## Why
When a workspace has an unreadable ancestor, PowerShell can start with `$PWD` unset and its filesystem drive at the root, breaking relative paths.
## What changed
Prefix PowerShell commands in the MXC sandbox with a guarded workaround that restores the location from the process working directory when `$PWD` is unset. Preserve locations already initialized by startup or a profile.
## Testing
Extend the MXC PowerShell integration test to cover an unreadable ancestor, checking that `$PWD` matches the process working directory, relative file access works, and the parent and sibling file remain inaccessible.
GitOrigin-RevId: 4fb067db52a7f3c6e819169016fe6bd104a277a1
## Why
User-configured model catalogs can supply Guardian prompt templates that omit policy slots or add conflicting instructions. Managed rules need a trusted template to reach the reviewer.
## What changed
- Use the bundled Guardian policy template when managed policy or additional rules are present, while preserving explicit host-provided templates.
- Remove `auto_review.extra_policy` and `auto_review.experimental_policy_template` from configuration and the schema. Warn when they are used, directing additional rules to `guardian_extra_policy` in managed `requirements.toml`.
## Testing
Add regression coverage for managed rules with user-supplied catalog templates, explicit host templates, and migration warnings for the removed settings.
GitOrigin-RevId: 7f00bfaa85051272ed70ceb2fcb64ffc297b8755
## Why
Waiting for host acceptance of a service-tier update in the submission loop can block interrupts while the host receipt is pending.
## What changed
Move the host acceptance wait out of the submission loop while keeping explicit thread settings replies pending until acceptance completes. Report handoff failures to the caller while preserving the locally committed settings, and allow a subsequent explicit request for the same tier to retry a failed handoff.
## Testing
Add a WebSocket regression test covering interrupts with pending host receipts, failure reporting, same-tier retries, and continued thread operation after startup caller cancellation.
GitOrigin-RevId: 1b27d156eba3ebb47e717a987f41f4f595635be8
## Why
Holding the session MCP gate during `tools/list` blocks other runtime access. Releasing it requires preventing stale refresh results from publishing after configuration or authentication changes.
## What changed
- Capture the Apps client under the session gate, then release the gate before fetching tools.
- Validate runtime and authentication state before publishing the shared cache and client catalog; retry a superseded refresh once.
- Wait for in-flight Apps refreshes before capturing model tools, preparing Apps calls, or shutting down the runtime.
## Testing
Add regression coverage for stale refreshes after runtime invalidation or logout, publication validation after call preparation drains, and a model step that waits for refreshed Apps tools while MCP status queries remain available.
GitOrigin-RevId: 42d4be8c4a9218933f8e3d07fc7f32f2da9cbd9d
## Why
MCP tools marked with `readOnlyHint: true` could still require approval in automatic mode when `destructiveHint` was also true.
## What changed
Give `readOnlyHint` precedence over `destructiveHint` and `openWorldHint` when deciding whether annotations require approval. Explicit prompt mode and strict automatic review continue to require their respective approval checks.
## Testing
Update unit tests for conflicting annotations, prompt mode, and strict automatic review. Extend app integration coverage to verify that read-only calls proceed while writes prompt in both automatic and writes approval modes.
GitOrigin-RevId: 11a930b857886bf41d09fd54c3a38607ae3d1b4e
## What changed
Allow GCP Responses requests to use `incremental_tools_legacy`. When enabled, tool declarations are sent through `additional_tools` inputs instead of the top-level `tools` array.
## Testing
Extend Vertex request coverage to check incremental tool declarations, including namespaces, tool search, and `exec_command`. Add GCP cases to the scenario that verifies tool catalog updates are appended without rewriting history, with incremental tools enabled and disabled.
GitOrigin-RevId: 8f4c02f8d62575e24e695d6fae0472a09625409f
## Why
Title and content searches exclude attached threads, preventing clients from finding their saved conversations alongside ordinary threads.
## What changed
- Add `includeAttachedThreads` to `thread/list` and `thread/search`. For `thread/list`, require a non-empty `searchTerm` and preserve the usual provider and source filters.
- Expose `attachedToThreadId` on thread responses to identify the owning parent independently of fork and subagent lineage.
