication status reflect usable account grants, saved enterprise credentials, and completed connection failures.
## Testing
Extend regression coverage for enterprise sign-in failures and recovery, MCP authentication status, account grant identity across token refreshes, and retries after transient credential failures.
GitOrigin-RevId: eeac65f668d5d2d55e9d8bf4547fbcbdd6a6c42d
## Why
Managed stderr logs previously retained a tail only before a new launch, allowing logs to grow during a long-running process. Direct stderr writes could also block lifecycle operations on disk I/O.
## What changed
- Route managed app-server and updater logs through a shared nonblocking worker with a bounded queue. Drop records when the queue is full or a record exceeds 16 KiB, and avoid waiting for the worker at shutdown.
- Prune live logs when they exceed 1 MiB, preserving the latest 256 KiB in `.log.previous` before truncating the current file. Keep inherited stderr handles usable after truncation.
- Pause predecessor pruning during Windows updater handoff and resume it after a failed handoff only when ownership has been restored.
- Keep ordinary stderr output when managed logging has not been initialized.
## Testing
Add regression tests for stalled workers and queue overflow, tail retention, inherited append and nonappend handles, and pruning exclusion during updater handoff.
GitOrigin-RevId: b6301962b1180fa6cdb231a56edce2429dc20b54
Pause Tokio time after the validation timeout in
`malformed_handshakes_preserve_active_streams_and_admission_recovers`
while inspecting diagnostics, since that inspection does not poll the
harness WebSocket for pings. Resume time before closing the WebSocket so
the close handshake and its timeout run with an active clock.
GitOrigin-RevId: 733a1fa35f80561424be97c4beb233780a7796cb
## Why
Dropped lifecycle facts can leave incomplete turns retaining analytics metadata indefinitely.
## What changed
- Limit retained turns to 256, evicting the oldest turn and its associated tool and review state when capacity is reached.
- Forward `ThreadClosed` notifications to analytics and discard the closed thread's turn and review state, including reviews received without turn lifecycle facts.
## Testing
Add regression tests covering metadata release after capacity eviction, continued reporting of new complete turns, cleanup isolated to the closed thread, and ignored approval responses after thread closure.
GitOrigin-RevId: eed0a1fef013381654345d535f03de42b99e8607
## Why
Guardian review metrics derived duration from wall-clock timestamps, while analytics measured elapsed time when tracking the result. Clock changes and delayed tracking could produce inconsistent latencies.
## What changed
Capture one monotonic duration at review completion and pass it to both metrics and analytics. Preserve wall-clock timestamps for event ordering, and saturate analytics latency conversion at `u64::MAX`.
## Testing
Add a regression test covering skewed wall-clock timestamps and delayed tracking, verifying that the duration metric uses the captured interval and completion timestamps are preserved.
GitOrigin-RevId: 19eafb8e1f1a3d13a751bdc72c218e4cafeae410
## What changed
Add `codex-utils-critical-path` to track shared dependency paths and attribute time to inference, automatic review, user waits, tools, overhead, and unknown work. Parallel joins retain the later-finishing branch, preserving its full history without double-counting overlapping work.
Clip attribution to the requested interval and count unrecorded gaps as overhead. Bound retained history by collapsing it into unknown work at the depth limit, with nonrecursive destruction and bounded debug output.
## Testing
Add unit tests for parallel joins, nested dependencies, ties, user waits, interval clipping, overlapping segments, history exhaustion, and safe formatting and concurrent release on small stacks.
GitOrigin-RevId: 2df7453162491d3ae97bf4bee942730c8a4d5e5c
## What changed
Store `RolloutItem::SessionMeta` and `RolloutItem::Compacted` payloads in `Box` values and update their producers, consumers, and test fixtures. Preserve the existing serialized rollout format.
GitOrigin-RevId: 59fcc4beb47d23160872dcb6e95ace9b142d3d11
## Why
Reducing code cell lifecycle events discarded their response payload references and lost the initial response status when the runtime status changed.
## What changed
Store the initial response status and separate raw payload IDs for the initial response and final result on `CodeCell`. Carry payload references through queued lifecycle events so they survive replay when the source item arrives later.
