## Why
Host-owned runtimes skip controller rollout-budget accounting. Give hosts an optional callback to account for inference spending and signal budget exhaustion.
## What changed
- Add `AgentUsageAccounting`, `AgentUsageReport`, and `UsageAccountingDecision`, captured at startup and supported by host child spawn reservations.
- Await per-response usage reports with thread and turn attribution, including provider budget units and foreground and background compaction usage.
- Map host exhaustion to `SessionBudgetExceeded` and accounting failures to fatal errors without retrying inference. Preserve the original error for incomplete responses.
- Keep controller accounting unchanged and leave accounting disabled for host-owned runtimes without a provider.
## Testing
Add coverage for usage attribution, child accounting, budget exhaustion, nonretryable accounting failures, incomplete responses, and compaction reporting, including background usage charged once to its originating turn.
GitOrigin-RevId: 887703f50fe882497e4e8cb33259072935ec82e0
## Why
`codex exec --output-last-message` wrote through a pathname after tools finished, allowing sandbox activity to redirect the final write by replacing that path with a symlink. The related risk is described in https://github.com/openai/codex/pull/25956.
## What changed
- Open the destination before starting the agent and retain its handle until the final write.
- Reject symlinks, Windows reparse points, and multiply linked files; verify that the pathname still identifies the bound file before truncating and after writing.
- Propagate output errors so the command fails when the destination cannot be opened or written safely.
- Preserve inherited Unix output streams, FIFOs, devices, and Windows `NUL` support, while avoiding duplicate final answers when human output targets stdout.
## Testing
Add regression coverage for sandbox-created symlinks across consecutive invocations, redirected stdout, delayed truncation, hard links, replaced paths, and Windows stream binding and filesystem identity checks.
GitOrigin-RevId: 4a31bd28a5eb2d0a9e200cb658eb7d19dc93e933
## What changed
Enable `multi_agent_v2` and the new `agent_message_board_mcp` feature to automatically start a temporary, tree-scoped HTTP MCP message board without plugin or endpoint configuration. The MCP feature defaults off and takes precedence over `agent_message_board`.
Share board state across parent and child agents while retaining each caller's host binding. Keep the server alive while participating threads remain, and serialize board tool calls through the MCP server configuration.
## Testing
Extend the HTTP board integration scenario to cover automatic discovery, parent-child message sharing, child subscriptions and posts after the parent unloads, serialized mutations, and absence of a persistent board database.
GitOrigin-RevId: 613183c14b2ab67dfb1aaf3a3abf338376d1cc05
## Why
Pressing `Esc` in the memory reset confirmation could also close the memories settings popup instead of returning to it.
## What changed
Stop forwarding `Esc` to a view's key handler when its cancellation handler has already handled the event, even if the view remains open.
## Testing
Extend the memory reset confirmation test to verify that the first `Esc` returns to settings and the second closes the popup.
GitOrigin-RevId: b842fdaed69a1ac2a6af6fc454e02be2ac8946e6
## Why
Saving a generated title awaited thread metadata reads and name writes in the TUI event handler, delaying its return to keyboard polling.
## What changed
Move automatic title persistence into the background title-generation task. Make metadata reads cancellable and serialize automatic writes with manual renames so a manual name takes precedence, including when an automatic write is already in flight.
## Testing
Extend title tests to check that completion dispatch returns immediately, canceled metadata reads finish, and manual renames wait for in-flight automatic writes. Retain coverage for saving titles to the originating thread after switching threads and preserving existing names.
GitOrigin-RevId: b284a06ca3f0fdcf22fd2fc87b07447f8ab754c0
## What changed
- Skip rendered-row counting during history hydration when there is no row budget or no next item page.
- Return early when checking history insertion prefixes if there is no active cell or the placeholder session header must remain active.
GitOrigin-RevId: 669ebf0ceb0fc01c8a7bfd8d2addbcbb6fc6a364
## What changed
Add `AgentRuntimeOwnership::Host` and an `AgentTurnAdmission` provider so hosts can acquire execution capacity before runtime tasks run, including root turns. Require the provider at startup and retain its execution guard for the task lifetime. Controller ownership remains the default; host ownership skips controller rollout-budget accounting, budget reminders, and subagent roster context.