- Support inclusive searches through SQLite and filesystem fallback, repairing missing database entries with saved thread names during title searches.
## Testing
Add regression coverage for opt-in title and content searches, attached-parent metadata after restart, default search filters, filesystem searches without SQLite, and discovery and repair of unindexed title matches.
GitOrigin-RevId: ac12ec3c730ad7f1722bdf8e21600d17f12017f0
## What changed
- Add `tui.collapse_turn_details`, disabled by default, and a “Collapse turn details” toggle in the full-screen settings panel.
- Summarize command executions with output-free labels, grouping multiple calls behind an expandable row. Keep full details available through transcript search and detailed view.
- Restore interruption notices at their turn boundaries when resuming and loading older history, including turns split across pages.
## Testing
Add coverage for live summary updates, expansion controls, search access to hidden output, settings visibility, and interruption ordering across history pages.
GitOrigin-RevId: 68987fb0239e39414dac383098acac190fc4f516
## What changed
Move `ThreadMetadataBuilder` into its own module, make its fields private, and replace direct field assignments with fluent `with_*` methods. Initialize `updated_at` and `recency_at` from the creation time and default the approval mode to `OnRequest`.
Update `apply_rollout_items` to accept a boxed `ThreadMetadata` seed, keeping callers' async frames small while preserving existing database fields except for the seed rollout path. Add `build_thread_metadata` to use the state runtime's configured provider, and use `thread_id_from_rollout_path` directly for the doctor's filename fallback.
GitOrigin-RevId: a27e4c6b22832e902922dbdd60d7f5c11b4a1a83
## Why
Forked and recovered sessions can restore a tool call before its output has been recorded. Missing outputs for these calls should be treated as interrupted work rather than an error.
## What changed
Track the restored history's sequence cutoff so custom tool and local shell calls in that history can receive synthetic `aborted` outputs without reporting a missing-output error. Keep the existing checks for newly recorded calls and clamp the cutoff when history is replaced.
## Testing
Extend the active-turn fork test with a pending `apply_patch` call and verify that the fork's model input includes its `aborted` output.
GitOrigin-RevId: d989fa0991db72f0f8fa8a6d5de403fb307c40c7
## What changed
- Use `SandboxManager` to prepare `codex sandbox` commands, including permission profiles, workspace roots, and managed network proxy settings.
- Return a `WrappedSandboxCommand` that can produce an execution request or a configured process command, preserving native executable paths and Linux helper `argv[0]`. Require the session launcher for native Windows token sandboxes.
- Move macOS inherited-terminal policy handling into the shared manager, retaining Unix socket grants and the terminal input injection denial.
- Prepare managed network context alongside proxy environment variables and pass it through sandbox transformation.
## Testing
- Extend sandbox network proxy tests to macOS, covering blocked direct loopback access and explicitly allowed requests.
- Add coverage for Linux helper executable paths and dispatch names, including non-UTF-8 paths.
GitOrigin-RevId: 8b7396d21b2f34122699388f16047329a3f5e5c6
Add `McpRefreshReason::SessionPermissionsGranted` and pass it when marking the
MCP runtime dirty after a session-scoped permission grant. This supplies the
required reason argument and identifies the refresh cause in CLI diagnostics.
GitOrigin-RevId: 2ff8f6b9e1a40d68e1f799d0414c2d45e2576a1a
## Why
An explicit denial from a workspace inference hook should stop the request, including retries and compaction model fallback.
## What changed
Recognize `inference_hook_denied` provider errors and preserve the provider's message, with a fallback when none is supplied. Expose the distinct `inferenceHookDenied` error through the app-server protocol and generated schemas and SDK types. Treat the denial as non-retryable during turns, compaction, and guardian review.
## Testing
Add coverage for terminal denials over HTTP, SSE, and WebSocket, error serialization and persistence in `thread/read`, and compaction failures that preserve token usage and history without retrying or falling back to another model.
GitOrigin-RevId: 2ebd480f01e52f4e6bd3db8a0f92d5814d18ccb1
## What changed
- Track and log `McpRefreshReason` values for runtime refreshes, including invalidations received during thread startup and forced refreshes. Restore claimed reasons when a refresh is cancelled before publication, while preserving concurrent invalidations.
