## What changed
- Recognize executables under `codex-resources/` as part of a package layout by resolving the sibling `bin/` directory, while requiring that directory to exist.
- Add `InstallContext::package_manifest()` to parse the semantic package version from `codex-package.json`.
## Testing
- Extend the package-layout test fixture with a complete manifest and verify that version `1.2.3` is returned.
GitOrigin-RevId: 034aad3e8b865c6c6ecdff47da7c12c969744404
## What changed
- Parse safety-buffering payloads from typed `response.metadata` SSE events.
- Preserve the existing top-level `safety_buffering` field as the authoritative value when it is present, including when it is null or malformed.
- Continue applying the header-provided fallback model when the metadata payload omits `retry_model`.
## Testing
- Add parser coverage for metadata fallback, top-level precedence, and unrelated metadata events.
- Exercise metadata-based safety-buffering delivery through the core SSE integration test.
GitOrigin-RevId: 7dadfd54be28f2f33c2283de92fd49da0557d98a
## What changed
- Add `goals.max_goal_token_budget` as a positive-integer configuration setting.
- Use the configured maximum as the default budget for new goals and when `tokenBudget` is reset to `null`.
- Reject goal creation and updates whose token budget exceeds the configured maximum, including requests through goal tools and `thread/goal/set`.
- Respect managed configuration precedence and per-thread configuration overrides.
## Testing
- Cover configuration parsing and managed overrides.
- Cover defaulting, resetting, and rejecting oversized budgets through the goal service, goal tools, and app-server API.
GitOrigin-RevId: f8d7e6418cdc237d454c8cf47bb32ba0d44a60cf
## Why
Managed networking implicitly selected the elevated Windows sandbox backend,
even when the sandbox was configured to use a restricted token.
## What changed
- Select the Windows sandbox backend solely from `WindowsSandboxLevel`.
- Reject managed networking with a restricted-token sandbox before spawning a
process, since managed networking requires the elevated backend.
- Cover the rejection through sandbox preparation, unified exec, and Windows
sandbox session tests.
GitOrigin-RevId: 308858652d7b629af623d22896dafde3a23d3758
## What changed
- Exclude conversation turn count, response-engine latency, and turn token usage metrics from the built-in Statsig exporter, alongside the existing API and tool-call exclusions.
- Apply the Statsig exclusion list consistently to counters, histograms, gauges, observable gauges, and duration histograms.
- Preserve all excluded metrics for custom OTLP exporters and extend the loopback coverage to verify they are exported.
GitOrigin-RevId: e49f9aa1433126a3de8dbed76a4d2688f2831af8
## What changed
- Add `codex-history` for model-history and persisted-rollout domain types, including `RolloutItem`, `RolloutLine`, `CompactedItem`, and initial/resumed history state.
- Re-export the persisted types from `codex-rollout` and update consumers to use the new crate boundary instead of `codex-protocol`.
- Preserve existing rollout serialization, including legacy numeric compacted-window IDs.
## Testing
- Add `codex-history` tests for rollout JSON round trips, compacted-history compatibility, persisted history modes, and multi-agent version selection.
GitOrigin-RevId: 944daa9297ddd231d3aebbdcb05fff4adf8b4e1b
## What changed
- Reject patches containing multiple operations whose paths resolve to the same file, such as `duplicate.txt` and `./duplicate.txt`.
- Preserve support for patches that update multiple distinct files.
## Testing
- Add CLI integration coverage for distinct updates and duplicate resolved paths.
GitOrigin-RevId: 0fb7f69ae31acc5c677268ffd9e38ad8d8314276
## What changed
- Cover non-blocking credential probes when the file or secrets store is locked, including retaining only a matching prior credential snapshot and recovering after the lock is released.
- Extend the streamable HTTP OAuth round trip to verify that user turns continue during store contention, newly discovered servers recover after contention, and logged-out servers do not reuse authenticated connections.
- Cover reconciliation of authentication failures and effective `Authorization` headers.
GitOrigin-RevId: 8e377644001bd0be04dc9f79841080094d09d199
## Why
Standard MCP forms can require user-entered values even when tool permissions are
otherwise auto-approved in full-access sessions.