Keep pending admission interruptible without blocking input submission. Report admission failures through the turn lifecycle, record accepted input before exposing the error, and unwind task setup such as review mode. Preserve recoverable input during suspension. On interruption, skip prompts that still require a `UserPromptSubmit` hook rather than recording them without inspection.
## Testing
Add integration tests for missing-provider startup cleanup, denial and immediate retry, steering during admission, cancellation, execution guard lifetime, submit-hook handling, suspension recovery, and review-mode cleanup. Add a context snapshot verifying retained input reaches the next admitted turn.
GitOrigin-RevId: 9ee85fad2ecfbfb38735bac8ef88888fb179a967
## Why
Deduplicating against optional transcript entries can remove retained instructions or required tool calls even though the optional copies may later be evicted. Elastic instruction caps can also report evidence loss for revisions already delivered in full.
## What changed
- Capture the review's budget policy and use it for feasibility checks, admission, and restoration after compaction.
- Prefer required and protected native messages over optional duplicates, and use only complete, required pending transcript entries as proof of instruction delivery.
- Match elastic instruction duplicates by source revision and discard truncation observations for copies already delivered in full.
## Testing
Extend coverage for compaction recovery under fixed and elastic budgets, required and protected tool-call deduplication, and capped instruction duplicates covered by complete delivery metadata.
GitOrigin-RevId: fe456e645cdba6f782fb16ad582702d3b7ed012c
## What changed
- Consult SQLite before scanning for ancestor rollouts when no prefetched path is available. Validate that indexed paths resolve to managed storage and match the expected rollout ID and owner.
- Fall back to another copy when an indexed rollout is invalid, preserving the indexed copy's error if recovery fails.
- Skip ancestor cutoff validation when resolving history pages, which read projected rows and only need ancestor metadata for lineage bounds.
## Testing
Add regression coverage for indexed archived and compressed rollouts, invalid paths and owners, fallback recovery during context loading and forking, and history paging with an incomplete compressed ancestor.
GitOrigin-RevId: 486afdc8d49c829130b34d1544f325907c67628a
## Why
A fork's inherited history can become unreadable when the preferred ancestor rollout is truncated or has an incomplete compressed frame, even when a usable archived copy exists.
## What changed
- Retry failed ancestor reads using another copy of the same rollout, validating its owner and location before rebuilding the lineage.
- Apply fallback to model-context loading, fork and revert preparation, and paginated history reads. Preserve the original error when no usable replacement exists.
- Validate inherited byte offsets when opening ancestors for consumption, allowing a newer model-context checkpoint to avoid reading an unusable ancestor.
- Limit ancestor materialization to the inherited history boundary while preserving any existing progress beyond it.
## Testing
Add regression coverage for incomplete compressed ancestors, replacement ownership checks, archived-copy recovery during resume and fork, and materialization boundaries. Add an app-server test that cold-resumes a fork and pages inherited turns and items from an archived copy when the active ancestor is too short.
GitOrigin-RevId: 43730c17329ac759f7292b16ddf0d9eb463e3310
## Why
Automatic Git marketplace upgrades can repeatedly check out the same revision only to reject it because its manifest name differs from the configured marketplace name.
## What changed
Cache name mismatch rejections and reuse the error when the configured name, source hash, ref, sparse paths, and remote revision are unchanged. Store the cache outside the checkout without persisting the source URL.
Manual upgrades bypass the cache. Only cache rejections when the checked-out revision matches the queried remote revision and the manifest paths contain no symlinks, since symlink targets can change without a new commit.
## Testing
Add a regression test covering skipped repeat checkouts, manual retries, ref changes at the same revision, and successful recovery after a new revision restores the configured name.
GitOrigin-RevId: 586e6247a18a79563be168ff9da5b30573ecc497
## Why
Host-provided context such as budget reminders can become stale while compaction runs. Replaying a captured value or retaining its comparison snapshot can prevent the next step from emitting a fresh reminder, even when the remaining budget has changed.
