## Why
The agent command center previously required a shared background server, preventing embedded sessions from opening it and rejecting `codex agents --no-daemon`.
## What changed
- Allow `codex agents --no-daemon` to use an embedded app server and open the command center without a shared server.
- Route `codex agents` through the normal daemon startup, eligibility, and compatibility checks, including embedded fallback where applicable.
- Return embedded sessions to the command center when canceling directory trust or archived-session confirmation.
## Testing
Add CLI coverage for `--no-daemon` before and after `agents`, plus an integration test that verifies embedded mode is used even when a daemon is running. Update archived-session tests to expect cancellation to return to the command center.
GitOrigin-RevId: 3bdf18a00456eae2e4d38103d12126e039d44119
## Why
Command-center navigation required a shared app server, leaving embedded sessions without the same way to switch between chats. Archiving or deleting an embedded session also exited the TUI.
## What changed
- Enable command-center navigation and session listing for embedded sessions, including navigation from read-only conversations and the safety precaution menu.
- Return to the command center after archiving or deleting a session.
- Retain thread subscriptions when forking, including on embedded servers.
- Confirm before quitting an embedded server would stop running sessions or side conversations.
- Construct large startup and event-loop futures outside their callers' stack frames before boxing them.
## Testing
Add regression coverage for embedded session switching with background approvals and draft restoration, plus confirmation before quitting with a running side conversation. Update navigation, archive/delete, fork, and UI snapshot tests for the new behavior.
GitOrigin-RevId: 96bac48cccf85b685b58934d23dd1db93b663751
## Why
Archiving or deleting a thread in the command center shuts down side conversations belonging to other threads.
## What changed
Limit side conversation shutdown to those whose parents belong to the affected thread's known subtree. Proceed once those conversations close successfully, even if unrelated side conversations remain. Continue shutting down all side conversations on exit.
## Testing
Extend the delete lifecycle test to verify that an unrelated side conversation remains open after deletion.
GitOrigin-RevId: f27efcd1fc49cf5c617c9fa454d83eed91ae185f
## Why
Long realtime conversations could lose speech when active transcripts and handoff transcript fields were truncated.
## What changed
- Record completed V3 transcript chunks in model and client history once the active transcript exceeds 4 KiB, without triggering inference.
- Keep unfinished utterances pending to preserve conversation order, and persist completed chunks before subsequent handoffs.
- Preserve full V3 transcript text at handoff and session-end tail flush, and avoid adding handoff input already recorded in transcript history.
## Testing
Add integration coverage for long transcripts, XML escaping, recording before handoff without inference, repeated handoff input, and both session-end tail flush settings.
GitOrigin-RevId: 62218b811809c4cf5b16fb0247a335eb474f9ab9
## What changed
Allow gateway OAuth configuration to select `credentials_store = "file"` to persist credentials in plaintext at `$CODEX_HOME/secrets/gateway_oauth.json`. Keep `keyring` as the default.
Read, update, and delete file-backed credentials by credential ID, using atomic writes and the existing cross-process lock. Preserve the serialized provider identity when using the default store.
## Testing
Add an app-server test that completes gateway OAuth login with file storage, verifies Unix file permissions are `0600`, and checks that login remains successful after a server restart.
GitOrigin-RevId: dc1d17922bd80bf65034cbc5aa3d97959e962dcc
## Why
Switching model providers can hide saved chats from resume lookup or prevent them from opening. Keep their history readable when the server rejects resuming because of a provider mismatch, missing configuration, or policy conflict.
## What changed
- Include all providers in the resume picker, named resume lookup, and `resume --last`, while retaining provider filtering for fork lookup.
- Open chats with provider errors as read-only history and show an explanation with recovery shortcuts: `c` to continue in a new chat, `n` to start fresh, and `Esc` to choose another chat.
- Continuing in a new chat prepares an editable, unsent prompt referencing the saved conversation.
- Preserve drafts and rejected prompts or steers, suppress automatic submission, and retry provider admission when reopening the chat.
