## What changed
- Make `/copy` select the latest completed response directly in the owned transcript. Navigate user messages, code blocks, and blockquotes with arrow keys or `j`/`k`, use `g`/`G` to jump to the ends, and press Enter to copy or Escape to close.
- Highlight selected blocks and keep surrounding context visible during navigation and resizing. Preserve source payloads for code and quotes, including rendered Mermaid diagrams and fenced Markdown tables.
- Pause queued submissions until copy mode closes, and report clipboard results in the transcript footer.
## Testing
Add tests for copy routing, keyboard navigation, highlighting and resize behavior, source whitespace and line endings, clipboard completion, and queued-input resumption.
GitOrigin-RevId: bd4f58ec17568f95d0e91014e5ddba33ca8bd57c
## What changed
Allow accounts using an API key with the OpenAI provider to access `/daybreak` and Daybreak policy notices. Model availability and the connected server still determine program access.
Use the same eligibility checks for turn submission, continuation, and retries. For API-key accounts, send the selected `cyberAccessProgram` when Daybreak is enabled and omit it when Daybreak is off.
## Testing
Extend session lifecycle coverage to check API-key turn parameters with Daybreak enabled and disabled. Add an API-key `/daybreak` help snapshot and update the signed-out error snapshot.
GitOrigin-RevId: ab6d4313c430f316ef9835d4facb878aab0b9725
## What changed
Keep Markdown link destinations attached to prompt and last-message previews in the agents overview details pane as text wraps and is clipped. Render visible links as terminal hyperlinks, while keeping truncation ellipses unlinked.
## Testing
Add a regression test and snapshot covering links that span multiple rows, prompt links, and clipped previews with unlinked ellipses.
GitOrigin-RevId: d121e062b197790ce45a70d6d64aadcb181e4dde
## Why
Paginated history previously persisted completed commands' full `aggregated_output`, allowing large command outputs to inflate stored history.
## What changed
- Limit persisted command `aggregated_output` to 64 KiB, including a truncation marker. Preserve the beginning and end of the output without splitting UTF-8 characters.
- Apply the shared persistence policy to rollout recording, thread-store appends, and legacy-to-paginated history migration.
- Measure persisted payload bytes after truncation so persistence metrics reflect the stored representation.
## Testing
Add coverage for the byte limit, UTF-8 boundaries, unchanged inputs that fit, and markers that exceed the budget. Verify capped output in paginated thread history and migrated legacy history, and verify persistence metrics use the truncated payload size.
GitOrigin-RevId: 01d420d396ad34b42dc5dc208c0bf88d890639ee
## Why
Streamed `response.failed` events can carry retry advice in `response.error.headers`. Ignoring it loses server-provided delays or uses a conflicting delay from a rate-limit message.
## What changed
- Parse nested `Retry-After` headers using the existing HTTP header validation and retry parser, and preserve them for rate-limit, overload, and generic retryable failures.
- Prefer valid headers over rate-limit message advice, falling back to the message when the header is absent or invalid. Keep terminal error classifications unchanged.
- Reject unrepresentable plaintext retry durations without panicking.
## Testing
Add regression coverage for header precedence, validation, and terminal errors, plus retry-loop coverage for SSE sampling, remote compaction, and WebSocket failures.
GitOrigin-RevId: 46433c2e9e6d5e804211ef96950fadd70e322b49
## What changed
Label the `/new` and `/fork` picker options “Use current Git worktree” and “Create new Git worktree”. Explain that creating a worktree makes a separate checkout of the repository in another directory.
## Testing
Update picker assertions and snapshots for both commands to cover the revised labels and description.
GitOrigin-RevId: b7fb1aac3107e39c324707f9ae69c210a97346d7
## What changed
- Remove `stdout`, `stderr`, and `formatted_output` from `CommandExecutionItem` and `ExecCommandEndEvent`, retaining `aggregated_output` as the output field.
