## What changed
Update `extra_policy_reaches_guardian_review` to expect a retained user
instructions section before the transcript, including the source-order notice
and the original user request. Adjust the subsequent snapshot item numbers.
GitOrigin-RevId: 9e57f9bb7cdc9318787d083bf4350143a1353287
Verify that unsubscribing from a message board thread remains effective
after posting to that thread and resuming the session. The runtime test
checks that replies from a child agent produce no `CHANNEL_POST` notices
while unsubscribed and that explicit resubscription restores delivery.
Use gated streaming responses to keep the recipient active during each
reply and drain worker completion messages before checking notices.
GitOrigin-RevId: fe2695a46722a94e6fca86a3d3bd49c0b8bb7ee7
## What changed
Mark `guardianv2.thread_context` as stable and enable it by default for synchronous and asynchronous Guardian reviews. Keep it independent of the Guardian v2 `enabled` toggle and preserve explicit configuration and profile overrides. Update the configuration schema documentation to match.
## Testing
Update coverage for default configuration and sender user messages, review prompt snapshots, history retention across compaction, and checkpoint provenance. Assert that later user input invalidates an in-flight review's authorization. Keep legacy transcript budgeting coverage by explicitly disabling thread context in that test.
GitOrigin-RevId: 19afd34d7bfc0ee36bbf878089c68b732a21bc6a
## What changed
Add a V1 spawn regression test that removes the child from the thread manager during startup, before spawn reports its settings. Verify that the completed spawn event retains the role-configured model and reasoning effort, nickname, and role even when the child can no longer be looked up.
Also verify that the child receives its initial input with the effective settings and the parent receives a successful spawn result.
GitOrigin-RevId: 5e94e3ddb0feda0eaaa86e7539ef8c6720176f88
## Why
Remote compaction v2 excluded descendant progress messages from retained history but kept `CHANNEL_POST` messages from those same agents.
## What changed
Treat descendant `CHANNEL_POST` messages like `MESSAGE` progress updates when selecting history to retain after remote compaction v2.
## Testing
Extend the remote compaction test to verify that a child channel post is included in the compaction input and omitted from the follow-up request.
GitOrigin-RevId: 204bf44b8cddf1e6dc1e48234f51d4ac2aaf2e9f
## Why
Accepted inter-agent messages can still be waiting in the submission queue when a worker appears idle. Evicting that worker can lose the queued work, while cancelling an eviction caller can leave shutdown unfinished and allow delivery to a closing runtime.
## What changed
- Pin V2 recipients until queued submissions are handled or dropped, and verify that delivery targets the registered runtime.
- Move `Submission` into core so it can carry the residency guard through queue handoffs.
- Give eviction exclusive access to each runtime and keep it counted against capacity until removal. Run teardown in a separate task so it completes even if its caller is cancelled, and remove registry and residency entries together.
## Testing
Add a regression test covering queued follow-up delivery, eviction refusal while mail is pending, cancelled eviction completing teardown, rejection of late delivery, and capacity reuse after removal.
GitOrigin-RevId: d6de3d68cb6b911942e9ddfc05c65b3741b796b2
## Why
Channel and thread subscriptions, or explicit `agents_to_notify`, could cause agents to receive notifications for their own posts.
## What changed
Exclude the author from notification recipients, even when explicitly targeted. Preserve the author's subscriptions so replies from other agents still reach them, and document this requirement in the board API.
## Testing
Update board tests to cover explicit self-targeting, subscribed authors, and delivery of other agents' replies. Update the model-context scenario and snapshot to verify posts remain searchable without a `CHANNEL_POST` self-notification.
GitOrigin-RevId: 0b2558e7df79122a6da06ad592f9735ba260cce1
## Why
MCP requests pass through background transport queues, so HTTP requests need the caller's trace context carried explicitly to preserve trace ancestry.
## What changed
- Capture W3C trace context in request metadata for tool and resource operations, custom requests, and event streams.
- Restore that context in an `mcp.http.request` span around HTTP POSTs, linking outgoing HTTP traces to the originating request.
- Preserve application metadata while replacing trace fields with the current caller's context and removing stale `tracestate`. Read the SDK's merged metadata so extension fields retain precedence over parameter metadata.