- Correlate installed-plugin metadata invalidations with downstream MCP refreshes using a shared change ID. Log changed field names by plugin ID, additions, removals, and reordering without logging field values.
- Record whether background installed-plugin bundle updates were requested by startup, plugin listing, or installation.
## Testing
Add coverage for metadata change attribution across membership changes and reordering, and for retaining refresh causes across cancellation and concurrent invalidation.
GitOrigin-RevId: 3d4485ccfcc1d8788eb9909a060ac200c467af13
## What changed
Compute the `sandbox_policy` label for `codex.conversation_starts` from the effective `PermissionProfile` without constructing a legacy `SandboxPolicy`. Preserve the historical labels and native-path compatibility fallbacks, including `workspace-write` for writable profiles that cannot be represented by a legacy policy.
Share the full-disk write compatibility check with session startup and the write-intent check with legacy policy conversion.
## Testing
Extend telemetry tests to assert sandbox labels in both logs and traces across disabled, external, read-only, workspace-write, and full-disk profiles, including unrenderable writable URIs and read restrictions. Add protocol assertions for legacy write-intent detection.
GitOrigin-RevId: 00f11d763c366453e7bb0899546a4ebbdb93c4d5
## Why
Asynchronous Guardian collection applied entry caps and compressed heartbeat messages before request preparation, while synchronous collection preserved originals. Preserve the captured evidence so request-time profiles and budgeting determine what is delivered.
## What changed
- Replace `prepare_sync_context` with a shared `prepare_context` entry point for synchronous and asynchronous presentations.
- Defer text caps, native-message omission, and heartbeat compression to preparation, preserving heartbeat reference numbering across transcript deltas.
- Support elastic transcript preparation for both reviewer profiles.
- Borrow collected asynchronous context instead of cloning the full transcript, and filter previous reviews against reviewer history during preparation.
## Testing
Add coverage for collection preserving originals, fixed preparation truncating text and omitting oversized native entries, and elastic preparation deferring entry caps for both profiles. Update heartbeat tests to cover full and delta preparation without mutating collected evidence.
GitOrigin-RevId: 4d4e448acf5dc8880a05c3c9a9754378135f61eb
## Why
Session-opening failures were returned as strings, preventing callers from inspecting the terminal gRPC admission status directly.
## What changed
- Add `GrpcCodeModeSessionProvider::open_session` returning `GrpcSessionOpenError`, distinguishing admission status codes, admission timeouts, and other setup failures.
- Keep string errors for the existing `CodeModeSessionProvider` trait API.
- Re-export `ProcessOwnedGrpcCodeModeSessionProvider` from `codex-core`.
## Testing
Extend admission tests to assert terminal status codes, cover exhausted `ResourceExhausted` retries, and verify that `DeadlineExceeded` is not retried.
GitOrigin-RevId: 9d7f2e733e12b8bb7def368fa5fc5a09ea2a374e
## What changed
Route MCP elicitations through the standard handling paths for Xcode 26.4 clients. Remove the client-specific auto-deny flag and the synthetic acceptance of session elicitation requests without dispatching them to the client.
Simplify `request_mcp_server_elicitation` to return the optional response directly, and remove telemetry guards that depended on whether the workaround bypassed dispatch.
GitOrigin-RevId: ab540dcd67f8fa6d16c69bc7629f436e4b5aa73a
## What changed
Mark `untrusted_as_tool_output` as stable and enable it by default. Untrusted additional context, such as browser information and goal objectives, now reaches the model as `function_call_output` items in the `agent` namespace instead of user messages. Setting `features.untrusted_as_tool_output = false` preserves the message format.
## Testing
Update core, app-server, TUI, and Python SDK test expectations for the default output format. Cover context persistence, deduplication, goal continuation, and explicit opt-out behavior.
GitOrigin-RevId: 30828351e2ed584928f6055b6dcf276d8288c0fb
## Why
HTTP 400 responses with `context_length_exceeded` need to reach context-window recovery so manual compaction can retry with less history. Streaming context-window failures should end the stream immediately.
