## What changed
- Add an `Interrupt` hook event that runs for an active top-level turn before its
interrupted abort event is emitted.
- Flush the turn transcript before invoking the hook and provide the session,
turn, transcript, working directory, model, and permission mode in its input.
- Support command and MCP handlers, including asynchronous commands, with a
one-second default timeout and a three-second maximum.
- Expose the event through hook configuration, managed requirements, app-server
notifications, generated schemas, analytics, and the TUI hook views.
## Testing
- Cover handler discovery, timeout normalization, output parsing, protocol
compatibility, TUI rendering, and interrupt execution ordering.
GitOrigin-RevId: 163fa7c098d94ac2775f6d137f8e916f8ea9b6eb
## What changed
- Add a `thread_artifacts` SQLite table with per-thread typed identities,
JSON payloads, cascade deletion, uniqueness enforcement, and an index for
ordered per-thread reads.
- Export artifact records, attachment and removal outcomes, and paginated
result models from `codex-state`.
## Testing
- Add a migration test covering preservation of existing thread-section
metadata and compatibility with the previous migration set.
GitOrigin-RevId: 4e0a8e5bfa168ae2b8871970466e5055e142a4a6
## Why
Clients need a bounded view of realtime conversations that preserves the order of speech, agent work, and turn lifecycle events without loading the full thread history.
## What changed
- Persist realtime session boundaries, transcript segments, and promoted agent items in paginated thread rollouts.
- Add the experimental `thread/timeline/list` API to page ordinary items, realtime items, and turn boundaries in canonical rollout order. Include `activeRealtimeSessionAtPageStart` so each page can be rendered independently.
- Emit typed `thread/realtime/item/started`, `thread/realtime/item/transcript/delta`, and `thread/realtime/item/completed` notifications around durable realtime items.
- Keep the existing `thread/items/list` response and legacy thread history behavior unchanged.
## Testing
- Cover mixed timeline pagination, realtime-session state at page boundaries, rollout replay, subagent history prefixes, transcript streaming, steering, and promoted agent artifacts.
GitOrigin-RevId: faa2c420192d63e060e8fb32446e3c797422656e
## What changed
- Send `Free`, `Go`, `Plus`, `Pro`, and `ProLite` ChatGPT users to the individual Trusted Access page when a cybersecurity policy error ends a turn.
- Keep the enterprise Trusted Access application for other plans and sessions without a ChatGPT account or known plan.
## Testing
- Cover individual and enterprise link selection in chat widget tests and history-cell snapshots.
GitOrigin-RevId: a563560d15c401b47f1865a6f58ea4692d31d457
## What changed
- Render AGENTS.md paths under the home directory with `~` in `/status`.
- Preserve project-relative paths for instruction files inside or above the current working directory.
## Testing
- Add coverage for home-relative, parent, current-directory, and nested AGENTS.md paths.
GitOrigin-RevId: 6dd1ddf481d95dda9d16f7c03a7431d1297f87ec
## Why
Unified `@` search could show a plugin alongside the skills it owns, creating duplicate entry points for the same capability.
## What changed
- Add a nullable `pluginId` to `SkillMetadata` returned by `skills/list` so clients can associate skills with their owning plugin without inspecting names or paths.
- Hide a plugin's owned skills from unified `@` results when that plugin is present, while retaining standalone skills and skills with unknown ownership.
- Keep `$` focused on individual skills and apps, and use it consistently as the skills-list shortcut. Preserve the legacy mention behavior when `mentions_v2` is disabled.
## Testing
- Cover plugin ownership in `skills/list` and the updated `@` and `$` composer results.
GitOrigin-RevId: e168cdff8d0c58f74ce4c228a683880a3167775b
## Why
Another Codex process can write, archive, or compress a rollout while startup
migration is inspecting it. This can leave a discovered path stale or make an
in-progress rollout look empty or busy.
## What changed
- Wait for rollout maintenance to finish before starting background migration.