## Testing
Extend lifecycle tests to verify distinct initial and final payload IDs and the preserved initial status for yielded cells that complete and failed cells whose lifecycle events precede their source item.
GitOrigin-RevId: 8f49a3174ea487a5d91ebc2a6c97133aacaabfd2
## Why
Sessions using the same MCP catalog can repeat schema normalization and retain duplicate tool specifications.
## What changed
Split immutable MCP tool metadata and normalized specifications from per-handler caches, and reuse matching definitions within each `McpManager`. Require matching tool metadata, agent-plugin mode, and schema budget before reuse.
Keep shared definitions behind weak references and prune expired entries on cache misses so completed sessions do not keep their schemas alive. Build definitions outside the shared index lock.
GitOrigin-RevId: 02345359a1b0d297ca56f2f469de88aba89106f1
## Why
Targeted notification delivery and broadcast routing clone the message for every recipient, then discard the original.
## What changed
Use `std::iter::repeat_n` to move the original message to the last recipient, avoiding one clone per nonempty recipient list while preserving delivery behavior.
## Testing
Expand notification tests to cover empty, single, and multiple recipient lists, checking payloads, target order, and shared timestamps. Add broadcast coverage for zero, one, and two eligible recipients, verifying that uninitialized clients, clients without the required experimental API support, and clients that opted out are skipped.
GitOrigin-RevId: 2ba192f416ccd786e3566da3e5c851518b509afe
## Why
Disabled or failed protected shell snapshots prevent commands from running when credential masking is enabled.
## What changed
Restore unmasked credentials and continue execution when a protected shell snapshot is unavailable. Log and emit a warning explaining that the command will run with unmasked credentials.
## Testing
Extend `brokered_shell_snapshot_fallback` coverage for disabled and failed snapshots, including managed feature settings. Verify the warning, successful execution with restored credentials, continued filesystem sandbox and network policy enforcement, and masking recovery after snapshot storage is repaired.
GitOrigin-RevId: 28561e571b2a043d0b6cfa248c9ba2a61dd558ba
## Why
MCP callable namespaces and tool names can differ from their backend identities or match built-in tool names. Classifying calls by name can misidentify MCP calls and incorrectly parse namespaced `write_stdin` calls as terminal operations.
## What changed
Resolve `ToolCallKind::Mcp` from the runtime invocation's server and tool as soon as the runtime starts, before MCP correlation assignment. Preserve the caller-facing summary and raw invocation, and skip built-in runtime handling for MCP calls.
Only create dispatch-based `write_stdin` terminal operations for calls without a namespace.
## Testing
Add replay regression coverage for prefixed and unprefixed MCP aliases, names that match built-in tools, and `write_stdin` arguments with and without a session ID. Verify backend classification, preserved callable identity and dispatch lifecycle, and the absence of terminal operations and sessions.
GitOrigin-RevId: 71f31335c1eb36b6b7e1a34383d10fc500bd2c4f
## What changed
Move cached cloud skill contents into `SkillCatalogState` alongside the published catalog generation. Prepare auth scopes and access cached contents under the same lock, clearing contents when the auth scope changes and retaining them when a partial refresh preserves a complete catalog. Keep generation checks around asynchronous discovery and reads.
Use the auth key already captured by `prepare_cloud_generation` when creating a cloud plugin generation, so the stored and returned keys match.
GitOrigin-RevId: 426bb7868baf9ff7855988291783a8d3e38d9c93
## What changed
- Prefer stored enterprise credentials when available; otherwise use a validated Codex account OAuth grant whose issuer matches the enterprise MCP configuration.
- Pin each connection to its credential source and OAuth client, reject stale account grants, and hold the account refresh lease only during the IdP exchange.
- Report actionable sign-in and issuer configuration errors, and classify token failures by credential source.
GitOrigin-RevId: 26673f276a31e4ca5290f6b120f0ac44c77d7239
## Why
Configuration reloads must cancel stale enterprise MCP startups while preserving access for running threads that still pass validation. Replacing a runtime during `thread/revert` must also leave the replacement able to use enterprise tools.
