## What changed
Advertise `fileWriteStreaming` and support `fs/open` with `mode: "replace"` to create or truncate a file for writing. Implement `fs/writeBlock` with explicit offsets and nonempty chunks of up to 1 MiB, rejecting ranges beyond the signed 64-bit file offset limit.
Apply write sandbox permissions when opening writable handles, including when full-disk reads are allowed. Keep `read` as the default open mode.
## Testing
Add integration coverage for positional writes, chunk and offset bounds, replacement truncation, read/write handle permissions, and sandbox write restrictions. Verify that duplicate handle IDs and exhausted handle capacity reject replacement opens without creating or truncating files.
GitOrigin-RevId: 696ee6437dd5f5b69d5a7667dddea0ff44472094
## Why
Local secrets storage pulled in the unmaintained `proc-macro-error2` through `age` and `i18n-embed-fl`, requiring an exception for `RUSTSEC-2026-0173`.
## What changed
Upgrade `age` to `0.12.1` and update the Cargo and Bazel lockfiles. The updated dependency chain uses `proc-macro-error3`, allowing removal of the advisory exception from both `cargo-audit` and `cargo-deny` configuration.
GitOrigin-RevId: 7e18dec4d71d9260512f54fbfe71dbe4e6ee8a5d
## Why
The per-connection limit of 128 file read handles was checked only after opening the file, leaving pending opens outside the limit.
## What changed
Reserve a semaphore permit before polling the file-open future, counting pending opens and registered handles against the same limit. Release capacity when an open fails or is cancelled, or when a handle closes, even if a read still retains the file.
Use synchronous handle-table locks that never cross an await, and recheck duplicate IDs after opening to preserve the winning handle during concurrent opens.
## Testing
Add tests for stalled-open progress, pending-open admission limits, permit cleanup after failure or cancellation, capacity reuse while a file remains in use, and concurrent duplicate IDs.
GitOrigin-RevId: caabf38c74dda5951f2fc75234a7149daaa01263
## What changed
Expose `create_worktree`, `get_worktree_creation_status`, and `list_worktrees` through MCP when the worktrees feature is enabled for a trusted local project and attachment storage is available. Support both embedded and local daemon sessions.
Create worktrees asynchronously and attach them to the requesting task, with ownership and attachments retained across restarts. Default to the repository's remote default branch unless `ref` is supplied. Keep the task's working directory and execution environment unchanged, and leave uncommitted source changes in place.
Reject creation in ephemeral side conversations and explicitly untrusted source projects, reuse pending operations, and reject configured MCP servers that conflict with the TUI tools namespace.
## Testing
Add integration and model-request snapshot coverage for creation, polling, listing, attachment persistence across restart, task isolation, trust checks, namespace conflicts, and worker failure reporting.
GitOrigin-RevId: b6a57e92cf5f6fc51fd6d4028543d6fabaf5ac49
## Why
Permission shortcuts checked local configuration while the picker used the connected server's catalog and requirements. Shortcuts should respect the same server restrictions, including model-specific auto-review requirements.
## What changed
- Share a cached server catalog between the permission picker and shortcuts. Show the loading picker when no catalog is available and reuse an outstanding fetch.
- Clear the cache on session, account, working-directory, or connection changes.
- Give discovery RPCs distinct request IDs for each fetch and profile page so repeated requests after timeouts do not collide.
## Testing
Add coverage for loading and catalog reuse, managed permission restrictions, and refetching after disconnect. Update timeout coverage to verify that repeated discovery attempts use distinct IDs and each reports a timeout.
GitOrigin-RevId: 7d79874294136bfe3a654bb306eb7caf36d4df1e
## What changed
Add `codex tcp-tunnel --diagnostics-json` to emit versioned, newline-delimited JSON diagnostics on stderr. Records classify startup, CONNECT, transport, and control failures without exposing credentials, addresses, headers, or raw error messages. Rejected CONNECT records may include a validated `http_status`.
Distinguish terminal failures from recoverable stream and transport events, flush terminal records before returning a generic error, and preserve stdout readiness and credential acknowledgments. Keep human-readable diagnostics as the default and document the version 1 schema and consumer fallback rules.
