## Why
Temporary trusted Git repositories can remain on disk when a process exits without running directory cleanup.
## What changed
Use `MarketplaceStagingDir` for trusted Git repositories under Codex home's `.tmp/.staging` directory. Clean up abandoned staging directories before creating a repository, while ownership locks protect repositories still in use. Reject a symlinked `.staging` directory to keep `GIT_DIR` inside Codex home.
## Testing
Update the cross-process staging test to create trusted Git repositories and verify that cleanup preserves live owners, reclaims a repository after its process exits, and leaves a concurrent checkout intact.
GitOrigin-RevId: f45b60db82814b4bcc09365f68d808c73d2d5378
## What changed
- Stage Cloud speed choices for the next new turn in the conversation, alongside pending model and effort selections. Update the displayed conversation speed after admission without changing the local default.
- Offer speed commands supported by the pending model. Clear an incompatible pending speed change with a warning when switching models.
- Carry `service_tier` through Cloud message requests, preserving omission to inherit the thread tier and explicit null to clear it. Translate `default` to null and reject tier overrides on queued requests.
## Testing
Add tests for Cloud speed toggling, model-dependent speed choices, admission-time updates, and preserving the conversation tier when selecting a model. Extend request and wire tests to cover service-tier values, explicit clearing, and queue rejection.
GitOrigin-RevId: b4daa701f1fe29593d90a938e60cc20cb980298a
## What changed
- Create WebRTC calls using the TUI's local provider and credentials, then attach the app server through `existingCall` with the returned call ID.
- Preserve the effective voice preference and share realtime prompt preparation and thread headers between call creation and the backend observer.
- Run negotiation asynchronously, cancel pending startup when voice stops, and ignore results from stale startup attempts.
## Testing
Update voice request and handoff tests for client-created calls. Add coverage ensuring that canceling and restarting voice attaches only the new attempt, including when an earlier result is already queued.
GitOrigin-RevId: b704976f4918dddd24a17fbaa868a7c62e81885b
## What changed
Rename `SidebarLayout::Chooser` to `SidebarLayout::Panel` and use panel helpers for geometry, transcript visibility, focus routing, and shortcut hints. Retain `chooser_focus()` for chooser-specific logic.
When changing panel focus, reuse the pane's visible content instead of explicitly selecting `SidebarContent::Chooser`. Update existing sidebar tests to use the renamed geometry helper.
GitOrigin-RevId: ee6180bad691da3a76bd23835077aeb11c7d969d
## What changed
Route direct reviews through the reusable Guardian session so sequential `thread/guardianReview` calls on the same loaded thread can share review history with live approvals. Keep the reviewer conversation separate from the actor and follow the parent thread's persistence settings. Retries reassess the final call under the current policy.
## Testing
Extend app-server coverage to verify history reuse within a parent thread and isolation between parents. Extend the core scenario and snapshot to cover sequential direct reviews without executing the recorded commands.
GitOrigin-RevId: 5f10a04aec43a9351e38575265cb6b5ff06530a5
## Why
The Hickory 0.25.2 dependencies used by `codex-network-proxy` through `rama-dns` and `rama-tcp` have five DNSSEC-only advisories. DNSSEC is disabled even with all workspace features enabled.
## What changed
Add matching exceptions to `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml` for `RUSTSEC-2026-0504`, `RUSTSEC-2026-0505`, `RUSTSEC-2026-0511`, `RUSTSEC-2026-0512`, and `RUSTSEC-2026-0514`.
Document that the exceptions must be reassessed before enabling DNSSEC and removed when the Rust/Rama upgrade brings Hickory to version 0.26.2 or later.
GitOrigin-RevId: 506585d84746076f68ec9a0033603533c52f0f7b
## Why
Proxy HTTP 503 responses can contain plain-text or HTML bodies instead of gRPC frames. These responses should reach the existing session admission retry logic as `Unavailable` errors.
## What changed
Strip body data from HTTP 503 responses to `OpenSession`, preserving headers and trailers so tonic can honor an explicit gRPC status or infer `Unavailable` when none is present. Keep this handling scoped to session admission and retain the existing five-attempt retry limit.
## Testing
Extend admission tests to cover bounded retries for plain-text 503 responses, recovery after an HTML 503 response, and an explicit `Internal` gRPC status that prevents retries.
