## Why
Guardian approval reviews may need the original user instructions to decide
whether a command is authorized.
## What changed
- Forward the parent thread's `history.list_windows`, `history.list_items`,
`history.read_item`, and `history.search_contents` executors to Guardian
reviewer sessions.
- Keep other parent extension tools, including the `notes` namespace, isolated
from Guardian reviewers.
## Testing
Add an app-server integration test that reads parent history during a Guardian
review and verifies that `notes` tools are not exposed.
GitOrigin-RevId: 65a90036577050adfa23b1d98f862233c994d9d7
## What changed
- Default Guardian v2's review scope to computer-use tools. Set
`features.guardianv2.review_scope.computer_use_only = false` to retain the
broader tool review scope.
- Include images in Guardian transcripts by default. Set
`features.guardianv2.transcript.include_images = false` to disable them.
## Testing
- Update configuration and app-server coverage for the new defaults and
explicit broader-scope overrides.
GitOrigin-RevId: 88c3cfe6dd2a96df052111794ad59c5c9ea39b78
## What changed
- Express nullable history and notes arguments with `anyOf` and remove unsupported schema constraints.
- Forward valid JSON object arguments to the backend without enforcing client-side limits.
- Clarify history ID, ordering, cross-agent path, and consistency semantics in the tool descriptions.
## Testing
- Cover forwarding previously restricted argument values for every history and notes tool.
- Verify app-server requests expose the Bridge-compatible schemas and still reject non-object arguments locally.
GitOrigin-RevId: 28809fe9da5099944fd04962b5e71ffda4163eea
## What changed
- Convert unstructured MCP results into typed function-call output items instead of serializing the entire content array as a text string.
- Keep structured MCP results as serialized text and preserve media, encrypted content, and unknown content through their existing item conversions.
- Drop empty text items during output truncation so they do not consume API array slots.
## Testing
- Cover text-only, mixed unstructured, structured, and image-sanitized MCP results.
- Verify empty text items are discarded under byte- and token-based truncation policies.
GitOrigin-RevId: fa1c5b7dee6f003a094265379dcabdd060386a48
## Why
MCP servers attached to executor environments must retain their owner's
permission profile instead of inheriting the thread-wide sandbox authority.
## What changed
- Resolve and capture a permission profile for each enabled MCP server when
publishing the runtime, and reject calls or elicitations when that authority
is unavailable.
- Use the captured server profile for tool approval decisions, elicitation, and
sandbox metadata, including after runtime refreshes.
- Materialize `:workspace_roots` from `PathUri` values so permissions preserve
the path convention of remote executor environments.
- Give threadless app discovery and resource reads an explicit default
permission profile.
## Testing
Added coverage for per-server elicitation authority, unresolved attachments,
runtime refreshes, restricted tool calls, and foreign-platform workspace roots.
GitOrigin-RevId: 6b188d4b08b29e9971ff7aa68a7785a0cdf9e394
## Why
SQLite log persistence needs visibility into batch size, write latency,
failures, and entries dropped before they reach the writer. Exporter
diagnostics must not feed back into the SQLite log sink and keep metric
exports active indefinitely.
## What changed
- Record write count, duration, batch bytes, entry count, largest-entry size,
and queue drops with bounded outcome tags.
- Add explicit byte histogram boundaries for log batch metrics.
- Filter OTLP transport noise and the benign unsolicited HTTP/2 PING warning
from SQLite log persistence to prevent export cycles while retaining other
HTTP/2 warnings.
## Testing
- Cover metric values, tags, queue-drop reasons, and histogram boundaries.
- Verify successful and failed OTLP HTTP and gRPC exports become idle instead
of generating recurring SQLite log-write metrics.
GitOrigin-RevId: a63224ae15945fe84adc977a8b7d55bb47a4de53
## Why
Reserved tool parameter constraints must survive schema parsing so the model receives the declared limits.