## Testing
Add tests for bounded output, error-chain suppression, terminal flushing, control error classification, CONNECT status validation, legacy behavior, and flag parsing. Extend the reconnect test to exercise a rejected CONNECT followed by a successful connection in JSON mode.
GitOrigin-RevId: 350f67fe8e3f313e8a6d3bb0fd891952b77647fd
## Why
When Codex runs on Unix and launches a stdio MCP server on a Windows executor, explicit remote environment variables activate an allowlist based on Unix defaults. This can filter out Windows runtime and temporary-directory variables.
## What changed
Include `SYSTEMROOT`, `TEMP`, and `TMP` in the remote environment allowlist whenever explicit remote variables are requested.
## Testing
Extend the environment-filtering test to verify that `SystemRoot`, `TEMP`, and `TMP` survive alongside requested variables while unrequested secrets remain excluded.
GitOrigin-RevId: 059c9e23833be66aaf5b65ba5f95013f94f0f792
## What changed
Add `CodexThread::current_turn_model` to return the model slug selected for the named running turn's next step, independently of settings for future turns. Return `None` when the turn ID does not match, the task is cancelled, or the turn is no longer running.
## Testing
Extend the step-settings test to verify that the accessor ignores model changes for future turns, reflects active-turn model updates, and returns `None` for a mismatched ID or a completed turn.
GitOrigin-RevId: 2cae7c07fa761ed4d64befaa3419a2f9bce4b161
## What changed
Add `codex-cloud-client`, a reusable Rust client for `ThreadService.Resume` and live `ThreadService.Attach` over HTTP/2. Callers supply the native gRPC origin, bearer token, account ID, and `HttpClientFactory`.
- Reuse shared proxy, custom CA, and network policy handling for HTTPS. Reject redirects and allow plaintext HTTP only on direct loopback with unrestricted, unmanaged policy.
- Preserve notification and server-request protobuf payloads as opaque bytes and expose native gRPC status details while redacting credentials, payloads, and error details from diagnostics.
- Bound resume and attach setup to 150 seconds without retrying requests or imposing an idle deadline on live streams. Attach ends on its first error and provides no history or automatic reconnect.
- Select Rustls in `HttpClientBuilder::http2_prior_knowledge()` so HTTPS advertises `h2` through ALPN.
Include a standalone attach example and documentation of admission semantics and stream behavior.
## Testing
Add HTTP/2 fixture tests for protobuf framing, authentication metadata, status trailers, event preservation, malformed responses, stream cancellation, redirect rejection, and diagnostic redaction. Add checks for unsafe origins, network policy restrictions, and TLS `h2` advertisement.
GitOrigin-RevId: 55db70438bb5e59272c6995c67a46ced5fa28ff4
## What changed
Move the voice connection spinner into shared helpers in `codex-rs/tui/src/motion.rs`, keeping its 100 ms animation cadence and static reduced-motion glyph. The helpers handle frame scheduling, and `loading_glyph_with_delay` supports hiding the animated spinner until a specified delay expires.
GitOrigin-RevId: c4ebe5e6a33239999aab2f4432c9145432c8f4fd
## Why
Long drafts need to remain browsable while leaving room for the transcript. Remote image attachments also need to leave an editable prompt row visible.
## What changed
- Cap the fullscreen composer, including padding and hints, at two-thirds of the screen, with a minimum of eight rows when the screen allows.
- Support mouse-wheel browsing without moving the caret or changing transcript selection, search, or activity focus. Show arrows for hidden prompt rows and hide the cursor when the caret is offscreen.
- Resume caret following on editor input, paste, and external edits.
- Keep the selected remote image visible while reserving space for prompt text.
## Testing
Add regression tests and snapshots for fullscreen scrolling, caret restoration after navigation, paste and external edits, remote image navigation and deletion, resizing at scroll boundaries, and disconnected editing.
GitOrigin-RevId: 9a1e4ce14b3b3747e6d136207546327531339258
## What changed
Move footer property construction, mode resolution, hint overrides, quit shortcut hints, and custom footer height calculation from `chat_composer.rs` into `chat_composer/footer_state.rs`. Preserve existing behavior and expose the moved helpers to the parent module where needed.