GitOrigin-RevId: c996e13506464e8b65bae06172324bcbadb1f394
## What changed
- Remove `Config::set_legacy_sandbox_policy` and update session, approval, and Guardian test setup to set permission profiles and workspace roots explicitly.
- Reuse `PermissionProfile::from_legacy_sandbox_policy_for_cwd` for legacy policy validation and updates in `Permissions`.
GitOrigin-RevId: 5ee92c46290ee6a3d7e2d2db7b02641e80bdc44f
## Why
Unfocused chat panes reduced status content to a single dim line, hiding rows that were visible while focused.
## What changed
- Share status measurement, wrapping, rendering, and footer row allocation between the main conversation and side chats.
- Retain structured status content in inactive side chats so native and extension status lines can use the available rows and reflow when resized.
- Keep unfocused status content dimmed with hyperlinks suppressed, while respecting space reserved for the draft and footer hints.
## Testing
Add regression coverage for status reflow across split-pane focus switches and resizing, and update extension status coverage to verify multiple dimmed rows when unfocused.
GitOrigin-RevId: f4def37259fe106d6a3fac9fe4c6cc2d4972f244
## What changed
- Route filesystem helpers through `SandboxManager::transform`, moving helper policy preparation and Windows direct-spawn wrapping into the sandboxing crate.
- Require explicit workspace roots and an available sandbox for helper launches, restrict networking, and reject managed networking configuration.
- Share command preparation and integrity checks between helper requests and sandboxed file opens.
## Testing
Extend coverage for helper executable reads, workspace write boundaries, restricted networking, and Windows wrapper policy serialization. Verify that sandboxed writes to helper siblings leave host files unchanged.
GitOrigin-RevId: e57bfdabf47f79f2194b35df8a75051daf933465
## What changed
Use `legacy_sandbox_policy_label` from the active permission profile to check sandbox overrides when resuming a loaded thread. Continue accepting `external-sandbox` for `danger-full-access` requests, and construct the legacy sandbox policy only when reporting a mismatch.
GitOrigin-RevId: 0f923323394692d2e1f39bafe637c70ce305dc3d
## What changed
Move permission normalization into `Session::apply_session_settings`, leaving `SessionConfiguration::apply` to install the normalized snapshot. Preserve existing deny-read restrictions and infer active profile identity before merging those restrictions.
Convert legacy `sandbox_policy` updates into permission profiles using the updated working directory, clearing active profile identity and profile workspace roots. Normalize a copy so previews preserve the original compatibility input for subsequent admission.
## Testing
Extend session tests to cover deny-read preservation for both update forms, Git metadata protection when changing the working directory, and preview/commit behavior for legacy updates and active profile identity.
GitOrigin-RevId: 8b3a0f630ab56aca6ad75cf16ad432f7fdc08255
## What changed
- Build and assert `PermissionProfile` values directly in memory consolidation tests using filesystem and network permissions.
- Remove the `SandboxPolicy` dependency from rollout trace test fixtures while preserving their `DangerFullAccess` value.
- Update sandbox documentation to describe legacy `sandbox_mode` conversion to `PermissionProfile` and nested filesystem rules, and reference `SandboxMode` in the CLI documentation.
GitOrigin-RevId: ac1be62625b1bfd98dde5f762b379eb840f9186b
## What changed
Consolidate cache refresh entry points around an explicit refresh mode, derive plugin keys from the configured sources, and share request matching and batch outcome handling. Clarify pending refresh state and extract the worker notification callback helper.
## Testing
Add an app-server regression test verifying that the first full plugin list installs a newly published plugin version while preserving cached contents for a plugin whose version is unchanged.
GitOrigin-RevId: 85d91ec7675e98f7430a8bd9c699118c7feb06c4
## Why
Allow collector credentials to refresh without rebuilding OpenTelemetry providers.
## What changed
Add `otel.headers_helper`, a command run from `CODEX_HOME` that returns a JSON object of header strings. Share its results across explicitly configured HTTP log, trace, and metric exporters. Refresh every 29 minutes by default, configurable through `otel.headers_helper_refresh_interval_ms`.
Helper headers override matching static headers. Failed refreshes block affected exports until the helper recovers, and HTTP redirects are disabled when helper headers are used. Repository-local configuration cannot set the helper; exporters set by admin requirements, gRPC exporters, and built-in analytics do not use it. Helper execution respects network policy.