## Testing
Add a unit test for metadata merge precedence and an integration test covering concurrent paginated requests, tool calls, custom requests, and tool-call continuations across legacy and `2026-07-28` protocol modes. Verify HTTP trace ancestry, metadata preservation, and removal of stale `tracestate`.
GitOrigin-RevId: 0b22cd75f31f9fcb855b27fa8d34ecdffd6e3549
## Why
Standalone web search selected a proxy route only for the initial endpoint. Redirect destinations can require a different system proxy route.
## What changed
- Add `RouteAwareClientPool` support to `ReqwestTransport` for both buffered and streaming requests, and use it for standalone web search.
- Preserve default Codex headers and Cloudflare cookie handling across routes, while retaining the default client behavior when route-aware handling is disabled or Codex is sandboxed.
- Share request construction so URL authentication and header precedence follow `reqwest` semantics, applying them once before redirects and TLS retries.
- Map route-aware failures to transport errors and remove request URLs from those errors.
## Testing
Add regression coverage for redirects through distinct proxies, preservation of POST bodies and default headers, URL authentication and header precedence, and transport error classification without URL leakage.
GitOrigin-RevId: 19a10a62118846db09dd95265dc277e54aac09ef
## Why
Injecting context before the first turn currently forces a full flush. Stores need a preparation checkpoint that can leave disposable context in memory, while local storage must keep prepared context durable before the first user input.
## What changed
- Add `PersistContext::ThreadPreparation` and `CodexThread::checkpoint_preparation()`, and use the checkpoint in `inject_response_items()`.
- Allow stores to defer rollout-derived metadata writes through `record_thread_metadata()`, including during preparation and execution checkpoints. Keep standard metadata updates synchronous.
- Flush local storage at preparation checkpoints so injected context survives restart.
## Testing
Add tests showing that preparation and first sampling can proceed without waiting for durable metadata. Cover prepared context in first and follow-up requests, plus durability before first input and restoration after restart, in both legacy and paginated history modes.
GitOrigin-RevId: 74f6bb1a5f8d47192364b8bba6afd703a3b7d688
## Why
Reaching the pending tool-call limit could evict finished empty cells even though removing them frees no pending-call capacity. This loses the metadata needed to certify an empty tool-call inventory on a later `wait`.
## What changed
Only evict cells with pending calls when reclaiming pending-call capacity. Keep empty cells eligible for eviction when a cell slot is needed.
## Testing
Extend recorder coverage to check empty inventories under pending-call pressure in fresh and resumed sessions. Add a code-mode integration test verifying that `wait` serializes an empty inventory with `tool_calls_complete: true` while another cell has filled the pending-call budget.
GitOrigin-RevId: 559d0b4fdc9864c42a90b7d087eb2a3327272d5c
Refresh the collaboration namespace hash and aggregate tools hash in the
`code_mode_catalog_messages` snapshot.
GitOrigin-RevId: bcfb793ba379760219cb4214d39f9c8bcd01e40c
## Why
Standalone web search used a default HTTP client, bypassing the configured system proxy route when `respect_system_proxy` was enabled.
## What changed
Pass the configured `HttpClientFactory` to the web search tool and create its client asynchronously for the provider's search URL using the API route policy. Export and reuse `SEARCH_ENDPOINT` so route selection and search requests use the same endpoint.
## Testing
Add an isolated regression test with environment proxies removed and a mock system proxy. Verify that standalone web search reaches the proxy and returns its result in the follow-up model request.
GitOrigin-RevId: 3b64803a777b9d1eb0ccf694e06658b0fd562129
## What changed
Remove `ultrafast` from the bundled `gpt-5.6-sol` model's `service_tiers`, leaving `priority` (Fast) as its only advertised service tier. Update scenario snapshots for the affected multi-agent tool definitions.
GitOrigin-RevId: 9a235d8f7ea8a72e71152708d2d602194256d420
## What changed
- Add `auto_review.extra_policy` and the managed `guardian_extra_policy` requirement to supply policy text alongside the resolved tenant policy. Nonblank managed values take precedence; blank values are ignored.
- Render the additional text through `{{ extra_policy }}` in Guardian reviewer templates and append it to the tenant policy for Guardian v2 classification before truncation.
- Preserve placeholder-like text inside supplied policies literally.
## Testing
Add coverage for configuration precedence, blank values, template substitution, and classifier prompts, plus a scenario verifying that managed tenant and extra policies reach the Guardian reviewer together.