## What changed
- Separate pending startup cancellation from published thread lifetimes, with independent startup state for forks and replacement runtimes.
- Retain eligible enterprise MCP connections across refreshes and explicit reconnects while applying updated tool restrictions and approvals. Do not create replacement enterprise connections after initial startup.
- Revoke enterprise authorization when a thread is removed, drain requests when access is disabled, and revoke a connection's authority when token renewal requires authentication.
## Testing
Extend regression coverage to verify enterprise tool calls survive `thread/revert`, inherited fork configurations are cancelled after a reload, and enterprise calls fail after logout while ordinary MCP calls remain available.
GitOrigin-RevId: 2d634be3011854b57f73c741bd1ec6b5aed94ee5
## What changed
Add an `incremental_tools` attribute to `codex.tools.registered` using the effective mode for the current sampling request. Compute the mode once and reuse it for registration metrics and prompt construction across transport retries.
## Testing
Extend integration tests to verify the attribute for incremental and non-incremental requests, including when the feature flag is enabled but the Responses API does not support incremental tools. Assert registration sample counts and retain coverage that stream retries do not duplicate registration metrics.
GitOrigin-RevId: e5b7a1075fe722ef6bdf900ae07e2b1b06aecfb5
## What changed
- Classify token-source failures by credential kind and exchange stage, with sign-in or administrator guidance that omits provider error text. Treat resource authorization failures separately from enterprise identity failures when deciding whether authentication is required.
- Add policy-bound request authority checks that return `RequestNotSent` when policy is updating or unavailable, while allowing admitted responses to finish. Support child authorities that isolate connection revocation and share response draining.
- Recheck account validity after acquiring the credential invalidation lock and check cancellation before deleting a rejected credential.
## Testing
Extend regression coverage for policy suspension during token renewal, completion of admitted requests, recovery with fresh authority, and transport retry classification. Expand provider-error tests to cover `unauthorized_client` and `invalid_client` while checking that credential text is not exposed.
GitOrigin-RevId: c0097adc35cb5fdffde1466e4bc2b5ec78114a4b
## Why
Legacy marketplace checkouts have no owner lock and were skipped by staging cleanup. Age thresholds allow cleanup to reclaim them while leaving recent clones from older binaries alone.
## What changed
Remove legacy `marketplace-add-` directories after 24 hours and `marketplace-upgrade-` directories after 10 minutes, based on directory modification time. Keep owner locks authoritative for current staging directories.
## Testing
Extend cleanup tests to cover both legacy age thresholds, preservation of recent legacy clones and live locked checkouts, and skipping legacy symlinks.
GitOrigin-RevId: 77b55bfe50ab29f5ceae46a80276b2c9e361107f
## Why
Failed marketplace adds can leave temporary checkouts behind, and interrupted adds or upgrades can leave abandoned staging directories.
## What changed
- Share a staging guard across marketplace adds and upgrades so temporary checkouts are removed on completion or failure, including config-write rollback.
- Reclaim up to four abandoned directories per cleanup pass during add and upgrade operations. Use file locks to preserve active checkouts and operating-system-specific names to avoid reclaiming another platform's staging directories.
- Skip symlinks and unrelated entries, and report cleanup failures as warnings.
## Testing
Add regression coverage for failed adds, CLI and automatic-upgrade cleanup, cross-process ownership and abandonment, lock contention, bounded cleanup, and symlink handling.
GitOrigin-RevId: 20999da0eab861dfb8025aad5e9fba2bcaf818b8
## What changed
- Add an account IdP identity resolver that checks ID-token bindings against trusted issuer and client provenance before discovering the refresh-token endpoint. An expired ID token does not by itself invalidate the refresh grant.
- Generalize `EmaIdpIdentity` and token exchange requests to carry caller-owned credential leases. Invoke a `finish_idp` callback after the IdP exchange and before resource authorization server I/O so callers can release their refresh guards at that boundary.
- Reject empty expected OIDC issuers and client IDs, and expose an unverified issuer hint solely for explaining legacy login migration.
GitOrigin-RevId: 34473fed82a9a6e58997664cd5e6e67049b5ee7e
## Why
Queued prompts can resume before a pending permissions menu opens, and local
`/permissions` commands can bypass guards for outstanding permission changes.