- Update command event producers, legacy conversion, rollout traces, and the precomputed schema. Use aggregated output for terminal trace results.
- Clear `interaction_input` in emitted and migrated command completion items.
## Testing
Update command execution and trace tests to use aggregated output, and assert that legacy rollout migration preserves `aggregatedOutput`.
GitOrigin-RevId: ed59827d4a5ec9a767084ee4feac72c2042440f2
## Why
Transcript scrolling hardcoded `PageUp` and `PageDown` to full-page movement, ignoring customized pager bindings.
## What changed
Resolve unmodified `PageUp` and `PageDown` through the pager's scroll bindings so they can scroll by a full page, half a page, or one row, or remain unbound. Preserve the one-row overlap for full-page scrolling and leave pager typing shortcuts unhandled by the transcript.
## Testing
Add a regression test and snapshot covering default, half-page, single-row, and unbound configurations. Verify that `PageDown` reverses `PageUp` scrolling and that `j` and `Ctrl+u` remain unhandled.
GitOrigin-RevId: 945e99d7370f84f326ab71037be2924dddada32c
## Why
Transcript selection can consume a configured composer shortcut such as `ctrl-space`, preventing it from submitting a prompt or steering a running turn.
## What changed
Let explicitly configured shortcuts for active actions take precedence over transcript key handling when no transcript interaction is active. Include global binding fallbacks, while preserving empty `Enter` returning to the latest transcript content and default `PageUp` scrolling.
## Testing
Add regression coverage for `ctrl-space` submission with idle and running turns, default `PageUp` scrolling, and empty `Enter` returning to latest with composer or global submit bindings.
GitOrigin-RevId: 16613043a7634b47fd24e4ee9feacdce94a9fabd
Set `OAI_RCODESIGN_ARM64_16K_CODE_PAGES=true` to pass
`--arm64-16k-code-pages` when signing with `rcodesign`. The option is
disabled by default.
GitOrigin-RevId: ee7d4992f89a8fe2eb355fb2516a0188e7583812
## Why
If required MCP startup outlasts the requesting connection's cleanup, the newly created thread can remain loaded without subscribers because its listener is never started.
## What changed
Start the thread listener even when the requesting connection has already closed, allowing normal idle unloading to clean up the thread while preserving the `ConnectionClosed` result.
## Testing
Add a regression test that disconnects during blocked required MCP startup, then releases startup and verifies a `thread/closed` notification, an empty `thread/loaded/list`, and MCP process exit on Unix.
GitOrigin-RevId: 4ad912a82177266316042d806f5faa1713a48fa4
## Why
GNU Screen truncates Unicode in OSC titles to a byte, which can turn visible characters into control bytes and spill title text into the terminal.
## What changed
Detect Screen through `STY` and convert the full terminal title to printable ASCII. Map activity spinners and the status dot to ASCII equivalents, and replace other non-ASCII content with `?`. Keep Unicode titles outside Screen and preserve Unicode in TUI status rendering.
## Testing
Add coverage for ASCII title output with activity indicators and Unicode names, preserved Unicode outside Screen, and removal of control and invisible formatting characters.
GitOrigin-RevId: e6b45b9be0d06ab3c3eece89885647f3e9db17da
## What changed
Remove `initial_messages` from `SessionConfiguredEvent` and the corresponding schema. Stop attaching replay history to startup events for resumed or rejoined threads, and remove `InitialHistory::get_event_msgs`.
## Testing
Update the MCP resume test to verify persisted tool events through `load_history`, and retain coverage that resumed requests include prior conversation items.
GitOrigin-RevId: 54b72bc44423c9b1ef2051891ef392c0ede32fe5
## Why
Hook system messages were rendered as plain text, leaving ANSI formatting uninterpreted.
## What changed
Parse hook system messages into styled spans so colors and text styles render across lines. Preserve hook prefixes, continuation indentation, and trailing blank lines.
## Testing
Add a snapshot test for multiline ANSI styling and style resets, and extend multiline coverage to include a combining character and a trailing newline.