- Re-read empty rollouts under their writer lock and retry busy rollouts on a
later startup.
- Find archived or compressed rollouts again when their paths change after
discovery, while keeping terminal failures from blocking the startup cursor.
## Testing
Added coverage for maintenance contention, writer-owned empty rollouts, busy
rollout retries after archive and compression moves, permanent failure skips,
pending recovery, and paths that move after discovery.
GitOrigin-RevId: 9708f212f2bbff88bd47a01ec4872bf6ce9af535
## What changed
Change the background model refresh interval from 3 minutes to 4 minutes 30
seconds.
GitOrigin-RevId: dcefe471c91dc94a04ddc74595c3ce00d9061e55
## Why
Internal Guardian reviews must remain independent of parent-session customization while still honoring managed execution and environment restrictions.
## What changed
- Apply the restricted Guardian session path to both internal and subagent review sources.
- Start internal reviews without inherited user instructions, extensions, MCP servers, or multi-agent behavior.
- Preserve managed execution policy and selected environment constraints while exposing only the allowed review tools. Honor shell feature restrictions across every selected environment and retain code mode when enabled.
## Testing
- Cover internal review isolation from parent state and managed instructions.
- Cover optional tool filtering, managed shell restrictions, code mode, and secondary environment profiles.
GitOrigin-RevId: edbf7d8a6fe3ee8213a1c75bc8ec331a1cf49006
## What changed
- Emit control-tool analytics for history and notes extension calls and for
`send_user_message_async`.
- Preserve non-default namespaces in reported tool names, such as
`history.read_item` and `notes.write_file`.
## Testing
- Add an app-server integration test covering successful and failed calls,
turn-level tool counts, and omission of tool argument values from analytics.
GitOrigin-RevId: b15a53a311228339f4d577a7b96146ed67f22253
## What changed
- Generate a title suggestion from the latest substantive user and assistant messages when the TUI `/rename` prompt opens.
- Prefill the prompt with the result while keeping it editable and preserving any text the user enters before generation finishes.
- Bound and escape the conversation context, omit commentary and IDE context, and correlate responses with the active thread and prompt so stale suggestions are ignored.
## Testing
- Cover conversation selection and prompt construction, generated-title delivery through the embedded app server, loading and prefilled prompt states, stale responses, and preservation of manual edits.
GitOrigin-RevId: 1e7f1d5d4f6503ff9da0548388f610c446c130ca
## What changed
- Ignore `thread/started` notifications for ephemeral threads whose feature source is `system`, preventing hidden helper threads from entering TUI thread routing or refreshing the agents overview.
- Continue routing persisted system threads normally.
## Testing
- Add coverage for hidden and persisted system-thread notifications in the agents overview.
- Add generated-title normalization cases for wrapping quotes, trailing punctuation, and meaningful leading punctuation.
GitOrigin-RevId: e1ea48502b4f9aa7d5a187c7407df69c55abe2a9
## What changed
- Give unnamed TUI threads an immediate provisional title from the first user message, then replace it asynchronously with a normalized generated title.
- Preserve manual renames by applying a generated title only while the provisional title is still current, and keep automatic rename notifications out of the transcript.
- Run title generation in a bounded ephemeral structured request that preserves custom permission profiles, otherwise uses read-only access, and disables tools and MCP servers.
## Testing
- Cover prompt and response bounds, Unicode-safe truncation, title normalization, manual-rename races, silent automatic updates, permission preservation, and structured-response failures.
GitOrigin-RevId: 7ed73522f4f6c65a005f65f3a903974d8419e312
## Why
`skills.read` paginated resources against a fixed response limit, so a page could exceed a smaller tool-call response budget.
## What changed
- Size each serialized `skills.read` page to the current call's response budget, accounting for JSON escaping and UTF-8 boundaries.
- Cache one bounded executor-resource snapshot per thread so cursor continuations return consistent contents without rereading the file. Replace the snapshot when another resource is read, and reject stale cursors after a reread.
