## Why
Existing login-keychain access rules identify the CLI as `codex`. Packaging it in an app bundle must preserve that code-signing identifier independently of the bundle identifier and provisioned App ID.
## What changed
- Sign the provisioned CLI with the identifier `codex`, retaining `com.openai.codex.cli` as its bundle identifier.
- Require the expected signing identifier and team during signature verification, and reject unexpected bundle identifiers, executable names, or package types.
- Document the identity distinction and keychain compatibility limits.
## Testing
Extend signing-driver tests to check the signing identifier, verification requirement, bundle metadata, and provisioned entitlements, and to reject altered bundle identity fields. These tests use generated credentials and stubbed native tools; they do not verify runtime keychain access or credential recovery.
GitOrigin-RevId: ab00072e48189551adb0e70008210fee6d36241d
## Why
Workspace paths from the client configuration belong to the client host. Sending them to a remote app server can override the server's workspace roots.
## What changed
- Omit client-configured `runtimeWorkspaceRoots` from remote start, resume, and fork requests so the server resolves defaults or restores saved roots.
- Preserve server-provided roots when forking an active session or side conversation, including after reloading client configuration.
- Reject `--add-dir` and `sandbox_workspace_write.writable_roots` command-line overrides with `--remote` before connecting, directing users to configure additional roots on the server.
## Testing
Add regression coverage for remote workspace roots across start, turn, resume, and fork operations; active-session forks after configuration reloads; and embedded requests retaining explicit roots. CLI tests cover rejected root overrides and continued acceptance of network-access overrides.
GitOrigin-RevId: b87ea6037d197db68e25a1a8610d693f6aa13caf
## Why
MCP startup alone should not prevent opening the review picker or submitting inline review instructions.
## What changed
- Defer `/review` availability checks and draft clearing to dispatch, where thread state is available.
- Reject live review commands while foreground work is running, pending, or queued, preserving the draft and attachments.
- Distinguish live and queued dispatch so a queued review does not clear a newer composer draft.
## Testing
Add regression tests for the review picker and inline instructions during MCP startup, draft and attachment preservation when review is blocked, and newer draft preservation when a queued review opens.
GitOrigin-RevId: 48962bfc26127ffa8dd157f15be512b78bf9b39b
## What changed
- Use a shared preview renderer for agent command output and MCP results, showing the first three wrapped rows with a hidden-line count and `ctrl + t` transcript hint.
- Apply one preview budget across all MCP result blocks. Count partially displayed logical lines as hidden and hard-wrap long URLs to fit the available width.
- Preserve complete MCP result text in transcript and raw output, including trailing failure diagnostics.
- Bound preview input before wrapping to limit work on very long lines and combining characters.
## Testing
Add unit tests and snapshots for wrapped output, hidden-line counts, blank lines, combining characters, shared MCP block limits, transcript preservation, and matching streamed and completed command previews.
GitOrigin-RevId: bd3c2ec40ee837dc8a7a171aaf91577a0ac50985
## Why
Providers configured with `gateway_oauth` need gateway credentials alongside primary authentication for inference and model discovery.
## What changed
- Attach gateway tokens through the configured header or cookie while preserving primary authentication, including WebSocket handshake headers.
- Share gateway credential managers across matching provider instances and model discovery so they observe refreshed tokens.
- Reject authentication on gateway setup or token failures, invalid token values, and conflicting auth headers. Mark gateway headers sensitive and avoid exposing issuer error details.
- Include gateway OAuth configuration in model catalog cache identity to prevent reuse across different gateway configurations.
## Testing
Add provider and core integration tests covering combined credentials, header and cookie delivery, token refresh, shared credential state, cache isolation, and request blocking on gateway token or HTTP client initialization failures.
GitOrigin-RevId: cb74125cf7e87660967d49edacf14646cf0b99c4
## What changed
Replace `analytics_client_tests.rs` with event-specific suites under
`codex-rs/analytics/src/tests/suite/` and shared fixtures in `tests/support.rs`.
Group turn tests by events, requests, compaction, and accepted lines, and keep
cross-event arrival-order coverage in a dedicated reducer ordering suite.
Separate app and plugin ingestion assertions into their respective suites while
retaining a combined test for arrival order. Document where to place tests based
on the contract they cover.