GitOrigin-RevId: 0a5a88ec26fac114fc66efa656bacf6fa15a1adf
Return a clone immediately when the current path is not a prefix of any
registered legacy config key. This avoids recursively visiting unrelated
subtrees while preserving alias normalization along matching paths.
GitOrigin-RevId: 1c7e62898e12ab3f468b978f865805989914ac44
## Why
Closed WebSocket connections previously triggered immediate reconnects, and successful handshakes reset backoff even when connections were short-lived.
## What changed
- Delay automatic reconnects before token refresh or enrollment, and report `Connecting` while waiting.
- Use exponential backoff with jitter between half and all of the delay, starting at 5 seconds and capped at 30 seconds.
- Retain backoff across short-lived connections and reset it after a connection lasts at least 60 seconds.
- Interrupt the reconnect delay on shutdown, auth owner invalidation, or enable/disable changes, including an immediate disable/enable pair.
## Testing
Add connection tests for delayed token refresh, backoff retention and reset, explicit re-enabling, and prompt shutdown. Update retry tests to check jitter bounds, saturation during sustained failures, and backoff retention after a successful handshake.
GitOrigin-RevId: 0b9055ff64ff7d96f2d974b73ced8d4ffd02ac9e
## Why
Cached subagents can remain in the TUI picker after being archived, including when archive notifications are missed.
## What changed
- Hide archived threads from the picker and keyboard navigation, and restore them when unarchived.
- Refresh both active and archived descendants to reconcile cached visibility, including after dropped server events. Queue a follow-up refresh when needed and preserve visibility changes received during an in-flight refresh.
- Preserve picker selection by thread ID as visible rows change, and mark archived thread attachments as replay-only.
## Testing
Extend regression coverage for missed archives, unarchive notifications, hidden subagent navigation, and the subagent enable prompt when only archived subagents are cached.
GitOrigin-RevId: 9e75906dfe6946b1400583a386922453e2b77ea1
## What changed
Add an MCP integration test that forwards sandbox state from tool-call metadata unchanged to `codex sandbox --sandbox-state-json` and runs a real subprocess.
Verify that workspace writes succeed, overwriting an existing file outside the workspace fails and preserves its contents, and relative paths resolve against `sandboxCwd` rather than the MCP server's working directory.
GitOrigin-RevId: 768513c74679010e806a62dffdde6b7cccbfb41f
## What changed
Record `agree`, `disagree`, or `unavailable` comparisons between Decisions risk classifications and accepted Responses scores. Emit paired latency histograms only when both backends succeed, and include request preparation and queue time in Decisions duration. Report unavailable comparisons when the comparison feature is enabled but the Decisions sampler is not initialized.
## Testing
Extend lifecycle coverage for an uninitialized Decisions sampler, checking skipped outcome and unavailable comparison metrics while preserving the baseline score.
GitOrigin-RevId: f11789ab5d5fd6957b7913d849bbb2ae7006d3ed
## Why
A hung tmux command or a descendant holding stdout open can block terminal input setup indefinitely.
## What changed
Run tmux option probes on a worker thread with a shared one-second deadline, returning default input options when the wait times out. Prevent overlapping probes and kill and reap commands that exceed the deadline.
Capture stdout in a temporary file so completed commands do not wait for descendants to close it, and read at most 4 KiB of output.
## Testing
Add Unix regression tests for successful output, killing and reaping a timed-out command, and returning promptly when a descendant keeps stdout open.
GitOrigin-RevId: a5a4c9323a3e18d1baada5ab1cf3734ce6a9403a
## What changed
Replace the rename field with a single-line `TextArea` that honors configured editor bindings and the composer's Vim setting. Start renaming in insert mode and support Vim Escape recovery on legacy terminals.
Strip carriage returns and newlines from titles and pasted text, keep Vim linewise pastes inline, and scroll horizontally at grapheme boundaries to keep the cursor visible.