Attaching to a different project can also retain model access information from
the launch directory.
## What changed
- Route `/permissions` through app permission guards and hold queued prompts
while the menu is pending. Settle the hold when opening is rejected, discovery
is invalidated, or a covering request is resolved.
- Apply the custom permission profile selection check beyond embedded servers.
- Refresh API-key model access when the first attached session changes the
working directory, including with an embedded server. Propagate the widget's
model catalog to the app and server even when the model response matches the
widget's already-updated catalog.
- Skip sessions reported as `thread not loaded` during name lookup for all
server types instead of falling back to unverified list metadata.
## Testing
Add regression coverage for permission guards, queued prompts across successive
permission menus, invalidated and covered menus, model catalog propagation,
project changes on initial attachment, and name lookup across server pages with
unreadable entries.
GitOrigin-RevId: eb49cb5268ce0ce1e40009b73a0180f23e61ed72
## Why
A persisted login replacement can leave the auth cache holding the previous login, even for the same account. Enterprise MCP authorization must detect that replacement before continuing to use enterprise credentials.
## What changed
- Check cached and persisted account login ownership before enterprise MCP connections and around token exchanges, revoking authorization when ownership changes.
- Recheck account ownership and login generation before committing enterprise sign-in credentials.
- Compare complete token data when checking whether an account OAuth grant is still current, and expose grant token access and credential comparison helpers.
## Testing
Add regression coverage for detecting a same-account login replacement without updating cached auth, rejecting enterprise MCP use after replacement, and keeping ordinary MCP usable while an enterprise account storage read is blocked.
GitOrigin-RevId: 6303f88a9cbcc84c99e453dc281b23d66930f518
## What changed
- Update Cargo and Bazel toolchain pins, CI and release workflows, and Windows setup from Rust `1.95.0` to `1.99.1`.
- Adapt Rust code to updated APIs and lint requirements, including `try_update` and `as_chunks`, and refresh the halfwidth sound marks snapshot.
- Update `webpki-root-certs` from `1.0.5` to `1.0.10` in the Cargo and Bazel lockfiles.
GitOrigin-RevId: e1aaed63b7e72bb8c8bbe25b32c6329c9a37b6c3
## Why
Agent Plugin manifests previously skipped app declarations, including service-generated declarations installed with remote curated plugins. This prevented those plugins from using app routing and suppressing matching direct MCP connections.
## What changed
- Recognize app declarations for Agent Plugins from `openai-curated-remote` across loading, capability summaries, plugin details, tool suggestions, and install authentication.
- Apply app routing to suppress same-name MCP servers when an app route is available. Keep unrelated MCP servers available and preserve direct MCP access in API-key mode.
- Keep app declarations inactive for Agent Plugins from other marketplaces.
## Testing
Add coverage for marketplace and authentication routing, service-generated app declarations during installation with both manifest formats, and app tools reaching turns. Verify that disabling Apps does not restore matching direct MCP connections.
GitOrigin-RevId: 791739569f0e01c898040bc2d028cf517f767e00
## Why
Decisions snapshot comparisons reject requests containing reasoning or compaction, while conversation comparisons already omit those items. A parent compaction also causes snapshot comparisons to be rejected.
## What changed
- Share filtering of reasoning, compaction, and context compaction across both comparison modes, and ignore parent compaction when building the Decisions request.
- Distinguish malformed request setup from unsupported input items. Record setup errors as failures and unsupported input items as skipped comparisons.
## Testing
Extend the HTTP contract test to cover both comparison modes with reasoning, compaction, context compaction, and parent compaction while preserving message content. Update assertions for the distinct setup and unsupported-input errors.
GitOrigin-RevId: e3ba0cce3b6457b3e3eab3589352b70288cbb1ef
## What changed
Add `MessageLifecycleContributor` hooks to capture extension state when local agent control publishes a message and notify contributors when the recipient commits it to history, before sampling.