## What changed
- Add `WorldStateSectionContribution::without_full_context()` to omit a section's fragment and comparison snapshot from initial and compacted context rebuilds while preserving ordinary step updates.
- Reset comparison state after prefix compaction for sections excluded at either capture or installation, including when their messages survive in the live suffix.
- Include step World State updates when building debug prompt input.
## Testing
Add regression coverage for budget reminders refreshing after remote compaction within the same threshold, unchanged request prefixes within a context window, refreshes with a retained live suffix, and step reminders in debug prompts.
GitOrigin-RevId: ea4456755e16c93b5d16e8c762b26a33f8571a86
## What changed
Register Guardian evidence-board cleanup with the app server's thread store when Guardian V3 is enabled. Leave Guardian storage untouched when the feature is disabled, and report cleanup failures as thread-store errors.
## Testing
Extend deletion tests to cover feature gating, preservation of unrelated boards and a surviving main thread's board, and corrupt-database recovery. Expand message-board tests to verify namespace isolation and persistent deletion markers that prevent later writes.
GitOrigin-RevId: d9119d22607769c92448d0f3cacbbfd03fbdf943
## What changed
Replace `thread_store_from_config` with `ThreadStoreBuilder`, exported through `codex_core` and `codex_core_api`, and migrate callers to the builder.
Allow hosts to register `with_additional_cleanup` for permanent deletion in local stores. The callback runs after successful agent-board cleanup and before rollout deletion, under the existing deletion locks. Document that cleanup must be idempotent and must avoid thread-store operations that reacquire those locks. In-memory stores do not invoke the callback.
Preserve the existing backend selection, startup rollout migration, and compression behavior.
GitOrigin-RevId: f2853d7de06fe12ef29451b204cf9fcbb349c359
## What changed
Add `RealtimeSidebandTransport` and `Op::RealtimeConversationAttachStream` so callers can attach Core to an existing realtime call through bounded JSON channels without opening or reconnecting a socket.
Read events independently of outbound backpressure, enforce a 1 MiB message limit, and drain accepted input on detach or channel closure before flushing the transcript. Pending writes are never replayed.
## Testing
Add transport and Core integration tests covering delegation without a callback socket, stalled output, attachment replacement and detach, channel closure, oversized messages, and preservation of queued transcripts in history.
GitOrigin-RevId: 06b7d1dfe2388054438d72d925e510a959dfe106
## Why
A transient WebSocket failure previously kept the session on HTTP for its remaining lifetime, even if WebSocket connectivity recovered.
## What changed
- Probe WebSocket connectivity in the background during HTTP fallback, allowing a subsequent request to use a ready connection without delaying HTTP requests.
- Verify recovery with a real request and bound its first-response wait to five seconds. Keep HTTP 426 responses and recovery timeouts on HTTP for the rest of the session.
- Keep retries of an HTTP request on HTTP. If a recovered connection fails before output, replay the request over HTTP without consuming its ordinary retry budget; failures after output use normal retry accounting.
- Rate-limit recovery probes and honor `Retry-After` deadlines.
## Testing
Extend integration coverage for successful recovery within a turn, disconnects before and after output, full-context replay followed by incremental WebSocket requests, persistent HTTP 426 fallback, and retry deadlines.
GitOrigin-RevId: 1c139a4bbce1a67442db5622fd70ff0cc8056c9c
## Why
Delegation messages containing `<source_orbit_id>` fail sender provenance parsing, leaving Guardian without the sender's instructions.
## What changed
Accept an optional `<source_orbit_id>` between `<source_thread_id>` and `<input>`, rejecting values containing `<`. Continue to derive sender authority from the source thread ID.
## Testing
Update the cross-host sender context scenario and snapshot to include orbit attribution. The scenario checks that sender evidence reaches Guardian after compaction and rollback without exposing it to the receiving agent.