## Testing
Add single-line editor coverage for newline filtering, Vim commands, repeat edits, and inline yanks. Extend command-center tests to cover Vim renaming across status-filter changes and cursor placement in narrow layouts.
GitOrigin-RevId: 8d320d6b6de9f77e18292169418383929ca6ceda
## Why
Windows Terminal forwards `Ctrl+Insert` when its Copy action has no native terminal selection. Recognize this shortcut so it can copy text selected within Codex.
## What changed
Add `Ctrl+Insert` to the shared copy-key detection used by transcript and composer selections. Use the same detection for transcript input ownership so the selection consumes the shortcut before other input handlers.
## Testing
Extend transcript tests to verify `Ctrl+Insert` input ownership and copying. Extend composer tests and snapshots to verify that failed or unconfirmed copies preserve the selection, while confirmed copies clear it without changing the draft or cursor.
GitOrigin-RevId: 5a33c72cff4c4395511779a7051fc92f8bd5e5d7
## What changed
Add `tui.mouse_scroll_speed` as a finite positive multiplier for transcript mouse wheel scrolling, including transcript overlays and session previews. Change the default from three rows to one row per wheel event; set the multiplier to `3.0` to retain the previous speed.
Fractional values accumulate movement across events and discard the remainder when direction reverses. For example, `0.5` scrolls one row every two events. Following the latest output pauses only when a whole row moves.
## Testing
Add tests for configuration validation, integer and fractional scroll speeds, direction changes, decimal accumulation, and following behavior. Extend local settings coverage to include a command-line override for the new setting.
GitOrigin-RevId: d355e246fd943415f0ce5a6affe849f77f3615e6
## Why
Table holdback kept completed tables and subsequent content mutable until the response finished. Releasing completed tables earlier also requires a final scrollback reflow when late reference-link definitions change previously emitted content.
## What changed
- Release table holdback once the containing top-level Markdown block is stable, rescanning the remaining tail for later tables.
- Track completed-block boundaries across incremental and full renders.
- Request scrollback reflow at answer completion when reference-link definitions are present, including definitions pending without a trailing newline.
## Testing
Add regression assertions and snapshots for completed tables entering scrollback while later tables remain mutable, and for late reference-link definitions resolving correctly at completion. Cover reflow requests with and without a trailing newline and reference handling with inline visualizations enabled.
GitOrigin-RevId: a6b2aac74496281495b53840bbb1daf06bef60d2
## What changed
Add `configured TUI mode` to the configuration details in human-readable and JSON doctor reports. Report `fullscreen` when `tui.fullscreen_transcript` is enabled and `scrollback` when it is disabled.
## Testing
Add an integration test covering both configuration values in JSON output and update the human-readable report snapshot to include the mode.
GitOrigin-RevId: beb62ddfa62a3516a64b5a69d5a41b257434f5d5
## Why
Account-update notifications include authentication mode and plan information but
omit the email, causing `/status` to lose the signed-in account's email after an
update.
## What changed
Fetch the ChatGPT account email asynchronously after account updates, with a
30-second timeout, without blocking terminal input. Apply the result only if its
request ID is still current, invalidating pending results on subsequent account
updates and disconnects.
## Testing
Extend the account-update test to verify that the email is restored and a stale
result is ignored. Update the status snapshot to include the account email and
plan alongside credits and limits.
GitOrigin-RevId: 202421f78f3d6a7b373194f9c65d1c22d70a04c1
## What changed
Allow the issuer `https://mcp.mercadopago.com/mcp` to use authorization endpoints on `https://auth.mercadopago.com` and token endpoints on `https://mcp.mercadopago.com` without issuer-bound callbacks. Remove the previous Figma exception.
## Testing
Update the provider-exception test to accept the Mercado Pago combination and reject lookalike issuer hosts, unrelated token hosts, and HTTP issuer and token URLs.