## What changed
- Preserve `minimum` and `maximum` as exact JSON numbers.
- Preserve `maxLength` and infer a string schema when it is the only type hint.
## Testing
- Cover bounded integer, number, and string schemas through both parsing paths.
- Verify history and notes tools retain their constraints in app-server model requests.
GitOrigin-RevId: 4cc89722b5b226d595b57232ec3b8e825863faf3
## What changed
- Read `x-codex-imagegen-request-id` from image generation and edit responses.
- Propagate the ID to `codex_image_generation_event` analytics.
- Keep the ID in process only, excluding it from extension item serialization, generated types, app-server wire data, and rollout history.
## Testing
- Cover response-header extraction and missing-header behavior in the images client.
- Verify end-to-end analytics emission and the unchanged image-generation item wire shape.
GitOrigin-RevId: 9b8e09b7d655c0c2faa84f0eee99aabae583668d
## Why
Git remote URLs can embed usernames, passwords, or tokens. Codex carries these
URLs through turn metadata and persisted thread metadata, so credentials must be
removed before a remote enters those paths.
## What changed
- Add `SanitizedGitUrl`, which parses Git URL and SCP-style remotes, strips
authentication data, and preserves the conventional `git` SSH user.
- Use sanitized remotes when collecting Git metadata, enriching model requests,
discovering cloud environments, updating thread metadata, and reading legacy
rollouts. Reject or omit malformed remotes instead of retaining their raw
contents.
- Keep API, schema, and TypeScript representations as strings while enforcing
sanitization in Rust.
## Testing
- Cover URL schemes, SCP and IPv6 forms, remote helpers, encoded paths,
malformed values, and legacy deserialization.
- Verify credentials do not appear in model requests, API responses, SQLite, or
rollout files.
GitOrigin-RevId: 6435efc4c45bfbfad4723ce7a0457cb00175f25c
## What changed
- Accept only `http://` and `https://` gRPC endpoints for app server
`--code-mode-host` connections.
- Limit the standalone code-mode host to stdio and gRPC listeners.
- Remove the WebSocket session provider, dual-WebSocket negotiation, transport
lanes, and related dependencies and tests.
- Keep coverage for shared and prewarmed gRPC hosts and reject WebSocket host
URLs in CLI parsing tests.
GitOrigin-RevId: 8792604e79ffd54ce776074a4dc3f7d55e63752a
## Why
MCP servers can share an OAuth callback URL. Without a validated issuer or a
server-specific callback path, an authorization response could be associated
with the wrong server.
## What changed
- Use stable callbacks when authorization metadata advertises issuer-bound
responses, and validate the returned issuer before exchanging the code.
- Retain server-specific callback IDs for providers without issuer support,
including fallback to the global or default callback for legacy registered
clients.
- Persist registered callback URLs for MCP servers and plugins, and insert the
active listener port into portless loopback redirects.
## Testing
Add coverage for issuer validation, callback-mode discovery, registered and
legacy clients, plugin OAuth, CLI persistence, and loopback listener ports.
GitOrigin-RevId: 2878c92e237fc17fd3def0bd2e1cce3e104a3db8
## What changed
- Add the experimental `turn/start.cyberAccessProgram` option with `standard`,
`daybreakBlue`, and `daybreakRed` values.
- Forward the selection as `access_programs.cyber` on Responses, WebSocket,
and remote-compaction requests made with ChatGPT authentication, while
omitting it for API-key and custom-provider requests.
- Preserve the per-turn selection across recovery, compaction, and child-agent
turns without making it a persistent thread setting.
## Testing
- Cover app-server forwarding, authentication boundaries, WebSocket reuse,
turn recovery, compaction, and child-agent inheritance.
GitOrigin-RevId: d2eb468f365b2214c5099bc21741cf30f8bd2eb5
## Why
Removing a base-user marketplace must not delete a snapshot that is still
referenced by another enabled configuration layer.
