## What changed
Replace `PreparedThreadSpawn` with `PreparedChildContext`. `CodexThread::prepare_child` now captures parent inputs from a live tool invocation without requiring a child request. Hosts choose the child's name, role, and history, bind destination services, and apply child settings.
Expose captured instructions, environments, permissions, approval settings, disabled plugins, current inheritable dynamic tools, and an execution-policy snapshot with its original managed requirements. Retain those requirements across MCP configuration refreshes so hosts can assess policy-source compatibility.
Remove `ThreadManager::create_prepared_child`; `CodexThread::create_child` handles reserved child startup on the parent's manager with invocation-bound cancellation and cleanup.
## Testing
Add coverage for execution-policy snapshots and managed requirements after MCP refresh. Update child-spawn tests to verify captured instructions and permissions, current dynamic-tool declarations, and fresh versus forked history.
GitOrigin-RevId: f15b595b44997fa70cd0c9be0e92f470e1f333e1
## What changed
Add `AgentMcpMetadataRecipient` as a thread extension that lets the host select which MCP plugin registration receives `x-codex-root-turn-id` and `x-codex-cyber-access-program` in tool-call metadata.
Require an exact match on the plugin ID, installed root, server name, and transport configuration in the `local` MCP environment. Omit both keys without host opt-in or when the registration does not match, including same-name user overrides. Send JSON null for unset values on matching registrations.
## Testing
Add unit tests for registration matching and integration coverage for host opt-in, same-name user overrides, and an unset access program.
GitOrigin-RevId: eaa44e17b29aa0bdec6f6ed9faa86b8fc931faad
## Why
Direct Guardian review checked recorded `exec_command` calls without applying `PreToolUse` hooks, so approval decisions could miss hook rewrites or denials.
## What changed
Run the shared `PreToolUse` hook handling before evaluating approval requirements. Use the rewritten arguments for policy checks and the Guardian approval request, and return an error when a hook blocks the call, even if policy would otherwise skip review.
## Testing
Add regression tests covering rewritten commands that require approval and hook denials for policy-allowed commands. Verify the rewritten approval request, hook events and recorded denial context, and that reviewed commands are not executed.
GitOrigin-RevId: 3ec7700f695e422ac59c903c285acc0cf633b915
## What changed
Return `CatalogModel` from model lookups, keeping metadata together with its `Bundled`, `Provider`, `ExplicitConfig`, or `Synthetic` origin through config overrides and runtime snapshots. Replace `used_fallback_model_metadata` checks with explicit `Synthetic` origin checks.
Share the underlying `Arc<ModelInfo>` with extension stores and use copy-on-write for metadata changes. Keep origin tracking outside serialized model metadata.
## Testing
Extend coverage for origin retention across cache reloads, namespaced model lookups, catalog fallback, and config overrides. Verify that step snapshots and extension stores share the same model metadata allocation.
GitOrigin-RevId: bb6130c94a7a795aa168ee24664a1dd453579fba
## Why
Concurrent executions accessing the same endpoint can produce duplicate network approval prompts before a session decision is recorded.
## What changed
- Queue manual prompts by environment, host, protocol, and port while keeping execution decisions separate.
- After a one-time approval or denial, let the next execution prompt. Reuse committed session grants and deny rules without another prompt.
- Keep tool results paused while requests are queued and attribute the wait to the triggering tool call.
## Testing
Extend coverage for concurrent requests, one-time and session decisions, independent ports, queued cancellation and timing, and isolation between local and remote environments.
GitOrigin-RevId: ebf580dddc39a9a9dc3b0d1acfa21438fbc6e100
## Why
A network request can disappear while its approval prompt is still pending. Leaving that prompt active allows a late cancellation to interrupt the turn even though the request no longer needs approval.
## What changed
- Track network prompt lifetimes in core and notify the app server when a prompt is resolved or withdrawn.
- Cancel the corresponding server request, emit `serverRequest/resolved`, and release its permission guard. Resolve outstanding network prompts during thread shutdown as well.
- Claim a live pending approval and validate its originating turn before applying a decision, so stale responses cannot interrupt a turn or persist policy changes.
- Distinguish network approvals that require the originating turn from proxy approvals that can be serviced by a later active turn.