GitOrigin-RevId: 180d8d716c63fe96a92ec5bfbd22db4ddccd4f1f
## Why
Attachment stores need the receiving thread ID to support thread-based placement.
## What changed
Add `thread_id` to `UploadRequest` and pass the session's thread ID through image preparation for messages and tool outputs. Include the ID in debug output while continuing to redact attachment bytes.
## Testing
Extend the image rollout test to assert that a new image uploaded after resume carries the resumed session's thread ID. Update the debug-output test for the new field.
GitOrigin-RevId: f81e3bd761dca704064287177b8ecd7175662f07
## What changed
- Add `tools.code_mode` catalog messages for `exec`, `wait`, deferred-tool guidance, and shared MCP TypeScript definitions.
- Render `{{ default_exec_yield_time_ms }}` and `{{ image_helper }}` in `exec` descriptions while preserving runtime tool declarations and the freeform grammar.
- Resolve `wait` descriptions and parameter schemas independently, falling back to bundled parameters for invalid or unsupported schemas.
- Use the active model's Code Mode messages, including after mid-turn model changes. Missing overrides retain bundled defaults; empty text overrides suppress the corresponding text.
## Testing
Add coverage for literal template substitution, runtime section preservation, independent `wait` overrides and fallback behavior, mid-turn model changes, and a yielded cell completing through `wait` with catalog messages.
GitOrigin-RevId: e542a0cd47a7138a414871192cee47790ed1214e
## Why
Remote plugin requests always sent `OAI-Product-Sku: codex`, ignoring the existing `apps_mcp_product_sku` setting.
## What changed
Pass `apps_mcp_product_sku` through plugin configuration and use it for authenticated remote plugin requests, including discovery, search, installation, and sharing. Keep `codex` as the default and include the SKU when comparing remote service configurations.
## Testing
Extend app-server plugin listing and core agent-turn tests to check default and configured SKU headers. Update the CLI worktree test to wait for the user prompt's model request, skipping background title generation requests.
GitOrigin-RevId: 508c9ef9aa3e41b87c92383c3088eb1eb9227fd8
## What changed
- Capture optional `creator_user_id` and `creator_account_id` from authentication when creating a thread, including forks.
- Carry these fields through thread storage, rollout metadata, and a SQLite migration. Leave them absent when unavailable or when reading older threads.
- Preserve recorded creator values across resume and metadata updates. On revert, recover missing rollout values from SQLite before writing replacement metadata.
## Testing
Add coverage for ChatGPT and API-key sessions, resume under another account, forks using current authentication, metadata extraction and upserts, and repeated reverts after creator fields are removed from a rollout.
GitOrigin-RevId: 9839fa42f9392f12226002e2c27d05d5656f5695
## Why
Code Mode callbacks can retain skill tools after another turn becomes active. Looking up the active turn when a delayed skill invocation completes can lose access to the originating turn's metrics and metadata.
## What changed
- Capture and retain the originating `SkillTurnMetrics` when constructing skill analytics.
- Expose turn analytics metadata through the turn extension store and carry it into skill telemetry.
- Add optional turn metadata to `TrackEventsContext` and pass it from app, skill, and plugin usage call sites.
## Testing
Add a regression test that yields a Code Mode cell, starts another turn, and releases both skill reads through a shared barrier. Assert that each `skill_invocation` event retains its originating `turn_id`.
GitOrigin-RevId: aa629dd5f84563d558aa6a86bfbdfc356f1b98e4
## Why
Realtime WebSockets connected directly, bypassing the configured proxy policy for Voice's WebRTC sideband.
## What changed
Pass the configured `HttpClientFactory` into `RealtimeWebsocketClient` and connect through the shared `WebSocketConnector`. Add support for supplying an existing Rustls configuration to preserve custom CA handling and Windows platform trust.
## Testing
Add an integration test that enables `respect_system_proxy`, starts a WebRTC conversation, and verifies that the sideband establishes its session through an HTTP `CONNECT` proxy and closes successfully.
GitOrigin-RevId: d974c9275d7fe29f388d56a9d5d8ce0c483eb8d0
## What changed
- Describe GPT-5.6-Sol as a reliable agentic workhorse for everyday tasks and change its catalog `priority` from `6` to `4`.
- Describe GPT-5.5 as a proven previous-generation model for coding and general work.