- Tie cached executor snapshots to the selected environment and sandbox context without keeping the environment alive.
## Testing
- Cover budget-constrained reads, escaped and multibyte contents, multi-page reconstruction, changed resources, snapshot eviction, and expired turn-scoped access.
GitOrigin-RevId: e515935b82771b3f29b3fb91ea7a7a72e19a65ee
## Why
Project configuration must not influence credential-provider environment variables or shell startup behavior while credentials are being brokered.
## What changed
- Track credential brokering as unconfigured, disabled, or enabled, and apply effective network proxy requirements before sanitizing project layers.
- When brokering is enabled, ignore project settings for shell snapshots, profile loading, `ZDOTDIR`, `BASH_ENV`, and credential-provider environment variables.
- Preserve those project shell settings when requirements disable credential brokering.
## Testing
Added coverage for active and disabled broker states, protected credential environment variables, and shell startup settings.
GitOrigin-RevId: 6967cbffdfbb60424a2d2324bad5b91bd2ccfcf6
## Why
Managed network requirements can remain present when `enabled = false`, but a
disabled configuration should not create or expose an active proxy runtime.
## What changed
- Start the managed network proxy only when its effective specification is
enabled.
- Clear an existing proxy when a permission-profile refresh disables managed
networking.
- Keep remote executor launches free of managed-network proxy settings when the
requirements explicitly disable the feature.
## Testing
Added session and unified-exec coverage for initial startup and refresh with
disabled managed networking.
GitOrigin-RevId: f76699802e079eb746d5b1ea6547d19a4bfb7715
## What changed
- Emit `codex.turn.cost_microusd` as a counter with turn, conversation,
interruption, speed, and reasoning-effort attributes. Convert the estimated
USD string to microdollars, rounding to the nearest microdollar and skipping
values that cannot be represented safely.
- Start turn-cost collection when an OTLP metrics exporter is configured, even
when the OTEL log exporter is disabled.
## Testing
- Verify cost conversion, rounding, and metric attributes with an in-memory
metrics snapshot.
- Verify that a metrics-only OTLP configuration starts the turn-cost worker.
GitOrigin-RevId: e60587079f097f10cc1b6d1bf889d3f7a0dc3d5f
## What changed
- Add `codex-agent-roles` for agent role configuration types, parsing,
discovery, validation, and layered loading.
- Update `codex-core` to consume the new crate's public role configuration and
parsing APIs.
GitOrigin-RevId: 5a963a219a581b2848dae6fd071aa31a0b5ff22c
## Why
Analytics need to associate subagent activity with the top-level turn that
caused it, while avoiding a stale association when steering makes that origin
ambiguous.
## What changed
- Add `root_turn_id` to turn and tool-item analytics events.
- Read the root from live turn metadata when each event is built, reporting
`null` when the root is unknown or ambiguous.
- Propagate the metadata through control-tool and code-mode completion facts so
correlated and background tool events retain the correct root.
## Testing
- Cover root IDs for top-level turns, subagent turns, correlated code-mode
calls, and tool events emitted after turn completion.
- Verify that queued and subsequent events report `null` after the live root is
invalidated.
GitOrigin-RevId: 42fd76541c3c716cec74787d47b50adb2d22e6d2
## What changed
- Discover supported credentials inherited from the parent even when their canonical provider variable is filtered from the child environment.
- Replace matching values and credentials embedded in longer child environment values with broker dummies, then restore only aliases that the broker virtualized.
- Preserve provider and host bindings when selecting credentials for outbound requests, including GitHub Enterprise and custom OpenAI hosts.
- Expose helpers for identifying provider and binding variables, plus an API for virtualizing credential-bearing text before it is persisted.
## Testing
- Extend credential broker tests for filtered parent variables, exact and embedded aliases, text virtualization, user overrides, and host-bound GitHub and OpenAI credentials.