## Testing
Add tests for shared execution, credential refresh and recovery, blocked exports after failure, network restrictions, and configuration validation. Collector tests cover header precedence across all three signals using JSON and binary HTTP encodings, including exclusion of an admin-managed exporter.
GitOrigin-RevId: 89018ac09c2c99523d3f92bf77048e7ed9dae5f2
## What changed
Move shell command construction, bounded process execution, and JSON header parsing from `rmcp-client` into `codex-http-headers-helper`. Preserve the 10-second timeout, 64 KiB output limit, process-tree cleanup, and rejection of invalid or duplicate headers. Keep MCP environment setup and reserved-header validation in `rmcp-client`.
Mark helper-provided header values as sensitive so debug formatting redacts credentials.
## Testing
Add parser tests for credential-safe errors and debug redaction, and adapt the MCP reserved-header test to exercise helper execution.
GitOrigin-RevId: e32d96261ff3648722014971bbf3803d37176ab4
## What changed
Parse reasoning removals from response `input_transformations` and carry the counts through completion events to sampling telemetry.
- Add `codex.responses.reasoning_replay` to distinguish unavailable reports, no reported removals, prefix mismatches, and other removals.
- Add `codex.responses.reasoning_items_removed` histograms by bounded removal reason, grouping unknown or missing reasons under `other`.
- Include zero counts for usable reports; exclude missing, null, or malformed reports from histograms without failing the response.
- Use the sampling step's session telemetry when recording response events.
## Testing
Add SSE and WebSocket integration coverage for report availability, removal counts, unknown reasons, zero observations, and `product_sku` tags in exported metrics.
GitOrigin-RevId: 83c70ca6067fa4b34bf5c463958b4632a7a0a188
## Why
A recovery turn can occupy the core turn slot before `TurnStarted` is published and thread statuses reflect it. During this window, `thread/resume` with configuration overrides could treat an unsubscribed thread as idle and shut it down, interrupting recovery.
## What changed
Require the core turn slot to be empty before replacing a loaded thread during resume. Expose `CodexThread::has_active_turn()` and reuse it in the residency unload check.
## Testing
Add a regression test that blocks paginated history writes to hold a recovery turn before status publication, reconnects with a configuration override, and verifies that the client receives completion for the preserved recovery turn.
GitOrigin-RevId: f295038c8502a9b2849ddc08614db4a3cb5610cf
## Why
Cancelling an MCP HTTP request during a reactive OAuth refresh must not interrupt persistence of rotated credentials. Concurrent requests receiving a `401` also need to reuse a fresh replacement token without refreshing it again.
## What changed
- Route authenticated streamable HTTP requests through `OAuthRuntime`, giving token exchanges independent tasks that finish persistence even if the caller is cancelled.
- Serialize refreshes in both legacy and coordinated modes, recheck the rejected token and replacement expiry, and persist legacy credentials before releasing the manager lock.
- Keep requests waiting to start an exchange cancellable, and use cached access credentials for session cleanup without refreshing tokens.
## Testing
Add coverage for reactive refresh cancellation and rotated refresh-token persistence in both modes, concurrent refreshes with fresh or expired replacements, cancelled waiters, and legacy credentials with only a relative expiry.
GitOrigin-RevId: f52da37d82baf89abcb1585e8e24359de53d40d7
## Why
Providers can echo a bare reserved prefix or return an opaque item ID. Request preparation previously stripped these IDs when they lacked an underscore prefix, even if they carried allocation metadata.
## What changed
- Keep response item IDs with allocation metadata when preparing requests.
- Add `ResponseItemId::with_generation_prefix` to attach a request reservation's allocation while preserving the exact wire ID and recording a matching item-kind prefix and provider suffix.
GitOrigin-RevId: 3249c2669aca11ee5facbd8a246016490a29a4f4
## What changed
Render service tier names in lowercase for the `model-with-reasoning` status line item, while preserving their display casing in terminal titles.
## Testing
Extend footer snapshots to cover Fast and Ultrafast, verify terminal title casing, and check lowercase Flex and multiword tier labels.
GitOrigin-RevId: 16227735d4aae55463df537b91ff7e81c436a66e
## Why
A lost Cloud reply stream previously required reopening the conversation, even when it was idle. Recover the displayed conversation automatically while holding queued input until its reply stream is usable.
## What changed
- Add bounded retries for transient stream failures in the displayed, idle conversation, with credential and network-policy checks. Keep explicit reopen behavior when recovery is unavailable or fails.