- Refresh model picker, migration prompt, and agent tool snapshots to reflect the catalog updates.
GitOrigin-RevId: b39f51c22862b8cef585ed76f3973c9f4b670c27
## What changed
- Record each MCP source and its first turn, including connector and plugin identifiers when available. Cover direct and Code Mode calls, including returned errors and results that are not printed.
- Persist cumulative attribution checkpoints and restore them across compaction, resume, and forks, including forks limited to recent turns.
- Attach fresh attribution to Responses API `client_metadata` under `mcp_attribution`, outside model-visible content. Restrict transmission to allowed OpenAI HTTPS destinations for both HTTP and WebSocket requests.
- Report `attribution_error` for legacy history without checkpoints, malformed or conflicting attribution, and serialized attribution exceeding 16 KiB.
## Testing
Add coverage for source deduplication, checkpoint persistence and restoration, recent-turn forks, direct and Code Mode calls, destination filtering, and the serialized size limit.
GitOrigin-RevId: fd285e152ca9e24bfa000debb20013709d67a86e
## Why
Concurrent credential refreshes could restore a removed environment by overwriting the selection list with stale state. Unpolled snapshot futures could also keep pending configuration alive after an environment was removed.
## What changed
- Protect environment selections with a mutex and update them in place to serialize selection changes, configuration refreshes, and connection listener setup.
- Capture only selection metadata and resolution futures in snapshots so they do not retain pending configuration senders.
## Testing
Add regression tests for removal during credential refresh and cancellation while an unpolled snapshot is held. Strengthen the pending attachment integration test to check that `wait_for_environment` returns the expected environment ID and `ready` status.
GitOrigin-RevId: c6f933e8d3031b05335ddcfed00ab400aa5bad2a
## Why
Message board notifications exposed only post and thread IDs, requiring a read to see any post content.
## What changed
Deliver notifications as `agent_message` items with author and recipient attribution. Include a `CHANNEL_POST` payload with the sender, channel, message and thread IDs, and up to 150 characters of post text. Direct agents to `read_post` when the preview is truncated, and retain recognition of legacy user-role notices.
## Testing
Update the model-context scenario to assert the notification's author, recipient, and preview payload, and update the idle-agent scenario to check for the new notification format.
GitOrigin-RevId: e0e2794be82e38bba47f41fb4fc8128eb5e47619
## What changed
- Replace the built-in orchestrator skill provider with a host-supplied cloud provider, using `cloud` authority and `c` root aliases in skill tools and prompts.
- Add `cloud.skills.enabled`, defaulting to true but requiring a supplied provider. Keep `orchestrator.skills` accepted as a legacy no-op setting, and remove the app server's automatic orchestrator provider registration.
- Discover cloud skills once per turn during cancellable startup. Serve catalog snapshots to prompts and tools without triggering discovery or retries.
- Scope cached catalogs and resources to authentication state. Preserve them on refresh failures within the same scope, invalidate them when that scope changes, and reject late discovery or read results from replaced cache generations.
- Reuse executor discovery catalogs only when successful discovery inputs and bundled-skill settings match.
## Testing
Add coverage for per-turn refresh, skill removal, same-account failures and reconnects, authentication changes, and stale in-flight results. Update configuration and tool tests for cloud authority, provider gating, and resource reads without an executor.
GitOrigin-RevId: c57e38ec7dcc880c0d4c8a2995adfd3e28301079
## Why
`TurnComplete` precedes active-turn cleanup, so injecting follow-up history immediately afterward can race with cleanup.
## What changed
Register the `ThreadIdle` lifecycle contributor in `review_preserves_user_instructions_until_request_budgeting` and wait for the thread to become idle after the initial and follow-up turns.
GitOrigin-RevId: 1ae6c80593a71d331c5c6ddf85bbe10822a68afe
## Why
Guardian can lose a confirmed User Messaging message from its parent context when a `PostToolUse` hook blocks the result or is cancelled. The message has already been sent and remains relevant to interpreting the user's authorization.
## What changed
Capture confirmed message text after input-rewriting hooks in shared per-call state before awaiting post-tool processing. Attach that evidence to the response metadata even when dispatch returns a blocked or aborted result, while keeping post-tool hooks cancellable. Calls cancelled before delivery confirmation contribute no message evidence.