## What changed
- Map `context_length_exceeded` through the shared terminal provider error parser for HTTP 400 responses and events without an HTTP status.
- Return SSE context-window failures immediately.
- Preserve retryable handling for WebSocket errors carrying HTTP 503, even when their code is `context_length_exceeded`.
## Testing
Add coverage for WebSocket status handling and immediate SSE termination with retry headers. Update the manual compaction test to verify recovery from an HTTP 400 context-window error by dropping one history item and retrying.
GitOrigin-RevId: 56d8c831c2fad2ca1318318a3b4258fcc516d689
## Why
A `403` with `codex_workspace_access_denied` indicates that the account cannot use Codex in the selected workspace. Retrying or falling back to HTTP does not resolve that denial.
## What changed
Map `codex_workspace_access_denied` and `invalid_workspace_selected` responses to a shared workspace access denial error, and rename the error variant to reflect its broader scope. Keep workspace denials excluded from compaction model fallback.
## Testing
Extend API error mapping tests to cover the new code on `403` and preserve ordinary handling for `503`. Add WebSocket coverage verifying that an explicit workspace access denial does not trigger HTTP fallback.
GitOrigin-RevId: e601a22a0fa783a4ce5401a98ff9c8d3d9d1b074
## What changed
Recognize `content_policy_violation` in HTTP 400 responses and streamed errors as a dedicated, non-retryable error. Preserve the provider's message and available HTTP status, use a fallback message when needed, and report `CodexErrorInfo::InvalidPrompt` to clients.
End the response stream immediately on this error and stop compaction from falling back to the current model after a content policy rejection. Add redacted diagnostic output and a dedicated sampler failure reason.
## Testing
Extend coverage for HTTP and wrapped WebSocket errors, missing or blank provider messages, terminal stream failures with retry headers, and content policy rejections during local and remote compaction on model downshift.
GitOrigin-RevId: 592170ac30c07b0b303a8d5cb15bd35c8f821b55
## What changed
Recognize `access_program_not_enabled` in HTTP 403 responses and response stream errors as a dedicated, non-retryable error. Preserve HTTP diagnostic details and provider stream messages, with a default message when none is supplied.
Stop SSE streams immediately on this error and avoid triggering WebSocket fallback for explicit access program denials. Add a fixed diagnostic label for doctor output and telemetry.
## Testing
Extend coverage for HTTP and WebSocket denials, immediate SSE termination despite retry headers, and doctor diagnostic redaction.
GitOrigin-RevId: 3a41f7bb80ad5e13a87e831b458d17cdd19a4b62
## Why
HTTP 403 responses with `invalid_workspace_selected` were treated as unexpected status errors, allowing retries and compaction fallback to another model after the server rejected the selected workspace.
## What changed
Recognize the code in `detail.code` or `error.code`, falling back to the `x-error-json` header when the body has no code. Classify these 403 responses as `InvalidWorkspaceSelected` and disable retries and compaction model fallback while preserving the response details and HTTP status. Other 403 responses retain their existing retry behavior.
## Testing
Add coverage for body and header error codes, code precedence, HTTP and WebSocket retry behavior, and local and remote compaction during a model downshift.
GitOrigin-RevId: f44a3bee5ef06e601909839868ab99cea6dd7d03
## Why
Local compaction retried invalid requests and server overload errors without retry advice, and used local backoff even when the server supplied `Retry-After`.
## What changed
Use `CodexErr::retry_delay` to decide whether and when to retry local compaction. Honor the original `Retry-After` deadline when present, while retaining the configured retry limit and context-window trimming behavior.
## Testing
Add coverage verifying that manual local compaction does not retry invalid requests or overload responses without retry advice, but retries overload responses with `Retry-After`.
GitOrigin-RevId: abe6cbba661f701b97f8b1ab83b1fe86979f03c0
## Why
Approved filesystem access should make executor skills discoverable and readable for the lifetime of the grant. Turn-scoped access must not authorize persistent plugin servers or hooks, or bypass disabled-plugin policy.
## What changed
- Apply environment-specific session grants to capability discovery and refresh MCP after session grants change.