## What changed
- Load the current configuration stack for marketplace commands in the CLI and
app server.
- Reject removal when a matching marketplace is defined by another enabled
layer, and identify the configuration source that must be updated instead.
- Allow cleanup of an installed marketplace snapshot even when no base-user
entry exists.
## Testing
Cover project, enterprise-managed, system, and session-flag configurations, as
well as snapshot-only removal through the CLI and app server.
GitOrigin-RevId: 4f0853a40c2b5fae0410696b79eee4284239c7a9
## What changed
- Add the opt-in `code_mode_prewarm` feature to establish the code-mode host session during startup, before the first turn.
- Make in-progress host initialization cancellable so a stalled prewarm does not block shutdown.
- Share a failed connection attempt with concurrent callers instead of immediately starting another attempt.
## Testing
- Verify app-server contacts the configured host before the first turn and can shut down while that connection is stalled.
- Exercise shared remote-host behavior with prewarming enabled.
GitOrigin-RevId: 3cfde5509be7b4aba80112c36c5616b9a9b632c6
## What changed
When `thread/start` omits `historyMode`, select `paginated` for durable
threads whose store supports `thread/turns/list` and `thread/items/list`.
Continue to default ephemeral threads and threads backed by stores without
those APIs to `legacy`.
Explicit `legacy` and `paginated` selections keep their existing behavior.
## Testing
- Verify durable threads use paginated history with the local store.
- Verify ephemeral threads and stores without history-list support use legacy
history.
GitOrigin-RevId: c94b6a3b522049d541da33c41618c4142370f1a7
## Why
Paginated thread history should be loaded incrementally through
`thread/turns/list` and `thread/items/list` instead of being fully reconstructed
in `thread.turns`.
## What changed
- Emit `deprecationNotice` when `thread/read`, `thread/resume`, or `thread/fork`
requests full history for a paginated thread.
- Direct clients to omit `includeTurns` for reads or use `excludeTurns: true` for
resumes and forks, then page history through the list APIs.
- Document the deprecation in the protocol schemas and app-server README.
## Testing
- Cover notices for paginated reads, cold and loaded resumes, and forks.
- Verify metadata-only requests, legacy threads, and rejected forks do not emit
the notice.
GitOrigin-RevId: 0d387b46d73608f90b7960120a54af4ef332e510
## Why
App-server clients can enable `background_paginated_rollout_migration` after the server has started, so the startup-only migration path does not handle that transition.
## What changed
- Allow runtime enablement of `background_paginated_rollout_migration`.
- Start the local rollout migration when the feature transitions from disabled to enabled at runtime.
## Testing
Update the app-server integration test to enable migration through the runtime feature API, wait for paginated history, and verify that cold resume preserves model context.
GitOrigin-RevId: d695624a03b4f056be94fcaac2075f91896f19e5
## What changed
- Add an optional `turnTrigger` field to app-server `turn/start` requests and
expose it in the generated protocol schemas.
- Propagate non-empty trigger values to Responses request metadata as the
reserved `turn_trigger` field, while preserving the original value when a
request steers an active turn.
- Classify turns started by queue dispatch, goal continuation, retry recovery,
and realtime handoff.
## Testing
- Cover HTTP and WebSocket metadata forwarding, steering behavior, reserved
metadata handling, and the built-in trigger classifications.
GitOrigin-RevId: c12fe2c522286db21b76081ae6154fbf6bfb3639
## What changed
- Add the experimental `turn/settings/update` method for changing `model`,
`effort`, `summary`, and `serviceTier` on a specific live turn without
changing future turns.
- Report whether the update was applied or the target turn was unavailable,
and reject unsupported fields, disabled feature use, unsafe model changes,
and direct updates to parent-owned subagents.
- Document the method's feature requirements, null handling, and limits.
## Testing
- Cover current-turn and future-turn isolation, rejected and unavailable
targets, feature and capability gates, saved threads, and subagent ownership.