GitOrigin-RevId: 463b18667384d30297245eedcd0f6bcbf683634e
## Why
After provider setup, new threads could still use the models manager created for the server's startup provider, leaving their default model inconsistent with the model picker.
## What changed
- Build a models manager from the thread's configuration when its provider differs from the startup provider.
- Invalidate the model catalog after successful Amazon Bedrock setup so subsequent model listings reflect the configured provider.
## Testing
Extend Bedrock and GCP setup integration tests to verify that a new thread's model matches the refreshed model listing. The Bedrock test also checks that the thread uses `amazon-bedrock`.
GitOrigin-RevId: 1db30ad040ba97e2f4f31c9e162a2b73af1377fa
## What changed
Eligible interactive launches now start or reuse the shared daemon regardless of `features.daemon_auto_start`. Remote-control daemon eligibility also no longer checks this flag. Use `--no-daemon` to run without the shared background server.
Treat `daemon_auto_start` as removed: ignore configured values with a migration notice, ignore managed requirements with a warning, and hide the flag from experimental feature discovery. Remove its launch telemetry tag.
## Testing
Extend retired-feature requirement coverage and add a migration-notice snapshot. Update CLI and TUI integration tests for daemon startup and explicit `--no-daemon` usage.
GitOrigin-RevId: e0290e5acd4bc0169a0f71c3296c567e46269ce3
## Why
The previous histogram placed post-truncation values just over 4,000 bytes in a bucket ending at 8,000 bytes, obscuring their size near the truncation cap.
## What changed
Use logarithmic boundaries through 4 MiB for `codex.additional_context.value_bytes`, with an explicit 4 KiB boundary near the truncation cap.
## Testing
Add a regression test verifying that post-truncation samples between 4,024 and 4,043 bytes land in buckets ending at or below 4 KiB while preserving their sum and count.
GitOrigin-RevId: af268fc0de3d5ceb648ce51fced3918317f2457a
## Why
`CodexThread::call_mcp_tool` returns only the tool result, so computing attribution and creating a cached runtime binding for these calls is unnecessary.
## What changed
Add `McpRuntime::latest_call_tool_without_attribution` and use it for direct thread calls. Validate the call, wait for server startup, and dispatch through the latest connections without capturing an attribution binding.
## Testing
Extend the runtime binding cache test to verify that a successful call without attribution leaves the cached binding empty. Update the test server to return a successful tool result.
GitOrigin-RevId: 898e655d9a0174ddaf71c390757d6fc9a5a61780
## What changed
Strengthen the execution cancellation test to verify that a session approval wakes a queued request before it is polled again. Assert that the request remains unwoken while the session policy commit lock is held, then receives a wakeup after the grant completes.
Wait for the second request to hold a prompt queue reference and install a counting waker on its semaphore. Share `WakeCount` with the existing manual prompt wakeup tests.
GitOrigin-RevId: c559a7c31385000347cd1c7dace25e84d1099db9
## What changed
Move inline tests for authentication, bearer auth, model endpoints, and providers into dedicated `*_tests.rs` files. Register workspace-routing tests under the `workspace_routing` module and keep test-only imports with the tests.
GitOrigin-RevId: 9ba043c82814e27be63432a0e13a4929dc3ea372
## What changed
- Thread `ContextBudgeting` through synchronous context and image preparation. Elastic mode preserves candidates for later entry capping and allocation; existing reviewer callers continue to use `Fixed`.
- Defer transcript selection, supporting-text caps, and image budget admission in elastic mode while preserving exact planned actions. Mark host framing as protected and distinguish optional user messages from required manual approvals.
- Add `ElasticBudgetConfig` validation requiring section minimums, including fallback policies, to sum to `DEFAULT_MAX_INPUT_TOKENS`.
## Testing
Extend tests for elastic transcript preservation, deferred native tool-call limits, oversized planned actions, image allocation, and section minimum totals above and below the required budget.
GitOrigin-RevId: 46a4605e12e2bab5973097eb1caf5fd99f6640aa
## Why
Connected legacy MCP sessions and HTTP keep-alive connections can retain message-board state after shutdown. Pending board bindings also need cancellation before they can dispatch a tool call.