- Enable HTTP/2 keepalive pings for Cloud connections.
- Queue input while disconnected and resume ordinary submission after recovery. Mark recovered history as potentially incomplete so an explicit reopen reloads missed turns while preserving drafts and reconciling pending submissions.
- Store retained input per backend and apply background settings updates to the owning backend's drafts.
## Testing
Add regression coverage for queued input during disconnection and extend resume and backend-handoff tests to cover history refresh, draft preservation, and retained settings.
GitOrigin-RevId: 3d753e53d3c0d594680a90cac8a75fe33b91e219
Trim surrounding whitespace from `OPENAI_API_KEY` and reject empty values or
characters outside printable, non-space ASCII with `Invalid API key format`.
Use the validated key in the request's `Authorization` header.
GitOrigin-RevId: 61da9b4989b7cfbceb247ffbbeb6f6efd8413598
## What changed
Separate shortcut binding definitions from rendering in the TUI shortcut overlay. Store optional bindings, paired alternatives, and repeated-key labels in typed entries, then format them through a shared rendering path.
Use `KeyBinding` values for Page Up and Page Down instead of hard-coded labels.
GitOrigin-RevId: da5d61eb94aefa3334612005fe614f58e6bfcae8
## What changed
Add `biometricType` to `userVerification/verify` responses as context alongside the signed `proof`. Successful Touch ID protected signing reports `"fingerprint"`; an unknown method reports `null`. Responses from older servers that omit the field remain supported.
Carry the native method through the verification provider and app-server protocol, and update the experimental protocol exports and API documentation.
## Testing
Add coverage for responses without `biometricType` and for returning `"fingerprint"` separately from the proof. Update existing verification coverage to check the `null` case.
GitOrigin-RevId: c82e84a325a4d9ab1e5262e5100ffc1a043bd97e
## Why
Windows can report a service privilege error after another deployment has registered the same runtime package version for the target account, causing provisioning to fail despite that registration.
## What changed
Accept `ERROR_PACKAGED_SERVICE_REQUIRES_ADMIN_PRIVILEGES` from a registration operation with `AsyncStatus::Error` only when both checks pass:
- The execution alias exists as a reparse point when queried as the target user.
- `FindUsers` reports the exact package as installed for the target SID.
## Testing
Add a regression test covering successful reconciliation, missing target registration, cancellation, and unrelated access-denied errors. Verify that the registration check runs only for the matching status and deployment error.
GitOrigin-RevId: 5ccf0186046b1d681777d7caa083695b86fda1ca
## Why
Reapplying directory ACLs during registered sandbox setup can change permissions on existing files moved into the sandbox directory.
## What changed
During `ProvisionOnly` setup for a registered runtime, verify both persistent sandbox directories' ACLs before writing them. Skip both writes when the explicit permissions match the expected policy, allowing additional inherited entries. If verification fails or either policy differs, apply the directory policies as before.
## Testing
Add a regression test that repeats registered setup and verifies that a moved file remains unwritable by the sandbox group while a newly created file inherits write access.
GitOrigin-RevId: fb199001fc554903064618b86562b2ff0d0384c5
## What changed
- Initialize item and context-window ID generators per thread, reuse the stored window on resume, and give history reconstruction a separate item generator.
- Recover item ordinals from checkpoint replacement history, guardian history, and retained context without lowering the cursor established by earlier records.
- Stamp compaction resume metadata with the next item ordinal in append order, tracking the cursor in local and in-memory thread stores.
## Testing
Extend the history ordinal test to verify that a checkpoint records the cursor at its position in a batch, excluding later allocations.
GitOrigin-RevId: 7121b747a039dc5477235078702137d1ff74e789
## What changed
Add lossless conversions between legacy sandbox templates and `PermissionProfile` without probing workspace metadata, collapsing fixed roots into current-directory access, or deduplicating writable roots. Reject profiles whose restrictions cannot survive the round trip.
Use these conversions for sandbox inheritance in `create_thread` and for validating read-only temporary structured threads.
## Testing
Extend coverage for duplicate writable roots, existing `.git` metadata, unrepresentable restrictions, and child threads inheriting writable roots, network access, and temporary-directory exclusions.
GitOrigin-RevId: cb37acaf615b09f45680b4b0c4152470fbc04abb
## Why
Command Center retains tasks across backend switches. Opening a retained task must use its owning backend, and restoring its draft must account for history or settings that changed while another backend was displayed.