GitOrigin-RevId: 18440f6d7ee5fcd06ae23bd41b22c492b62bb2b5
## Why
Selected executor plugin roots could still expose capabilities when managed
requirements disabled the `plugins` feature.
## What changed
- Suppress MCP servers, skills, apps, and connectors from selected executor
plugins when `plugins` is disabled, while preserving the selected-root
identity used to filter those capabilities.
- Apply the policy consistently to direct selected-root discovery and batched
executor capability discovery.
## Testing
- Add contributor-level and app-server coverage that verifies disabled plugin
capabilities are absent and their MCP servers never start.
GitOrigin-RevId: e30bd8a936c4b0e083908b89a65f4d02e01747de
## Why
Answers collected by `request_user_input` can change what the user authorizes, but post-tool hooks may replace or reject the tool output that Guardian normally sees.
## What changed
- Record bounded, host-observed answers before post-tool hooks run and provide them as trusted evidence to synchronous and asynchronous Guardian reviews.
- Include root-thread answers in worker review context.
- Count successful answers as authorization changes so earlier review evidence becomes stale, while ignoring empty or unrelated answers.
## Testing
Add coverage for allowed and denied stale reviews, empty and oversized answers, hook-modified output, and root-to-worker propagation.
GitOrigin-RevId: 970c52e40338ecd057c7cd2a69d04b06e97cd068
## What changed
- Add `serviceTierForTurn` to `turn/start` so a newly started turn can override the service tier without changing the thread's saved tier.
- Treat `"default"` as standard speed and omitted or `null` values as inheriting the thread tier.
- Keep `serviceTier` authoritative for subsequent turns when both fields are supplied, and ignore the turn-scoped override when steering an active turn.
## Testing
- Extend the app-server turn-start test to verify both the one-turn `"default"` override and inheritance on the following turn.
GitOrigin-RevId: 4c2c4db21d8d31617a7a6e6df65bf54834e72383
## What changed
- Record collaboration tool analytics for `send_message`, `followup_task`,
`interrupt_agent`, and `list_agents`, including receiver attribution, duration,
failures, and interrupted calls.
- Include these calls in per-turn subagent tool counts while keeping the existing
`subAgentActivity` output unchanged and omitting additional public collaborator
tool items.
- Extend the collaboration tool schemas with the new tool variants and the
`interrupted` terminal status.
## Testing
- Add an app-server integration test covering successful and failed calls,
receiver attribution, duration, prompt omission, activity items, and turn
counts.
GitOrigin-RevId: e73eaa05c508261e5fc97e7d08d7881a31e04e22
## What changed
- Register the history-notes extension as a context contributor and fetch `thread_hint` from the configured history-notes backend.
- Add non-empty hints of at most 4,000 bytes to the context-window prompt, and omit hints when the request fails or the response is missing, empty, or oversized.
- Verify that app-server sessions use the native backend when `use_history_notes_extension` is enabled and retain the MCP bridge behavior when it is disabled.
## Testing
- Cover hint injection, request context, response validation, backend failures, and disabled-extension behavior in history-notes and app-server tests.
GitOrigin-RevId: 344a7bb79d962ea8b7c969f25b67a79423fc7fcc
## Why
Clients need a bounded view of realtime conversations that preserves the order of speech, agent work, and turn lifecycle events without loading the full thread history.
## What changed
- Persist realtime session boundaries, transcript segments, and promoted agent items in paginated thread rollouts.
- Add the experimental `thread/timeline/list` API to page ordinary items, realtime items, and turn boundaries in canonical rollout order. Include `activeRealtimeSessionAtPageStart` so each page can be rendered independently.
- Emit typed `thread/realtime/item/started`, `thread/realtime/item/transcript/delta`, and `thread/realtime/item/completed` notifications around durable realtime items.
- Keep the existing `thread/items/list` response and legacy thread history behavior unchanged.