## Testing
Extend regression coverage for disconnected network requests, late cancellation responses, turn completion during review, shutdown cleanup, mismatched turn IDs, and command approvals from background code running during a later turn.
GitOrigin-RevId: 78f656d92607ec21ddd0c5d781ed0947588cb2eb
## Why
Long realtime conversations could lose speech when active transcripts and handoff transcript fields were truncated.
## What changed
- Record completed V3 transcript chunks in model and client history once the active transcript exceeds 4 KiB, without triggering inference.
- Keep unfinished utterances pending to preserve conversation order, and persist completed chunks before subsequent handoffs.
- Preserve full V3 transcript text at handoff and session-end tail flush, and avoid adding handoff input already recorded in transcript history.
## Testing
Add integration coverage for long transcripts, XML escaping, recording before handoff without inference, repeated handoff input, and both session-end tail flush settings.
GitOrigin-RevId: 62218b811809c4cf5b16fb0247a335eb474f9ab9
## What changed
Allow gateway OAuth configuration to select `credentials_store = "file"` to persist credentials in plaintext at `$CODEX_HOME/secrets/gateway_oauth.json`. Keep `keyring` as the default.
Read, update, and delete file-backed credentials by credential ID, using atomic writes and the existing cross-process lock. Preserve the serialized provider identity when using the default store.
## Testing
Add an app-server test that completes gateway OAuth login with file storage, verifies Unix file permissions are `0600`, and checks that login remains successful after a server restart.
GitOrigin-RevId: dc1d17922bd80bf65034cbc5aa3d97959e962dcc
## Why
Older executors sandbox reads whenever a policy is supplied, even when the policy allows unrestricted reads. This can interfere with loading skills across executor versions.
## What changed
- Omit sandbox contexts from remote read operations when reads are unrestricted and explicit permission paths are valid for the target path convention. Retain contexts that require executor-side path validation.
- Check remote `windows_mxc` support before sending MXC sandbox contexts for reads or capability discovery, returning an update-executor error when unsupported.
## Testing
Add coverage for permission path validation across read operations, unsupported MXC requests, and skill loading over Noise with mismatched app and executor versions, including selected skill roots with capability discovery disabled.
GitOrigin-RevId: 4a2a7ccaa2ba4daac657bd84aea603404452be45
## Why
Cyber access program selection was restricted to the `openai` provider ID, preventing custom providers from accepting explicit program selections.
## What changed
- Add `capabilities.cyber_access_programs` to provider configuration and preserve it through remote thread configuration. Default to enabled for `openai` and disabled for other provider IDs, with explicit overrides taking precedence.
- Use the capability when forwarding `access_programs.cyber` and determining Daybreak availability in exec and the TUI. Refresh TUI eligibility when the server changes the selected provider.
- Preserve authentication, API-key feature gates, and catalog access checks; the capability does not grant program access.
## Testing
Add coverage for capability defaults and overrides, configuration round trips, custom-provider requests with both authentication types, API-key feature gating, compaction, WebSocket response reuse, exec selection, and TUI provider changes.
GitOrigin-RevId: 579f7c33c9e857ff5fedd08311aa8e3129740c1f
## What changed
Allow shared network constraints in `[permissions.network]` in `requirements.toml`, alongside `[permissions.filesystem]`. Apply them throughout configuration loading, network approvals, Windows sandbox policy validation, and `configRequirements/read`, and show their source in `/debug-config`.
Retain `[network_proxy]` and `[experimental_network]`, but reject mixing either with `[permissions.network]`, even across requirements layers. Preserve independent network and filesystem precedence and source attribution, and report unknown nested network fields.
Reserve `network` as a managed requirements table name and reject empty or profile-shaped tables with migration guidance. Profiles named `network` remain valid in `config.toml`. Document that policy publishers must keep using `[experimental_network]` until all readers support the chosen replacement.
## Testing
Add coverage for layered constraints and source attribution, conflicting spellings, profile-name migration errors, unknown-field diagnostics, and cloud validation. Extend API, project discovery, network approval, and Windows policy tests to cover `[permissions.network]`, and verify managed proxy settings remain independent of disabled feature configuration.