## What changed
- Recognize the `openai/standard-form-input` client extension and surface
non-approval forms in full-access, user-initiated root threads.
- Keep approval forms, automation and subagent threads, headless sessions, and
clients without the capability on their existing decline or review paths.
- Treat the capability as client-only so it is not advertised to MCP servers,
and enable it after session startup so required servers cannot block startup
waiting for form input.
## Testing
Add unit and app-server coverage for accepted form round trips, declined cases,
approval metadata safeguards, resumed threads, and extension filtering.
GitOrigin-RevId: 053bfe397a5c79eceef90a81d13e2aca6353af43
## What changed
- Rename `EnvironmentConfig` to `TurnEnvironmentConfig` to make its scope explicit.
- Rename the corresponding `SessionConfiguration` accessor and update all call sites.
GitOrigin-RevId: f47d745566199e699bd8e7c671c313eaf3bba79e
## Why
Refreshing MCP connection identities should not stall the async executor while another process holds the OAuth credential-store lock.
## What changed
- Probe file and secrets credential stores without waiting during runtime refreshes, retaining the last known credentials when the store is contended.
- Reuse unchanged authentication failures while credentials are temporarily unavailable instead of restarting the connection.
- Run blocking credential loads on a blocking worker during MCP client construction.
- Allow OAuth fallback when a configured authorization header is missing, empty, or invalid.
GitOrigin-RevId: 38dad5606da9a1ceb30fe945000ec9151a5058fa
## What changed
- Send Unix `execve` approvals intercepted by the zsh fork through the shared approval pipeline, including permission hooks, Guardian review, user prompts, and telemetry.
- Resolve the active turn and its auto-review setting when an intercepted command needs approval, so commands sent to persistent terminals use the current turn's reviewer.
- Give each intercepted command a distinct approval ID and propagate an aborted approval as a turn abort.
## Testing
- Cover Guardian review for intercepted `unified_exec` commands and persistent terminals across turns.
- Verify repeated identical intercepted commands receive separate user approvals.
GitOrigin-RevId: e6cccf160637e4246aff4714c22f08c90b65306d
## What changed
- Add `pluginId` to each `mcpServerStatus/list` result.
- Populate it for MCP servers contributed by installed or selected plugins, and
return `null` for servers from other sources.
- Update the generated protocol schemas, TypeScript bindings, and app-server
documentation.
## Testing
- Cover plugin-owned servers in plugin installation and executor flows.
- Verify non-plugin servers and protocol serialization return a null
`pluginId`.
GitOrigin-RevId: 0e4b912252cf51be56dcb63e0c1c7365a5e870ee
## What changed
- Set `CODEX_SESSION_ID` to the shared root-session ID for shell tool calls,
unified exec processes, and user shell commands.
- Preserve `CODEX_SESSION_ID` when restoring a shell snapshot, alongside the
existing runtime-owned environment variables.
GitOrigin-RevId: 5228867d25507105c7edf11607a8298958c3b917
## What changed
- Restore a V2 agent's inherited environment selections when reloading its
thread after residency eviction.
- Keep the restored execution environment and its tools available when the
agent receives a follow-up task.
## Testing
- Add an integration test that evicts and reloads a V2 agent, then verifies
its environment selection and `exec_command` tool are preserved.
GitOrigin-RevId: a5d4ad0fa465c717b32b7ae6807486429187a41d
Call `scrub_non_inheritable_env_vars` directly from each Git command path and
remove the redundant crate-local forwarding helper.
GitOrigin-RevId: 9e4125dc538ea888626bde3cb3646a90712206a2
## Why
Concurrent MCP startup and status checks should not serialize when they only read the shared credential store. Repeated reads of the encrypted MCP OAuth store also needlessly decrypted unchanged contents.
## What changed
- Use shared locks for `File` and `Secrets` credential reads while keeping saves and deletes exclusive.
- Cache decrypted MCP OAuth secrets by store path, ciphertext, and passphrase, and invalidate the cache after writes.
## Testing
- Cover concurrent readers, reader/writer exclusion, shared credential loads, and cache invalidation after updates and deletes.
GitOrigin-RevId: f13512e6404d4919879ba5ba77a3e34e52b35640
## What changed
- Restrict host loading, snapshot, and outcome implementation details to the
skills extension crate.