Carry shared delivery state through submissions, input queues, and mailbox eviction with `PendingAgentMessage`. Notify consumption at most once per delivery, release captured state when consumed or abandoned, and drop pending mail outside queue locks. Preserve the serialized message format without republishing restored history.
## Testing
Extend the mailbox eviction test to verify that publication state survives eviction and retained messages are consumed before the first resumed model sample.
GitOrigin-RevId: 9a1f6832bd48ec646a3fd179485c095e8dcc72cc
## What changed
- Add `CodeModeCellTiming` notifications for yielded executions, terminal waits, and unavailable cells, with thread, call, and cell identifiers.
- Measure how long completed results remain buffered before retrieval and carry `result_buffered_for` through the runtime, stdio protocol, and gRPC response metadata. Immediate delivery reports zero; waits without a completed result report no buffering measurement.
- Default missing buffering data to zero for compatibility with older hosts.
## Testing
Extend runtime tests to verify buffering duration with a paused clock and retrieval through termination. Add gRPC conversion tests for nanosecond precision, optional metadata, and the distinction between immediate delivery and no completed result.
GitOrigin-RevId: 60c0c5a3affa69ac3779bf1812fca50f5748af76
## What changed
Collect compressed rollout paths and scan them in up to four concurrent batches, reusing compiled search patterns within each batch. Preserve match snippets, plain rollout path keys, and per-file error handling.
## Testing
Extend the regression test to verify matches across seven compressed rollouts while skipping a corrupt file, and retain coverage for oversized search patterns and missing files.
GitOrigin-RevId: 522403654ab8577499f8f8043ccc017590c4833e
## Why
An in-flight token refresh or auth reload can outlive a login change or logout. Its result must not overwrite credentials for a different login or restore stale cached auth.
## What changed
- Serialize in-process auth storage reads and writes that participate in credential updates.
- Verify the stored login before persisting refreshed tokens or agent identity records, while allowing older clients to drop login metadata when the refresh token still matches.
- Reject stale auth reload results using generation checks, and invalidate pending reads on logout even when the cache is already empty.
- Keep account grant reads strict when the keyring is unavailable, while preserving ordinary auth fallback behavior.
## Testing
Add regression coverage for stale reloads after logout, login replacement during refresh, legacy metadata loss, keyring recovery with rotated tokens, and refresh persistence failures.
GitOrigin-RevId: 01bce9ddbc3101de868adcda3370fcdc4eb70163
## Why
When unread events block notification delivery and the client request queue is full, shutdown can hang waiting to enqueue its shutdown message before reaching its timeouts.
## What changed
Drop the event receiver at the start of `InProcessClientHandle::shutdown` to unblock notification delivery before waiting for space in the request queue.
## Testing
Add a regression test that fills both queues with real requests and notifications, then verifies shutdown completes within the configured timeout budget.
GitOrigin-RevId: a2b01042fc81dd2df4affca1d6cf2ddfb64b39db
## Why
Input injected before `wait_agent` or `clock.sleep` begins must still interrupt the wait and reach the next model request.
## What changed
Track notifying response-item injections as pending steering activity. Reset that state when pending input is consumed or cleared so later passive context does not interrupt waits.
## Testing
Extend wait and sleep tests to cover injections queued before the wait and delivered while waiting, alongside user steering. Add queue coverage for pending injection detection and reset after consumption.
GitOrigin-RevId: 90f8d968336082c76271d1ca4f81b855bafc72c6
## What changed
Add `RuntimeAuthProvider` to resolve request authentication through the runtime auth manager. Support `dual_header` mode, which sends a bearer credential alongside `x-openai-agent-assertion`, and `assertion_only` mode, which uses `Authorization: AgentAssertion …`.
Replace stale authentication headers and sign a fresh assertion for each request attempt. Propagate registration failures without falling back to credential-only authentication, preserving policy errors and classifying transport failures, rate limits, and server errors as transient.
Add the disabled-by-default `features.runtime_agent_instances` configuration with independent `enabled` and `mode` settings, schema support, and structured override merging. Selecting a mode alone does not enable the feature.
## Testing
Add coverage for both modes with API key and ChatGPT credentials, stale header replacement, fresh assertions, credential refresh without runtime replacement, registration failures, and configuration parsing and merging.