GitOrigin-RevId: 994dfca9abf5a7aea914276c0ded8b40d7ed0372
## What changed
Include `tool_name` in MCP tool approval elicitation metadata and forward available `readOnlyHint`, `destructiveHint`, `idempotentHint`, and `openWorldHint` values under `tool_annotations`. Omit unspecified hints and the annotation title.
Reuse the stored tool approval metadata when available so annotation hints reach the approval request.
## Testing
Extend unit tests to cover tool names, annotation hints, and omission of unspecified hints. Update integration coverage to verify that the approval tool name matches the executed MCP call and that `readOnlyHint` is preserved.
GitOrigin-RevId: f082fe7fd87fde9f4895149e09210c7cb9d1e582
## What changed
Add the disabled-by-default `code_mode_host_output_truncation` feature flag. When enabled, Core requests server-side output truncation for its built-in code-mode session providers over both stdio and gRPC. Injected providers retain control of their session settings, and explicit session options pass through unchanged.
## Testing
Add coverage for both transports verifying that the host's output-limit notice survives a zero-token observation budget. Extend the shared-provider test to exercise an injected provider with the new flag enabled.
GitOrigin-RevId: edbb65e930bf544e3d2f8384767037a6fb82d451
## What changed
- Add “System proxy” to `/experimental` for opting into macOS or Windows system proxy settings. Keep `respect_system_proxy` disabled by default.
- Update doctor’s macOS proxy guidance to point to `/experimental` and `codex features enable respect_system_proxy`, and tell users to restart Codex after changing the setting.
## Testing
Add snapshots for the experimental setting and doctor guidance, plus a Responses test verifying that `x-codex-beta-features` includes `respect_system_proxy` only when enabled.
GitOrigin-RevId: caa3e1a7cbe222069f35022b06c59da578b8a4dd
## What changed
Add `codex.additional_context` to count submitted entries, including unchanged entries, and `codex.additional_context.value_bytes` to measure UTF-8 value sizes before and after the existing truncation limit. Sizes exclude message wrappers and include the truncation marker after truncation.
Tag metrics with context kind, truncation status, and an explicitly supplied name when present; never use opaque source keys as tags. Record metrics through the current turn's telemetry.
## Testing
Add integration coverage for message and tool-output formats, repeated submissions, truncation boundaries, empty and multibyte values, optional name tags, and turn-specific model attribution.
GitOrigin-RevId: 463f257af27be58c372970fac853b85fde495dd5
## Why
Creating child history before persisting its parent-child relationship can leave history that parent subtree deletion cannot discover, especially when fork startup copies history. A relationship write failure must reject the spawn before child storage is created.
## What changed
- Reserve the child thread ID and persist its spawn edge before starting the child. Propagate persistence failures to the caller.
- Keep pending relationship writes owned through caller cancellation, and wait for them to finish before closing the edge during cleanup, including when a write commits but reports an error.
- Skip edge cleanup when publication was skipped, and reject IDs belonging to running threads before publication.
## Testing
Add regression coverage for cancellation before commit or acknowledgement, errors after commit, skipped publication, and duplicate child IDs. Integration tests cover fresh children and full-history forks, verifying that failed publication leaves no child history, execution, or creation notification and preserves unrelated history during parent deletion.
GitOrigin-RevId: 6e2e3f32d9558091312651ab47aa845d7d13b4ca
## Why
Host-side truncation can bound Code Mode output before it crosses the transport, including script errors that would otherwise exceed the frame limit.
## What changed
- Negotiate server-side output truncation for stdio and gRPC sessions, with client-side fallback for older hosts.
- Forward output budgets for execution, waiting, and termination when server-side truncation is selected. Avoid truncating host-formatted output or appending script errors a second time.
- Preserve the negotiated mode across reconnects and reject hosts that cannot maintain it.
## Testing
Add transport and integration coverage for output budgets, oversized script errors, reconnect compatibility, and preservation of output-limit notices with a zero-token budget.
GitOrigin-RevId: 2075101e4845eca64f45491c27a3b326788645c8
## What changed
- Match final serving assessments to their response and output item, then retain them with tool invocations and code cells across waits.
- Use matching assessments instead of asynchronous scoring for adaptive review: low-risk actions can skip synchronous review, while elevated-risk actions require it.
- Revalidate captured authorization and policy before approval. Require fresh review for stale or incomplete authorization, preserve explicit review requirements, and discard assessments when hooks rewrite tool input.