## Testing
Add coverage for cross-provider discovery, read-only history, configuration recovery, continuation drafts, rejected input recovery, error rendering, and Escape handling during transcript browsing.
GitOrigin-RevId: 5aaa7a404b9a6231101599adef18d2f1e4a8020a
## What changed
- Add a non-inlined `TryFrom<toml::Value>` implementation for `ConfigToml` and route callers through it to share the generated deserializer in `codex-config`.
- Reuse the ignored-field deserialization helper for strict validation, returning path-aware errors while preserving existing fallbacks for CLI validation and ignored-config warnings.
GitOrigin-RevId: 0208b314416ad4d3d7fbf3a30560a0c8c4035abd
## Why
Older executors sandbox reads whenever a policy is supplied, even when the policy allows unrestricted reads. This can interfere with loading skills across executor versions.
## What changed
- Omit sandbox contexts from remote read operations when reads are unrestricted and explicit permission paths are valid for the target path convention. Retain contexts that require executor-side path validation.
- Check remote `windows_mxc` support before sending MXC sandbox contexts for reads or capability discovery, returning an update-executor error when unsupported.
## Testing
Add coverage for permission path validation across read operations, unsupported MXC requests, and skill loading over Noise with mismatched app and executor versions, including selected skill roots with capability discovery disabled.
GitOrigin-RevId: 4a2a7ccaa2ba4daac657bd84aea603404452be45
## Why
Cyber access program selection was restricted to the `openai` provider ID, preventing custom providers from accepting explicit program selections.
## What changed
- Add `capabilities.cyber_access_programs` to provider configuration and preserve it through remote thread configuration. Default to enabled for `openai` and disabled for other provider IDs, with explicit overrides taking precedence.
- Use the capability when forwarding `access_programs.cyber` and determining Daybreak availability in exec and the TUI. Refresh TUI eligibility when the server changes the selected provider.
- Preserve authentication, API-key feature gates, and catalog access checks; the capability does not grant program access.
## Testing
Add coverage for capability defaults and overrides, configuration round trips, custom-provider requests with both authentication types, API-key feature gating, compaction, WebSocket response reuse, exec selection, and TUI provider changes.
GitOrigin-RevId: 579f7c33c9e857ff5fedd08311aa8e3129740c1f
## Why
Standalone web search must use the same permission mode as hosted search. Permission changes during a turn should take effect on the next turn, without changing web access for searches in the active turn.
## What changed
Pass the turn's `WebSearchMode` to the web search extension and use it to determine tool availability and `external_web_access`, while retaining provider support checks and thread-level search settings.
## Testing
Add an app-server regression test that switches from cached search to Full Access while a turn is paused. Searches before and after the update keep `external_web_access` disabled in that turn; the next turn enables it.
GitOrigin-RevId: 9e3b8598f2e491388b7e7d4840c849155ae95e88
## What changed
Allow shared network constraints in `[permissions.network]` in `requirements.toml`, alongside `[permissions.filesystem]`. Apply them throughout configuration loading, network approvals, Windows sandbox policy validation, and `configRequirements/read`, and show their source in `/debug-config`.
Retain `[network_proxy]` and `[experimental_network]`, but reject mixing either with `[permissions.network]`, even across requirements layers. Preserve independent network and filesystem precedence and source attribution, and report unknown nested network fields.
Reserve `network` as a managed requirements table name and reject empty or profile-shaped tables with migration guidance. Profiles named `network` remain valid in `config.toml`. Document that policy publishers must keep using `[experimental_network]` until all readers support the chosen replacement.
## Testing
Add coverage for layered constraints and source attribution, conflicting spellings, profile-name migration errors, unknown-field diagnostics, and cloud validation. Extend API, project discovery, network approval, and Windows policy tests to cover `[permissions.network]`, and verify managed proxy settings remain independent of disabled feature configuration.