GitOrigin-RevId: 4a23753ac1648352ab19d4bcc3da9f368c48f619
## What changed
Add the disabled-by-default `guardianv2_decisions_comparison` feature to run Decisions alongside Guardian V2 snapshot classification using the same policy and evidence. Initialize the comparison sampler with `CODEX_GUARDIAN_DECISIONS_API_KEY`.
Publish the baseline score before awaiting comparison results, and keep comparison results and failures from changing approvals. Apply Guardian's input token budget, skip conversation evidence, and cancel comparison work when the baseline classification is superseded. Record success, failure, and skip outcomes with bounded diagnostic reasons, including setup failures.
## Testing
Add lifecycle tests covering disabled comparison, disagreeing classifications, backend failures, unchanged published scores, matching policy and evidence, and rejection of over-budget requests before either backend sends them.
GitOrigin-RevId: 743d34c8ee440362da94f001058366027b39bd11
## Why
`thread/attachment/list` lists attachments for a known thread. Clients also need to find the threads associated with a given attachment identity.
## What changed
Add `thread/attachmentOwner/list` to return owning thread IDs and archive status for an exact `attachmentType` and `identityKey`. Support cursor pagination and an optional `archived` filter, including both archived and non-archived threads by default.
Wire the request through the thread store and update documentation, protocol schemas, and generated TypeScript and Python types. The lookup is limited to the configured thread store and reports current membership, not an atomic resource-cleanup check.
## Testing
Extend app-server integration tests to cover exact type-and-key matching, multiple owners, archive filtering, and invalid cursor rejection.
GitOrigin-RevId: 30f4a20e00243d0023246d465a9b95213b3adeb6
## Why
Reloading an unloaded root from a surviving child can supply the shared instruction wrapper already registered for that root. Replacing its underlying provider with that same wrapper makes instruction loading recurse into itself.
## What changed
Reuse the existing wrapper without replacing its provider when both are the same `Arc`. Continue to accept distinct replacement providers.
## Testing
Extend regression coverage to reload the root from a surviving child and verify that shared instructions still update. Check wrapper reuse, replacement with a distinct shared provider, and freezing the shared snapshot when switching to a provider that does not share with subagents.
GitOrigin-RevId: 7b6b2f9031f206e203f6fa14e1478a36b305ec39
## Why
Unread queue-only messages prevented idle agents from unloading, and sending a
message to an evicted agent reloaded its session. Pending mail should not require
an idle recipient to occupy a loaded thread slot.
## What changed
- Retain queue-only mail in an in-memory runtime mailbox when a session unloads.
Queue new messages for locally evicted agents without reloading them or
starting a turn.
- Add `AgentControl::take_mailbox` and `AgentControl::watch_mailbox` so sessions
can consume retained mail and react to host mailbox notifications.
- Preserve message order across eviction, reload, and subsequent follow-ups.
Keep agents with outstanding durable sleep or turn-triggering mail loaded,
and discard retained mail when an agent is removed or its tree shuts down.
## Testing
Add integration coverage for retaining mail across eviction, sending while
unloaded, and ordering messages around a follow-up after reload. Add a host
controller test verifying that mailbox notifications wake `wait_agent` and
that the message is delivered exactly once.
GitOrigin-RevId: 4b55647f9ee9d1aaf3753f0688863bda81617327
## What changed
Add `StateRuntime::list_thread_attachment_threads` to find threads by exact `attachment_type` and `identity_key`, including threads without previews. Return thread IDs and archive state, with filters for all, archived, or non-archived threads.
Order results by thread ID and bind pagination cursors to the attachment identity and archive filter. Add a database index on `(attachment_type, identity_key, thread_id)` to support the lookup.
## Testing
Add coverage for exact identity matching, archive filters, pagination, rejection of cursors reused with different lookup parameters, and membership updates after attachment removal or thread deletion.
GitOrigin-RevId: 21f32eb0cb1845a82d740d67b374080b6e12eb03
## Why
Subagents spawned without forked history do not receive their parent's client-defined dynamic tools, preventing them from using those tools for delegated work.