GitOrigin-RevId: 9e93d25762600f0ff592c5248fe4c8c2c8182c8d
## Why
Guardian V2 previously skipped optional Decisions comparisons in conversation mode as unsupported evidence.
## What changed
- Start comparisons from the prepared conversation input, including retained history or rebuilt evidence after a history reset.
- Extract the classifier rubric and preserve evidence message roles, content order, and boundaries. Omit retained reasoning and compaction items while continuing to reject other unsupported evidence.
- Measure baseline sampling through the usable score, before history draining and commit, and report skipped comparisons when preparation fails or the request is superseded.
## Testing
Extend coverage to both classifier modes for comparison disagreements, failures, and disabled or uninitialized comparisons without changing baseline scores. Verify conversation evidence across history reuse and resets, malformed input rejection, and budget failures before either backend sends a request.
GitOrigin-RevId: ce32cf876d15d3b82e0b83ac02c33447e7724a51
## What changed
Classify messages from code-mode collaboration calls as `AgentMessage::Plaintext` so they receive the context wrapper for plaintext messages. Apply this to `spawn_agent`, `send_message`, and `followup_task`.
## Testing
Add a regression test that spawns an agent through `exec` and verifies that the child receives the task as plaintext with sender and recipient attribution.
GitOrigin-RevId: 495c70ea13fd2bb06989e5aacab60beed0c19a56
## What changed
- Add `--cloud-skills-snapshot PATH` to load a cloud skill catalog and resource contents from JSON once at app-server startup, without contacting a live skill service.
- Expose snapshot skills through the native `skills.list` and `skills.read` interface, preserving aliases and prompt visibility. Reads remain available after the snapshot file is removed.
- Validate package boundaries, required resources, duplicate packages, and size limits; fail startup for missing or invalid snapshots.
- Keep frozen cloud catalog and read caches independent of live MCP resource changes.
## Testing
Add provider, cache, app-server, and core scenario tests covering validation, exact resource contents, authority boundaries, startup failures, and listing and reading frozen skills alongside a named executor.
GitOrigin-RevId: d438a5d678121db3e17515fc5edcd00d4e20b900
## Why
Sibling rollout prefetching returns no paths when its candidate set omits the first ancestor. With more than 64 sibling rollouts, the candidate limit could exclude that ancestor and prevent prefetching.
## What changed
Pass the first ancestor ID into candidate collection and reserve the final slot for it until it is found, preserving the 64-candidate limit.
## Testing
Add a regression test that creates more siblings than the candidate limit and verifies that an otherwise omitted ancestor is included when prioritized.
GitOrigin-RevId: 130508dfb1a190af68ccf1911c7501617be79a00
## What changed
- Rename the snapshot comparison entry point to `start_snapshot_comparison` and extract request spawning into `spawn_request`.
- Accept a `ContentItem` rubric and an iterator of evidence in the request adapter.
- Read the Decisions comparison feature flag once per classification and simplify the budget rejection test setup.
GitOrigin-RevId: b4a294eeecb6069db0f80ff6e4f13f558cbd7815
## What changed
Extract the inline test modules for `bundled_bwrap`, `bwrap`, `exec_util`,
`launcher`, `proxy_routing`, and `seccomp` into sibling `*_tests.rs` files.
Keep them wired through `#[cfg(test)]` and explicit `#[path]` attributes,
with existing test coverage and runtime behavior unchanged.
GitOrigin-RevId: 79b70a092a19b10716939744542415bc1dcaf0b2
## What changed
- Update `rustls-webpki` from `0.103.15` to `0.103.16`.
- Update `webpki-roots` from `1.0.5` to `1.0.10`.
- Refresh the corresponding entries in `codex-rs/Cargo.lock` and `MODULE.bazel.lock`.
GitOrigin-RevId: c73d2afb6ce9f8bd8756d3cbe6f8114edc461262
## Why
Synchronous auth header construction could silently return no credentials when managed authentication became unavailable. Callers need an error to avoid sending requests with missing or partial authentication.
## What changed
- Make `AuthProvider::add_auth_headers`, `to_auth_headers`, and auth header telemetry fallible, and propagate failures through request and WebSocket setup.