GitOrigin-RevId: aba497f103ad6e23eca6266fc93d150d16f5913c
## Why
Reasoning summaries and nonzero command exits split adjacent exploration into separate groups, while compact history omitted exit codes. Replayed commands also failed to retain the same grouping as live commands.
## What changed
- Keep adjacent read, list, and search commands grouped across reasoning summaries and nonzero exits in both live and replayed history.
- Preserve reasoning in chronological order in the expanded transcript while omitting it from compact and raw history.
- Show nonzero exit codes in compact exploration entries and keep unsuccessful reads separate from successful read summaries. Render search exit code `1` without red failure styling, and label compound-command outcomes as `command exit`.
## Testing
Add regression coverage for live/replay rendering parity, reasoning order, grouping boundaries, and nonzero exit labels and colors. Update the overlapping-command test to verify that exploration stays grouped after a failure.
GitOrigin-RevId: 19c6ffec44c62c185fc6f79282c38e66468f7b80
## Why
Async questions answered on another client should disappear from the TUI without losing drafts for other questions, even when questions have identical titles.
## What changed
- Send answers using the desktop reply envelope with stable per-question IDs, and resolve matching questions from committed messages and replayed history.
- Render replies as readable question-and-answer text in transcripts, queue previews, and input history.
- Preserve separate reply envelopes and message order when retrying rejected or interrupted input.
- Account for JSON escaping in input limits and fall back to plain text for oversized question IDs.
## Testing
Add regression coverage for cross-client dismissal, draft preservation, replay ordering, reply parsing, IDE context, distinct replies with identical text, and retry ordering. Update the async question scenario to use the reply envelope.
GitOrigin-RevId: 9b9e4b1e140508590401622d96cfc16fc192eb7c
Preserve known error classifications, including BioPolicy, while falling back to Other for unknown values so saved sessions can still be read.
Add optional gateway OAuth settings to model provider configuration.
Co-authored-by: Owen Lin <owen@openai.com>
Co-authored-by: alexsong-oai <alexsong@openai.com>
GitOrigin-RevId: 64bcf45ca042efca7645c798db3746375426b0fe
## Why
Environment settings saved for the next turn must not change MCP tool availability during the active turn.
## What changed
- Use one captured environment snapshot for MCP policy evaluation and runtime publication, including selections that are still starting or have failed.
- Compare both captured selections and ready environment handles when deciding whether to refresh the runtime, and rebuild the startup configuration when resolved selections change.
- Preserve the configuration origin of failed selections so MCP authority evaluation retains whether configuration comes from the thread.
- Box the MCP refresh future to keep it off the sampling request's stack.
## Testing
Add a regression test that updates the environment MCP policy while a turn waits for user input, verifies the tool remains visible when that turn resumes, and verifies it disappears on the next turn. Extend snapshot tests to cover starting and failed selections.
GitOrigin-RevId: cc2744b5137be69f000d70b0c7009b14079f39ae
## What changed
- Add `Platform` to `codex-utils-path-uri` with metadata parsing, native platform detection, and path convention mapping. Preserve missing or unrecognized metadata as `Unknown`.
- Replace `NetworkProxyExecutorOs` with the shared type and keep executor-specific socket path validation in the network proxy.
- Extract `effective_sandbox_mode` with explicit platform and Windows sandbox level inputs, preserving the native Windows fallback from `workspace-write` to `read-only` when the sandbox is disabled.
## Testing
Add unit tests for platform metadata, path conventions, native platform detection, and sandbox mode selection across platforms and Windows sandbox levels.
GitOrigin-RevId: 4fe0972e3a91040e35f2a6dfa5bcdf6c9a29be88
## Why
Cleanup needs fresh logon tokens for sandbox accounts that may already be disabled. Temporarily enabling those accounts must leave a durable obligation to disable them again if the service exits unexpectedly.
## What changed
- Persist `cleanup_logon_pending` before enabling an account, then disable it again after the logon attempt before clearing the marker.
- Recover pending account disables before owner restoration or IPC admission, validating account SIDs before restoration. Block runtime readiness and provisioning while recovery is pending, and defer retirement until cleanup logons are prepared.
- Include the blocking logon details in cleanup timeout errors and suppress repeated identical cleanup errors in the Windows event log.
## Testing
Add receipt tests covering backward-compatible defaults and pending cleanup state surviving serialization, blocking readiness and owner admission until cleared.