- Keep asynchronous scoring as the fallback when an assessment is missing or does not match.
## Testing
Add integration coverage for direct and nested tool calls, hook rewrites, explicit escalation, interrupted responses, catalog-driven policy, incomplete authorization, and assessment retention across code-cell yields and waits.
GitOrigin-RevId: 4346a227204137f018c03c34b302d6f1e9592c96
Expose `MAX_TEXT_PART_ESTIMATED_TOKENS` from `codex-guardian-context` and use it for native tool calls, transcript entries, and delivery-size assertions. Keep the existing 9,000-token limit while replacing duplicated limits in code and tests.
GitOrigin-RevId: 90cb98eea9bade34f18db0d1666ed7ed1e93febe
## Why
Managed command policies need to require a human decision independently of automatic review, hook allowances, and saved approvals.
## What changed
- Support `decision = "prompt-user"` in managed `requirements.toml` prefix rules, requiring a fresh, one-time human decision for matching commands.
- Add experimental `humanCommand` approval requests for clients advertising both `experimentalApi` and `requiredHumanApproval`. Accept only `accept`, `decline`, or `cancel`; reject commands when no capable client is available.
- Restrict responses to capable clients that received the request, and replay pending prompts to compatible clients on reconnect.
- Enable the capability in the TUI and update protocol schemas and client bindings.
## Testing
Add coverage for fresh decisions overriding saved allowances, hook allowances, and automatic review, plus child-thread approval routing and rejection of responses from incompatible or unrelated clients.
GitOrigin-RevId: 0b95ff6aab7f8a04b7298c8a4329d1fddf6a603e
## Why
Guardian review needs the original function-call metadata even when the call is no longer in live conversation history. Looking it up in history can lose the evidence needed to review encrypted multi-agent messages.
## What changed
Capture native-review policy in the tool registry and retain the original call through dispatch for multi-agent tools that require review. Use that retained call for Guardian review, applying hook-rewritten arguments while preserving encrypted-argument metadata and clearing stale replay content. Limit `ToolCall` debug output to the tool name and call ID.
## Testing
Add coverage for selective call retention across review settings and namespaces. Extend Guardian tests to cover calls absent from live history and hook rewrites that preserve call identity and encrypted-argument metadata across incremental reviews.
GitOrigin-RevId: 0e49833741c09c29228440bddd2e12695ae99583
## What changed
Add `otel.log_sse_deltas`, enabled by default. Setting it to `false` suppresses successful SSE event logs whose kind ends in `.delta` while preserving errors, completion events, and metrics.
Apply the setting to session and memory telemetry, support managed requirements, and expose it in the app-server configuration requirements API and generated schemas and bindings.
## Testing
Add coverage for delta log suppression with errors, completion logs, event counts, and duration metrics preserved. Extend configuration and app-server tests to cover defaults, overrides, and managed requirements.
GitOrigin-RevId: 751c7f357c41f51848b025c838246a733eb92e2f
## What changed
Add `CodexThread::guardian_review` to assess the final injected `exec_command` call against recorded history without executing the command. Reuse command preparation and approval policy, returning the call ID and an optional assessment when approval is required.
Reject active threads, unsupported calls, commands intercepted by `apply_patch`, and histories containing `request_permissions`. Honor cancellation and the configured review timeout.
## Testing
Add a scenario test and request snapshot verifying that direct review matches live Guardian input, leaves commands unexecuted, skips assessment for explicitly allowed commands, and rejects trailing tool output and recorded permission grants.
GitOrigin-RevId: 704f8dc77bbb991c231fce03cfda1c238c4e0b02
## What changed
Allow `refresh_mcp_config` to replace explicit session `plugins` overrides while preserving other session overrides and user settings. Omitting session plugins retains the current overrides; supplying an empty map clears them and restores inheritance from lower configuration layers.
## Testing
Add coverage for replacing and clearing plugin overrides, preserving unrelated settings, rejecting stale refreshes, revoking and restoring plugin tools and hooks, and retaining refreshed plugin policy when a deferred executor becomes ready.
GitOrigin-RevId: 26913fac0f8ae9590b39bdc037a78c9be86abb67
## Why
A transient environment startup failure persisted across turns when the selected environment and workspace were unchanged, preventing commands from recovering after the executor became available.