- Use a separate discovery inventory for skills with turn-scoped grants, keeping plugin servers and hooks on the session inventory. Reuse discovery results across unchanged model steps.
- Preserve disabled-plugin checks for unreadable manifests and symlinked manifest files or directories, including ancestor markers, while retaining standalone skill roots.
## Testing
Add coverage for V1 and V2 skill discovery before approval, after approval, and on the next turn; disabled-plugin ownership checks; discovery cache reuse; and session hooks surviving turn-scoped discovery failure.
GitOrigin-RevId: 929a7f8cb01f4bcfb4bee2c50ae02cd762066b2d
## Why
A pending realtime connection handshake can hold up subsequent attachment requests. Callers need to cancel obsolete attempts or limit how long they may take to establish a connection.
## What changed
- Add `RealtimeAttachmentOptions` with an optional cancellation receiver and `start_before` deadline to `Op::RealtimeConversationAttach`.
- Interrupt pending connection work and finish cleanup before acknowledging cancellation. Reject cancelled or expired requests before replacing an existing conversation, and recheck cancellation and the deadline before publishing a connection.
- Preserve a successfully published connection when cancellation arrives later. Dropping a cancellation sender whose value is `false` lets the attempt continue.
- Prepare the daemon startup test's socket directory with `codex_uds::prepare_private_socket_directory`.
## Testing
Add integration coverage for cancelling a held handshake, skipping cancelled or expired queued requests, preserving the next usable call, and releasing a pending handshake when its deadline expires without a cancellation receiver.
GitOrigin-RevId: 7144c1237bcbe3b859f10b654d919ae9ff20cbbb
## Why
Account changes during asynchronous request setup can invalidate the credentials selected for a generation request.
## What changed
- Restart HTTP request setup if the auth owner changes during the budget check.
- Validate the WebSocket connection's retained auth owner with `AuthOwner::is_current()` after budget checks.
## Testing
Add regression coverage for account switches during HTTP budget checks and external credential changes before WebSocket request setup, in both dual-header and assertion-only runtime auth modes.
GitOrigin-RevId: 7a1e1475a40aa2d34cd94f60f729ad697f3f7028
## Why
Aggregate resource listings omitted dormant MCP servers, leaving callers without their names for explicit queries.
## What changed
Include a sorted `deferredServers` list in aggregate `list_mcp_resources` and `list_mcp_resource_templates` results alongside resources from ready servers. Apply the listing filters to deferred servers and omit the field when empty. Discovery leaves dormant servers unstarted; callers can query them by passing `server` explicitly.
## Testing
Extend the resource discovery scenario for direct calls and Code Mode to verify deferred server names, confirm discovery leaves the server unstarted, and then list and read resources by server name.
GitOrigin-RevId: f95b8beb64bb1329f4ae3245e8c375614fcb3360
## What changed
Simplify the post-denial rule in the Guardian policy template: user re-approval after seeing the concrete risk sets `user_authorization` to `high`. Remove repeated qualifiers about explicit approval of the exact action and certainty that approval came from the user; the authorization scoring guidance still covers those requirements.
Update the Guardian extra-policy review snapshot to match the revised prompt.
GitOrigin-RevId: 63643222e8f9c46c9d902ac8f5d1e11d24fafe9c
## What changed
- Pass goal objectives as untrusted `goal_objective` context instead of embedding them in continuation instructions. Direct the model to use `get_goal` if the objective is missing or truncated.
- Inject newly created objectives into their originating active turn without dropping unrelated client context. Render them as tool outputs when `UntrustedAsToolOutput` is enabled.
- Queue additional context together with automatic turn input so both reach the first model request.
## Testing
Extend app-server coverage to verify that model-written objectives appear as tool outputs at creation and continuation, without duplicating them in user messages. Update steering and Python SDK tests to check objective preservation and delivery alongside continuation instructions.
GitOrigin-RevId: 6f44f6d6c895bb4dc378c9cf84d6470ccc885c67
## What changed
- Add `CodexThread::agent_tree_id()` to identify a loaded agent tree. The root and native children share an ID; loading a new tree produces a new ID even when reusing a persisted thread ID.
- Add `EnvironmentManager::remove_environment()` to unregister an environment while preserving existing handles and the default environment ID.