## Testing
- Cover mixed timeline pagination, realtime-session state at page boundaries, rollout replay, subagent history prefixes, transcript streaming, steering, and promoted agent artifacts.
GitOrigin-RevId: faa2c420192d63e060e8fb32446e3c797422656e
## Why
Unified `@` search could show a plugin alongside the skills it owns, creating duplicate entry points for the same capability.
## What changed
- Add a nullable `pluginId` to `SkillMetadata` returned by `skills/list` so clients can associate skills with their owning plugin without inspecting names or paths.
- Hide a plugin's owned skills from unified `@` results when that plugin is present, while retaining standalone skills and skills with unknown ownership.
- Keep `$` focused on individual skills and apps, and use it consistently as the skills-list shortcut. Preserve the legacy mention behavior when `mentions_v2` is disabled.
## Testing
- Cover plugin ownership in `skills/list` and the updated `@` and `$` composer results.
GitOrigin-RevId: e168cdff8d0c58f74ce4c228a683880a3167775b
## What changed
- Emit control-tool analytics for history and notes extension calls and for
`send_user_message_async`.
- Preserve non-default namespaces in reported tool names, such as
`history.read_item` and `notes.write_file`.
## Testing
- Add an app-server integration test covering successful and failed calls,
turn-level tool counts, and omission of tool argument values from analytics.
GitOrigin-RevId: b15a53a311228339f4d577a7b96146ed67f22253
## Why
`skills.read` paginated resources against a fixed response limit, so a page could exceed a smaller tool-call response budget.
## What changed
- Size each serialized `skills.read` page to the current call's response budget, accounting for JSON escaping and UTF-8 boundaries.
- Cache one bounded executor-resource snapshot per thread so cursor continuations return consistent contents without rereading the file. Replace the snapshot when another resource is read, and reject stale cursors after a reread.
- Tie cached executor snapshots to the selected environment and sandbox context without keeping the environment alive.
## Testing
- Cover budget-constrained reads, escaped and multibyte contents, multi-page reconstruction, changed resources, snapshot eviction, and expired turn-scoped access.
GitOrigin-RevId: e515935b82771b3f29b3fb91ea7a7a72e19a65ee
## Why
Analytics need to associate subagent activity with the top-level turn that
caused it, while avoiding a stale association when steering makes that origin
ambiguous.
## What changed
- Add `root_turn_id` to turn and tool-item analytics events.
- Read the root from live turn metadata when each event is built, reporting
`null` when the root is unknown or ambiguous.
- Propagate the metadata through control-tool and code-mode completion facts so
correlated and background tool events retain the correct root.
## Testing
- Cover root IDs for top-level turns, subagent turns, correlated code-mode
calls, and tool events emitted after turn completion.
- Verify that queued and subsequent events report `null` after the live root is
invalidated.
GitOrigin-RevId: 42fd76541c3c716cec74787d47b50adb2d22e6d2
## What changed
- Add the experimental `amazonBedrockAccessKeys` app-server login flow, persist its credentials in the configured auth store, and use them for SigV4-signed Bedrock requests.
- Report `bedrockAccessKeys` as a distinct auth mode and document access-key login alongside AWS profile and environment credential setup.
- Clear the selected Bedrock provider, AWS settings, and Bedrock-specific model on logout while leaving external AWS credentials and `.env` untouched.
- Reject managed access-key login when higher-precedence configuration would prevent its region or profile settings from taking effect.
## Testing
- Cover access-key login, storage, request signing, configuration conflicts, status reporting, and logout cleanup.
GitOrigin-RevId: bbf297887c6503d3651ceb2aad85c4d626e32723
## What changed
- Add `features.guardianv2.review_scope.computer_use_only` to restrict asynchronous classification and fast approvals to browser and computer-use REPL tools.
- Keep other tools on the synchronous approval path without letting them age or reuse scores from in-scope calls.