## What changed
- Track each thread's first observed backend, reject conflicting ownership, and switch to the owning backend when opening a retained task. Require users to open tasks on other backends before running task actions.
- Keep discovery cursors, initialization, and pins per backend. Scope refreshes and usage requests to their owner, and handle background archive and delete notifications without consuming the displayed backend's pagination budget.
- Verify cached blank sessions are still idle and have no turns before reusing them, with a history-read fallback for older servers. Otherwise, resume saved history and preserve current server collaboration settings when restoring drafts.
- Use only interactive task-list pages for cloud discovery, which does not support the additional source filters.
## Testing
Add regression coverage for ownership conflicts, action routing, pins across backends, background removals, usage isolation, cloud discovery, and draft restoration with blank or populated history, including older-server fallbacks.
GitOrigin-RevId: 0d0913ec38dc16a839823008a4a84aa46ad8e6c6
## What changed
Add `transcript_selected_exec_results` to synchronous Guardian elastic budgeting so selected Code Mode `exec` outputs can receive a separate token reservation and entry cap from ordinary tool evidence.
Configure selection with `nested_tool_names`. Match results against the host-recorded inventory of completed nested tool calls, including normalized tool names, even when the original `exec` call has left review history. Leave the new section's reservation at zero when omitted.
## Testing
Add coverage for recorded-inventory matching and results whose calls are missing from history. Extend the elastic budgeting scenario to verify that selected output is retained while ordinary tool output is capped.
GitOrigin-RevId: 6a8de250e36b18f2acfdab993c83c254f101ce87
## Why
MCP servers discovered on different executors can share a name. Resolving them by name alone exposes only one server and prevents tools and resources from being addressed independently.
## What changed
- Add the disabled-by-default `multi_environment_mcp` feature to expose environment-scoped servers, including multiple installations of the same plugin.
- Carry exact `McpServerKey` identities through catalogs, connections, tool calls, resources, and approval tracking. Give environment-scoped tools stable namespaces derived from their environment.
- Include `environment_id` in scoped resource listings and accept it in resource requests. Require it for environment-owned servers when multiple environments are selected.
- Preserve server ownership through hooks and use the owning environment's permissions for scoped elicitation review.
## Testing
Add coverage for same-named servers across environments, independent calls and approvals, resource selection, plugin discovery, and rejection of hook changes to the tool environment.
GitOrigin-RevId: 5593372b06a15c16aa3220faa3b19f5d3b20e67e
## What changed
- Replace free-form `AgentMessageDisplay` actions with a version `1` contract using `show`, `hide`, and `block` modes, with typed annotations, replacements, block reasons, and trusted-contact handling.
- Discard invalid or unsupported display instructions and set `moderated` to `true` when reading moderation data in Rust and the Python SDK.
- Update generated JSON schemas, TypeScript types, and Python SDK models to match the contract.
## Testing
Add coverage for display variants, tolerance of extra fields, and unsupported-version or unknown-mode fallback. Update the final-answer moderation test and add Python coverage for thread history and item notifications.
GitOrigin-RevId: ec64070002da67e8e377dccb3728806ac8b290e7
## Why
The root metadata test copies the sandbox executable into an isolated root, which also needs access to the bundled bubblewrap fallback.
## What changed
Copy the discovered bundled binary into the fixture's `codex-resources/bwrap`. Allow the system binary as a fallback when `CODEX_BWRAP_SHA256` is absent or all zeros; require a matching bundle for digest-verified builds.
GitOrigin-RevId: 6d61fa212d8ecfd05f482a219dfc4f1c5911e08c
## What changed
Replace the issue labeler's Codex action with a Python script that calls the Responses API with tools disabled and a strict JSON schema. Preserve the label catalog while validating one issue type, an optional product, and known area labels before applying them.
Retry transient API failures and timeouts, honor `Retry-After`, and reject redirects. Pass validated labels directly to `gh issue edit`, surface label application failures, and allow trigger-label cleanup after suggestion failures.
GitOrigin-RevId: 2bfe301468808b4d15aa8b5fe8ddd98c1ed844c6
Keep a `NoSubscriber` dispatch alive while the cancellation-before-admission
test runs so untraced parallel workers registering the callsite do not
interfere with timing log capture.
GitOrigin-RevId: 11bc60e3e4633d3ccf426823aeb271875affa39a
## What changed
- Use `std::fs::rename` for atomic file replacement to support overlapping readers on Windows, retaining temporary-file cleanup if publication fails.