- Require `HostSkillsLoadInput` construction through its public constructor
instead of exposing its fields.
- Remove redundant implicit-invocation helpers from `SkillLoadOutcome`; use the
`ImplicitSkillLookup` interface for enabled-skill lookup instead.
GitOrigin-RevId: e79c77fc3e69ecc0231b0c87e5f9f24a5487f9e4
## Why
The plugin and skill test suites were excluded wholesale on Windows, even though
most cases do not depend on POSIX behavior.
## What changed
- Make generated TOML and JSON fixtures escape Windows paths correctly.
- Use Windows-safe path canonicalization and normalize advertised skill paths.
- Select test environments through the environment-aware builders.
- Run the suites on Windows while narrowly skipping cases that execute POSIX
commands or require matching host and executor path conventions.
GitOrigin-RevId: aadf31013c2bf9bac728adc4dd96f572d4a3bf3f
## Why
The app server should not need access to host skill root internals to decide
which paths require filesystem watching.
## What changed
- Add `HostSkillsService::watchable_skill_root_paths` to return non-plugin,
non-system skill roots for the watcher.
- Make `HostSkillRoot` and root resolution private to the skills extension.
- Update the app-server watcher to consume the filtered paths directly.
## Testing
Add a host service test confirming that user skill roots remain watchable while
plugin and generated system roots are excluded.
GitOrigin-RevId: b3e3b576e4ffe96230af71d9bf7c6c315b1705d3
## What changed
- Remove the path-only `effective_skill_roots` API and its type-erasing trait in favor of `effective_plugin_skill_roots`, which preserves plugin metadata.
- Remove skill-path ancestor lookup helpers and keep namespace resolution scoped to an explicit plugin root.
- Update plugin manager and namespace tests to exercise the retained APIs directly.
GitOrigin-RevId: 507bf43bc6147bb5ab2deba4fa176bea2535159c
## What changed
Add the `codex.turn.unified_exec.running_processes` counter and increment it
by the number of background terminal processes remaining when a turn finishes.
GitOrigin-RevId: 82a33b89533960d86cef95360fa122836c8aa84d
## Why
A single `skills/list` request should use one view of shared skill roots across
all requested workspaces while still applying each workspace's skill rules.
## What changed
- Add a request-scoped host skills view that reuses non-plugin root snapshots
across `cwd` entries without persisting them across requests.
- Resolve user-scoped plugin skill roots once per request, then apply workspace
skill configuration separately for each `cwd`.
- Make `forceReload` refresh plugin roots before building the request-scoped
view so subsequent entries see the refreshed skills.
## Testing
Expanded `skills/list` and host skills service tests to cover multiple ordered
workspaces, per-workspace skill rules, request-local snapshots, cached results,
and forced plugin-root refreshes.
GitOrigin-RevId: eedd3a4c3e213b7f30df6cacd3adf23ba2967437
## What changed
- Load an optional package-supplied config file as the lowest-precedence
configuration layer, so every existing layer can override its values.
- Report the layer as `packagedDefaults`, including its source path, through
config diagnostics and the app-server protocol.
- Return an error when a configured packaged defaults file is missing.
## Testing
- Cover precedence across packaged, system, user, and session layers.
- Cover the missing-file error path.
GitOrigin-RevId: 52406890f4d580eedabc90bf2a9ee3affa36fee1
## What changed
- Make `package` the only required argument to `skills.read`, resolving the
owning orchestrator or executor catalog automatically.
- Default omitted `resource` values to the package's main `SKILL.md`.
- Render orchestrator skills as package locators and instruct the model to read
them directly without first calling `skills.list`.
- Update skill extension and app-server coverage for direct main-resource
reads, referenced resources, aliases, and the revised tool schema.
GitOrigin-RevId: 9faf57a8d0935566a15094931eaabaa8f0613e9e
## Why
Building a prompt cloned every model-visible `ToolSpec`, even though the tool
set is immutable for the lifetime of its router.
## What changed
- Store model-visible tool specs as an `Arc<[ToolSpec]>` in `ToolRouter` and
`Prompt` so prompt construction only clones the shared pointer.
- Keep separately built routers on distinct shared slices so refreshed tool
sets remain independent.