- Give this scope precedence over `sandboxed_exec_commands` when both options are enabled.
## Testing
- Cover configuration precedence, direct and code-mode tool detection, fast-approval isolation, and end-to-end approval routing for browser, computer-use, and unrelated MCP servers.
GitOrigin-RevId: bfd9ab6abdbd90634b265d354e038724b1e81d65
## Why
Multi-Agent V2 children are owned by their parent at runtime. Resuming an
unloaded child directly could rebuild it from caller-provided settings instead
of the parent's current authority.
## What changed
- Route child reloads through their loaded immediate parent and reject direct
cold resume when that parent is unavailable.
- Preserve the child's recorded model, provider, reasoning effort, and role
while inheriting the parent's execution policy and MCP extensions.
- Validate cached environments against the parent, intersect local permission
profiles, and reject stale remote or workspace-root configurations.
- Keep paginated cold-resume token usage attribution when attaching to the
reloaded child.
## Testing
Add coverage for owner validation, nested-parent reloads, permission and
environment changes, role instruction restoration, paginated usage replay,
and app-server child resume behavior.
GitOrigin-RevId: 84014762bcdb57f94fc23974c9c1af55dc1babf1
## What changed
- Track truncation and omission across Guardian v2 actions, transcript entries and images, and synchronous review evidence.
- Emit `codex.guardian_v2.classification.truncation` counters and byte histograms for original, retained, and omitted content after successful classifications.
- Tag observations by input component and whether content was truncated or fully omitted.
## Testing
- Extend async scorer coverage for action truncation metrics.
- Verify the app-server Guardian flow records truncated review evidence.
GitOrigin-RevId: 70680897f75716770aa072f866d60bd37e171c1d
## Why
Parent-owned Multi-Agent V2 subagents must remain controlled by their parent,
but several app-server endpoints could still mutate them directly.
## What changed
- Centralize the direct-input ownership check and apply it to turn injection,
MCP calls, reviews, compaction, rollback and revert, shell and Guardian
actions, realtime requests, and goal mutations.
- Enforce the same policy for goal mutations on unloaded threads while keeping
goal reads and turn interruption available.
- Document the affected endpoint behavior and continue exposing
`canAcceptDirectInput: false` for parent-owned subagents.
## Testing
- Cover direct-input rejection for both legacy and paginated thread history.
- Cover goal mutation ownership checks for unloaded V2 subagents, V1
subagents, and non-subagent V2 threads.
GitOrigin-RevId: 791b7af98490aed5eab4e672b90661acad11ec23
## What changed
- Retain completed synchronous Guardian reviews as structured records until the async scorer builds its classification input.
- Render and bound review correlation, action, rationale, and full evidence body with the async scorer's transcript truncation marker.
- Extend the Guardian V2 integration test to verify oversized action and rationale content is truncated and the resulting review evidence remains bounded.
GitOrigin-RevId: 0000ba77b810748e34254dd00df4a69f8492e175
## What changed
- Replace structured numeric classifier output with a single `high` or `low`
token and map those classifications to `1.0` and `0.0` risk scores.
- Require the classification contract in both default and overridden prompts,
including when classifier instructions are truncated.
- Return the first streamed classification immediately while draining the
remaining response for connection reuse and token accounting.
## Testing
- Cover prompt rendering and truncation, classification parsing, early streamed
results, conflicting later output, WebSocket reuse, and approval routing.
GitOrigin-RevId: 31a57e4eb9bf8df2a161b84aa3d5b16ab8f2937b
## What changed
- Include `environmentInfo` in the exec-server `initialize` response and seed the Rust client's metadata cache from it.
- Fall back to one lazy `environment/info` request when connecting to older servers that omit initialization metadata, then share the cached result across client clones and session recovery.
- Keep app-server `environment/info` requests uncached so they continue to probe the executor.
## Testing
- Cover initialization metadata, the legacy-server fallback, shared caching, accepted WebSocket environments, and repeated uncached app-server probes.