## What changed
Add the disabled-by-default `multi_agent_v2_dynamic_tools` feature flag. When enabled, fresh V2 subagents inherit the parent's dynamic tool definitions and persist them in session metadata.
## Testing
Add coverage for V1 and V2 feature gating, tool persistence, and a fresh V2 subagent calling an inherited tool and receiving its result without inheriting parent history. Update TUI assertions and a snapshot to reflect blank-line separation and question text in recovered answers.
GitOrigin-RevId: a17a16bf5570f54ce922c1521cffb883022354f2
## What changed
Add a Decisions sampler under `#[cfg(test)]` for Guardian's optional comparison classifier, without wiring a runtime caller.
- Encode text and inline image evidence as a `guardian_risk` choice request using `gpt-6-luna`, accepting only `low` or `high` responses. Reject the complete request when evidence cannot be represented.
- Bound concurrency to 16 requests, cancel the oldest unfinished request at capacity, and abort unfinished work when its owning task is dropped.
- Enforce a six-second HTTP deadline, an 8 MiB inline image data limit, and a 16 KiB response limit. Keep credentials and wire bodies out of errors.
## Testing
Add tests for the HTTP contract, unsupported evidence, inline image preservation and size limits, response validation, oldest-request cancellation, and capacity release when a caller is dropped while awaiting completion.
GitOrigin-RevId: e7209ca49a04505acf10ff1aeaca941514589e13
## Why
Bubblewrap consumes and closes the file descriptor for each `--ro-bind-data` mount. Reusing one descriptor across multiple file masks prevents the sandbox from starting.
## What changed
Open and preserve a separate `/dev/null` descriptor for each empty-file mask.
## Testing
Extend unit tests to verify distinct descriptors for multiple denied files and missing-path masks. Add integration coverage for exact-path and glob deny rules, checking that the sandbox starts, denied files remain unreadable and unwritable, and allowed files remain accessible.
GitOrigin-RevId: 85158c83699afd36bb7aca453b2652d777cf65e4
## What changed
- Centralize `windows-sys` at version `0.61.2` in the workspace and migrate dependent crates to it.
- Adapt Windows API calls to the updated handle, boolean, and type definitions. Replace custom handle owners with `OwnedHandle` and use `BorrowedHandle` where ownership stays with the caller.
- Add explicit wrappers for non-owning Windows handles passed between threads.
## Testing
Enable the MCP refresh cleanup test on Windows. Retain process handles to verify that a superseded MCP server stays alive during an in-flight call, exits after cancellation, and leaves the replacement running until shutdown.
GitOrigin-RevId: 86f53d9b300d13edff7154f4a7c32e34dacd2919
## What changed
Update `post_sampling_token_estimate_is_disabled_by_always_on_sinks` to register explicit event metadata with the subscriber and assert that its interest is `never`. This replaces the scoped default subscriber and global interest-cache rebuild with a direct check of the configured logging layers.
GitOrigin-RevId: 7c4ecd9c4adef148fd222394ad1ad326e8033d95
## Why
When a turn ends, unsent question answers are recovered into the main composer. Recovering only the answers loses which question each answer belongs to.
## What changed
Prepend each recovered answer with its question title as a Markdown blockquote. Separate questions, answers, and existing composer text with blank lines.
Sanitize question titles and limit them to 512 bytes at a UTF-8 character boundary, adding an ellipsis when truncated. Keep answer text untruncated.
## Testing
Add coverage for bounded titles, multibyte characters, control characters, and multiline question-and-answer submission. Update recovery assertions and snapshots for turn completion, failure, interruption, large pastes, and Vim undo.
GitOrigin-RevId: 141dacfb64bcad5fcabc5be217d2340ef7de1eb5
## Why
Environment changes and overlapping catalog refreshes can cause a step to use another step's selected plugins or executor skills. Model context and skill tools need to agree on the capabilities captured for that step.
## What changed
- Resolve selected plugins from each step's ready capability roots, honoring disabled plugins, and retain the snapshot with the step's extension data.
- Use that snapshot for skill attribution in World State and the first step's active-plugin telemetry.
- Return executor skill catalogs directly from refresh so overlapping requests render their own results while retaining thread caches.