## Testing
Extend Guardian subagent authorization coverage to verify retained messages after post-tool hook blocking and cancellation, and their absence when cancellation precedes delivery confirmation.
GitOrigin-RevId: 9abb7959980eada20d0fb5c0b3a4a8669e4cd0a3
## Why
Extension tool calls eagerly copied and converted conversation history even when the tool never read it.
## What changed
Retain a shared invocation-time snapshot and defer conversion to raw response items until `ConversationHistory::items()` is called. Cache the result across clones with `LazyLock`, and keep debug formatting from triggering materialization. Release unrelated history metadata when capturing the shared items.
## Testing
Extend the extension executor test to verify that history first read after a later turn still reflects the invocation-time snapshot, in both legacy and paginated history modes. Update the history API test to check that shared items preserve their envelopes.
GitOrigin-RevId: c737b765b7e4889735dc78e12d685d36e854570b
## Why
Guardian's retained root context appended assistant messages after user evidence and omitted questions sent through User Messaging. This could leave subagent authorization reviews with missing or misplaced conversational context.
## What changed
- Record assistant messages and function calls in the same order sequence as accepted user inputs, then merge retained review context by recorded position while prioritizing user evidence within the message budget.
- Capture bounded User Messaging text after input hooks when a send succeeds, and match it to the original call for assistant context.
- Label assistant context without a recorded position explicitly and clear parent assistant and tool positions when forking agent history.
- Clarify that recorded order does not establish delivery order or pair ordinary replies with questions; assistant messages remain untrusted context.
## Testing
Add coverage for hook-rewritten messages, failed or unconfirmed sends, queued replies with delayed tool results, ordering across resume, and removal of inherited assistant positions from forked history.
GitOrigin-RevId: ac717cf0f5efe4b05c18f2d8370dd48453ac4e35
## Why
Message-board tools hardcoded the `collaboration` namespace and used a different namespace description from the multi-agent tools. This ignored custom namespace configuration and caused conflicts under strict tool collision checking.
## What changed
- Use `multi_agent_v2.tool_namespace` and the shared multi-agent namespace description for message-board tools, resolving the namespace at runtime startup.
- Support unnamespaced tool specifications when no namespace is supplied.
- Remove hardcoded `collaboration` prefixes from message-board notifications.
## Testing
Add app-server integration coverage for the default `collaboration` namespace and a configured `agents` namespace with strict collision checking enabled. Verify that both tool families are advertised together and that `get_channels` executes through the installed extension.
GitOrigin-RevId: fef7be51ea2a84bbdb6d3491606db442ed4e6ea3
## What changed
- Register the existing message-board tools with the app server through a lifecycle extension, gated on `agent_message_board`, multi-agent v2, and non-ephemeral sessions. The new feature flag is disabled by default.
- Bind tools to each agent's identity and share the SQLite-backed board across the agent tree and runtime resumes.
- Use the runtime clock for posts and deliver ID-only notifications to running agents, with tools to retrieve post contents. Skip inactive recipients without starting them or queuing notices.
- Emit a warning and leave board tools unavailable if initialization fails.
## Testing
Add runtime scenarios and a context snapshot covering feature gating without creating storage, posting and searching, active-only notifications, sharing with child agents, persistence across resume, and clock failure without channel creation.
GitOrigin-RevId: a81bd85cd372b0d122ba375ed1a1bfd3ba3a3b7c
## Why
Tool allowlists alone cannot express the reviewer's sandbox and shell restrictions, which previously depended on session identity. Threads need to supply these restrictions explicitly at startup.
## What changed
- Replace `AllowedTools` with `ToolPolicy`, combining an optional allowlist with managed-sandbox requirements, unified-exec requirements, and control over additional-permission arguments.
- Capture the policy once at startup and apply it during tool registration and construction, including hosted tool filtering. Later extension-state changes cannot relax it.
- Supply the reviewer policy explicitly while retaining the fallback for reviewer sessions without a supplied policy. Explicit policies take precedence over session identity; ordinary defaults preserve existing tool setup.
## Testing
Update tool-planning tests to use explicit policies and add startup coverage for additional-permission schemas, ordinary defaults, reviewer fallbacks, explicit-policy precedence, and policy capture despite later extension-state changes.
GitOrigin-RevId: 71e561d76ea24d961f5b29c7c619bdb1356c216a
## Why
Native `openai/userVerification` requests need to carry optional `_meta` to clients for extension-specific presentation.