GitOrigin-RevId: 380132d9db183998d73e8c6b0954e4d70c7e8406
## What changed
- Use `gpt-live-1-codex` as the default model for frameless realtime sessions.
- Preserve an explicitly supplied per-session model override.
## Testing
- Cover both default and explicit model selection in the WebRTC frameless conversation test.
- Update the app-server live session request expectation for the new default.
GitOrigin-RevId: ce5dc978911ff0289d677b60fae2dd8cb1058d22
## Why
Collaboration can resume an archived descendant without unarchiving its
rollout. Archiving the parent again previously skipped shutdown for that
descendant because only rollouts newly marked as archived were prepared.
## What changed
Prepare every loaded thread in the spawn subtree for archival, including
descendants whose rollouts are already archived, before updating archive
state.
## Testing
Add an app-server integration test that resumes an archived child through its
parent and verifies that archiving the parent unloads the entire subtree.
GitOrigin-RevId: aca8c0d6ddb8900aad16becbeb594426cea1e3a6
## Why
MCP inventory can be cached or collected separately from a thread's live
connections, so tool availability alone does not describe the current runtime
state.
## What changed
- Add a nullable `runtimeStatus` to `mcpServerStatus/list` for thread-scoped
requests, covering not-started, starting, connected, authentication-required,
failed, cancelled, and disabled connections.
- Observe published connection state without starting or reconnecting servers,
and return an unknown status when no thread is supplied or the active
configuration no longer matches the published registration.
- Show connection state and tool counts in the compact `/mcp` view while
retaining the detailed inventory in `/mcp verbose` and compatibility with
servers that omit `runtimeStatus`.
## Testing
- Cover runtime status transitions, deferred and disabled servers, closed
transports, configuration changes, protocol compatibility, and TUI rendering.
GitOrigin-RevId: e3bb6efe652f0fa8b3c97d5c53e4729b3a87cd91
## What changed
Propagate canonical denial, timeout, and abort responses from strict MCP
auto-review instead of replacing them with a generic decline. This preserves
the reviewer's action and metadata, including denial rationale, while still
failing closed when no canonical decision is available.
Update the fallback message to direct the agent to request explicit user
approval before proceeding.
## Testing
Add unit and app-server integration coverage for strict auto-review denials
and cancellations.
GitOrigin-RevId: d8126ab223ab546b95e2d984f6e4dd540a324a59
## What changed
- Emit a structured log event for each completed Guardian V2 classification with its thread, turn, tool call, risk score, review threshold, sample time, and whether the score was accepted or superseded.
- Verify that accepted async classification events appear in the reviewed thread's log export with the expected context and decision fields.
GitOrigin-RevId: a027d5991b12a1968b9327da57e2993f0a529ca1
## What changed
- Add typed `browser_use` settings for history access and per-origin access,
download, upload, and full CDP policies.
- Add typed `computer_use` settings for default app access, macOS bundle IDs,
Windows AUMIDs, and Windows executable identities.
- Expose the merged settings through app-server config reads and generated
Rust, TypeScript, and JSON schemas.
## Testing
- Cover TOML serialization round trips, layered config reads with origin
metadata, and app-server batch writes.
GitOrigin-RevId: 78065f6fec990602071fc81ff639ff97f7ad8cd5
## What changed
- Retain bounded evidence from completed synchronous Guardian allow and deny reviews and supply it to subsequent Guardian v2 async classifier samples as trusted developer context.
- Keep review evidence isolated from the conversation transcript, escape and truncate its fields, and ignore failed or incomplete reviews.
- Invalidate retained evidence after conversation history rewrites or new user messages, including authorization changes in a worker's root thread.
## Testing
- Cover approved, denied, malformed, and forged review inputs, plus root rollback and authorization-change scenarios.
GitOrigin-RevId: 27817e1fde9a136de727048c4220d148fcf72f42
## What changed
- Implement `account/bedrock/discover` to report AWS profiles and available environment credentials.