## Testing
Extend tests to check tree IDs across child creation, forks, warm reuse, and cold reloads, and to verify environment removal and re-registration.
GitOrigin-RevId: 43944ed6766374508d9862cd5d333bc4cb67c338
## What changed
Add `exec_tools_update_hint` and `exec_tools_removed_definitions_header` to `model_messages.tools.incremental_tools` and use them when rendering Code Mode catalog updates and removals.
Overrides are literal strings limited to 512 UTF-8 bytes per field. Missing, null, or oversized values use the existing bundled wording. Empty strings omit the guidance while retaining changed definitions and removal keys. Wording changes alone do not trigger catalog updates.
## Testing
Extend unit coverage for defaults, null fields, independent fallback, and UTF-8 byte limits. Add scenario assertions and a snapshot covering custom and empty wording, model switches, catalog changes, and restoration after compaction.
GitOrigin-RevId: da9e00fdb5197a2b5fa39ce533ba87c76ff3e82c
## What changed
- Add configurable `sidebar_up` and `sidebar_down` actions to cycle through tabs with wraparound while the sidebar has focus. Default leader shortcuts use `Shift-Tab` / `Tab`, `Up` / `Down`, and `k` / `j`.
- Support mouse-wheel tab switching over the tab strip and clickable overflow arrows when tabs do not fit.
- Show previous/next tab shortcuts in the leader HUD and keymap picker, and preserve pane zoom when switching tabs.
## Testing
Extend sidebar interaction tests and snapshots to cover overflow arrows, mouse-wheel navigation, leader shortcuts, repeated custom bindings, draft preservation, and scroll handling where the leader HUD overlaps the tab strip.
GitOrigin-RevId: 39ccb40f40560d1be850397f9597e765caa996a3
## What changed
Count tool and namespace-instruction entry deltas in `codex.tools.exec_entry_updates`, tagged by `added`, `schema_changed`, or `removed`. Entry replacements count as `schema_changed`; full catalog declarations do not count as entry deltas.
Record rendered UTF-8 batch sizes in `codex.tools.exec_update_bytes`, including hints and framing but excluding full declarations and removal notices.
## Testing
Extend the namespace transition test to verify action counts, UTF-8 byte totals, and metric behavior when exec is hidden, restored, or unchanged.
GitOrigin-RevId: 22070b84230296d78a67b83641cbc02157d84419
## What changed
- Cover incremental exec tool settings and catalog changes across resume, fork, tool mode switches, and compaction.
- Verify that adopting background compaction preserves live exec declarations, tool metadata updates, and retained conversation order after a model catalog refresh.
- Include an `exec` namespace in the top-level tool catalog ordering and snapshot round-trip test.
GitOrigin-RevId: 3df603b98a006abb55a5095b299080f036576242
## Why
Recovered answer history needs presentation instructions alongside the moderation flag so clients can apply the intended display behavior.
## What changed
- Add optional `display` metadata with an `action` and optional `blockType`, `cyberTrustedAccess`, and `checkTrustedContacts` fields.
- Carry display metadata through final answers, legacy events, thread history reconstruction, and legacy rollout migration.
- Expose the metadata in the app-server protocol and update generated JSON schemas, TypeScript types, and Python SDK models. Missing display fields remain compatible with existing stored moderation data; the app-server emits absent optional values as `null`.
## Testing
Extend the final-answer moderation test to cover display metadata in answer items and legacy events. Add serialization coverage for missing display data, nullable fields, and preservation of an explicit `false` value.
GitOrigin-RevId: b798a2ecc53c2a94c7659ef3d9663b3143b70a1a
## Why
Changes to nested tools should update the model's catalog without repeating the full `functions.exec` declaration or rewriting retained context.
## What changed
Pass structured exec definitions through the tool router into the session's tool world state. Enable granular updates for Responses Lite in `CodeModeOnly` when both `IncrementalTools` and `IncrementalExecTools` are enabled.
Append changed tool definitions, namespace instructions, and removals as developer messages. Keep common exec instructions and shared types frozen until compaction, then install the latest full catalog.