GitOrigin-RevId: 3838c7e4c32d6a2022f0011d6020e383035fe67f
Teach the issue labeler to suggest `dots` for issues about setting up
ChatGPT dots or managing their ongoing work. Exclude these issues from
the generic `agent` fallback.
GitOrigin-RevId: 6950c1bbde3aaf7f050e64484658f4ed1e4ae6e8
## What changed
Advertise `fileWriteStreaming` and support `fs/open` with `mode: "replace"` to create or truncate a file for writing. Implement `fs/writeBlock` with explicit offsets and nonempty chunks of up to 1 MiB, rejecting ranges beyond the signed 64-bit file offset limit.
Apply write sandbox permissions when opening writable handles, including when full-disk reads are allowed. Keep `read` as the default open mode.
## Testing
Add integration coverage for positional writes, chunk and offset bounds, replacement truncation, read/write handle permissions, and sandbox write restrictions. Verify that duplicate handle IDs and exhausted handle capacity reject replacement opens without creating or truncating files.
GitOrigin-RevId: 696ee6437dd5f5b69d5a7667dddea0ff44472094
## Why
Local secrets storage pulled in the unmaintained `proc-macro-error2` through `age` and `i18n-embed-fl`, requiring an exception for `RUSTSEC-2026-0173`.
## What changed
Upgrade `age` to `0.12.1` and update the Cargo and Bazel lockfiles. The updated dependency chain uses `proc-macro-error3`, allowing removal of the advisory exception from both `cargo-audit` and `cargo-deny` configuration.
GitOrigin-RevId: 7e18dec4d71d9260512f54fbfe71dbe4e6ee8a5d
## Why
The per-connection limit of 128 file read handles was checked only after opening the file, leaving pending opens outside the limit.
## What changed
Reserve a semaphore permit before polling the file-open future, counting pending opens and registered handles against the same limit. Release capacity when an open fails or is cancelled, or when a handle closes, even if a read still retains the file.
Use synchronous handle-table locks that never cross an await, and recheck duplicate IDs after opening to preserve the winning handle during concurrent opens.
## Testing
Add tests for stalled-open progress, pending-open admission limits, permit cleanup after failure or cancellation, capacity reuse while a file remains in use, and concurrent duplicate IDs.
GitOrigin-RevId: caabf38c74dda5951f2fc75234a7149daaa01263
## What changed
Expose `create_worktree`, `get_worktree_creation_status`, and `list_worktrees` through MCP when the worktrees feature is enabled for a trusted local project and attachment storage is available. Support both embedded and local daemon sessions.
Create worktrees asynchronously and attach them to the requesting task, with ownership and attachments retained across restarts. Default to the repository's remote default branch unless `ref` is supplied. Keep the task's working directory and execution environment unchanged, and leave uncommitted source changes in place.
Reject creation in ephemeral side conversations and explicitly untrusted source projects, reuse pending operations, and reject configured MCP servers that conflict with the TUI tools namespace.
## Testing
Add integration and model-request snapshot coverage for creation, polling, listing, attachment persistence across restart, task isolation, trust checks, namespace conflicts, and worker failure reporting.
GitOrigin-RevId: b6a57e92cf5f6fc51fd6d4028543d6fabaf5ac49
## Why
Permission shortcuts checked local configuration while the picker used the connected server's catalog and requirements. Shortcuts should respect the same server restrictions, including model-specific auto-review requirements.
## What changed
- Share a cached server catalog between the permission picker and shortcuts. Show the loading picker when no catalog is available and reuse an outstanding fetch.
- Clear the cache on session, account, working-directory, or connection changes.
- Give discovery RPCs distinct request IDs for each fetch and profile page so repeated requests after timeouts do not collide.
## Testing
Add coverage for loading and catalog reuse, managed permission restrictions, and refetching after disconnect. Update timeout coverage to verify that repeated discovery attempts use distinct IDs and each reports a timeout.