## What changed
Explicitly close MCP sessions after HTTP drains and track binding factories and handlers until they release their state. Cancel pending bindings during shutdown while allowing already-dispatched board operations to finish. Clarify that `LocalServer::shutdown` waits for cleanup, while dropping the server initiates it.
## Testing
Add regression coverage for shutdown with a connected legacy client, a paused board binding, and an unauthenticated keep-alive connection. Assert that shutdown releases the board host before returning.
GitOrigin-RevId: 7fbc9415e579a21f0c0fcf7bbb7db239b3aea886
## Why
Direct Guardian review rejected recorded `exec_command` calls intercepted as `apply_patch`, even though normal execution could review those patches.
## What changed
Share intercepted patch preparation between execution and direct review so Guardian assesses the verified patch and its approval requirement without applying it.
## Testing
Extend the direct patch review scenario to cover `exec_command` heredocs alongside native `apply_patch` calls, asserting identical live and direct review inputs and no file writes after direct approval.
GitOrigin-RevId: af62cf66a3f01c65a65c15cfad3fc9cdd1f2bf19
## Why
Streaming answers and plans need to wrap to the conversation's allocated width, which can differ from the terminal width. Resizing while reading earlier output should not report new activity unless new output has arrived.
## What changed
Reflow live streams when preparing the owned conversation layout, using its allocated width. Update the observed live revision after presentation-only reflow so it does not trigger `New activity`, while preserving notifications for unseen output.
## Testing
Add regression coverage for streaming answer and plan tables across width changes, including a narrow-layout snapshot, preservation of the reading position, and activity notifications when new output arrives before a resize.
GitOrigin-RevId: a9831c5a1a5ffb7477e7868d4ecca430d6ee50f3
## What changed
- Add `currentAccountOnly` to `thread/list` and `thread/search`, defaulting to `false`, and enable it for TUI history discovery, resume pickers, and task mentions.
- Mark newly created threads as account-scoped and require each recorded creator user or account ID to match the current login. Older threads and threads without creator IDs remain shared; API-key logins continue to see all local history.
- Preserve account scope through resume and revert, including fallback to original rollout metadata when an older binary drops the marker. Forks receive new-thread scope.
- Skip unreadable rollout headers in scoped discovery and filter search candidates before reading snippets. Direct access by thread ID remains available.
## Testing
Add coverage for account matching, shared legacy history, list page refilling, search pagination, API-key visibility, and scope preservation across reverts. Extend rollout lookup coverage to compressed active and archived files.
GitOrigin-RevId: aa374f5e69165be5a71c0716ded1b105f5fb51e0
## What changed
Expose `launch_in_memory()` and `LocalServer` to run a loopback HTTP endpoint with generated bearer credentials. Runners register a shared in-memory board per session through `add_board(session_id, host)`, using `MessageBoardHost` for membership, clocks, and notifications without a SQLite registry.
The handle exposes the endpoint and authorization header for MCP configuration, including plugin endpoint overrides. Dropping it cancels HTTP and MCP sessions; `shutdown().await` also waits for completion.
## Testing
Extend the parent/child HTTP integration scenario to cover the in-memory launcher, plugin endpoint overrides, host-provided timestamps, authentication and invalid identity rejection, and operation without creating a SQLite board database.
GitOrigin-RevId: e1cae295724a35f4eded290ba8a4e19926b98c13
## What changed
Add a `message-board` plugin with connection metadata for the HTTP MCP server. It defaults to `http://127.0.0.1:7777/mcp`, uses `CODEX_MESSAGE_BOARD_TOKEN` for bearer authentication, and marks the server as required.
Document installation and endpoint overrides through `mcp_servers.codex_message_board`. Installing the plugin does not start the server.
## Testing
Extend the HTTP board integration scenario to cover both direct configuration and plugin installation, verifying that a child can post a decision and its restarted parent can discover the same board and read it. Add a plugin context snapshot and include the plugin resources in Bazel test data.