## What changed
- Accept optional metadata objects with the same validation as MCP elicitation.
- Restore metadata from the MCP request context, excluding `progressToken`, and forward it through `mcpServer/elicitation/request`.
- Update protocol types, schemas, and documentation while retaining support for requests without metadata. Challenge bytes and acceptance proofs remain unchanged.
## Testing
Add coverage for metadata validation, transport context restoration, and protocol round trips. Extend MCP integration tests to check that verification metadata reaches the client.
GitOrigin-RevId: 5d04004244cf33effac675c19e543157c48d1504
## Why
MCP requests requiring user input previously failed in subagents with guidance to ask the parent agent, blocking browser sign-in, form input, and interactive tool approval in the child thread.
## What changed
Remove the root-only MCP elicitation guard and `allow_user_interaction` plumbing so subagents can surface prompts and wait for responses under the existing approval policy and automatic review rules. Connector authentication can now return retry guidance after acceptance or preserve the original failure when declined.
Keep legacy tool approvals through `request_user_input` restricted to the root thread.
## Testing
Update unit and integration coverage for subagent prompt resolution, form responses, connector authentication acceptance and decline, automatic approval, strict review, and approval-policy updates on reused connections. Update the browser sign-in scenario snapshot to show the subagent continuing after an accepted response.
GitOrigin-RevId: c226fc6dfde724ed22b91dc04dd32bbc15245bee
## Why
Orphaned output mappings and pending calls from finished cells can exhaust recorder capacity, preventing fresh code mode calls from attaching complete executed tool call metadata.
## What changed
Reclaim output mappings without remaining cells when the mapping limit is reached. Under cell or pending-call pressure, evict finished cells without output mappings, invalidate their retained completion markers, and release their pending-call count. Preserve the cell being registered and keep late records until capacity pressure requires cleanup.
## Testing
Add regression coverage for preserving existing cells and late partial records under mapping pressure, and an integration test verifying that a fresh code mode call carries its executed calls, cell ID, and completion marker after orphaned mappings fill the recorder.
GitOrigin-RevId: 8894d1283a962088fbf8cad60078cc0cd07aaf17
## Why
Shared thread instructions can change after an action is generated but before Guardian reviews it. Polling the live provider during review can give the reviewer different instructions from those applied to the action.
## What changed
Initialize Guardian reviewers with the user and thread instructions captured in the review session reuse key, keeping the review tied to the applied snapshot.
## Testing
Add a regression test that updates and removes shared instructions between action generation and review in a running descendant thread. Verify that the worker picks up each change, Guardian uses the applied instructions, and instruction changes create new reviewer sessions even while ancestor threads remain idle.
GitOrigin-RevId: 4980762bc7b6646a1691a43be93c71a7dc611ec6
## Why
Subagents inherit applied instruction snapshots, so later provider updates do not reach running descendants. Hosts need an explicit way to share current thread instructions across an agent tree.
## What changed
- Add `ThreadInstructionsProvider::share_with_subagents()`, defaulting to `false`. Opted-in descendants refresh instructions at their next model-request boundary.
- Retain shared providers across root unloads and descendant reloads. Let a resumed root replace the provider for surviving descendants, or preserve their last shared instructions when it supplies a non-sharing provider.
- Keep providers scoped to their root tree and preserve snapshot-only instructions for root forks and isolated sessions, including Guardian reviews.
## Testing
Add coverage for child and grandchild instruction updates and clearing, provider replacement after root restart, lazy descendant reloads, default snapshot inheritance, and isolation between roots and Guardian sessions.
GitOrigin-RevId: 44c9fb7fe9ae1f96156bdf3c47ab6c4a81bd65e9
## What changed
- Support an optional cloud provider alongside executor plugins, refreshing its thread-scoped catalog at each regular turn when plugins are enabled.
- Use cloud connector metadata for app attribution without starting cloud-declared MCP servers.
- Scope cached catalogs to authentication and Apps availability. Retain the previous catalog on discovery failure within the same scope, clear stale catalogs on auth changes, and reject results completed under outdated credentials.
- Add a cancellable regular-task startup phase that reconciles MCP before discovery and reapplies contributor state afterward without invalidating resource caches.
## Testing
Add regression coverage for per-turn refresh, empty catalogs, discovery failures, plugin disabling, auth changes during discovery, MCP reconciliation and cancellation, and cloud app attribution alongside executor MCP tools.