## Testing
Add feature-gating coverage and a scenario snapshot covering tool additions and removals, namespace instruction changes, eager/deferred transitions, re-enabling tools, retained context, and catalog restoration after compaction.
GitOrigin-RevId: bbf850d4e5018388eeb4c09345d885d776962e09
## What changed
Render stable entries for nested tool definitions and namespace instructions alongside the full `functions.exec` description. Add optional catalog tracking that emits complete replacements for added or changed entries and explicit notices for removed entries, while keeping the existing exec declaration unchanged.
Preserve entry hashes while exec is unavailable, then restore the full catalog and withdraw removed entries when it returns. Keep the existing snapshot format for ordinary tool catalogs.
This change provides the rendering and state support; runtime activation remains disabled.
## Testing
Add tests for definition rendering and namespace identity, batched additions and changes, removal notices, unchanged catalogs, and full catalog restoration after exec is hidden.
GitOrigin-RevId: f472bd3e8e770a8cad9663c72e290abe7d0473be
## What changed
- Save side chats as attachments to their parent conversation when local workspace history supports them, and let users reopen them from the sidebar after a restart.
- Show chat names or first-prompt previews in sidebar labels, and allow saved side chats to be renamed with `/rename`.
- Add tab close buttons, middle-click closing, and the configurable `close_sidebar_tab` shortcut, defaulting to `Ctrl-X W`. Closing a saved chat keeps it available in the picker; archiving removes it from Side chats.
- Confirm actions that stop running work, discard unsent input, or lose temporary history. Delete saved TUI side chats when deleting their parent conversation.
## Testing
Add coverage for reopening saved side chats after restart, archive handling, close confirmations, and preventing close-confirmation keys from accepting a replacement approval dialog.
GitOrigin-RevId: 3d47533d007286a7354660c08df13a83dd48d5d7
## Why
Code mode requests can fail before a `CodeCellStarted` event. Suppressing their dispatch traces loses the caller-facing error in that case.
## What changed
Record dispatch lifecycles for code mode custom payloads, preserving their results independently of code cell events.
## Testing
Update the incompatible-payload regression test to use the code mode tool name and verify that replay retains the failed tool call and result payload even when no code cells were recorded.
GitOrigin-RevId: 687a36cd7ba55665ed7abc88c36732597e7fb025
## What changed
- Honor `RuntimeAgentInstances` and the configured runtime auth mode for Analytics plan discovery and report requests to OpenAI endpoints.
- Share installation ID resolution and Codex runtime registration setup through `codex-runtime-agent-instance`.
- Preserve typed runtime authentication errors so expired credentials retain the “Sign in again to load Analytics” guidance.
## Testing
Add coverage for both runtime auth modes across regional and staging endpoints, fresh assertions for each request, sign-in guidance after bootstrap failure, redirect rejection, and invalid organization/project selectors.
GitOrigin-RevId: 50e0d959b3abd81ebe7a6a584e272f14cf52e504
## Why
Invalid assertions and paused or revoked runtime instances cannot recover through request retries or credential refresh. Permanent refresh-token failures also need to retain their sign-in error instead of becoming retryable stream errors.
## What changed
- Recognize terminal runtime denial codes in `401` and `403` response bodies and identity error headers, preserving HTTP diagnostics while stopping retries.
- Skip credential recovery for runtime denials in runtime-enabled model providers and backend requests, while preserving recovery for ordinary credential expiration.
- Propagate permanent refresh-token failures through runtime authentication as `RefreshTokenFailed` errors.
## Testing
Add coverage for body and header denials, preserved HTTP diagnostics, provider-scoped credential recovery, and cached permanent refresh failures. Complete-turn tests verify that runtime denials stop without retries or refreshes while expired credentials recover in both runtime authentication modes.
GitOrigin-RevId: 33f6f707454130e97e13f3b53e29d2c484602152
## What changed
Make `ModelRequestContributor::budget_exhausted` return an `ExtensionFuture` and await budget checks before HTTP and WebSocket generation. WebSocket warmup continues to skip budget checks.
If the account changes during the post-connect budget check, rebuild the request setup and reconnect before sending the WebSocket request.