GitOrigin-RevId: 7d79874294136bfe3a654bb306eb7caf36d4df1e
## What changed
Add `codex tcp-tunnel --diagnostics-json` to emit versioned, newline-delimited JSON diagnostics on stderr. Records classify startup, CONNECT, transport, and control failures without exposing credentials, addresses, headers, or raw error messages. Rejected CONNECT records may include a validated `http_status`.
Distinguish terminal failures from recoverable stream and transport events, flush terminal records before returning a generic error, and preserve stdout readiness and credential acknowledgments. Keep human-readable diagnostics as the default and document the version 1 schema and consumer fallback rules.
## Testing
Add tests for bounded output, error-chain suppression, terminal flushing, control error classification, CONNECT status validation, legacy behavior, and flag parsing. Extend the reconnect test to exercise a rejected CONNECT followed by a successful connection in JSON mode.
GitOrigin-RevId: 350f67fe8e3f313e8a6d3bb0fd891952b77647fd
## Why
When Codex runs on Unix and launches a stdio MCP server on a Windows executor, explicit remote environment variables activate an allowlist based on Unix defaults. This can filter out Windows runtime and temporary-directory variables.
## What changed
Include `SYSTEMROOT`, `TEMP`, and `TMP` in the remote environment allowlist whenever explicit remote variables are requested.
## Testing
Extend the environment-filtering test to verify that `SystemRoot`, `TEMP`, and `TMP` survive alongside requested variables while unrequested secrets remain excluded.
GitOrigin-RevId: 059c9e23833be66aaf5b65ba5f95013f94f0f792
## What changed
Add `CodexThread::current_turn_model` to return the model slug selected for the named running turn's next step, independently of settings for future turns. Return `None` when the turn ID does not match, the task is cancelled, or the turn is no longer running.
## Testing
Extend the step-settings test to verify that the accessor ignores model changes for future turns, reflects active-turn model updates, and returns `None` for a mismatched ID or a completed turn.
GitOrigin-RevId: 2cae7c07fa761ed4d64befaa3419a2f9bce4b161
## What changed
Add `codex-cloud-client`, a reusable Rust client for `ThreadService.Resume` and live `ThreadService.Attach` over HTTP/2. Callers supply the native gRPC origin, bearer token, account ID, and `HttpClientFactory`.
- Reuse shared proxy, custom CA, and network policy handling for HTTPS. Reject redirects and allow plaintext HTTP only on direct loopback with unrestricted, unmanaged policy.
- Preserve notification and server-request protobuf payloads as opaque bytes and expose native gRPC status details while redacting credentials, payloads, and error details from diagnostics.
- Bound resume and attach setup to 150 seconds without retrying requests or imposing an idle deadline on live streams. Attach ends on its first error and provides no history or automatic reconnect.
- Select Rustls in `HttpClientBuilder::http2_prior_knowledge()` so HTTPS advertises `h2` through ALPN.
Include a standalone attach example and documentation of admission semantics and stream behavior.
## Testing
Add HTTP/2 fixture tests for protobuf framing, authentication metadata, status trailers, event preservation, malformed responses, stream cancellation, redirect rejection, and diagnostic redaction. Add checks for unsafe origins, network policy restrictions, and TLS `h2` advertisement.
GitOrigin-RevId: 55db70438bb5e59272c6995c67a46ced5fa28ff4
## What changed
Move the voice connection spinner into shared helpers in `codex-rs/tui/src/motion.rs`, keeping its 100 ms animation cadence and static reduced-motion glyph. The helpers handle frame scheduling, and `loading_glyph_with_delay` supports hiding the animated spinner until a specified delay expires.
GitOrigin-RevId: c4ebe5e6a33239999aab2f4432c9145432c8f4fd
## Why
Long drafts need to remain browsable while leaving room for the transcript. Remote image attachments also need to leave an editable prompt row visible.
## What changed
- Cap the fullscreen composer, including padding and hints, at two-thirds of the screen, with a minimum of eight rows when the screen allows.