GitOrigin-RevId: 994dfca9abf5a7aea914276c0ded8b40d7ed0372
## Why
A completion marker missing its final newline can make an incomplete trace appear complete. Opaque JSON payload validation can also miss invalid UTF-8 inside strings.
## What changed
Require a newline-terminated `RecordingCompleted` record before setting `recording_complete`. Read raw payloads as UTF-8 text before validating their JSON structure.
## Testing
Extend the lifecycle replay test to cover a completion marker missing its final newline and an opaque payload containing invalid UTF-8.
GitOrigin-RevId: a0007ff449cdefeb44065ed9165ef60bf720dad9
## Why
The SIGTERM cleanup test depends on the OS scheduling the shell within the production grace period. Tracing tests also need fixture creation and cleanup to use the appropriate subscriber.
## What changed
- Pause Tokio time while waiting for the shell's cleanup marker, keeping the cancellation future runnable to prevent automatic clock advancement, then resume time after execution.
- Adjust subscriber setup and fixture lifetimes in session and tool dispatch tests so instrumented resources are created and dropped under the appropriate subscriber.
GitOrigin-RevId: 12c654a031a8a4e61fc66488a5f687852f5ca099
## Why
MXC requires deny paths to have existing parent directories, even when the denied path itself does not exist.
## What changed
Create missing parent directories before expanding deny globs and volume grants on Windows. If creation fails, return a policy resolution error with guidance to create the directory manually or correct the path or permissions.
## Testing
Extend policy tests to cover missing deny parents, preserved read-only carveouts during volume expansion, and parent denies expressed as explicit paths or glob patterns. Verify that parent directories are created without creating the denied child.
GitOrigin-RevId: d852444bef51e5d5449c4228a31d01c0e6f982dc
## Why
Enabled rollout tracing could silently fail to initialize, and a terminal task status did not establish whether all recording had finished. Trace consumers need to distinguish a complete recording from a partial bundle, including when a task is interrupted.
## What changed
- Fail thread startup or resume if an enabled recorder cannot initialize, while cleaning up session resources.
- Stop recording after the first write or serialization failure and preserve that failure across shared producers.
- Append a closing record when the last writer handle is released without recording errors. Expose `recording_complete` in `state.json` independently of task success, and mark submission-channel closure as an aborted rollout.
- Reject replay logs with missing or reordered events, mismatched rollout IDs, events after completion, or missing or invalid JSON payloads. Valid prefixes remain replayable with `recording_complete` set to `false`.
## Testing
Add coverage for startup failure and recovery, shared-writer failures, finalization after child handles close, incomplete logs, and missing or malformed payloads. Extend session and CLI tests to check recording completion after shutdown, interruption, stream failure, and submission-channel closure.
GitOrigin-RevId: 30d62fa95912fb0442ad1199776d110884066c30
## Why
Remote plugin bundle download URLs can contain signature tokens in query parameters. Including the full URL in errors or debug output exposes those tokens.
## What changed
Omit the download URL from `ValidatedRemotePluginBundle` debug output. Report download hosts instead of full URLs, strip URLs from underlying HTTP errors, and report only the scheme for unsupported final URLs. Invalid URL errors retain the parse error without echoing the input.
## Testing
Extend tests to check that signature tokens stay out of bundle debug output, unsupported final URL errors, and app-server installation errors while preserving signed request URLs and HTTP status diagnostics.
GitOrigin-RevId: 8edda4847feae4f2bcb12fbb414a3a25bde53814
## What changed
Include `tool_name` in MCP tool approval elicitation metadata and forward available `readOnlyHint`, `destructiveHint`, `idempotentHint`, and `openWorldHint` values under `tool_annotations`. Omit unspecified hints and the annotation title.
Reuse the stored tool approval metadata when available so annotation hints reach the approval request.
## Testing
Extend unit tests to cover tool names, annotation hints, and omission of unspecified hints. Update integration coverage to verify that the approval tool name matches the executed MCP call and that `readOnlyHint` is preserved.