GitOrigin-RevId: d6cf797caaa4dbdcd45114c2ad0a6bd695cf056f
## What changed
- Add `codex-message-board-mcp` to serve discussion tools at `/mcp` through ordinary MCP configuration, backed by the existing SQLite board and a read-only Codex registry.
- Require bearer authentication and validate `threadId` and `sessionId` metadata against persisted agent membership. Support additional allowed HTTP hosts with `--allowed-host`.
- Expose a reusable `serve_http` library entry point and scope retry deduplication to the caller within an MCP session.
## Testing
Add integration coverage for a child posting and its restarted parent reading the persisted board, including reads while a database writer lock is held. Cover invalid tokens, disallowed hosts, missing caller metadata, invalid membership, and startup without an existing registry.
GitOrigin-RevId: 5e3d71eaaf120169e2585acd0b5f84df1b402f00
## What changed
Allow `guardian_review` to assess a final recorded `request_permissions` call without granting permissions. Build the review action using the same permission request preparation as live review, while continuing to reject earlier permission requests in the recorded history.
Return no assessment when the approval policy is `never` or granular policy disables permission requests.
## Testing
Add coverage comparing live and direct permission review inputs, plus tests that disallowed requests return no assessment without contacting the reviewer.
GitOrigin-RevId: cb5935202b0980e657b023f840a0186cea5e0b74
## What changed
Allow `guardian_review` to assess recorded native `apply_patch` calls alongside `exec_command` calls. Use the existing patch preparation and approval logic without applying the patch, and skip assessment when approval is unnecessary.
## Testing
Add coverage that compares direct and live patch review inputs, verifies that an allow decision leaves files unchanged, and checks that writable files skip review without writes or model requests.
GitOrigin-RevId: 8634ad8c00a67bcac9e7930ebf89c02707c3a6f7
## What changed
- Add `model_messages.plugins` overrides for generic usage guidance, selected-plugin hints, and recommendation introductions, with independent fallback to bundled wording for missing or invalid fields.
- Validate text limits and required template placeholders while keeping plugin identities, available capabilities, and eligibility controlled by the client.
- Track generic guidance changes across model switches and session resume, emitting replacement or retirement notices and supporting legacy snapshots and retained history.
## Testing
Add unit and scenario coverage for sparse overrides, literal text preservation, template validation, UTF-8 size bounds, capability filtering, recommendation fallback, and guidance recovery after resume.
GitOrigin-RevId: 148b658c2d8490c9d0dc208addbee1be5342a5f5
## What changed
Add the disabled-by-default `cli_resume_account_check` feature. When enabled for `codex-tui` and `codex_exec`, reject resuming or attaching to a local thread if its recorded creator user or workspace differs from the current ChatGPT account. Return an error directing the user to sign in with the original account.
Carry creator IDs through stored thread metadata and check them before loading resume history. Preserve existing behavior for untagged threads, other clients, and authentication modes without a comparable ChatGPT account.
## Testing
Add integration coverage for account and workspace mismatches, matching accounts, legacy and paginated history, ID and path lookup, and the feature's default and bypass behavior. Verify that switching back to the original account permits attachment to a loaded thread and that creator metadata remains unchanged.
GitOrigin-RevId: a3ab089254703417dde0890a5f8d6326c4cbb75a
## Why
Timestamp-only cursors can skip threads that share the last result's timestamp, including rollout files created in the same second.
## What changed
- Include thread IDs as tie-breakers in time-sorted listing and search cursors, and use them when resuming filesystem scans and database queries.
- Share filesystem sort-key and cursor construction so continuation cursors match the listing order, including filename-based creation times.
- Preserve support for legacy timestamp-only cursors and their existing behavior of skipping ties.
## Testing
Update regression coverage for pagination through filesystem timestamp ties, legacy cursors, thread IDs in database fallback cursors, and search cursors for all time-based sort keys.
GitOrigin-RevId: 455b95452849e6ffe20a27d7bdcec864f2e8135a
## Why
Input accepted while a regular turn was flushing its transcript could miss the final pending-input check and remain unprocessed when the turn completed.