GitOrigin-RevId: 8469eb109ea316e21cbc4122c52ad8000caeef03
## Why
When a selected environment is unavailable, permission fallbacks can use the turn's initial environment and workspace roots. Daemon recovery can also miss a local environment that finishes starting after the turn begins.
## What changed
- Resolve fallback permissions from thread defaults using the captured selection's workspace root URIs, including when setup is starting or has failed.
- Apply this resolution to Guardian reviews, permission instructions, and sandbox context selection.
- Capture daemon recovery from the latest step inputs and refresh environment readiness before checking recovery eligibility.
## Testing
Add regression tests for Guardian resolving project-root restrictions against an unavailable captured environment's workspace and for daemon recovery including a local environment that finishes starting during a turn.
GitOrigin-RevId: c76d83d786fdc9c444b78ecbc335b02a20805c58
## Why
Providers need to serve Codex model metadata independently of their inference endpoint. A custom inference `base_url` alone should not opt API-key sessions into remote catalog discovery.
## What changed
- Add `model_catalog_url` to provider configuration and thread-config serialization. Fetch the full catalog URL with provider authentication, headers, query parameters, and `client_version`, while preserving inference routing.
- Require an explicit catalog URL for API-key discovery with a custom base URL. Keep default OpenAI discovery on the Codex backend, and apply `api_key_model_discovery` gating to provider API keys and cached catalogs.
- Include the catalog URL in cache identity so different catalogs do not share cached metadata.
- Limit explicitly configured catalog responses to 1 MiB, reject redirects, and suppress URL and response diagnostics that could expose credentials.
## Testing
Add coverage for catalog configuration round-trips, query encoding, authentication and header reuse, cache identity and discovery gating, oversized responses, and redirect rejection without credential forwarding. Add an integration test verifying that catalog model metadata and instructions reach conversation requests.
GitOrigin-RevId: 7f6ac5eec257278685e1867a6bcebae6514a365a
Remove the obsolete `windows_sandbox_private_desktop` field from the
`EnvironmentConfig` initializer in the active-turn environment fallback test
so it matches the current struct definition.
GitOrigin-RevId: 4441dc8ed3d4bfcd4c1de093e829c065d323f41a
## Why
Background processes can outlive their launching turn. Their approval reviews need the originating environment's filesystem restrictions, even when the active turn uses a different environment. Remote restrictions must also be resolved using executor paths rather than the local filesystem.
## What changed
- Capture settings and environment selections together in `StepInputs`. Preserve the captured selection during active model updates while allowing environment startup to finish.
- Carry environment IDs into Guardian network and `execve` requests, and use the owning process's environment with current review settings. Refresh environment readiness for network requests that fall back to the active turn.
- Resolve remote denied paths and globs using the executor's policy context. Decline automatic approval when the request's environment is unavailable or an explicitly denied temporary directory cannot be resolved.
## Testing
Add regression coverage for active model updates retaining their environment while the next turn adopts a new selection, background approvals using their owning environment, newly ready network environments, and remote denied paths and globs, including Windows paths and missing temporary-directory metadata.
GitOrigin-RevId: b620d4b030c597a4f430fe0500864fa5469db3d4
## Why
An executor can renew its registration while retaining its Noise identity. Connection refresh must distinguish registrations even when their keys match, and a stale registry lookup must not retire a session that recovery has already renewed.
## What changed
- Track the installed session's registration and expose it through `Environment::cached_executor_registration_id()` without connecting. Publish registration changes only when the new connection is installed.
- Require both registration and executor key to match before refresh reuses a session. Retry stale lookups and prevent recovery from installing a connection after retirement.
- Pin session recovery to the original Noise key while allowing registration renewal to preserve the session and running processes.
- Expose `CodexThread::active_turn_environment_selections()` so hosts can authorize steering against the active turn's selections, including starting and failed environments, independently of later settings updates.
## Testing
Add regression coverage for registration replacement, renewal with a running process, stale refresh lookups, missing sessions, and rejection of changed Noise keys. Extend active-turn tests to check selection snapshots across settings updates, deferred startup, and turn completion.
GitOrigin-RevId: 4395bc6c57f137691887e6585f52dcc5b958101c
## What changed
- Remove the private-desktop opt-out from elevated and unelevated Windows sandbox launches.