## What changed
Retry failed environment resolution at the start of a new turn when the error is retryable and the workspace remains selected. Reuse healthy or pending resolutions and preserve provisioning failures until the selection is updated.
## Testing
Add coverage for command execution recovering on an unchanged next turn after endpoint availability is restored. Extend provisioning failure tests to verify that subsequent turns receive the original error without restarting resolution.
GitOrigin-RevId: b80af60990f30d277804160c9c39c286024c7667
## What changed
- Add the disabled-by-default `interrupt_on_cancel` feature to interrupt upstream inference when a Responses Lite turn is canceled, with a one-second cleanup deadline.
- Detach canceled WebSocket responses so replacement requests can open a new connection without waiting for cleanup.
- Add an optional `interrupt_on_cancel` override for thread samples, inheriting the parent setting when omitted.
## Testing
Add coverage for cancellation during inference and steering, replacement turns proceeding before cleanup finishes, and prompt cancellation of model response interceptors.
GitOrigin-RevId: 501368746fc04fd3fdbd45c1f34c75ce57f4e955
## Why
Resuming or forking a thread loses the session flag indicating that reported token usage already includes retained reasoning. Counting that reasoning again can trigger automatic compaction too early.
## What changed
Persist `last_usage_includes_reasoning` with `TokenUsageInfo` and use it when estimating context usage. Record the flag with completed sampling and compaction usage, and mark local estimates as including reasoning. Older records without the field retain the existing accounting behavior.
## Testing
Add coverage for saved inclusive, exclusive, and legacy token counts. Extend the encrypted-reasoning compaction test to verify the compaction threshold for live, forked, and cold-resumed threads.
GitOrigin-RevId: 9f22262a693111ec0406dce11804eb4844ad8983
## Why
Stopping a sideband observer should close its WebSocket while preserving the frontend-owned realtime session. The existing frameless session close also sends `session.close`, so observer shutdown needs a transport-only close.
## What changed
- Add `close_transport()` to send a normal WebSocket close without `session.close`.
- Close the sideband transport on cancellation or when the call becomes inactive, including an existing connection awaiting adoption by the input task. Bound the close attempt to five seconds.
- Thread an optional sideband base URL through realtime start processing and allow nested thread ID fields in request serialization scopes.
## Testing
Add WebSocket and core conversation regression tests covering observer detachment for both realtime parsers and conversation versions. Verify that explicit frameless session close still sends `session.close`.
GitOrigin-RevId: 874a8980b0fcd45058e976b00c0d968f5b4b2404
## Why
When `codex-auto-review` is missing from the model catalog, Guardian falls back to the parent model. Refresh the catalog before accepting that fallback so reviews and checkpoint compatibility checks can use the default reviewer when it becomes available.
## What changed
- Share one refresh attempt per parent session, preserving it across cancelled waiters and retaining the parent fallback if recovery fails.
- Respect explicit reviewer overrides and custom catalogs, and skip recovery for basic sessions.
- Resolve reviewers from the in-memory catalog so a failed disk cache write does not discard a recovered reviewer.
- Apply review deadlines and cancellation to configuration setup, and avoid reviewer resolution during history replay unless checkpoint compatibility requires it.
## Testing
Add coverage for recovery, failed fetches and cache writes, overrides and custom catalogs, checkpoint compatibility, cancelled prewarming, review deadlines, and interruption.
GitOrigin-RevId: 87ae285713afde518a12bc2daba006a043b13bc5
## Why
Automatic gRPC reconnection could spawn a replacement host while dispatching an RPC for an existing session. Host loss must remain visible so recovery can report lost state without replaying execution or completed external effects.
## What changed
- Bind each local host channel to one child process and allow only `OpenSession` to replace a dead host.
- Add caller-owned transport support to `GrpcCodeModeSessionProvider` and map local transport failures to `Unavailable` so initial connection failures use the existing bounded admission retries.
## Testing
Add regression coverage for child exit during initial connection and between channel selection and dispatch, concurrent session recovery, and child reaping after teardown. An integration test kills the host after a command completes and verifies that recovery reports the reset, clears stored state, and leaves the command's external effect unchanged.
Increase the remote MCP stalled-handshake test's initialization timeout and mock response delay to let requests reach the server on loaded CI workers.