GitOrigin-RevId: 55d673911900470aab4e206d0f4f5e62ed3611ae
## What changed
- Add the experimental `amazonBedrockAccessKeys` app-server login flow, persist its credentials in the configured auth store, and use them for SigV4-signed Bedrock requests.
- Report `bedrockAccessKeys` as a distinct auth mode and document access-key login alongside AWS profile and environment credential setup.
- Clear the selected Bedrock provider, AWS settings, and Bedrock-specific model on logout while leaving external AWS credentials and `.env` untouched.
- Reject managed access-key login when higher-precedence configuration would prevent its region or profile settings from taking effect.
## Testing
- Cover access-key login, storage, request signing, configuration conflicts, status reporting, and logout cleanup.
GitOrigin-RevId: bbf297887c6503d3651ceb2aad85c4d626e32723
## What changed
- Add `features.guardianv2.review_scope.computer_use_only` to restrict asynchronous classification and fast approvals to browser and computer-use REPL tools.
- Keep other tools on the synchronous approval path without letting them age or reuse scores from in-scope calls.
- Give this scope precedence over `sandboxed_exec_commands` when both options are enabled.
## Testing
- Cover configuration precedence, direct and code-mode tool detection, fast-approval isolation, and end-to-end approval routing for browser, computer-use, and unrelated MCP servers.
GitOrigin-RevId: bfd9ab6abdbd90634b265d354e038724b1e81d65
## Why
Multi-Agent V2 children are owned by their parent at runtime. Resuming an
unloaded child directly could rebuild it from caller-provided settings instead
of the parent's current authority.
## What changed
- Route child reloads through their loaded immediate parent and reject direct
cold resume when that parent is unavailable.
- Preserve the child's recorded model, provider, reasoning effort, and role
while inheriting the parent's execution policy and MCP extensions.
- Validate cached environments against the parent, intersect local permission
profiles, and reject stale remote or workspace-root configurations.
- Keep paginated cold-resume token usage attribution when attaching to the
reloaded child.
## Testing
Add coverage for owner validation, nested-parent reloads, permission and
environment changes, role instruction restoration, paginated usage replay,
and app-server child resume behavior.
GitOrigin-RevId: 84014762bcdb57f94fc23974c9c1af55dc1babf1
## Why
`SetSecurityInfo` can reject a directory handle opened with only `WRITE_DAC`.
## What changed
- Request `READ_CONTROL` alongside `WRITE_DAC` when opening or creating a
no-reparse sandbox directory.
- Add a Windows regression test that provisions and locks a plain sandbox
directory through the handle-based ACL path.
GitOrigin-RevId: bd50dc54d4cc80e9609323ddb4ecc7e4780a31fb
## What changed
- Split the approval review contributor into a `fast_decision` path for existing evidence and a `full_review` path for structured reviews.
- Add host-owned full-review inputs with action evidence, conversation history, thread and turn identifiers, approval context, and extension data.
- Add structured assessment and error types, and resolve full reviews using the first contributor that claims the request.
## Testing
- Cover full-review input propagation, first-claim ordering, and short-circuit behavior in the extension registry tests.
GitOrigin-RevId: 6f763d874af8c0b66a0d760b7b7c7dfe32251c9e
## What changed
- Render web-link labels in cyan with an underline and hide the repeated destination in recognized terminals with hyperlink support.
- Keep destinations visible for unknown terminals, multiplexers, non-terminal output, and empty labels so the URL remains usable.
- Preserve OSC 8 link targets through prose and table wrapping, streaming updates, transcript clipping, and pager scrolling.
## Testing
- Add coverage for terminal detection, label formatting and fallbacks, wrapped tables and prose, streaming parity, history output, and scrolled transcript rendering.
GitOrigin-RevId: 4a09e41e349ba299022a9c00f0c25892d9aaefe3
## What changed
- Add `features.network_proxy.credential_broker` and preserve structured network proxy settings when toggling the feature through config APIs.