- Remove `windows.sandbox_private_desktop` and its managed requirement and API fields. Warn users to remove the obsolete setting.
- Require a private desktop name when launching through the Windows sandbox wrapper and command runner.
## Testing
Add coverage for the obsolete-setting migration warning and update wrapper tests to verify a live private desktop is passed and a missing desktop name is rejected.
GitOrigin-RevId: c7135f8d211aac8d812180691c2c1e433d77cde4
## What changed
Add a public, object-safe `AgentControl` trait and request/response types for coordinating an agent tree independently of where its threads run. Define contracts for lifecycle operations, message delivery, status observation, execution admission, usage accounting, shared configuration, and guardian evidence.
Move shared agent types out of the local controller and export them from `codex-core`. Let `AgentExecutionGuard` own a backend-provided reservation while preserving the local limiter's release-on-drop behavior. Include `root_thread_id` in `GuardianRootSnapshot` to identify the source of authorization evidence.
## Testing
Add tests for reservation release when a guard is dropped or a turn is cancelled, and extend the guardian authorization test to assert the root thread identity. Check trait object safety at compile time.
GitOrigin-RevId: 9385c9fbfd189f08429539fd89061ef8c9efe0d9
## Why
Recording response items in an initialized thread builds a turn context without starting a turn. Running host skill discovery for that context is unnecessary.
## What changed
Use a dedicated context build mode that skips host skill discovery for history injection. Preserve full discovery for initial context creation, startup prewarming, and execution. If compaction clears the reference context during preparation, rebuild a full context before initializing history.
## Testing
Add a regression test verifying that initial injection discovers skills, subsequent injection records items without discovery, and a real turn still discovers skills and sends the selected skill body and both injected messages to the model.
GitOrigin-RevId: 4a64e04eb0f21698f9b47160bfcfe5b6d6a68554
## What changed
Add `ToolLifecycleContributor::on_command_start` with `CommandStartInput` carrying the resolved command, working directory, selected executor's filesystem, and lifecycle context. Await contributors after command hooks and environment resolution so they can prepare the filesystem before `exec_command` runs, including calls from code mode.
Reserve process IDs only after preparation completes so cancelled preparation does not consume an ID. Keep deterministic process IDs from being reused after removal.
## Testing
Add tests for direct and code-mode calls that verify callbacks receive hook-rewritten commands and the executor's working directory, filesystem preparation completes before execution, and interrupted preparation prevents execution without consuming a process ID. Add a regression test for deterministic process ID reuse after removal.
GitOrigin-RevId: d10bcafcc583a6e3e8b5924d004806727e3763bb
## Why
Memory consolidation and ephemeral title generation need to use their selected request-level reasoning effort even when managed settings enable reasoning-effort overrides.
## What changed
- Exempt current and legacy memory consolidation sessions and ephemeral `thread_title` threads from reasoning-effort overrides.
- Tag temporary title threads with `thread_title` and keep them excluded from agents overview refreshes. Recap threads retain the `system` tag.
- Preserve override behavior for persisted `thread_title` threads and other ephemeral threads.
## Testing
Extend regression coverage to verify request effort, omission of effort updates from exempt workers' requests, preservation of inherited history, title thread tagging, and overview filtering.
GitOrigin-RevId: 8dbc2eb13509f9c80f90d5798a56ea33fad2a0bc
## Why
Using Responses Lite does not establish whether a model accepts reasoning-effort `configuration_update` items. Unsupported models need to use the selected request-level effort, including when resuming history containing saved updates.
## What changed
- Add `supports_reasoning_effort_updates` model metadata, defaulting to `false`.
- Require the override feature, an OpenAI provider, and explicit model support for reasoning effort updates, independently of `use_responses_lite`.
- Filter saved configuration updates from unsupported requests without changing persisted history.
- Clear the pinned effort baseline when sampling with an unsupported model so returning to a supported model establishes a fresh baseline. Compaction uses the selected effort without clearing the pin.
## Testing
Add coverage for supported models with either Responses mode, unsupported-model history filtering over HTTP and WebSocket, switching to an unsupported model and back, and compaction versus sampling pin behavior. Verify missing capability metadata defaults to `false`.
GitOrigin-RevId: 8a0fbc141964bd854dbcdd6f31e1c8e97697cf22
felixxia-oai