GitOrigin-RevId: f082fe7fd87fde9f4895149e09210c7cb9d1e582
## What changed
Add the disabled-by-default `code_mode_host_output_truncation` feature flag. When enabled, Core requests server-side output truncation for its built-in code-mode session providers over both stdio and gRPC. Injected providers retain control of their session settings, and explicit session options pass through unchanged.
## Testing
Add coverage for both transports verifying that the host's output-limit notice survives a zero-token observation budget. Extend the shared-provider test to exercise an injected provider with the new flag enabled.
GitOrigin-RevId: edbb65e930bf544e3d2f8384767037a6fb82d451
## What changed
- Add “System proxy” to `/experimental` for opting into macOS or Windows system proxy settings. Keep `respect_system_proxy` disabled by default.
- Update doctor’s macOS proxy guidance to point to `/experimental` and `codex features enable respect_system_proxy`, and tell users to restart Codex after changing the setting.
## Testing
Add snapshots for the experimental setting and doctor guidance, plus a Responses test verifying that `x-codex-beta-features` includes `respect_system_proxy` only when enabled.
GitOrigin-RevId: caa3e1a7cbe222069f35022b06c59da578b8a4dd
## Why
Standalone web search errors currently abort the turn as fatal failures, preventing the model from responding to them.
## What changed
Return client setup errors to the model and represent failed search requests as unsuccessful tool outputs. Failed requests still emit search completion events and retain external-context handling. Limit error messages to 1,024 bytes, truncating at a UTF-8 character boundary with a truncation marker.
## Testing
Add coverage for failure status reporting and UTF-8-safe error truncation. Extend workspace routing tests to verify that a rejected redirect returns a bounded diagnostic to the model, allows the turn to complete, emits search lifecycle events, and marks thread memory as polluted.
GitOrigin-RevId: 9fb308990afa2ce0db5d9beed9bc66d9c1500418
## What changed
Add `codex.additional_context` to count submitted entries, including unchanged entries, and `codex.additional_context.value_bytes` to measure UTF-8 value sizes before and after the existing truncation limit. Sizes exclude message wrappers and include the truncation marker after truncation.
Tag metrics with context kind, truncation status, and an explicitly supplied name when present; never use opaque source keys as tags. Record metrics through the current turn's telemetry.
## Testing
Add integration coverage for message and tool-output formats, repeated submissions, truncation boundaries, empty and multibyte values, optional name tags, and turn-specific model attribution.
GitOrigin-RevId: 463f257af27be58c372970fac853b85fde495dd5
## Why
Standalone web search could send requests to the bootstrap backend instead of the discovered workspace backend, bypassing workspace routing.
## What changed
Use the thread's shared `WorkspaceRoutingContext` when preparing search requests so they use the resolved backend, authentication, residency, and account routing headers. Reject redirects when required by the resolved routing policy or account routing header, and preserve the established routing context across configuration changes.
## Testing
Add an app-server integration test that verifies search reaches the discovered HTTPS backend with the expected credentials and routing headers, without contacting the bootstrap search endpoint. Add a regression test that verifies configuration changes preserve the thread's routing context.
GitOrigin-RevId: 67160f1b3e54231dc100ce3ed4cfcea965b56d26
## What changed
Update the `openai-docs` skill's model migration guidance to use the retiring model's documented replacement from the API deprecations page when no explicit target is given. Fall back to the latest-model resolver when no replacement is documented or the migration is not prompted by a deprecation.
GitOrigin-RevId: db51a2a034118f05fc6b9b30c763231205b784e5
## What changed
Append pasted text to the skills search query and immediately refresh the filtered list. Normalize whitespace for a single-line query and ignore whitespace-only pastes.
## Testing
Extend the filtering test to cover pasting after typed text, verify the rendered search results with a snapshot, and check that whitespace-only pastes leave the view unchanged.