GitOrigin-RevId: 801bec408a27ac85ccdc3eb5ca2bdb2ccb3d5827
## What changed
Apply dim styling to all rendered recap lines and remove the cyan color from
`Next:`, preserving italics and bold labels.
## Testing
Update recap style assertions and add a rendered-buffer snapshot covering dimmed
text, label styling, line breaks, and next-action wrapping.
GitOrigin-RevId: 2dfef4753fa5da4e1fae32b5cdb03a881482f91b
## Why
Feature settings and managed requirements can replace domain and socket values. Validating the selected configuration first rejects invalid entries even when they would be replaced before use.
## What changed
Keep listener removal and unsupported controller-field rejection in `project_environment_profile_network`, but defer domain and socket validation to `validate_environment_network_policy` for the composed policy. Remove the executor OS argument from the preparation step.
## Testing
Update tests to verify that invalid domain patterns and socket paths survive preparation, fail final validation when retained, and pass when managed requirements replace them.
GitOrigin-RevId: 866c633c14ff0b4664e8bf5cf79fef51db5d7ed6
Move the exponential backoff helper into `codex-async-utils` so
`codex-cloud-config` can use it without a runtime dependency on `codex-core`.
Keep `codex-core` as a development dependency for cloud-config tests.
Preserve the existing retry delays and jitter, and re-export `backoff` from
`codex_core::util` for existing callers.
GitOrigin-RevId: 338f3194e166e77003da532310ff5be78a0eac9e
## Why
Starting a thread in a directory without a project could persist trust and
preapprove project configuration added later.
## What changed
Track whether configuration discovery found no project-root marker, Git checkout,
or project-local `.codex` directory. Skip implicit project trust in `thread/start`
for these directories. Preserve existing trust decisions and permission checks.
## Testing
Add regression coverage for starting a thread with full access, then adding
project configuration and verifying that a read-only thread does not load it or
persist trust. Add loader tests for projectless classification, project markers,
saved trust, managed configuration, and skipped discovery.
GitOrigin-RevId: da490c649d272494f65d4e22da1ebf89f9085477
## Why
After a model switch, compaction with the previous model could fail after exhausting stream retries without falling back to the selected model.
## What changed
Allow compaction to fall back to the current model for all errors except `TurnAborted`, `Interrupted`, and `SessionBudgetExceeded`.
## Testing
Add a regression test that exhausts the previous model's compaction stream retries, then verifies that fallback compaction and turn sampling use the selected model.
GitOrigin-RevId: 9c9b7ccbb206d19f1ae750a32636fc9acaacfb2b
## What changed
Add `active_plugin_ids_at_turn_start` to turn analytics, combining active host plugins with selected plugin packages. Prefer remote plugin IDs when present and otherwise use validated package IDs. Sort and deduplicate the inventory.
Report `null` for unknown inventories, invalid IDs, IDs longer than 128 bytes, or inventories exceeding 512 distinct IDs; preserve `[]` for an observed empty inventory. Keep the first received inventory even when later resolved configuration updates arrive.
## Testing
Add coverage for ID selection and validation, deduplication, size limits, serialization, and preservation of the first inventory. Extend app-server tests to check inventories after plugin reconciliation and with selected plugins, including turns without explicit plugin mentions.
GitOrigin-RevId: 8a0de912e2570a902cd05bfc918dc8e6ff8b8527
## Why
Web search events in `codex exec --json` dropped structured results and relied on a serialization round trip to convert action types.
## What changed
Map web search actions explicitly, preserving `open_page` URLs and `find_in_page` URLs and patterns. Forward structured results through an optional `results` field, omitting it when unavailable while preserving empty arrays and error payloads.
## Testing
Add regression coverage for page actions with absent, empty, successful, and error results in serialized `item.completed` events.
GitOrigin-RevId: 9a7f4c9c2eb163ba62f5e1642437a9debffc3816
## What changed
- Export `GatewayAuthConfig` and `GatewayAuthManager` with PKCE browser sign-in, loopback callbacks, cached token resolution, and refresh after expiry or rejection.
- Store gateway credentials in a dedicated encrypted namespace with an independent keyring key. Serialize token exchanges and persistence across processes, preserve refresh rotations after caller cancellation, and retain pending credentials when saving fails.