- Protect broker enablement and provider context variables from project config, while carrying trusted context into filtered shell environments.
- Propagate brokered credentials through shell snapshots and restore real credentials for unsandboxed escalated commands.
- Normalize broker context environment keys case-insensitively on Windows and avoid conflicting remote managed-network enforcement when no proxy launch configuration is available.
## Testing
- Cover config layering, editing, project sanitization, Windows environment handling, shell snapshots, escalated execution, and end-to-end GitHub credential brokering in the zsh-fork runtime.
GitOrigin-RevId: 500e51e804e1988022052ccfe00b8fac5e495f4f
## What changed
- Track truncation and omission across Guardian v2 actions, transcript entries and images, and synchronous review evidence.
- Emit `codex.guardian_v2.classification.truncation` counters and byte histograms for original, retained, and omitted content after successful classifications.
- Tag observations by input component and whether content was truncated or fully omitted.
## Testing
- Extend async scorer coverage for action truncation metrics.
- Verify the app-server Guardian flow records truncated review evidence.
GitOrigin-RevId: 70680897f75716770aa072f866d60bd37e171c1d
## Why
Parent-owned Multi-Agent V2 subagents must remain controlled by their parent,
but several app-server endpoints could still mutate them directly.
## What changed
- Centralize the direct-input ownership check and apply it to turn injection,
MCP calls, reviews, compaction, rollback and revert, shell and Guardian
actions, realtime requests, and goal mutations.
- Enforce the same policy for goal mutations on unloaded threads while keeping
goal reads and turn interruption available.
- Document the affected endpoint behavior and continue exposing
`canAcceptDirectInput: false` for parent-owned subagents.
## Testing
- Cover direct-input rejection for both legacy and paginated thread history.
- Cover goal mutation ownership checks for unloaded V2 subagents, V1
subagents, and non-subagent V2 threads.
GitOrigin-RevId: 791b7af98490aed5eab4e672b90661acad11ec23
## Why
Blocking PTY reads and output-channel sends can keep Tokio runtime shutdown
waiting when a detached child retains the terminal or output backpressure fills
the channel.
## What changed
- Drive Unix PTY reads and writes through nonblocking `AsyncFd` readiness so
their tasks can be cancelled during shutdown.
- Keep draining child output after its receiver closes, and preserve queued
input plus EOF delivery when portable PTY stdin closes.
- Return a descriptive error when PTY spawning uses a Tokio runtime without an
I/O driver.
## Testing
Add Unix coverage for detached children, full and dropped output channels,
large input with EOF, inherited file descriptors, and runtimes without I/O.
GitOrigin-RevId: f7f1f58abebf8bf1d39285cd61b8d69946d54155
## What changed
- Add the under-development `content_item_kinds` feature, disabled by default.
- Strip content item classifications from Responses input when the feature is
disabled while preserving other passthrough metadata.
## Testing
- Add coverage that disables the feature and verifies requests omit content item
kinds without removing the turn ID.
GitOrigin-RevId: f938feb2895d766d979b1666fc7b97fd128fe8a7
## What changed
- Record the initiating agent path when inter-agent communication triggers a turn.
- Emit completed subagent activity to that agent's turn instead of always using the completed agent's parent thread.
- Keep parent-directed completion messages unchanged.
## Testing
Added a multi-agent v2 regression test where one sibling requests follow-up work from another and receives the resulting completion activity on the requesting turn.
GitOrigin-RevId: 949dd1116cccdd461c66a9b213a5bcd554cb3720
## Why
A failed shell snapshot capture was cached for the lifetime of its cache entry, so later commands continued using the original command even after a transient profile error was fixed.
## What changed
- Retry failed captures after a one-second backoff, up to three total attempts.
- Share each attempt across concurrent requests and preserve command fallback during failures and backoff.
- Keep the final failure cached after the retry budget is exhausted.
## Testing
Cover recovery and retry exhaustion for concurrent requests, local and remote execution, pipes and TTYs, and Bash and zsh where available.