## Testing
Add regression coverage for overlapping executor catalogs and environment changes during step preparation. Verify that `skills.list` retains the original step's skills, the next step advertises the new skills, and disabled executor and plugin skills remain absent from model context.
GitOrigin-RevId: 37d3cbe8c7e062fd06290aa985ada4d3b3462d43
## Why
Cygwin records installation timestamps in an unused Java truststore, changing Bazel action cache keys when the same tools are reinstalled.
## What changed
Exclude `cygwin/etc/pki/ca-trust/extracted/java/cacerts` from the generated `cygwin` filegroup in `.github/scripts/voice_windows_tools.py`.
GitOrigin-RevId: 8fdd910fadba7d977b45718546232652d073cdc8
## Why
Starting Find expanded the entire transcript into detailed mode. Searching hidden content should preserve the compact view and manually expanded activities.
## What changed
- Search full transcript content, including hidden live output, and temporarily expand only the current matching entry.
- Preserve manual disclosure state and retained text revisions while reading or selecting a match. Allow activity controls while reading results.
- Use `Enter` or `Ctrl+P` for older matches and `Ctrl+N` for newer matches, with matching footer hints.
## Testing
Add regression tests and snapshots for selective expansion, manual disclosures, hidden live matches, retained selections across updates and resizing, and Find in compact transcript overlays.
GitOrigin-RevId: 618ee47ba6c3f3a5138c9e3fe0961e7faa3383da
## Why
Closing Find previously restored the pre-search view, making it difficult to read a match and its surrounding transcript context.
## What changed
- Make `Esc` with a nonempty query close query editing while preserving the query, highlighted match, and expanded output. A second `Esc` returns to the latest output; `Ctrl+C` cancels Find and restores the pre-search presentation.
- Allow paging through surrounding context and loading older history without losing the query. Keep `Ctrl+N` and `Ctrl+P` available for match navigation, and reopen Find to edit the retained query.
- Show context above matches when space permits, preserve match layouts across resizing, and display navigation and history status while reading results.
## Testing
Add regression tests and snapshots for retained results, surrounding context, resizing, paging around live output, older-history loading, and footer status. Update interaction tests for the additional `Esc` transition.
GitOrigin-RevId: d822956d3c6ffab88fc1665ebdf0c86ccf110899
## Why
Legacy MCP tool discovery discarded pagination cursors, leaving tools on later pages unavailable.
## What changed
Pass `tools/list` pagination cursors to the existing collector in both legacy and modern protocol modes. Legacy discovery now follows subsequent pages and applies the same pagination limits and cursor validation as modern discovery.
## Testing
Extend integration coverage to both protocol modes, checking that tools from later pages reach the model and can be called successfully, while catalogs with oversized cursors are rejected. Update the legacy discovery test to expect an error for a repeated cursor.
GitOrigin-RevId: a6daa8034d2a403c1f2a5846e385789d8a620af7
## Why
A user restriction such as “Cancel the deployment” can fall outside the recent-message window after unrelated status questions. Guardian reviews need that restriction when assessing delegated actions.
## What changed
- Preserve root user messages during handoff relevance filtering, subject to the existing shared message cap.
- Apply handoff filtering during heartbeats while retaining saved heartbeat instructions and the active turn's trusted skills.
- Mark assistant context as incomplete when handoff filtering omits it, so ordinary user replies are not interpreted without their missing context.
## Testing
Add regression coverage for restrictions followed by status questions, bounded user history, omitted assistant questions, and trusted skills across first and repeated heartbeats. Update the delegation request-history snapshot.
GitOrigin-RevId: 67f77313572dc54225713cd7cdb90f06b0fbe030
## What changed
Add `CODEX_GUARDIAN_DECISIONS_API_KEY` to the non-inheritable environment variables and the HTTP header environment denylist. Case-insensitive filtering removes it from child process environments, including explicit shell policy and command overrides, and rejects its use through `http/request` header `value_env_var`.
## Testing
Extend regression coverage for inherited and overridden variables, mixed-case names, and HTTP header rejection before any network request is sent.