## Testing
Extend router tests to verify allocation sharing within a router, allocation
separation across rebuilt routers, and the existing deferred-tool filtering.
GitOrigin-RevId: 1e04cd7c4d1b3fa0b494c5c51670232d38ba8ebb
## What changed
- Direct the built-in `image_gen` path to request transparent backgrounds and
preserve the generated alpha channel.
- Remove the built-in chroma-key generation and local background-removal
workflow from the skill guidance and examples.
- Keep CLI model fallback explicit, including confirmation before switching
from `gpt-image-2` to `gpt-image-1.5` for transparent CLI output.
GitOrigin-RevId: 1a6fbbb632bbf3f95146347d66da5382313b32a2
## Why
Clients need to correlate a remote plugin installation request with a specific
installation attempt.
## What changed
- Add the optional `installAttemptId` field to `PluginInstallParams`.
- Forward the value as `install_attempt_id` in the remote plugin install POST
body.
- Preserve the existing empty request body when the field is omitted.
## Testing
- Cover protocol serialization and remote install request bodies with and
without an attempt ID.
GitOrigin-RevId: ffdceff4f9329b650848e6428a9ba39646c242c3
## What changed
- Add the `apply_patch_preserve_line_endings` feature, disabled by default, to
preserve CRLF, CR, and mixed line endings when `apply_patch` updates files.
- Apply the feature consistently to built-in patch handling and patches invoked
through shell, user-shell, unified-exec, and app-server command execution.
- Keep the active feature configuration authoritative over inherited, shell
snapshot, and client-provided environment values.
## Testing
- Cover line-ending behavior with the feature enabled and disabled for custom
tool calls, shell heredocs, command execution, and the `apply_patch` CLI.
GitOrigin-RevId: 531a7c66761959c650270559f57941929f03e6c4
## Why
Updating a file with `apply_patch` historically normalized its contents to LF,
which can rewrite line endings outside the requested change.
## What changed
- Add an opt-in `PreserveLineEndings` update mode and thread it through patch
verification, application, and the standalone executable. Existing APIs keep
the LF-normalizing mode by default.
- Retain the original endings of untouched and context lines, including in
mixed-ending files, and use the file's first line ending for inserted or
replaced lines.
- Track patch context separately from identical changed lines so preservation
does not alter replacement ordering or matching.
## Testing
Add coverage for CRLF, CR, mixed endings, trailing blank lines, repeated lines,
EOF overlap rejection, and legacy LF normalization.
GitOrigin-RevId: 085f0cbc57e0965aa62c6a2d0e80870424e762f5
## Why
Resolving the working directory encoded in a Cursor project name could recursively scan large directory trees.
## What changed
- Probe a bounded set of path candidates using common filename separators instead of walking the directory tree.
- Stop after 128 probes and reject ambiguous matches or unsafe encoded components.
- Parse Windows drive prefixes separately from the encoded path.
## Testing
Added coverage for common separators, ambiguous leaf and ancestor paths, and Windows drive prefixes.
GitOrigin-RevId: 34b2a2bbe2d302fac3d2614a5e36dd3fa20cf2e5
## What changed
- Accept `grpc://IP:PORT` endpoints through `--listen` and serve the existing
code-mode gRPC service over TCP.
- Print the bound HTTP endpoint to stdout so callers can discover the port when
binding to port `0`.
- Apply the protocol frame-size limits and disable Nagle's algorithm on accepted
connections.
## Testing
- Add an end-to-end test that starts the host on an ephemeral port, connects a
gRPC client, and opens a session.
- Verify accepted gRPC sockets have `TCP_NODELAY` enabled.
GitOrigin-RevId: 51d6c21dff8cffb47068c0677ba10ff370385cec
## What changed
- Append a stable `std::io::ErrorKind` category to the
`failed_to_load_session_config` subtype, including categories such as
`invalid_data`, `not_found`, and `permission_denied`.
- Propagate the categorized subtype through session import failure reporting.
## Testing
- Add an app-server test that verifies an invalid config reports
`failed_to_load_session_config_invalid_data` in both the import completion
notification and analytics event.