GitOrigin-RevId: fa82d2b5f1c78a7c3a7f61fc2d4f24c94c960386
## Why
Creating child history before persisting its parent-child relationship can leave history that parent subtree deletion cannot discover, especially when fork startup copies history. A relationship write failure must reject the spawn before child storage is created.
## What changed
- Reserve the child thread ID and persist its spawn edge before starting the child. Propagate persistence failures to the caller.
- Keep pending relationship writes owned through caller cancellation, and wait for them to finish before closing the edge during cleanup, including when a write commits but reports an error.
- Skip edge cleanup when publication was skipped, and reject IDs belonging to running threads before publication.
## Testing
Add regression coverage for cancellation before commit or acknowledgement, errors after commit, skipped publication, and duplicate child IDs. Integration tests cover fresh children and full-history forks, verifying that failed publication leaves no child history, execution, or creation notification and preserves unrelated history during parent deletion.
GitOrigin-RevId: 6e2e3f32d9558091312651ab47aa845d7d13b4ca
## Why
The startup command list was shown even when tooltips were disabled.
## What changed
Show the getting-started help only when `show_tooltips` is enabled. Keep regular tooltips and model-change notices suppressed on the first session event.
## Testing
Extend the first-event test to cover both tooltip preferences and update the startup header snapshot.
GitOrigin-RevId: 7b4a043737053f1a078cb21528dc459f0cfd762b
## Why
Host-side truncation can bound Code Mode output before it crosses the transport, including script errors that would otherwise exceed the frame limit.
## What changed
- Negotiate server-side output truncation for stdio and gRPC sessions, with client-side fallback for older hosts.
- Forward output budgets for execution, waiting, and termination when server-side truncation is selected. Avoid truncating host-formatted output or appending script errors a second time.
- Preserve the negotiated mode across reconnects and reject hosts that cannot maintain it.
## Testing
Add transport and integration coverage for output budgets, oversized script errors, reconnect compatibility, and preservation of output-limit notices with a zero-token budget.
GitOrigin-RevId: 2075101e4845eca64f45491c27a3b326788645c8
## What changed
Export `ElasticBudgetConfig`, named `ElasticSection` groups, and validated `ElasticSectionLimits` for optional evidence. Each group can specify a minimum token reservation and a per-entry text cap.
Validate limits during construction and deserialization: both values must be positive, and the entry cap must fit within the minimum reservation and the existing text-part delivery allowance. Reject unknown configuration fields.
This adds configuration types only; elastic allocation is not activated.
## Testing
Add a serialization round-trip test and deserialization checks for zero limits, entry caps above the minimum reservation, and entry caps above the delivery allowance.
GitOrigin-RevId: c869018cfc0d96377b1adbfbdd98e1d88bd1b32a
Register `incremental_exec_tools` as an under-development feature, disabled
by default, and expose it in the configuration schema.
GitOrigin-RevId: 444767b7a46e3ada7efb3f6c4fb570feb299e0c7
## What changed
Move the model client's request-preparation loop into the shared `prepare_provider_request` helper and add `RequestAuthChange` to classify auth state changes. For managed auth, retry preparation when credentials change and reject account changes, including when the provider starts or stops exposing an auth manager during setup.
Capture the auth owner and credential generations together and pass them into the preparation callback so the resulting client setup records the state used for that attempt.
## Testing
Add a test verifying that an explicit provider bearer token survives a workspace switch during setup without retrying preparation.
GitOrigin-RevId: ed8710d1c344b48ebf6182e25e6269214dd2d3fe
## What changed
Expose `thread/guardianReview` to review an idle thread's final injected `exec_command` without executing it. Return the call ID and Guardian assessment, or `null` for the assessment when exec policy skips approval.
Subscribe the requesting connection to the thread, enforce input and model-provider restrictions, and cancel an in-flight review when the connection disconnects so the thread is released promptly.
## Testing
Add integration coverage for assessment responses, policy-skipped reviews, model-provider enforcement, and WebSocket disconnect cancellation.