GitOrigin-RevId: 1adeef814fdccb2d6c77dd68f7a5dfcec0b41cc6
## Why
Concurrent Linux test spawns can inherit writable descriptors for executable fixtures, preventing those fixtures from being executed even after the writing test closes its descriptor.
## What changed
Replace direct executable fixture writes and copies across the Rust tests with `codex_utils_cargo_bin::write_executable` and `copy_executable`. These existing helpers complete writes and copies in separate processes on Linux.
Remove the empty temporary inode before creating fake bubblewrap executables, and stage tampered bubblewrap bytes in a separate data file before copying them into the executable fixture. Add the required test dependencies.
GitOrigin-RevId: c875c83088731a4933ef1574e8d79d8cecc12f54
## Why
Fresh TUI threads should use the app server's model settings unless the launch explicitly overrides them. Sending resolved configuration values in `thread/start` turns defaults into explicit overrides.
## What changed
- Track explicit launch choices for `model`, `model_provider`, and `model_reasoning_effort`, and omit unselected settings from the initial `thread/start` request.
- Preserve accepted model migrations as explicit model and reasoning-effort choices.
- Keep explicit profile launches on the existing resolved-configuration path.
## Testing
Update startup request tests to cover omitted defaults, CLI model and provider overrides, repeated model overrides, reasoning-effort overrides, accepted migrations, and explicit profiles.
GitOrigin-RevId: 4e2661ba42322a80e2b769a55c62f61a576762b0
## Why
The rolling retained-context window can change as assistant messages are added or evicted. Placing it before the transcript invalidates the reusable history prefix.
## What changed
Move retained user instructions and context after the transcript and action-specific attestations, immediately before the planned action in asynchronous Guardian requests. Keep synchronous section ordering unchanged.
## Testing
Extend the cache-prefix regression test to cover retained assistant message growth and eviction alongside changing attestations. Update app-server and async scorer assertions to verify the new request ordering.
GitOrigin-RevId: 59953d582d4b174ce3e083606626c7532ce0776d
## What changed
- Add `EmaAuthenticatedHttpClient` to cache and renew resource bearers, serialize concurrent renewals, and include authentication time in the request deadline. Confine bearers to the configured MCP endpoint and reject redirects.
- Return authentication-required errors for `401` responses without replaying MCP operations. Preserve a newer cached bearer when a delayed response rejects an older one.
- Add revocable request authority that cancels pending requests and ends response streams.
- Pin enterprise credentials to a persistent version advanced on save or deletion. Use short credential locks and invalidate rejected grants only when their record and version are still current, preserving newer logins.
- Hide keyring account identifiers from enterprise credential errors and traces while preserving authentication failure classification.
## Testing
Add tests for token expiry and renewal, endpoint confinement, redirects, request deadlines, revocation during renewal and streaming, delayed `401` responses, credential replacement and logout races, and credential error privacy.
GitOrigin-RevId: ee3e5cf7ecbba3d09e1ab29ed4fbb2a35eacc60d
## Why
Retaining process output, publishing events, and serving reads cloned the underlying byte buffers. Sharing those buffers avoids copying output bytes when chunks are cloned.
## What changed
Store `ByteChunk` bytes in `Arc<Vec<u8>>` and retain `ProcessOutputChunk` values directly. Add borrowed byte access for the MCP process transport while preserving base64 serialization and owned byte extraction through `into_inner()`.
## Testing
Add a unit test covering base64 serialization, deserialization, and independent owned bytes extracted from shared chunks.
GitOrigin-RevId: 6bba114af48424aa844487aa75163cfc604e0575
## What changed
Add a test that appends an original and updated name for one thread alongside another thread's entry. Verify that lookup returns the updated name and that removing the first thread's name entries leaves only the other thread's entry.
GitOrigin-RevId: cedf260a639f0c0e76aeda0d446559c3821bd911
Use `LazyLock` to compile the placeholder regex once and reuse it across
argument strings, avoiding repeated compilation during template expansion.
Preserve regex error propagation and placeholder substitution behavior.
GitOrigin-RevId: 2ac8aec86de3430335c068e47d09422dcd276f7c
## Why
Short sender replies such as `👍` need preceding assistant context to be understood during a delegation review. User messages alone omit that context.