- Replace PowerShell fixtures in legacy sandbox capture and ConPTY lifecycle tests with native subprocesses. Keep child markers and output in writable workspaces, prevent inherited capture handles, and use asynchronous waits in ConPTY tests.
- Update the Bazel `rules_rs` Linux zlib package pins and mirrors.
- Temporarily exempt four `hickory-proto` advisories in `cargo-audit` and `cargo-deny`, with removal tied to upgrading Rust to 1.96+ and Rama to use `hickory-proto` 0.26.2 or later.
GitOrigin-RevId: 23d10a023014cc16c100480d1e8bfc2ec87085e3
## Why
An immediate request after `start` could compete with the pending `initialized`
notification for channel capacity and fail with `WouldBlock`.
## What changed
Wait for an acknowledgment that `initialized` has been processed before returning
from `start`. Shut down the runtime if sending the notification or receiving its
acknowledgment fails. Ordinary notifications remain fire-and-forget.
## Testing
Require the first request after startup to succeed without retries with channel
capacities of zero (clamped to one) and one.
GitOrigin-RevId: 119a9a4375109f6b85aee0a9a4f8398a69269567
## Why
A pending token refresh must not overwrite a newer login or recreate credentials after logout. Legacy file entries also need to retain their stored identity across refreshes.
## What changed
- Lock and revalidate stored credentials before persisting changed authorization-manager credentials, requiring authorization again if storage has changed.
- Update file-backed refreshes only when the matched entry still contains the expected credentials, preserving its key, server name, and ownership. Compare only fields the file format can persist.
- Remove matching legacy file entries when saving login credentials or deleting credentials, while preserving unrelated entries and profile-scoped enterprise credentials' separate local entries.
## Testing
Add regression coverage for newer logins and logout during pending persistence, repeated refreshes of legacy and escaped-name entries, and cleanup that preserves unrelated credentials. Update guard-retention and telemetry assertions for the validation path.
GitOrigin-RevId: 3d7c603950afcff72f0bcd943edae5ecfbcb5bd2
## What changed
- Add the stable `incremental_tools_legacy_gcp` feature, enabled by default, to control incremental tool declarations on regular GCP Responses independently of Amazon Bedrock.
- Mark `incremental_tools_legacy` stable and keep it disabled by default for Amazon Bedrock.
- Expose the new flag in the configuration schema.
## Testing
Update integration coverage for GCP defaults and opt-out, independent provider flags, and incremental tool declarations during remote compaction.
GitOrigin-RevId: 7acf085789d44122fd2a5da97932a8b9e93e240e
## Why
Normalizing whitespace before matching prevents thread search from producing snippets for queries containing repeated spaces, newlines, or tabs.
## What changed
Match against the original conversation text and select the surrounding excerpt before normalizing whitespace for display.
## Testing
Extend `thread_search_matches_json_escaped_content` to cover repeated spaces, newlines, and tabs alongside quotes and backslashes, and assert that the returned snippet has normalized whitespace.
GitOrigin-RevId: fffdcc8d246e7603a52c32bb5239b9873f8179fc
## Why
Repeated or nested search roots can cause the same path to consume multiple result slots and inflate the total match count.
## What changed
Skip duplicate walk roots and deduplicate paths within overlapping subtrees before sending them to the matcher. Keep separate walks for nested roots so their ignore rules can still expose different entries.
## Testing
Add a regression test covering repeated parent and child roots in both orders, verifying that two distinct matching files fill a two-result limit and produce a total match count of two.
GitOrigin-RevId: 86483e572cb3d4dd69ec335fc2d27916301e1332
## Why
Threads need a visible title while automatic generation is pending or fails. Hidden title-generation requests must also stay out of the foreground conversation, including during skill installation prompts.
## What changed
- Immediately display a Markdown-stripped, single-line excerpt of the first message, capped at 60 characters. Replace it with the generated title, or save the excerpt if generation fails or returns an invalid title.
- Give title threads explicit read-only permissions and request the `never` approval policy, subject to managed policy constraints. Keep blocking input requests on the hidden thread until timeout.
- Interrupt timed-out temporary structured turns before detaching them.
## Testing
Add coverage for provisional title replacement, fallback persistence, managed permission and approval policies, and hidden input requests. Add a terminal integration test that verifies title generation after choosing “Continue anyway” on a skill installation prompt.