- Return a transient error when managed authentication is unavailable, and preserve network policy denials through auth error conversion.
- Retry transient MCP authentication errors while treating build errors and policy denials as terminal.
- Cancel local MCP event streams before resolving authentication so cleanup still works when credentials become unavailable.
## Testing
Add regression coverage for rejected partial authentication, async header resolution, terminal auth errors without sending requests, managed account changes, MCP retry classification, and local stream cancellation after authentication becomes unavailable.
GitOrigin-RevId: 39d981e232cba1e302de502a2fa6239101114ed1
Move context prefixing and request extraction into `user_prompt`, and update
IDE context injection, thread routing, thread titles, transcript export, and
user message rendering to use the shared helpers. Preserve the request
delimiter, text element byte offsets, and input ordering.
Move the existing last-delimiter extraction test alongside the shared helpers.
GitOrigin-RevId: 3ee350506a536a6dba9575e8311188bc92fed584
## What changed
Prefer frequently selected entries in the TUI's `$` picker within exact, prefix, and fuzzy match tiers, keeping stronger match tiers ahead of usage preferences.
Track the last 50 confirmed selections and persist them in `mention_usage.json` under `CODEX_HOME` when history persistence is enabled. Preserve in-memory preferences across compatible chat widget replacements, including when history persistence is disabled. Serialize background writes, merge updates under a bounded file lock, and flush pending writes on shutdown.
## Testing
Add coverage for picker ordering, preference handoff and persistence, history-disabled widget replacement, selection expiry, malformed history, and lock contention.
GitOrigin-RevId: 7efa8c1c365e23000fcda10dbbc2a7e90f4e777c
Remove the exception that allowed clients without a package identity to connect
when the provisioning service had one. Keep the debug foreground-mode exception.
GitOrigin-RevId: def2d22a91575477d73e3d8c6ac14808a2ff3b2b
## What changed
Record `codex.guardian.turn.blocking_ms` when a turn completes or aborts, with an `outcome` label. Count overlapping approval waits once, exclude idle gaps, and split pending reviews across the active turns they span. Use each turn's telemetry so samples retain the servicing turn's model attribution.
## Testing
Add unit coverage for overlapping waits, idle gaps, late turn completion, and duplicate stops. Extend integration coverage to verify attribution across turns and model changes for yielded command reviews and MCP elicitation, including aborted turns.
GitOrigin-RevId: a3e6a0c32a06fe58ea93119ecd941076100fb82c
## What changed
Expose `PromptCacheKey` through `StartThreadOptions` with three policies: retain the default session-derived key, send a custom key, or omit `prompt_cache_key` from model requests. Keep session identity headers independent of this policy.
Propagate the policy to child agents, delegated sessions, and guardian review sessions. Hosts must reapply the policy when resuming a thread from storage.
## Testing
Add coverage for all three policies across turns, including unchanged session and thread headers. Extend subagent coverage to verify inheritance of the default and omitted-key policies.
GitOrigin-RevId: f9e8ab31fcf568636f9712726760e4e9a4672428
## Why
Polling a failed background compaction consumes the closed oneshot receiver.
Keeping that receiver in session state can cause a later await to panic instead
of falling back to foreground compaction.
## What changed
Remove the receiver from session state before polling it, restoring it only when
its result is still pending. Discard closed receivers so compaction can fall back
normally.
## Testing
Add a regression scenario where background compaction fails before the next
checkpoint and automatic compaction falls back successfully.
GitOrigin-RevId: 1461bb403f4b0b8b7e171d1b3cba41411f2014b4
## What changed
Default `features.multi_agent_v2.preserve_fork_prefix` to `true`, so full-history forks retain the parent's model-visible history and append child instructions. Keep `preserve_fork_prefix = false` as an explicit opt-out for instruction filtering, and update the configuration schema documentation.
## Testing
Update coverage to verify inherited prefixes across child and grandchild forks, child instruction ordering after compaction, and explicit filtering opt-outs.
GitOrigin-RevId: f14eae5b924cdeac555d112d0aba3fbbb063b0ea
jif