GitOrigin-RevId: b432ef7c9eb35a3a0a703ac675b4db6954c43a80
## What changed
- Run capability discovery for roots with the same sandbox context in one sandbox helper invocation.
- Keep roots with different sandbox permissions isolated, and fall back to per-root discovery if the batched invocation fails.
## Testing
- Add coverage for single-launch batching, fallback after a sandbox launch failure, and roots with different permission profiles.
GitOrigin-RevId: a6e185a8edfd028fc3639b7c6c3cc7da342b6fe3
## What changed
- Detect readable symbolic `:root` entries separately from effective full-disk access so narrower deny-read rules do not disable the Windows sandbox's broad-read setup.
- Add explicit readable roots to that setup while omitting the filesystem root itself, and prevent read roots at or below denied paths from being granted access.
## Testing
- Extend the elevated Windows sandbox integration test to verify that an allowed bundled skill under the user profile remains readable while exact and glob-based secrets stay denied.
GitOrigin-RevId: 8f6f267b78718b9e8609a9205c489f253f478491
## What changed
- Configure x86_64 Windows MSVC `rules_rs` toolchains to use the bundled
`rust-lld` linker.
- Make `rules_rust` select the configured direct linker for that target unless
the toolchain explicitly prefers the C compiler driver.
GitOrigin-RevId: 941a1ca42b931cbb9e1c2d68300b8a82a5250be8
## Why
A Multi-Agent V2 child can finish after the parent turn that spawned it, so its
successful completion needs to remain associated with that parent turn in
notifications and history.
## What changed
- Add `completed` to `SubAgentActivityKind` and emit the corresponding started
and completed item events on the spawning parent turn when a child succeeds.
- Persist completed activity as a canonical turn item in both legacy and
paginated history, and expose it through app-server history and schemas.
- Render completed activity as terminal in the TUI without counting it as a
separate tool call or tool-runtime event.
## Testing
- Cover successful completion in legacy and paginated history, late updates to
completed parent turns, TUI rendering, analytics, and rollout tracing.
- Verify that terminal child errors do not emit completed activity.
GitOrigin-RevId: 6c71eb8b10e7327611c6af84f70e294e27d94d02
## What changed
- Register the stable, requirements-only `in_app_local_automation` feature for desktop apps.
- Add the feature to the configuration schema.
- Verify that an enterprise requirement can disable local automation.
GitOrigin-RevId: 939f7f3ee15f662dc85589cd1bcc3838e4cd1287
## What changed
- Retain completed synchronous Guardian reviews as structured records until the async scorer builds its classification input.
- Render and bound review correlation, action, rationale, and full evidence body with the async scorer's transcript truncation marker.
- Extend the Guardian V2 integration test to verify oversized action and rationale content is truncated and the resulting review evidence remains bounded.
GitOrigin-RevId: 0000ba77b810748e34254dd00df4a69f8492e175
## What changed
- Recognize percent-encoded drive colons when inferring Windows paths, rendering
native path strings, and resolving same-drive relative joins.
- Reject Windows file URIs with percent-encoded `/` or `\` separators before
converting them to native absolute paths, so decoding cannot reinterpret URI
segment boundaries.
## Testing
- Cover uppercase and lowercase encodings for drive colons and path separators,
including local-drive and UNC file URIs.
GitOrigin-RevId: ecb6c92f4ef1af73f85e57a135abf6bc5bb968dc
## Why
Windows update commands could be influenced by the current project through
relative `PATH` entries or project-local package-manager configuration.
## What changed
- Resolve package-manager commands and `powershell.exe` using only absolute
`PATH` entries before starting an update.
- Run the resolved command from a temporary directory so the current project
does not affect the update, while retaining Windows `.cmd` and `.bat`
handling.
- Reject a relative-only `PATH` with guidance to update manually.
## Testing
Added a Windows regression test that verifies relative `PATH` entries and
current-directory command decoys are ignored.