GitOrigin-RevId: f408f3061e5e7f0d9d6bc1f2f9674303e9e68400
## Why
Requests that exceed the server's advertised WebSocket message size limit can fall back to HTTP without first uploading the oversized message.
## What changed
Read `x-codex-websocket-max-message-bytes` from the handshake response and check the serialized request's byte length before sending. Route oversized requests through the existing HTTP fallback. Ignore missing or invalid limits, and remove the close-code-specific wording from the size-limit error.
## Testing
Add a fallback test that advertises a one-byte limit and verifies zero WebSocket generation requests and one HTTP request.
GitOrigin-RevId: 03b42012ca77d6b046e937fef8e6335d855a1c10
## Why
A WebSocket close with code `1009` before any text arrives indicates that the request exceeds the peer's message size limit. Retrying the request over another WebSocket does not address that limit.
## What changed
- Classify these early size rejections as requiring HTTP fallback and switch transports without exhausting WebSocket retries, including during prewarming.
- Preserve ordinary stream retry behavior for size closes after any text frame and for other close codes.
## Testing
Add integration coverage for early size rejections during generation and prewarming, size closes after metadata, rate limits, or response creation, and ordinary closes.
GitOrigin-RevId: 4550d289bb414fec1faae2a195bcc635d394117b
## Why
Replaying delivered assistant messages allocates new retained-source revisions instead of preserving those captured in live history.
## What changed
- Capture retained sources when recording assistant deliveries, persist them in rollout metadata, and reuse their revisions during replay.
- Add optional `next_item_ordinal` compaction metadata and a `next_model_id_ordinals` helper to recover item and window allocation positions from checkpoints and subsequent records. Ignore allocation metadata that refers to other threads.
## Testing
Extend tests to compare live and replayed delivery sources, preserve revisions through an older reader's rewrite, and verify ordinal recovery from checkpoints and subsequent local items.
GitOrigin-RevId: cfdeebe8e13b1700b34b9c98696880a90a99ace5
Share reviewer lookup and deferred configuration resolution through
`select_synchronous_reviewer` in isolated assessments and approval reviews.
Keep configuration resolution within each caller's review deadline.
GitOrigin-RevId: 77f9a77a3d7a859f5c8012e4d22b68c8def7d81b
## Why
A subagent can use a different model from its parent, with different supported access programs. Saved Daybreak choices need to resolve against the subagent's model and remain consistent throughout its turn, including compaction.
## What changed
- Resolve saved choices before native subagent turns start, preserving explicit turn overrides and applying saved toggles on later turns.
- Distinguish inherited parent programs from explicit child selections. Adapt inherited Daybreak Blue/Red selections to the child model while retaining the saved choice as the default for later turns and nested subagents.
- Validate the account associated with automatic selections and reject incompatible saved choices before sending model requests, while retaining rejected user input in conversation history.
- Require model changes to wait until the next turn when a saved Daybreak choice is present.
## Testing
Add coverage for both multi-agent spawn versions, model-specific selection, automatic compaction, WebSocket response reuse, account changes, unsupported choices, and rejected-input persistence across resume.
GitOrigin-RevId: 11971138d656600d9878187225e4d33217e68ad4
## Why
Restoring model-facing ID sequences requires allocation ordinals alongside the rendered IDs. Responses API payloads still require string IDs.
## What changed
- Add allocation metadata to `ResponseItemId` while keeping equality, hashing, and ordering based on the rendered ID.
- Preserve optional `id_allocation` metadata in rollout items, inter-agent messages, compaction replacement history, and Guardian checkpoints. Continue accepting legacy string IDs.
- Support structured context-window allocations alongside UUIDv7 strings, validate the `window` salt on restoration, and keep request metadata IDs as strings.
## Testing
Add tests for allocation round trips, legacy ID compatibility, string-only raw response item IDs, and context-window allocation validation.
GitOrigin-RevId: ce1fd964bde9a4e7c527432be99aea87ada30169
## What changed
Replace handwritten JSON schemas with Rust request types using `serde` and
`schemars`. Derive tool descriptions from doc comments and retain explicit
nullability, numeric bounds, enum values, and `encrypted` annotations.
Keep forwarding the original JSON arguments to the HTTP backend so catalog
parameters can evolve independently of the request types.
GitOrigin-RevId: e5268de27c2cb929153127b1c7376c7a9cac07e7
Eric Traut