GitOrigin-RevId: e8ad5598e8f101a937447ebe26136310bb76c8d1
## Why
`libz-sys` 1.1.29 is pulled in through `curl-sys`/`curl` in `codex-http-client` only on Windows, where it skips the affected probe. The lockfile also pins `cc` to 1.2.55, below 1.6.0.
## What changed
Add `RUSTSEC-2026-0418` to the `cargo-audit` and `cargo-deny` ignore lists with the rationale. Remove the exception when `libz-sys` reaches 1.1.31 or later, and reassess if it is used on Unix with `cc` 1.6.0 or later.
GitOrigin-RevId: 0e2ffb4686d9c77dfd7f1312aef6a093a803f832
Use `gpt-6-luna` for memory extraction and `gpt-6.1-terra` for memory
consolidation when the provider does not require a backend-specific model ID.
GitOrigin-RevId: 51419103b090d66af21e092983658da1285f6660
## Why
The schema exporter sits on application builds' critical path, but compiling it as a test harness also compiles and registers unit tests that schema generation does not need.
## What changed
Build the exporter with `--cfg=test` to retain test-only schema derives without the test harness, and disable its debug metadata. Run schema generation directly on a thread with an 8 MiB stack.
Share the environment-driven schema writer with the existing ignored test, allow a configurable crate root in `schema_sources`, and switch the public schema bundle to the dedicated generator.
GitOrigin-RevId: 317e24f77e153b9ba0c5c583837eed3bcd3774fd
## What changed
- Match final serving assessments to their response and output item, then retain them with tool invocations and code cells across waits.
- Use matching assessments instead of asynchronous scoring for adaptive review: low-risk actions can skip synchronous review, while elevated-risk actions require it.
- Revalidate captured authorization and policy before approval. Require fresh review for stale or incomplete authorization, preserve explicit review requirements, and discard assessments when hooks rewrite tool input.
- Keep asynchronous scoring as the fallback when an assessment is missing or does not match.
## Testing
Add integration coverage for direct and nested tool calls, hook rewrites, explicit escalation, interrupted responses, catalog-driven policy, incomplete authorization, and assessment retention across code-cell yields and waits.
GitOrigin-RevId: 4346a227204137f018c03c34b302d6f1e9592c96
Expose `MAX_TEXT_PART_ESTIMATED_TOKENS` from `codex-guardian-context` and use it for native tool calls, transcript entries, and delivery-size assertions. Keep the existing 9,000-token limit while replacing duplicated limits in code and tests.
GitOrigin-RevId: 90cb98eea9bade34f18db0d1666ed7ed1e93febe
Set `native_call` to `None` in the `ToolCall` and `ToolInvocation` fixtures used by the agent host invocation and spawn tests.
GitOrigin-RevId: 2a6f9ccb95d99297085a2861bb44e5ce7599715c
## Why
Managed command policies need to require a human decision independently of automatic review, hook allowances, and saved approvals.
## What changed
- Support `decision = "prompt-user"` in managed `requirements.toml` prefix rules, requiring a fresh, one-time human decision for matching commands.
- Add experimental `humanCommand` approval requests for clients advertising both `experimentalApi` and `requiredHumanApproval`. Accept only `accept`, `decline`, or `cancel`; reject commands when no capable client is available.
- Restrict responses to capable clients that received the request, and replay pending prompts to compatible clients on reconnect.
- Enable the capability in the TUI and update protocol schemas and client bindings.
## Testing
Add coverage for fresh decisions overriding saved allowances, hook allowances, and automatic review, plus child-thread approval routing and rejection of responses from incompatible or unrelated clients.
GitOrigin-RevId: 0b95ff6aab7f8a04b7298c8a4329d1fddf6a603e
## Why
Guardian review needs the original function-call metadata even when the call is no longer in live conversation history. Looking it up in history can lose the evidence needed to review encrypted multi-agent messages.
## What changed
Capture native-review policy in the tool registry and retain the original call through dispatch for multi-agent tools that require review. Use that retained call for Guardian review, applying hook-rewritten arguments while preserving encrypted-argument metadata and clearing stale replay content. Limit `ToolCall` debug output to the tool name and call ID.