## What changed
Check pending input atomically with closing steer admission. If input was accepted, resume sampling in the same turn while preserving MCP startup requirements, and complete the turn with the updated answer.
## Testing
Add a regression test that pauses the final flush, submits a steer, and verifies that the model receives it exactly once before the same turn completes with the answer to the steer.
GitOrigin-RevId: 193db3ab6916a86e97c3845590598fd8fbe47081
## What changed
Add `modelProvider/config/write` to create custom gateways and patch existing custom gateway, Bedrock, and GCP settings. Return the saved provider using the same safe summary as `modelProvider/list`.
Omitted fields retain their values; explicit `null` clears nullable user overrides. Apply patches through the shared configuration queue with last-write-wins semantics, enforce field editability and validation, and preserve unexposed authentication settings.
Saving leaves provider selection and authentication unchanged. Saving the provider used by `model/list` invalidates its catalog for the next access. Include documentation and generated JSON, TypeScript, and Python protocol types.
## Testing
Add coverage for gateway creation and ID allocation, patch and null semantics, configuration policy enforcement, authentication preservation, and catalog refresh after active-provider edits. Extend Python protocol tests to verify wire round trips and reject mismatched provider IDs or fields.
GitOrigin-RevId: 850fe2c48ef5274944400efb5a859d720179c923
## What changed
- Add `modelProvider/list` to return OpenAI and explicitly configured providers, provider-specific settings, and the selected default provider.
- Report `canEdit` and `canChangeDefault` based on configuration requirements, layer precedence, and whether user configuration is enabled.
- Describe gateway authentication without resolving credentials, and omit endpoint URLs that are unsuitable for display.
- Document the API and update generated JSON schemas, TypeScript types, and Python models.
## Testing
Add app-server tests for provider discovery, authentication modes, unsafe URL suppression, and configuration editability, plus a Python wire-format round-trip test.
GitOrigin-RevId: 8ba26637cd6bdd075e0e815e88aeeb04c53a2364
## Why
`start_or_steer_turn` rejected agent messages, preventing callers from submitting follow-up work through the turn input API.
## What changed
Route `TurnInput::InterAgentCommunication` through native agent message delivery and return `TurnInputSubmission::Accepted`, without implying an immediate turn ID. These submissions request work regardless of `trigger_turn`, retain the recipient's settings, and forward turn-start options.
Wrap plaintext messages with agent context while preserving encrypted content. Reject submissions to idle recipients when the host is draining.
## Testing
Add scenario tests and snapshots covering queued-message ordering, encrypted follow-ups, preemption at reasoning boundaries, and follow-ups arriving before or after a final answer. Extend drain-gate coverage to agent submissions with parent-turn lineage.
GitOrigin-RevId: 92d49465f97bb366babbf1b1bc18a1e8a6c6ed1c
## Why
MCP startup alone should not block `/fork`, and rejecting a fork while foreground work is pending should preserve the draft and its image attachments.
## What changed
- Defer `/fork` draft consumption until dispatch validates the thread state, as for `/review`.
- Allow `/fork` during MCP startup when no user turn or review is pending or running, and clear the composer after validation succeeds.
- Preserve drafts and attachments when these commands are rejected in side conversations.
## Testing
Extend regression coverage for `/fork` and `/review` draft preservation during MCP startup, successful fork dispatch and composer clearing, rejection during an active review, and attachment preservation in side conversations.
GitOrigin-RevId: d152ba6659e4507d8750cb6bd3073d9f8b293538
## Why
Accepting the startup update prompt exits before connecting to an app server, so launch telemetry previously reported `unconfirmed`.
## What changed
Record `app_server_mode=update_requested` when handing off to the updater. Continue recording `in_process`, `local_daemon`, or `remote` after a successful connection, and use `unconfirmed` for other early exits.
## Testing
Extend the launch telemetry test to verify exactly one recording for a connection, an update handoff, or an early return.
GitOrigin-RevId: 10dd29246218e1a86a396ab073305402a0b44d38
## Why
The DotSlash configs require Bazel assets that are absent from the Cargo-only release asset fixture for `0.167.0-alpha.2`.