- Implement `account/bedrock/setup` for validated AWS profiles and environment credentials, persisting the selected region and profile in the Bedrock provider configuration.
- Resolve Bedrock authentication according to the selected credential source, and clear stale profile configuration when using a Codex-managed Bedrock API key.
## Testing
- Cover profile and environment discovery, setup validation and persistence, conflicting credentials, and authentication-source precedence.
GitOrigin-RevId: 16d700cb0843df768c2fdb6d0c8d26c3402e93df
## Why
Runtime permission updates must not weaken managed filesystem `deny_read`
requirements.
## What changed
- Retain managed deny-read rules separately and merge them into updated
permission profiles.
- Reject permission profiles and legacy sandbox policies that conflict with a
managed denied path.
- Apply the same constraint when `command/exec` handles a request-specific
sandbox policy.
## Testing
- Cover thread permission updates with managed deny-read requirements.
- Cover `command/exec` enforcement for managed and user-defined denies,
including conflicting policy and profile overrides.
GitOrigin-RevId: 5e387b9c1bf1650a21753a74a3338bd33df7d0ce
## What changed
- Expand `configRequirements/read` with the Browser/Computer Use umbrella
policy and the complete browser-use policy, including origin-specific access,
download, upload, auto-review, and approval controls.
- Return computer-use persistent approval, default app access, macOS bundle ID
rules, and Windows AUMID and executable rules.
- Export the corresponding v2 protocol types and generated JSON and TypeScript
schemas.
## Testing
- Extend the config requirements RPC test to cover the new browser and
platform-specific computer-use fields.
GitOrigin-RevId: d1be93388701b06312a26853d640401b63b4d535
## Why
App-server logs can be persisted or included in submitted diagnostics, so credentials used by model providers, authentication refreshes, and attestation requests must not appear in diagnostic output.
## What changed
- Add `RedactedString`, which preserves serialization and string access while replacing debug output with `<redacted>`.
- Use it for model-provider bearer tokens, header and query values, authentication command arguments, and attestation tokens.
- Avoid logging JSON-RPC error payloads and parser or authentication errors that may echo credentials; retain safe context such as error codes and categories.
## Testing
- Add an app-server regression test that exercises provider credentials, refreshed authentication tokens, and attestation tokens, then verifies none appear in persisted SQLite or submitted diagnostic logs.
GitOrigin-RevId: 8c50408adf94d93847658b1320682cf3b637d2cc
## Why
Models listed in `auto_review.required_on_models` must always use the full
automatic review path, regardless of any cached Guardian v2 risk score.
## What changed
- Skip Guardian v2 risk classification for models that require automatic
review and clear any cached `SecurityRiskScore` before review routing.
- Count thread lookup failures as failed scoring attempts so stale scores
cannot continue approving later tool calls.
## Testing
- Verify required-review models do not start a classifier and always run full
reviews.
- Verify failed thread lookups advance score lag and fall back to strict review.
GitOrigin-RevId: 048d9a80ac2a282e05437a3abb0c46ec21391be8
## Why
Older executors do not support resolving HTTP header values from their own
environment. Sending environment-backed bearer tokens to them can prevent MCP
servers from starting.
## What changed
- Advertise executor support for environment-backed HTTP headers with the
`httpHeaderEnvVars` capability.
- Delegate bearer-token resolution only when the selected executor advertises
that capability; otherwise, resolve tokens available in the host environment.
- Exclude executor-owned MCP servers that require environment-backed bearer
tokens when the executor cannot resolve them, while retaining compatible
host-owned and executor-owned servers.
## Testing
Added protocol and environment-variable coverage plus an end-to-end test that
simulates an older executor and verifies compatible MCP servers remain usable.
GitOrigin-RevId: 43545926f6f7e0f3b1091eb29d34647f6372bc4a
jif