- Validate OAuth endpoints and token responses, disable token-request redirects and logging, and redact sensitive error details.
## Testing
Add tests covering browser authorization, callback state validation and cleanup, concurrent refreshes, cancellation, failed-save recovery, storage isolation, endpoint validation, and credential redaction.
GitOrigin-RevId: e0c17f1eab7acca378a14b2d00b80940d8542e47
## Why
Updating environment selections while a turn is running must not redirect its tools or prevent its pending environment setup from completing.
## What changed
- Store future environment selections separately from active environments, and activate them when preparing new work with no task running.
- Keep turn contexts and MCP workspace roots tied to the active environment snapshot. Report saved selections through thread settings and `environment_selections()`.
- Route environment configuration and failure callbacks to matching active or future selections so each can finish setup independently.
- Stop the running task before manual compaction adopts the saved environments.
## Testing
Add regression tests that preserve a running task's working directory and workspace roots, then adopt the saved selection for the next task. Add remote environment coverage showing that future setup can complete while the active turn waits, with each turn receiving its own capability roots.
GitOrigin-RevId: 09a6b90131d2ab2441ce2fe9b0368a3668889f31
## Why
Renewed image URLs and other display metadata changes unnecessarily invalidate loaded plugins and MCP and skill caches, even when installed plugin behavior is unchanged.
## What changed
- Compare installed plugin metadata by identity, version, enablement, policy, and availability before invalidating derived caches. Continue storing the full updated payload so display consumers receive fresh metadata.
- Preserve invalidation when behavioral metadata changes or reconciliation requires an effective plugin refresh.
- Export `remote_catalog_metadata_eq` to compare catalogs independently of display metadata and plugin display order, while retaining marketplace order significance.
## Testing
Add regression tests for display-only updates, behavioral changes, catalog ordering, and preservation of loaded skills and tool suggestions. Add an app-server integration test verifying that image URL renewals and badge updates preserve live MCP sessions and cached skill resources, while an authentication policy change invalidates resource caches.
GitOrigin-RevId: 22b9ba1234a9f850201c6890e03d1ef899a56c54
## Why
Streaming `bio_policy` failures were classified as generic invalid requests, losing their policy-specific classification.
## What changed
- Add `BioPolicy` errors across the API and core protocol, recognizing streaming failures and HTTP 400 responses, including wrapped WebSocket errors.
- Preserve server messages and use a biological-risk fallback when the message is missing or blank.
- Treat bio policy errors as non-retryable in core and guardian handling, and classify them in diagnostics and telemetry.
- Map `BioPolicy` to `other` in the app-server v2 protocol.
## Testing
Add coverage for error classification, message preservation and fallbacks, HTTP and wrapped WebSocket responses, guardian retry decisions, and app-server conversion. Extend the core integration test to verify that bio policy failures emit a typed error and complete the turn after a single request.
GitOrigin-RevId: 78c2647e8fc8f80297cb8a23fff06ab141099632
## Why
App-server callers that only need the active turn ID or its presence currently create a full turn snapshot, unnecessarily cloning its items.
## What changed
Expose `ThreadState::active_turn_id()` and use it for interrupt validation, elicitation turn ID fallback, and teardown and shutdown logging, preserving the existing turn selection behavior.
## Testing
Update the interrupt integration test to wait for `turn/started` instead of a fixed delay and verify that an incorrect turn ID is rejected before successfully interrupting the active turn.
GitOrigin-RevId: 4a030655fbc4d229809cf13f80c3d7f788f19c13
Upgrade `softprops/action-gh-release` from `v2.6.1` to `v3.0.3` and enable
`preserve_order` in the Rust release workflow to upload assets serially,
following GitHub's recommendation to avoid concurrent REST API requests.
GitOrigin-RevId: d1fbbbb01e191967be303040cfa2949146a2292d
## Why
A controller and its executor can run different operating systems. Validating socket paths against the controller's OS can reject absolute paths that are valid on the executor, such as Windows paths on a Linux controller.
## What changed
- Thread `NetworkProxyExecutorOs` through network policy validation, proxy construction, and policy updates.
- Require allowed socket paths to be NUL-free and absolute for the executor OS, while preserving deny entries unchanged.
- Accept either Unix or Windows absolute syntax when executor metadata omits the OS, then validate against the executor's own OS at launch.
- Keep native path normalization and socket support checks at execution time.