## What changed
- Capture preceding assistant context alongside up to three recent sender user messages at delivery, for Guardian only. Label assistant messages as untrusted context rather than authorization or verified questions.
- Share the existing 900-byte budget per exchange, prioritize user evidence, and report unavailable assistant context.
- Recognize `cloud_threads.send_message` deliveries and accept both compact and indented delegation envelopes.
## Testing
Expand integration coverage for app, TUI, and cloud-thread deliveries, contextual replies, and budget-driven omissions. Assert that sender user and assistant context stays out of the delegated agent's prompt.
GitOrigin-RevId: 4eca369cbb30241635273f729dec81b78ea57faf
## Why
The asynchronous matcher can return results for the previous query while a new query is still running. Labeling those results with the latest query produces a mismatched search snapshot.
## What changed
Only report a file search snapshot when its pattern atoms match the currently requested pattern. Extract snapshot conversion into `snapshot::for_query`, which skips pending results from an older pattern.
## Testing
Add a regression test that changes the query from empty to `bet`, verifies that the old snapshot is withheld, and checks that the completed snapshot contains `beta.txt` with the expected match indices and counts.
GitOrigin-RevId: 01b62b822db69e15480d3233b66ec55c45646fad
## Why
`codex exec` and the TypeScript SDK need a way to request a Cyber access program for an individual turn. Resuming with an API key can also leave compaction using a saved program that the current credentials cannot access.
## What changed
- Add `--cyber-access-program` with `standard`, `daybreak_blue`, and `daybreak_red`, and expose the equivalent `cyberAccessProgram` turn option and `CyberAccessProgram` type in the TypeScript SDK.
- Apply explicit selections to new, resumed, and prompted fork turns. Override automatic Daybreak selection for that turn without changing the saved choice. Reject the flag for review and forks without a prompt.
- Filter Cyber programs by the built-in OpenAI provider when starting turns and restoring previous-turn settings for compaction.
- Allow previous-model compaction fallback with API-key authentication, comparing both model and program so a program change can trigger a retry with the current pair even when the model is unchanged.
## Testing
Add CLI help, argument parsing, exec, and SDK coverage for per-turn selection and unsupported commands. Extend core tests for API-key compaction retries, denied explicit selections, custom-provider filtering, remote compaction, and WebSocket response reuse.
GitOrigin-RevId: 586f25b621924f3bc509c9a39b39fe2020ff9cd2
## Why
Forcing `approval_policy` to `never` on temporary structured threads can trigger configuration warnings when managed requirements allow only `on-request`. These hidden threads also need to reject unexpected interaction requests without prompting the user.
## What changed
Inherit the app server's approval policy when starting temporary structured threads. Reject their server requests before dynamic tool handling or interactive TUI routing.
## Testing
Extend regression tests to verify inherited `on-request` approval without approval-policy warnings, and error responses for recap-thread approval and user-input requests even when the thread is marked active and primary.
GitOrigin-RevId: 2d0a071d3687742c83ba933a7ef1357feea53403
## Why
Deserializing keybindings through an untagged enum hides the specific validation error, making invalid `tui.keymap` settings harder to diagnose.
## What changed
Deserialize single keybinding strings and lists by value type so validation errors reach the user. Errors now retain the reason a binding is invalid and the affected configuration key, including when loading configuration for `codex mcp list`.
## Testing
Add TOML regression tests for unknown keys, invalid chord strokes, and overly long chords in both string and list forms. Add a CLI snapshot test verifying that `codex mcp list` reports the invalid keybinding reason and configuration key.
GitOrigin-RevId: 26e3dea93fc43db21e993ea5cf93df53ce93a43e
## Why
Executor skill reads need to use the environments and permissions captured for the current step, including newly approved grants. Cached continuation pages must remain bound to the filesystem and permissions that produced them.
## What changed
- Supply borrowed `EnvironmentAccess` to turn-input contributors and extension tools, with session and originating-turn grants already applied.
- Require executor skill reads to use filesystem access from an environment available to the callback, and replace separate optional read contexts with `SkillReadContext`.