## Testing
Update tests to cover a pending budget check that resolves to exhaustion, warmup connection reuse, and an account switch while the post-connect budget check is awaiting completion.
GitOrigin-RevId: 462c74b86a46a4b2276f901c69187fc7cbc3ff81
## What changed
Make `AgentServiceTier` reads asynchronous and have updates return a receipt for local acceptance. Await acceptance during root startup and settings updates outside state and registry locks, sharing the receipt with explicit same-tier retries.
Await shared-tier reads during child preparation, startup prewarm, and step capture. Allow cancellation while capturing a step, and keep host propagation independent of the acceptance wait.
## Testing
Extend the host-child WebSocket test to cover delayed acceptance, same-tier retries without duplicate updates, accessible settings while acceptance is pending, and tier inheritance during prewarm and subsequent steps.
GitOrigin-RevId: 0e2e1899834c37684e904c4a36e66344a0c6c7f3
## Why
An inherited turn can suppress a fork's configured developer instructions, leaving the first side-chat request without its developer policy.
## What changed
- Move shared side-conversation instructions and the history boundary into `codex-context-fragments`.
- Inject the developer policy before the user-role boundary when creating a TUI side-chat fork, while retaining the configured instructions.
- Distinguish attached and temporary policies, applying the worktree restriction only to temporary side chats.
- Add guidance to set up recurring monitors in the main chat or a new chat because temporary side chats cannot run scheduled updates.
## Testing
Add a TUI integration test that checks the first side-chat model request contains the policy and boundary. Add a core request-history snapshot covering an attached side chat that preserves inherited context, policy, and its prior answer after resuming from disk.
GitOrigin-RevId: 889cb317dc3327457cd9ef0879ec9f77dbfaeeba
## Why
Guardian Decisions requests used bearer keys directly, bypassing runtime authentication. Memory startup quota checks used the app-level auth manager instead of the thread's provider auth context.
## What changed
- Bind Decisions credentials to runtime authentication and use route-aware HTTP clients with sensitive header protection. Preserve workload identity credentials, reuse the saved-login runtime binding, and isolate explicit API key bindings.
- Select the staging Decisions endpoint when the ChatGPT environment is staging.
- Use the thread's `ProviderAuthContext` for memory startup and quota checks, preserving account-bound network policy and applying runtime authentication.
- Keep custom destinations independent of runtime assertions.
## Testing
Add regression tests for dual-header and assertion-only authentication, fresh Decisions assertions, saved versus explicit credential isolation, workload identity, staging routing, redirect header protection, and memory quota authentication with custom destinations.
GitOrigin-RevId: 27bc7821a1cad1f5d1d2a71680527ea91ace95db
## Why
An open WebSocket can remain usable after its runtime is paused. Runtime-authenticated requests need a fresh handshake to revalidate access before submitting more work.
## What changed
- Reconnect before each runtime-authenticated Responses request and skip speculative preconnection. Preserve turn routing when the runtime identity is unchanged.
- Open a fresh connection for each runtime-authenticated Guardian classification instead of prewarming or reusing pooled sockets.
- Preserve HTTP fallback for unsupported upgrades and connection failures, while propagating authentication, authorization, rate-limit, and policy errors.
## Testing
Add regression coverage for pause and unpause behavior, credential changes, fresh assertions, and Guardian HTTP and WebSocket transports in both runtime authentication modes.
GitOrigin-RevId: 9f650147260da5cbbf5bb23dfff0af095fff3955
## Why
Child startup can lose remote model capabilities such as `tool_search` when the selected catalog is uninitialized or disk data is older than the parent's in-memory snapshot.
## What changed
- Initialize the final provider, auth, and originator catalog before resolving a child's startup model, then read it from memory.
- Preserve loaded catalogs, including empty responses and updates that failed to persist, without overwriting concurrent refreshes.
- Reuse catalogs across retry and WebSocket transport overrides while retaining routing and header distinctions.
## Testing
Add regression coverage for child tool search with warm, cold, and disabled caches; failed cache writes; concurrent refreshes; empty catalogs; and Guardian reviewer catalog reuse.
GitOrigin-RevId: 01d995a65b623cc7d6f26e2dc9b6e8cf380de782
zm-oai