- Support mouse-wheel browsing without moving the caret or changing transcript selection, search, or activity focus. Show arrows for hidden prompt rows and hide the cursor when the caret is offscreen.
- Resume caret following on editor input, paste, and external edits.
- Keep the selected remote image visible while reserving space for prompt text.
## Testing
Add regression tests and snapshots for fullscreen scrolling, caret restoration after navigation, paste and external edits, remote image navigation and deletion, resizing at scroll boundaries, and disconnected editing.
GitOrigin-RevId: 9a1e4ce14b3b3747e6d136207546327531339258
## What changed
Move footer property construction, mode resolution, hint overrides, quit shortcut hints, and custom footer height calculation from `chat_composer.rs` into `chat_composer/footer_state.rs`. Preserve existing behavior and expose the moved helpers to the parent module where needed.
GitOrigin-RevId: 4a23753ac1648352ab19d4bcc3da9f368c48f619
## What changed
Add the disabled-by-default `guardianv2_decisions_comparison` feature to run Decisions alongside Guardian V2 snapshot classification using the same policy and evidence. Initialize the comparison sampler with `CODEX_GUARDIAN_DECISIONS_API_KEY`.
Publish the baseline score before awaiting comparison results, and keep comparison results and failures from changing approvals. Apply Guardian's input token budget, skip conversation evidence, and cancel comparison work when the baseline classification is superseded. Record success, failure, and skip outcomes with bounded diagnostic reasons, including setup failures.
## Testing
Add lifecycle tests covering disabled comparison, disagreeing classifications, backend failures, unchanged published scores, matching policy and evidence, and rejection of over-budget requests before either backend sends them.
GitOrigin-RevId: 743d34c8ee440362da94f001058366027b39bd11
## Why
`thread/attachment/list` lists attachments for a known thread. Clients also need to find the threads associated with a given attachment identity.
## What changed
Add `thread/attachmentOwner/list` to return owning thread IDs and archive status for an exact `attachmentType` and `identityKey`. Support cursor pagination and an optional `archived` filter, including both archived and non-archived threads by default.
Wire the request through the thread store and update documentation, protocol schemas, and generated TypeScript and Python types. The lookup is limited to the configured thread store and reports current membership, not an atomic resource-cleanup check.
## Testing
Extend app-server integration tests to cover exact type-and-key matching, multiple owners, archive filtering, and invalid cursor rejection.
GitOrigin-RevId: 30f4a20e00243d0023246d465a9b95213b3adeb6
## Why
Reloading an unloaded root from a surviving child can supply the shared instruction wrapper already registered for that root. Replacing its underlying provider with that same wrapper makes instruction loading recurse into itself.
## What changed
Reuse the existing wrapper without replacing its provider when both are the same `Arc`. Continue to accept distinct replacement providers.
## Testing
Extend regression coverage to reload the root from a surviving child and verify that shared instructions still update. Check wrapper reuse, replacement with a distinct shared provider, and freezing the shared snapshot when switching to a provider that does not share with subagents.
GitOrigin-RevId: 7b6b2f9031f206e203f6fa14e1478a36b305ec39
## Why
Unread queue-only messages prevented idle agents from unloading, and sending a
message to an evicted agent reloaded its session. Pending mail should not require
an idle recipient to occupy a loaded thread slot.
## What changed
- Retain queue-only mail in an in-memory runtime mailbox when a session unloads.
Queue new messages for locally evicted agents without reloading them or
starting a turn.
- Add `AgentControl::take_mailbox` and `AgentControl::watch_mailbox` so sessions
can consume retained mail and react to host mailbox notifications.
- Preserve message order across eviction, reload, and subsequent follow-ups.
Keep agents with outstanding durable sleep or turn-triggering mail loaded,
and discard retained mail when an agent is removed or its tree shuts down.
## Testing
Add integration coverage for retaining mail across eviction, sending while
unloaded, and ordering messages around a follow-up after reload. Add a host
controller test verifying that mailbox notifications wake `wait_agent` and
that the message is delivered exactly once.