GitOrigin-RevId: 15303165af42718244b99786f939f400dc6cbd07
## What changed
- Add a `GuardianPolicy` contextual fragment that renders as a standalone
developer message with the `guardian.policy` content kind.
- Use the fragment when rebuilding Guardian context and verify that its content
kind remains attached after history compaction.
GitOrigin-RevId: f7028fb29a48ad2453437f3d3a4405fcab7a2fd7
## What changed
- Build `skills.list` pages against the current tool-call response-byte budget.
- Skip entries that cannot fit, preserve pagination across retained entries, and report oversized metadata without repeating the warning for the same budget.
- Keep existing cursors compatible while encoding the response budget in new cursors.
## Testing
- Cover direct and Code Mode listing, budget changes between pages, provider and omission warnings, oversized entries, legacy cursors, and budgets too small to return discovery warnings.
GitOrigin-RevId: 4b34cd2714e4849fe9155ce3f0021b218763c395
## What changed
- Cover forwarding a legacy `env_vars` entry when the portable MCP server has no `env` map.
- Use the test workspace variable instead of `PATH` in the stdio round-trip test, keeping overlay forwarding distinct from portable environment expansion.
GitOrigin-RevId: c5cfb333e553581fc856d43a04e5be0abd9f65ef
## What changed
- Increase the Guardian sampler's initial WebSocket pool from 2 connections to 8.
- Keep pool growth and recovery tests focused on the two-connection scenarios they exercise while making the remaining tests derive their expectations from the initial pool size.
GitOrigin-RevId: e2eabcdde5828ac7df333271f3253e74d696f396
## Why
Yielding once after spawning the test executor does not guarantee that its TCP
listener is ready, so the environment can race the server during setup.
## What changed
Poll the executor address until it accepts a TCP connection, with a five-second
timeout and a clear error if startup does not complete.
GitOrigin-RevId: b44b5bbef666a97da1299d05790f5e9c976d914f
## What changed
- Replace structured numeric classifier output with a single `high` or `low`
token and map those classifications to `1.0` and `0.0` risk scores.
- Require the classification contract in both default and overridden prompts,
including when classifier instructions are truncated.
- Return the first streamed classification immediately while draining the
remaining response for connection reuse and token accounting.
## Testing
- Cover prompt rendering and truncation, classification parsing, early streamed
results, conflicting later output, WebSocket reuse, and approval routing.
GitOrigin-RevId: 31a57e4eb9bf8df2a161b84aa3d5b16ab8f2937b
## What changed
- Add `ToolCallSource` to extension `ToolCall`s and propagate direct or Code Mode
invocation metadata, including the runtime cell and nested tool-call IDs.
- Add `ToolCall::response_byte_budget` so extension tools can bound direct-call
responses by the host truncation policy while allowing Code Mode responses up
to the tool's own limit.
- Share the skills extension's response-size limit between its `list` and `read`
tools.
## Testing
- Verify that Code Mode source metadata is preserved when core constructs an
extension tool call.
GitOrigin-RevId: b10aef01be30d35b67bee3af24a1a4175c9ee112
## Why
On macOS, rejecting a symlinked writable root during sandbox setup could be
misreported as corrupt session data because both paths surfaced an
`InvalidInput` I/O error.
## What changed
- Treat only `InvalidData` errors as evidence of corrupt session storage.
- Preserve `InvalidInput` failures so the original sandbox preparation error
and its actionable details reach the user.
## Testing
Add a macOS regression test that configures a symlinked writable root and
verifies thread creation reports the sandbox failure without suggesting that
session data is corrupt.
GitOrigin-RevId: 2b83d9f92a517407b88c21b471fa8bff5fd20d1d
## What changed
Set the local exec server's `shellSnapshotV2` capability on Unix, while
continuing to report it as unsupported on other platforms.
GitOrigin-RevId: 5e60cfb459c9312a3c56f020c11f7eece6643ab2