## Testing
Add coverage for cross-platform absolute path syntax, invalid allow entries, preserved deny entries, and remote policy round trips that retain executor semantics through domain edits and proxy construction.
GitOrigin-RevId: 1ebc09cbce7138f60ec5fd62875591a3df52d067
## Why
Login and token refresh have separate OAuth request and error handling. Token endpoint errors can echo credentials, and JSON decoding errors can expose token values in diagnostics.
## What changed
- Extract authorization URL construction, callback validation, PKCE, token grants, and error handling into a shared `oauth` module in `codex-rs/login`.
- Route authorization-code exchange and ChatGPT refresh through `OAuthClient`, retaining form and JSON encoding respectively and caller-owned HTTP and credential recovery policies.
- Redact echoed request secrets from rejection details and request IDs, redact sensitive transport URL fields, and replace token decoding errors with a generic error. Preserve original error codes for refresh failure classification.
- Keep callback state validation ahead of codes and provider errors, with the existing onboarding suffix handled by the login server.
## Testing
Add coverage for PKCE binding, request encoding and headers, callback state rejection, credential redaction, oversized or unreadable error bodies, and preservation of stored and cached credentials after transient refresh failures.
GitOrigin-RevId: d0a9583b99e24f5aafb751acd1e7200e2261a0e4
## Why
Model catalog description overrides only covered `spawn_agent`, leaving the other multi-agent V2 tools with fixed descriptions.
## What changed
Extend `model_messages.tools.multi_agent` description overrides to `send_message`, `followup_task`, `wait_agent`, `interrupt_agent`, and `list_agents`. Resolve each override by tool name across namespaced, plain, and Code Mode exposure.
Missing or null descriptions retain bundled text; empty strings suppress static text without disabling tools. Preserve `spawn_agent` runtime guidance, tool schemas, and execution behavior. Descriptions follow mid-turn model changes.
## Testing
Expand integration coverage to all six tools, including missing, null, empty, and sparse overrides; plain, namespaced, and Code Mode exposure; unchanged V1 behavior; and mid-turn model changes.
GitOrigin-RevId: a2c47eb8efb28c3eeebcc6482e36c188c38a6dd1
## Why
`CodexThread` retained the full `SessionConfiguredEvent`, including initial replay messages, and cloned it even for callers that only needed thread or session IDs.
## What changed
Store `ThreadStartupMetadata` without replay history and expose it by reference through `startup_metadata()`. Update callers to read IDs from this metadata. When rejoining a running thread, rebuild the startup response using the supplied resume history for `initial_messages`.
## Testing
Extend the resume test to verify that rejoining reuses the loaded thread, preserves startup metadata, and still returns the original replay messages as a prefix.
GitOrigin-RevId: 9d656063088c28f091d29e5862e4b9d894b7642c
## What changed
Use `EnvironmentAccess` for skill discovery, environment skill loading, and plugin namespace resolution, replacing direct `ExecutorFileSystem` calls with explicit `None` sandbox arguments.
Wrap existing host and executor filesystems with `FileSystemEnvironmentAccessor::unrestricted` to preserve their current access behavior. Update discovery, loading, and namespace tests to use the same adapter.
GitOrigin-RevId: d68168cc0ee19dc303ef4ee726cf1de1a8db81e0
## Why
Synchronous Guardian reviewers need to use their selected request-level reasoning effort even when managed requirements enable `reasoning_effort_override` and the parent history contains effort updates.
## What changed
Disable reasoning-effort overrides for synchronous Guardian sessions and use the same decision for request filtering, effort pinning, and update injection. Reviewers omit inherited configuration updates from requests without changing saved history or appending new effort updates.
## Testing
Add regression coverage for both current and legacy Guardian session sources with managed overrides enabled. Verify that the parent retains its pinned effort, reviewer requests follow selected `low` and `high` efforts, and inherited updates remain in saved history.
GitOrigin-RevId: 3a635dbdc613ea72f7a96fc96bb386e4ac7994c3
## Why
Resuming a thread after disabling reasoning effort overrides still sent saved `configuration_update` items until compaction. Disabling the feature should also apply to requests built from existing history.
## What changed
Pass the `ReasoningEffortOverride` feature state into `ModelClient` and filter `configuration_update` items from request input when disabled. Preserve persisted history and other input items while using the request-level reasoning effort.