GitOrigin-RevId: 4ffd810e4cfcfb7a56e606816aa867bc206a09b6
## Why
A bundled reviewer entry does not establish that a custom gateway offers that model. Guardian should fall back to the parent model when the reviewer is neither advertised by the provider nor explicitly configured.
## What changed
Track model metadata origins as `Bundled`, `Provider`, or `ExplicitConfig`, including across catalog merges and cache reloads. Exclude bundled entries from Guardian reviewer selection unless `auto_review_model_override` is set. Continue selecting reviewers from provider and explicitly configured catalogs.
## Testing
Add coverage for gateway reviewer selection with each catalog origin, plus origin tracking across cache reloads, empty provider responses, and authentication changes.
GitOrigin-RevId: f8bf865d406e56ee0ade90087b55f2e33b98181e
## Why
Guardian's `write_stdin` approval requests lacked the command used to launch the receiving terminal, leaving reviews without that context.
## What changed
- Carry `original_command` from the terminal's launch command into the approval request and Guardian action JSON. This describes the original launch, not the terminal's current state.
- Exclude `original_command` from the 8,000-byte stdin approval size check so launch context does not consume the budget for input, permission details, and the approval reason. Launch context remains subject to Guardian's normal request budget.
## Testing
Extend serialization coverage to check `original_command` and the strict stdin review integration test to verify that a launch command longer than 8,000 bytes reaches Guardian intact.
GitOrigin-RevId: cc765a6bf80d080baf94c959eafa6227b2889e1f
## What changed
Decode `response.metadata` Guardian assessments into typed `GuardianAssessment` events over SSE and WebSocket, carrying `response_id`, `item_id`, and `requires_review`. Ignore assessments with missing, empty, or incorrectly typed required fields while preserving independent delivery of other metadata.
Expose the assessment type to request-scoped extension interceptors. Keep assessments out of conversation history; they do not authorize tool execution.
## Testing
Add SSE coverage for assessment ordering, malformed metadata, and mixed metadata delivery. Extend model request tests to cover SSE and WebSocket interceptor delivery and exclusion from subsequent model input.
GitOrigin-RevId: 282b8817ee97346d76b40bcb412eef023df60ff1
Remove `[features.guardianv2].free_guardian` setup and test parameters
from the Guardian review suite, along with redundant opt-in cases.
Retain coverage for authentication-dependent requests, HTTP fallback,
and session prewarming and reuse without explicitly setting the flag.
GitOrigin-RevId: ba1f985ae2f7f0e0b0c8b32cb47ac9993cbb43f2
## Why
`ShutdownComplete` can arrive before detached task cleanup records and exports `codex.turn_profile` events, causing the turn phase trace test to read incomplete profile counts.
## What changed
Poll exported spans until the expected number of profiles is available, with a 10-second timeout, before asserting sampling request and retry counts for reply and interrupt cases.
GitOrigin-RevId: 43cdcdde71bbcd16ed2e6c8b2accaa2a5de03001
## Why
Legacy notifications only need user text, but retaining the full sampling input keeps image and audio payloads alive while the response streams.
## What changed
Extract notification text from the first request attempt only when `notify` is configured, and retain those strings across retries. Consume and drop the prompt after setting up the response stream, excluding attachments and media wrapper labels from notification text.
## Testing
Extend the notification integration test to verify that `input-messages` contains only user text while the model request still includes image and audio attachments.
GitOrigin-RevId: af4653c0e7ac2bf7006f5ae5a82a3e724c30c734
## Why
Model catalog refreshes need to use the same registered actor and credential owner as model requests when runtime authentication is enabled.
## What changed
- Add `ProviderAuthContext` to carry credentials and optional runtime authentication into model providers and catalog clients.
- Select runtime authentication independently for inference and catalog destinations. Reject unsupported OpenAI origins while preserving provider authentication for other destinations.
- Include API organization and project selectors in runtime registration. Reuse registered runtimes across projects within an organization and replace them when the organization changes.
- Preserve transport restrictions and account bindings, and strip sensitive headers on cross-origin redirects.
- Apply the catalog timeout to authentication and fetching while allowing credential refresh and registration to finish safely.