- Bind skill pagination snapshots to `EnvironmentAccessKey`, which identifies the source filesystem and callback permissions.
- Route image-generation filesystem operations through the same accessor.
## Testing
Extend skill-read integration coverage to verify that a denied reference becomes readable after a turn-scoped grant is captured by the next model step. Update Windows coverage to verify that restricted reads fail when the executor cannot enforce a sandbox, and add a test requiring turn environment selection before exposing capability roots.
GitOrigin-RevId: 825b49302319965835d61c77fc5bcdb951e10543
## What changed
Replace the separate `WorldStateSection::snapshot` method with a typed `SectionTransition` returned by `render_diff`. Snapshot updates and model-context fragments are independently optional; omitting a snapshot preserves the stored comparison state.
Update all section implementations to use this contract, skip snapshot updates for unchanged sections where applicable, and cache the multi-agent usage-hint fingerprint.
## Testing
Adapt world-state and context-history tests to the combined return value, including an assertion that unchanged permissions return neither a snapshot nor a context fragment.
GitOrigin-RevId: 79c1977a87481009ff193ea4cce4546be87458fe
## Why
Background code-mode cells can continue running after a new turn starts. Looking up grants and strict review requirements through the active turn can make those cells lose their approved access or use another turn's permissions.
## What changed
- Keep turn-scoped grants and strict review state in `TurnContext`, retained by captured steps and background cells.
- Record permission responses against the requesting turn, including requests made after a later turn starts.
- Share live session-scoped grants across turns while keeping turn-scoped grants isolated.
- Use the originating turn's permissions and review requirements for tool execution, patches, MCP calls, file uploads, and terminal input.
## Testing
Add regression coverage for background cells retaining grants across turn changes, turn versus session scope, permission requests after the next turn starts, and strict review enabled while `write_stdin` is queued.
GitOrigin-RevId: 641502fbfd43553c2c42424d4aaa53ae8020c850
## What changed
Remove personality from TUI turn commands and cached thread session state, and stop applying personality from thread settings notifications. Send no personality override in `turn/start` requests.
Forward `personality` through session configuration only when explicitly supplied as a CLI override, rather than deriving it from the effective local configuration.
## Testing
Extend configuration override coverage to verify that `personality = "none"` is forwarded only when supplied through CLI overrides.
GitOrigin-RevId: bd3c3bacc90e0561016c0cac557eb1b0e50d32c0
## Why
Startup presentation needs client preferences before thread initialization establishes effective execution permissions. The startup header should not infer permission state from local configuration.
## What changed
- Load `LocalSettings` directly from bootstrap TOML, preserving preference defaults and overrides, accessibility settings, and audio settings that exclude project layers.
- Use those settings for first-frame presentation and pass `LocalSettings` plus the working directory to the startup draft instead of a full `Config`.
- Stop showing the YOLO indicator in the startup header while execution permissions are unknown.
## Testing
Update tests to compare bootstrap settings with resolved configuration, verify first-frame keybindings and paste preferences with an unresolved permission-profile parent, and snapshot the configured startup header. Adapt startup editor tests to the settings-based interface.
GitOrigin-RevId: f33cf8f42c53a9ddcbe0273491b5a849da9e6808
## What changed
Replace `https://chatgpt.com/codex/settings/usage` with
`https://chatgpt.com/settings/usage` in usage-limit errors, the `/status`
card, and backend banner actions. Credit purchase actions retain
`?credits_modal=true`.
## Testing
Update error-message assertions, banner action tests, status hyperlink
assertions, and TUI snapshots to expect the new URL.
GitOrigin-RevId: 1e1db971284a25a781120da30a6dea5ff9c3d957
## What changed
Add a selectable `daybreak` item to the status line and terminal title, including setup previews and terminal-title validation. Display `Daybreak on` when enabled for the thread and `Daybreak off` otherwise, including during side conversations.
## Testing
Add coverage for on/off rendering and side conversations, update setup preview snapshots, and verify that terminal-title diagnostics accept `daybreak`.
GitOrigin-RevId: b0b7a6f0ee0a107ba4ee2d56113a5b9b6ebd1d41
Adam Perry @ OpenAI