## Testing
Add regression coverage for resumed threads, compaction, and WebSocket warmup and turn requests. Verify that saved updates remain in history and `agent_message` items remain in request input.
GitOrigin-RevId: aac3257da1ca38a0744807c4f7cb12565bd7fe53
## Why
Code-mode responses show host duration without exposing time spent outside the host, including app-server waiting.
## What changed
- Add `features.code_mode.experimental_show_cell_overhead`, disabled by default, to show handler duration, host duration, and their difference in `exec` and `wait` response headers.
- Reuse the completed handler measurement from tool-call logging, excluding dispatch waiting, and capture it even when logging is disabled.
- Preserve the existing timing format when the option is disabled or host timing is unavailable, and preserve boolean feature toggles when merging nested code-mode configuration.
## Testing
Add coverage for timing headers, zero and missing host measurements, negative rounding differences, content preservation, and configuration merging. Extend app-server tests across gRPC and stdio to verify timing includes post-host elicitation waiting, and add a response snapshot for successful execution and a failed wait.
GitOrigin-RevId: 929b84784d9c6077cf2b5927a90bd2d5f3870078
## Why
Model requests need the selected workspace's routing constraints before sending content. A missing cached route cannot establish that a custom ChatGPT-auth destination is independent of the workspace.
## What changed
- Register the account processor as the workspace routing resolver for Responses HTTP, compaction, and WebSockets, enabling origin selection and routing headers while preserving API paths and rejecting routed HTTP redirects.
- Share concurrent discovery by auth generation, workspace, and backend configuration. Recover from discovery-time `401` responses while allowing token refreshes for the same auth owner.
- Require successful discovery before classifying custom destinations as independent, and require a new thread when a workspace-bound session's bootstrap origin changes.
- Refresh managed requirements using retained session configuration without fetching thread configuration again. Return typed routing errors without account or backend details.
## Testing
Extend coverage for discovery-time token refresh, retained provider definitions under managed requirements, and specific invalid-routing error categories.
GitOrigin-RevId: 090cda70daa91ee8acfbc973699d028111e54125
## Why
Changing previous review decisions or trusted tool and skill evidence should not invalidate the reusable conversation history prefix.
## What changed
Move previous reviews, trusted tool metadata, and trusted skills after the transcript and permission context in Guardian context composition. Keep them before the current action, with history remaining user-role evidence.
## Testing
Add a regression test that varies reviews, tools, skills, and actions while asserting an identical history prefix, both with and without retained context. Update the Guardian v2 integration test to verify the separate transcript and action messages.
GitOrigin-RevId: 8f5b570b17b6715beac526afff7d52139d13a3ad
## Why
The release publisher uploads objects in parallel. Serializing transfers within each object avoids additional concurrency that can trigger R2 throttling.
## What changed
Configure the AWS CLI to use the `classic` S3 transfer client with `max_concurrent_requests` set to `1`. Enable `standard` retry mode with a maximum of six attempts for R2 release publishing.
GitOrigin-RevId: a029341e37ea36cfd077d13ff929963e3f697542
## What changed
- Accept `windows.sandbox = "mxc"` and preserve the selected backend through environment configuration, command execution, patch writes, and sandbox metadata.
- Treat MXC as enabled in the TUI and report Windows sandbox readiness as `ready`, avoiding legacy setup prompts.
- Keep `allowed_sandbox_implementations` scoped to the legacy elevated and unelevated backends without restricting MXC.
- Default `windows.sandbox_private_desktop` to `false` for MXC while retaining `true` for legacy sandboxes.
## Testing
Add coverage for MXC configuration precedence, legacy requirement handling, sandbox selection, and TUI state. Add a Wine integration test that verifies command and patch routing fails when native MXC is unavailable and reports `windows_mxc` in turn metadata.
GitOrigin-RevId: e2162447d0750f60753864c92a20e02a7f297bca
## What changed
Add `EnvironmentAccess` and `FileSystemEnvironmentAccessor` to expose filesystem operations with a captured sandbox configuration, without allowing consumers to extract the filesystem or select another sandbox. Include a text-reading helper and an explicit unrestricted constructor.
Provide opaque cache keys that compare filesystem identity and captured permissions without keeping the filesystem alive. Allow opened read streams to outlive the accessor. Export the new APIs through `codex-exec-server` and add `Environment::filesystem_ref()` for borrowing the shared filesystem.