## Testing
Add coverage for selective call retention across review settings and namespaces. Extend Guardian tests to cover calls absent from live history and hook rewrites that preserve call identity and encrypted-argument metadata across incremental reviews.
GitOrigin-RevId: 0e49833741c09c29228440bddd2e12695ae99583
## What changed
Add `otel.log_sse_deltas`, enabled by default. Setting it to `false` suppresses successful SSE event logs whose kind ends in `.delta` while preserving errors, completion events, and metrics.
Apply the setting to session and memory telemetry, support managed requirements, and expose it in the app-server configuration requirements API and generated schemas and bindings.
## Testing
Add coverage for delta log suppression with errors, completion logs, event counts, and duration metrics preserved. Extend configuration and app-server tests to cover defaults, overrides, and managed requirements.
GitOrigin-RevId: 751c7f357c41f51848b025c838246a733eb92e2f
## What changed
Add `CodexThread::guardian_review` to assess the final injected `exec_command` call against recorded history without executing the command. Reuse command preparation and approval policy, returning the call ID and an optional assessment when approval is required.
Reject active threads, unsupported calls, commands intercepted by `apply_patch`, and histories containing `request_permissions`. Honor cancellation and the configured review timeout.
## Testing
Add a scenario test and request snapshot verifying that direct review matches live Guardian input, leaves commands unexecuted, skips assessment for explicitly allowed commands, and rejects trailing tool output and recorded permission grants.
GitOrigin-RevId: 704f8dc77bbb991c231fce03cfda1c238c4e0b02
## Why
WebSocket heartbeat progress only establishes relay reachability, not executor receipt or completion. A blocked write or full application queue can also leave a Pong unread, so diagnosing stalled requests requires separate transport and application progress signals.
## What changed
- Trace request dequeue and completed writes under the request's trace context, and emit an executor receipt span immediately after decoding, before queueing or execution completes.
- Record RPC enqueue wait time and queue occupancy.
- Add bounded heartbeat events and a transport closure summary with fixed exit categories, queue depths, message counters, and read/write timing. Distinguish write timeouts from missing Pongs and report application delivery backpressure separately.
- Keep request methods, IDs, payloads, raw errors, and peer-provided text out of the new trace-safe transport diagnostics.
## Testing
Add coverage for blocked data and keepalive writes, missing Pongs, saturated application queues, read errors, and responsive relays without application responses. Verify trace correlation, immediate receipt span export, bounded Pong telemetry, and exclusion of payloads and raw error text.
GitOrigin-RevId: b58b2f747c4050dcde8efb408c35ecadd3561b5f
## Why
MXC read-only volume-root grants already provide recursive access, so enumerating their children is unnecessary.
## What changed
Expand only writable volume roots into grants for their immediate children. Document that read-only grants recurse, while new children created during a running command are not implicitly writable.
## Testing
Update policy tests to verify that only writable roots expand their children and that narrowing one volume preserves the other volume's grants.
GitOrigin-RevId: a7c7348b2f75bc7258fb1f130cfa4d9660e2faa6
## What changed
Negotiate the `codex/connection-lease` extension for pooled stdio connections. For servers that advertise it, open a unique lease per chat and attach its host-owned ID to tool calls and resource reads via `codex/connectionLease`, overriding caller-supplied lease metadata.
When a chat releases its lease, write cancellations for pending requests before sending `codex/connection/release`. Preserve open-before-release ordering across startup timeouts, bound unload waits, and remove connections from the pool when lease cleanup fails or times out. Servers without the extension retain existing behavior.
## Testing
Add coverage for cancellation-before-release ordering, late open acknowledgements, and lease drops outside the runtime. Extend app-server sharing tests to verify distinct chat leases, metadata replacement, release on unload, and continued use by another chat.