GitOrigin-RevId: 4b55647f9ee9d1aaf3753f0688863bda81617327
## What changed
Add `StateRuntime::list_thread_attachment_threads` to find threads by exact `attachment_type` and `identity_key`, including threads without previews. Return thread IDs and archive state, with filters for all, archived, or non-archived threads.
Order results by thread ID and bind pagination cursors to the attachment identity and archive filter. Add a database index on `(attachment_type, identity_key, thread_id)` to support the lookup.
## Testing
Add coverage for exact identity matching, archive filters, pagination, rejection of cursors reused with different lookup parameters, and membership updates after attachment removal or thread deletion.
GitOrigin-RevId: 21f32eb0cb1845a82d740d67b374080b6e12eb03
## Why
Subagents spawned without forked history do not receive their parent's client-defined dynamic tools, preventing them from using those tools for delegated work.
## What changed
Add the disabled-by-default `multi_agent_v2_dynamic_tools` feature flag. When enabled, fresh V2 subagents inherit the parent's dynamic tool definitions and persist them in session metadata.
## Testing
Add coverage for V1 and V2 feature gating, tool persistence, and a fresh V2 subagent calling an inherited tool and receiving its result without inheriting parent history. Update TUI assertions and a snapshot to reflect blank-line separation and question text in recovered answers.
GitOrigin-RevId: a17a16bf5570f54ce922c1521cffb883022354f2
## What changed
Add a Decisions sampler under `#[cfg(test)]` for Guardian's optional comparison classifier, without wiring a runtime caller.
- Encode text and inline image evidence as a `guardian_risk` choice request using `gpt-6-luna`, accepting only `low` or `high` responses. Reject the complete request when evidence cannot be represented.
- Bound concurrency to 16 requests, cancel the oldest unfinished request at capacity, and abort unfinished work when its owning task is dropped.
- Enforce a six-second HTTP deadline, an 8 MiB inline image data limit, and a 16 KiB response limit. Keep credentials and wire bodies out of errors.
## Testing
Add tests for the HTTP contract, unsupported evidence, inline image preservation and size limits, response validation, oldest-request cancellation, and capacity release when a caller is dropped while awaiting completion.
GitOrigin-RevId: e7209ca49a04505acf10ff1aeaca941514589e13
## Why
Bubblewrap consumes and closes the file descriptor for each `--ro-bind-data` mount. Reusing one descriptor across multiple file masks prevents the sandbox from starting.
## What changed
Open and preserve a separate `/dev/null` descriptor for each empty-file mask.
## Testing
Extend unit tests to verify distinct descriptors for multiple denied files and missing-path masks. Add integration coverage for exact-path and glob deny rules, checking that the sandbox starts, denied files remain unreadable and unwritable, and allowed files remain accessible.
GitOrigin-RevId: 85158c83699afd36bb7aca453b2652d777cf65e4
## What changed
- Centralize `windows-sys` at version `0.61.2` in the workspace and migrate dependent crates to it.
- Adapt Windows API calls to the updated handle, boolean, and type definitions. Replace custom handle owners with `OwnedHandle` and use `BorrowedHandle` where ownership stays with the caller.
- Add explicit wrappers for non-owning Windows handles passed between threads.
## Testing
Enable the MCP refresh cleanup test on Windows. Retain process handles to verify that a superseded MCP server stays alive during an in-flight call, exits after cancellation, and leaves the replacement running until shutdown.
GitOrigin-RevId: 86f53d9b300d13edff7154f4a7c32e34dacd2919
## What changed
Update `post_sampling_token_estimate_is_disabled_by_always_on_sinks` to register explicit event metadata with the subscriber and assert that its interest is `never`. This replaces the scoped default subscriber and global interest-cache rebuild with a direct check of the configured logging layers.
GitOrigin-RevId: 7c4ecd9c4adef148fd222394ad1ad326e8033d95
Benjamin Carlsson