## Testing
Add local and remote coverage for text reads through `EnvironmentAccess`, streams surviving accessor disposal, and cache keys distinguishing changed permissions or a replacement filesystem.
GitOrigin-RevId: 4f6787ed9ba0fb94adea2f31716c4d3132fed07d
## What changed
- Render `\hat`, `\bar`, `\tilde`, `\vec`, `\dot`, and `\ddot` on single visible graphemes, preserving support for following subscripts and superscripts.
- Add symbols for physics, relations, sets, logic, arrows, and integrals, including `\hbar`.
- Support named delimiters, including with `\left` and `\right`, plus angle brackets written as `\left<` and `\right>`.
- Preserve raw math when accent arguments are empty, invisible, or span multiple graphemes or layout rows.
## Testing
Add snapshots for accents, symbols, named delimiters, and the Schrödinger equation, plus rejection tests for ambiguous accent arguments and unsupported delimiters.
GitOrigin-RevId: 9dd4883cdf187835a4b4e873886c4299de488705
Remove the default description's instruction to spawn agents only for concrete,
bounded subtasks that can run independently alongside useful local work.
GitOrigin-RevId: cbceed13c738b0f84fb90c053fa9285f541d578b
## Why
Image preparation replaces uploaded images with file references in model history, but user message events still retain the original local paths or inline image URLs. Live and persisted display history should carry the prepared file IDs as well.
## What changed
- Prepare images before emitting user message events, and copy uploaded file IDs into the corresponding user inputs.
- Track original input positions through content expansion so failed image reads, omitted inputs, and duplicate URLs do not misassociate images.
- Preserve text spans, image detail settings, and inputs without a prepared file reference.
## Testing
Add a protocol test for image position mapping and an integration test covering file IDs in model requests, live user message events, and persisted display history, including failed images and duplicate URLs.
GitOrigin-RevId: 55e7ab97925b5db049c5c2403d90349635eee740
## Why
Asynchronous score publication updated the risk score, authorization, and tool-call coverage separately. Approval checks could therefore read inconsistent evidence when deciding whether to reuse a cached score.
## What changed
Keep Guardian's cached score and observation state under one lock, and use consistent snapshots for approval checks. Publish successful scores together with their authorization and classified tool-call index. Preserve timestamp ordering, fail-closed precedence on timestamp ties, and per-call oversized-action tracking.
## Testing
Add regression coverage for rejected delayed results and timestamp ties. Add a gated integration test showing that a delayed score becomes stale after intervening tool calls, while a sufficiently fresh score permits cached approval.
GitOrigin-RevId: 8df6fafd5e0ee59aa0f78f541eac562efce3d4d0
## Why
A runtime directory can have read/execute access while existing files and subdirectories lack inherited permissions. Checking only the runtime roots leaves those children inaccessible to sandbox users.
## What changed
- Walk the Codex app runtime tree and add missing read/execute grants for the sandbox group, validating access after changes.
- Use `GRANT_ACCESS` to preserve existing grants and skip additions that could override deny entries, including inherited denials for other trustees.
- Skip reparse points and trees with reparse-point ancestors, tolerate disappearing paths, and report repair failures through setup logging and refresh errors.
## Testing
Add Windows regression tests for repairing children beneath an already-readable root, repeated repairs, preserving read/write denials and other trustees' inherited file denials, avoiding write or ACL-management grants, and leaving junction targets untouched.
GitOrigin-RevId: 93d55dd9fca2b24eac157ae9be505982d07dd9b9
## What changed
- Use the installed provisioning service regardless of the onboarding feature gate. Fall back to the elevated helper only when the service is unavailable; propagate service errors.
- Pass the effective proxy settings and filter listener ports to match them, including when preserving saved settings.
- Remove stale credentials before repairing missing, disabled, or password-expired sandbox accounts so older services cannot mistake them for completed setup.
- Select helper fallback when workload-identity environment variables are present, since service requests do not carry that environment. Continue rejecting helper fallback for registered Core.
## Testing
Extend account-repair tests to cover stale credential removal, missing and disabled accounts, and repeated setup checks. Add subprocess tests for workload-identity routing with and without registered Core.