GitOrigin-RevId: f4c8b606cb98b5697acab1c515e992ff80ec8425
## What changed
Allow `refresh_mcp_config` to replace explicit session `plugins` overrides while preserving other session overrides and user settings. Omitting session plugins retains the current overrides; supplying an empty map clears them and restores inheritance from lower configuration layers.
## Testing
Add coverage for replacing and clearing plugin overrides, preserving unrelated settings, rejecting stale refreshes, revoking and restoring plugin tools and hooks, and retaining refreshed plugin policy when a deferred executor becomes ready.
GitOrigin-RevId: 26913fac0f8ae9590b39bdc037a78c9be86abb67
## What changed
- Add the disabled-by-default `tui_extensions_statusline` feature to render configured status items and their picker preview through a shared UI tree renderer.
- Support text, HTTP(S) links, rows, spacers, dividers, and gaps with rendering budgets, text sanitization, and width-aware truncation that keeps the ellipsis outside hyperlinks.
- Use plain text for the extension status line and hide the picker's theme color toggle while preserving the saved color preference.
## Testing
Add coverage for tree serialization and URL validation, Unicode widths, hyperlink clipping, picker previews, color preference preservation, and token usage updates across renderer switches.
GitOrigin-RevId: a6b87c2b1096765d61296d73e142834fcd53ceee
## Why
Footer hyperlinks must follow their text when the status line is truncated or animated. Inferring link targets from underlined cells loses that association, and Unicode width differences can shift links onto the wrong cells.
## What changed
- Carry explicit hyperlink ranges with status-line content through footer layout and reasoning-effort transitions.
- Fit content to the space allocated beside right-hand indicators, keeping the truncation ellipsis outside links.
- Measure and truncate rendered graphemes consistently while preserving source columns for transcript tab expansion.
- Box the composer's footer state to reduce its stack footprint during session navigation.
## Testing
Add regression tests for clipped links after halfwidth katakana and Arabic prefixes, hyperlink positions during effort transitions, and narrow status rows beside the Plan mode indicator.
GitOrigin-RevId: ede62690e191daefc85f38e637f9bcc9796268b7
## What changed
Return the cached built-in runtime keymap when `TuiKeymap` matches the default configuration, avoiding repeated keymap resolution. Keep custom configurations on the existing resolution and validation path.
## Testing
Add a startup regression test that edits `config.toml` after the directory-trust read and verifies that `thread/start` uses the updated `service_tier`, including with an embedded app server.
GitOrigin-RevId: 0c079c96cb2925c1367782e289595c637612e2cc
## Why
Code Mode sessions always used client-side output handling, leaving server truncation settings and observation budgets unused.
## What changed
- Honor each session's `output_truncation` setting in the runtime and both host transports, and advertise the bounded-output capability.
- Apply `max_output_tokens` independently to execute, wait, and terminate responses in server mode. Keep client mode as the default when the setting is omitted.
- Use bounded output collection and rendering in server mode, preserving head and tail output with omission notices. Include script errors in the output budget while retaining failure status and a separate diagnostic capped at 64 KiB.
- Estimate audio tokens without the Tokio-dependent cache when rendering bounded output.
## Testing
Add runtime and host regression tests for session mode selection, per-request budgets, output overflow, oversized images, zero-token audio output, diagnostic preservation, and termination under output backpressure.
GitOrigin-RevId: 3d9661edcdd2dde31526bb92eb83fa0614f0fa88
## Why
A transient environment startup failure persisted across turns when the selected environment and workspace were unchanged, preventing commands from recovering after the executor became available.
## What changed
Retry failed environment resolution at the start of a new turn when the error is retryable and the workspace remains selected. Reuse healthy or pending resolutions and preserve provisioning failures until the selection is updated.
## Testing
Add coverage for command execution recovering on an unchanged next turn after endpoint availability is restored. Extend provisioning failure tests to verify that subsequent turns receive the original error without restarting resolution.
GitOrigin-RevId: b80af60990f30d277804160c9c39c286024c7667
Eric Traut