## Testing
Add coverage for runtime-authenticated catalogs, provider isolation, resource selection, gateway authentication, cross-origin redirects, and timeout recovery that preserves registration and refreshed tokens.
GitOrigin-RevId: c14f1a02159031ea0af1f9b26ea890f8dca7d6ad
## What changed
- Add `permissions.approved_command_prefix_saved` to model messages and use valid plain-text headings in saved-prefix notices, with or without full permissions instructions. Reject empty, oversized, control-character, and markup-like headings.
- Keep `Approved command prefix saved:` as the leading marker for older clients and recognize saved-prefix content kinds when trimming rolled-back context.
- Shut down analytics test exporters asynchronously and serialize workspace-switching tests that share authentication environment state.
## Testing
Extend coverage for heading validation, sparse wire values, single-notice emission, rollback with and without metadata, and saved-prefix behavior across model switches.
GitOrigin-RevId: a70175deca64a6339abac2fa69af970f470e3f4f
## What changed
- Add `CodexThread::create_child` to create an idle child from a live tool invocation using a host-reserved thread ID and controller.
- Add `prepare_child` and `ThreadManager::create_prepared_child` to capture inherited settings and fresh or forked history, then start the child on another manager even after the parent shuts down. Reject detached preparation when live bindings cannot be transferred.
- Add opt-in `HostToolInvocationLookup` to track live calls and reject duplicate active call IDs within a turn. Revoke invocation access when dispatch ends and clean up provisional children when startup fails or is cancelled.
## Testing
Add tests for invocation lifetime and call ID reservation, inherited policy and live bindings, detached startup with fresh and full history, and cancellation cleanup.
GitOrigin-RevId: 71f17ecb4cd7636517e675df59289a8e8c7105b8
## Why
Image files can become unavailable between turns. Model requests should reflect their current availability while preserving the original references in saved history.
## What changed
- Add opt-in availability checks through `AttachmentStore::is_resolvable`, retaining references by default and on backend or access errors.
- Check distinct file IDs concurrently for each prepared request and replace confirmed-missing images with `[image unavailable]` in messages and tool outputs.
- Apply the same handling to compaction requests, with background image checks running outside the session lock without delaying foreground turn completion.
## Testing
Add unit tests and multi-turn scenarios covering placeholders, preserved history and annotations, concurrent deduplicated checks, backend errors, and nonblocking background compaction.
GitOrigin-RevId: ec98c7014c6e6b5063d87b943d2cd66a9ce7c1e3
## What changed
Add optional `request_permissions` and `auto_review_suffix` fields to catalog approval messages. Use them to customize the permission tool heading and introduce automatic review guidance while preserving the bundled instruction bodies and existing policy gates. Accept `request_permissions_tool` as a deserialization alias.
Limit headings to 500 UTF-8 bytes on a single line and fall back to bundled text for missing or invalid values. Complete catalog approval messages retain precedence.
## Testing
Add coverage for heading validation, serialization aliases, policy gates, fallback behavior, and complete-message precedence. Integration tests verify that model switches append the selected model's headings without rewriting history or repeating unchanged instructions.
GitOrigin-RevId: 3311591a464cc086783fe25271a352dd5a229790
## What changed
- Add `ConnectorRuntimeManager::without_shared_snapshot()` to keep connector catalogs local to each client and disable disk caching.
- Use the thread's own Apps discovery when snapshot sharing is disabled, preserving its catalog across turns.
- Expose `apps_tools_from_mcp_client()` to read a ready, unshared Apps client's tools without starting or waiting for discovery.
## Testing
Extend coverage for shared-cache eligibility and verify that an unshared thread waits for its own Apps discovery and uses its own tools on successive model requests, even when a peer finishes discovery first.
GitOrigin-RevId: d57ddacaede047e67c09d378c86c1aa3577ca56f
## What changed
Allow `model_catalog_url` under `[model_providers.openai]` while preserving the built-in provider's identity, authentication, and inference routing through `openai_base_url`. Reject other non-default overrides and require an HTTPS catalog URL on an allowed ChatGPT host, without embedded credentials.
Apply the same catalog override merging when checking managed provider requirements for existing threads, preserving each thread's inference endpoint even if user defaults change.
Document the required Codex catalog format, credential forwarding, and existing discovery and access restrictions.