GitOrigin-RevId: 1041ae76e9b0893ad60f30a5cdc506748be52552
## Why
Provisioning errors omitted underlying causes, and removing a legacy installation record could leave an empty registry key behind.
## What changed
- Include error chains in provisioning responses and failure logs, retaining control-character replacement and the response byte limit.
- Attempt to delete the legacy installation registry key after removing and flushing its record, preserving any remaining values or subkeys.
## Testing
Add a regression test for nested error causes, control-character replacement, and UTF-8 truncation within the response byte limit.
GitOrigin-RevId: 8fccfb49c708be5f5d5be7180289cb74a66498a2
## Why
An explicit `service_tier = "flex"` could be dropped when fast mode was disabled or the model catalog did not advertise Flex, even though Flex is an API request option.
## What changed
- Preserve configured `flex` through core session settings, TUI tier resolution, and request construction regardless of fast-mode or catalog support.
- Omit `service_tier` from Amazon Bedrock requests, including with custom catalogs, because Bedrock only supports the implicit default tier.
## Testing
Add regression coverage for Flex configured at startup or through thread settings, connected thread startup, and TUI turn submission. Update review coverage to expect Flex with fast mode disabled, and verify that both Bedrock providers omit `service_tier`.
GitOrigin-RevId: 98f2761bdd780603839ebfec75cb983a5d55e554
## Why
A delegated task can omit restrictions from the sender's user messages. Guardian needs that context when reviewing actions in the receiving thread.
## What changed
- When thread-owned Guardian context is enabled, capture up to three recent local user messages when a `send_message_to_thread` delivery from `codex_app` or `codex_tui` is accepted.
- Provide a bounded snapshot to synchronous and asynchronous reviewers, with explicit notices for unavailable evidence and a reminder that historical context does not transfer permission. Keep the snapshot out of the worker prompt.
- Retain snapshots with their deliveries across replay, compaction, and rollback, and strip them from forked agent history.
## Testing
Add coverage for reviewer-only visibility, missing sender provenance, context-budget preservation, checkpoint replay and rollback, fork isolation, and input serialization that rejects harness metadata.
GitOrigin-RevId: 3870ba762aa81689713b56d4cb3b98566bffed88
## Why
TUI startup metrics report the selected app-server mode before a connection succeeds, which can misrepresent embedded fallback or failed startup. Daemon startup and update actions also need distinct outcome observations.
## What changed
- Record `codex.tui.start` once after the first connection attempt, using the actual mode or `unconfirmed`, and include daemon selection and auto-start tags.
- Add `codex.daemon.start` for TUI auto-start and `codex.daemon.update` for foreground CLI updates and TUI update handoffs, using existing analytics consent and identity handling.
- Report TUI handoffs as `handoff_requested` and suppress duplicate child reporting. Remove the suppression flag when spawning long-lived daemon processes.
- Tag daemon settings by enabled state and explicit presence, without exporting setting values or contents; report invalid or unreadable settings as `unknown`.
## Testing
Add coverage for analytics defaults and explicit consent overrides, unconfirmed CLI updates, settings presence, and exactly-once launch observations. Extend the worktree TUI test to check startup tags and a single update handoff observation.
GitOrigin-RevId: 176d2ee594f930033fa1ece55d4c1c9603dbbc16
## Why
Private `/tmp` bind mounts can leave hidden entries in `/proc/self/mountinfo`, causing the Linux sandbox to reject layouts that safely isolate daemon sockets. The proc-mount preflight also needs the main sandbox's WSL masks when checking aliases.
## What changed
- Identify the opened socket directory's mount using `fdinfo`, with a `statx` fallback, and follow its mount ancestry to distinguish hidden paths from exposed aliases.
- Accept safe private and stacked mounts while rejecting covered mounts, exposed aliases, and nested mounts. Retain conservative checks when no mount ID is available.
- Preserve WSL interop and WSLg masks in the proc-mount preflight.
- Heap-allocate large lifecycle futures in the TUI approval-gated MCP tool test to reduce Windows test-thread stack usage.
## Testing
Add mount-layout regression cases and a namespace integration test that verifies daemon sockets remain inaccessible under private `/tmp`, unrelated sockets remain reachable, and an exposed alias prevents startup. Add a preflight test for preserving WSL masks.
GitOrigin-RevId: 289b4446ba7776a7dd57ef5ff09e87bda19b069c