## What changed
Remove the Bazel outputs for Codex, the Windows command runner and sandbox setup, and provisioned macOS packages from the release configs.
## Testing
Add regression tests using the release asset fixture to verify that every configured output has a matching asset and that missing Codex and provisioned macOS package assets are detected.
GitOrigin-RevId: ed10a56717e0a7c6c566087b64621bd3ff042412
## Why
Live paginated history retains completed assistant text even when summaries only need the latest message. Release older text for threads with persisted history while preserving full resume responses.
## What changed
- Evict superseded assistant text from live turn state while preserving corrected items and the latest assistant message.
- Restore evicted text for full resume responses from prepared history pages, fetching remaining items by ID in bounded batches. Return an error if saved text is missing.
- Only load the active turn when it belongs in the requested initial page, and use the item ID index for targeted history reads.
## Testing
Add reducer coverage for text eviction and corrected messages. Extend running-thread resume coverage to compare full and summary items with live notifications, exercise restoration when the prepared page lacks the active turn, and check missing-text errors.
GitOrigin-RevId: 3229c0cea820f117dc6331312f1e6056a8d1d52c
## Why
BuildBuddy credentials are unavailable for voice release builds.
## What changed
Set `BUILDBUDDY_API_KEY` to an empty string in the Linux, macOS, and Windows voice release build steps so the Bazel wrappers use their local configuration.
GitOrigin-RevId: 69e47d6b6077fbb74b5895eacbe587766345b7ec
## What changed
Add `BackendSessions` helpers to name the displayed listening backend, find the first listening backend, and cycle through listening backends in registration order. Cycling wraps around, skips closed streams, and excludes the current backend. Display names use `Local` for the initial session and `Backend N` for additional sessions; a closed displayed stream has no name.
## Testing
Extend backend session tests to cover cycling with a single backend, wraparound across three backends, and skipping a closed stream.
GitOrigin-RevId: e8f3fcc38a178b6b91d385d65d899fdd042062c5
## What changed
- Group threads needing approval first in `/subagents`, mark them with `(needs approval)`, and initially select the first waiting thread.
- Refresh the open picker and approval notice as requests and agent metadata change, preserving the selected thread when rows move.
- Use consistent agent labels across the picker and approval notice, preferring agent paths and using UUID suffixes to distinguish unnamed agents.
- Track approval requests that arrive before thread metadata and refresh pending approvals after reconnecting.
## Testing
Extend the picker test and snapshots to cover approvals arriving while the picker is open, agent paths arriving later, and selection staying on the same thread after reordering.
GitOrigin-RevId: b7dd943d151ce98d1978f7c6b9f5e16903b9075b
## What changed
- Build native voice SDK and runtime artifacts with Bazel for Linux GNU, macOS, and Windows on x64 and ARM64, then configure Cargo jobs to consume them. Keep musl builds in a separate job without these inputs.
- Validate artifact receipts against the target, source commit, and source manifest; verify SDK file hashes and relocate pkg-config metadata. Package the runtime and plugins with nextest archives and restore `CODEX_TEST_VOICE_RUNTIME` when running shards.
- Prepare native Windows voice tools for argument-comment linting and install ARM64 DotSlash on Windows ARM64. Reduce archive disk usage, bound Linux ARM64 build concurrency, and correct the JUnit artifact path.
- Recognize TLS errors wrapped directly in `io::Error`. Make TLS fallback fixtures select the native backend explicitly, allow the MCP test server's non-loopback address, and isolate skill-root tests from ancestor Git markers. Install `git` in remote test containers and filter MCP discovery assertions to POST requests.
## Testing
Add tests for relocated voice inputs, Windows ARM64 import libraries with host-native pkgconf, and rejection of mismatched receipts or corrupt SDK files. Extend untrusted-certificate coverage to an explicitly selected rustls backend.
GitOrigin-RevId: da3ff690b94906edc1f8f60a3c7feda1bf66134a
rhan-oai