## Testing
Add coverage for allowed and rejected catalog destinations, preservation of built-in provider settings, and managed requirement changes. Add integration coverage for API key and ChatGPT authentication that verifies separate catalog and inference routing.
GitOrigin-RevId: 4d91ada518ebd2a09cbf6ded0ddf4b11c92b77dd
## What changed
Add `CodexThread::replace_dynamic_tools` to replace the tool catalog without starting a turn. Updates apply to subsequent model steps and future turns while preserving in-flight calls; an empty list clears the catalog.
Require host opt-in through `allow_persistent_dynamic_tool_updates` for persistent threads. Persist replacements before publishing them, restore the latest catalog on resume, and preserve replacements and explicit clears through compaction. Keep explicit resume overrides separate from the persisted catalog.
## Testing
Add coverage for pending calls during replacement, replacement and clearing across restart, compaction recovery, resume overrides, submission ordering after caller cancellation, host opt-in, and persistence failures.
GitOrigin-RevId: fd2634906895a9b72ae7892ddd9435dced45eccb
## What changed
Expose `literature_search_query` in standalone `web.run` when the active model lists it in `experimental_supported_tools`. Support query text, domain filters, and recency filters, and reject literature search calls for models without the capability.
Pass the active model information to extensions for each step and report literature queries as search actions in web search events.
## Testing
Add coverage for capability rejection, model-dependent schema exposure, app-server round trips with a turn-level model override, and a scenario that searches for a paper and opens the returned reference.
GitOrigin-RevId: 87ef1fadd80ca7bfc2a7642c4e443f9b9f2e0e00
## What changed
Add optional `TurnInputRequest.user_item_uuid` and carry it through turn starts and steering to the recorded user message. When supplied, use `msg_input_<uuid>` as the Responses item ID; inputs without a UUID retain generated IDs. Raw response items ignore this field.
Add `ResponseItemId` helpers to construct and recognize the reserved `msg_input_` namespace.
## Testing
Add regression coverage for steered inputs with identical text and client IDs, checking that each supplied UUID survives recording and UI item IDs remain distinct. Add a scenario test verifying that the assigned ID reaches Responses and persists in subsequent request history alongside an identical ordinary prompt.
GitOrigin-RevId: 440e306bfdaa7facb69b21930c5244a83db2fdae
## What changed
Add the disabled-by-default `omit_skill_descriptions` feature flag to omit descriptions from model-visible host, executor, and cloud skill catalogs while retaining names and locators. Adapt catalog introductions, usage instructions, and alias budget accounting to the selected policy.
Persist the description policy in catalog snapshots and refresh usage instructions when it changes. Ignore description-only edits in catalog deltas while descriptions are omitted.
## Testing
Add coverage for alias token budgets, policy changes with older snapshots, and suppressed description-only updates. Extend scenario snapshots to cover plugin visibility and catalog deduplication with descriptions omitted.
GitOrigin-RevId: 5bf1dcee8c04059c7a78998affc1efcdef8ec883
## What changed
Extend the incremental Guardian review scenario with historical encrypted `send_message` calls in the default and custom tool namespaces. Add snapshots and assertions that both reviews retain each call and parent reply exactly once, in order, preserving call IDs, namespaces, and encryption metadata with a paired evidence-only output.
Verify that successive reviews reuse the same thread and append to the previous input. The scenarios use mocked ciphertext and decisions to check transport behavior, not backend decryption or authorization outcomes.
GitOrigin-RevId: a0927531b6cdae496fefa2a7f35032f7413807b6
## What changed
Add mock guardian approvals for setup handoffs in `handoff_scenario` when native multi-agent history is enabled. Match only the trailing `function_call_output` so historical handoffs cannot consume the final command's separate denial response.
Require five approval requests with native history enabled and none with it disabled.
GitOrigin-RevId: 7b14c97aa85adc63c4d3bf95014c44831eae1c85
## What changed
Make tool descriptions precede namespace descriptions in Code Mode execution and tool search. Mark `code_mode_tool_description_first` as removed and simplify cached definitions to depend only on the input schema budget.
## Testing
Update Code Mode integration assertions and catalog snapshots to expect tool descriptions before namespace descriptions.
GitOrigin-RevId: 1344d4c264d1d2b18ee0388a064b6813ca81f770
rhan-oai