GitOrigin-RevId: e9a1a7cd36979911f422805180dd91b6ed65e14e
## Why
Overflowing whitespace in the TUI composer could occupy a separate blank row
instead of remaining attached to the text that follows it.
## What changed
- Add composer-specific, grapheme-safe wrapping that keeps breakable Unicode
whitespace with the following word while preserving semantic breakpoints such
as hyphens and nonbreaking spaces.
- Preserve cursor insertion rows and positions as content reflows, including
across full lines and wrapped fragments.
- Keep wrapping linear for maximum-length unbroken input.
## Testing
Add focused rendering and cursor tests for ASCII and Unicode whitespace,
hyphenated words, reflowed fragments, and maximum-length input.
GitOrigin-RevId: fb7713e33bfddf37460b6c2f6f0c9700f31d86bf
## What changed
- Add `environmentConfigRead` to exec-server environment capabilities and advertise it for local executors.
- Default the capability to `false` when deserializing responses from older executors.
## Testing
- Verify legacy capability responses remain compatible and the environment config integration reports support.
GitOrigin-RevId: c2110fea9e0e6e756eaeaaad096c50a943668c99
## Why
Plugin install failures need stable, low-cardinality details that distinguish
actionable causes without relying on error messages.
## What changed
- Add HTTP status subtypes for remote catalog, mutation, and bundle download
failures, including specific common statuses and a general `http_5xx` bucket.
- Emit failure analytics when a remote plugin is disabled by an administrator or
unavailable under its install policy.
- Preserve marketplace I/O, configuration, and task failure subtypes, including
failures that occur before a plugin ID can be resolved.
## Testing
Add app-server coverage for catalog and install HTTP failures, unavailable
remote plugins, unreadable marketplace files, and oversized bundle error
responses.
GitOrigin-RevId: 71a4888c492d1806bf4ff92bebc48f40cfb89300
## What changed
- Represent configured handlers by handler kind and route execution through the
hooks engine, while preserving command hook behavior.
- Reject MCP tool inputs containing values such as `null` that cannot be
represented in TOML for trust hashing.
## Testing
- Add coverage for rejecting `null` at the top level and within nested MCP tool
input objects and arrays.
GitOrigin-RevId: 3854a349c2a721691450467592f99cf57e6260ef
## What changed
Read `allow_prefix_rules` from the turn attached to the active step context
when selecting the exec policy and constructing unified exec approval requests.
GitOrigin-RevId: d2d26e88b9cefa28bb2df5b9f71aa7b30b7ea331
## Why
Prompt editing looks up the selected user message in the thread's turns, but
new live turns may still exist only in the replay buffer.
## What changed
Reconstruct buffered turns from turn and item notifications before locating
the prompt to edit. Preserve completion metadata and avoid duplicating turns
or items already present in the snapshot.
## Testing
Extend the prompt-edit fork test to cover a selected turn supplied through the
replay buffer and verify that the source thread remains unchanged.
GitOrigin-RevId: e357098085a4def871f3df65b6721a31e07b737f
## Why
Deferred environments can become ready after a turn starts. Guardian approval
reviews must use the environment selected for the current step so their working
directory and permission context are not taken from the stale turn snapshot.
## What changed
- Carry `StepContext` through tool execution and approval handling.
- Add a Guardian review context that pairs the parent turn with the current
step's environment snapshot.
- Use that snapshot for Guardian prompts, reviewer sessions, and delegated
reviewer threads while retaining turn-level fallbacks for callers without a
step context.
## Testing
Added an integration test that makes a deferred remote environment ready before
an escalated command and verifies Guardian receives that environment's working
directory and denied-read policy instead of the initial local environment's.
GitOrigin-RevId: 779096bc7d0e0c7453a009c02141029714b9b407
## What changed
- Add the `codex-workload-identity` crate for exchanging a file-backed JWT assertion and federation rule ID for short-lived ChatGPT credentials.
- Cache valid access tokens, refresh them before expiry or after rejection, and coalesce concurrent exchanges. Continue using a still-valid cached token when a proactive refresh fails transiently.
- Validate assertion files, token endpoints, and exchange responses; honor outbound proxy policy for HTTPS endpoints and redact access tokens from debug output.
## Testing
- Cover request encoding, assertion rotation, caching, concurrent refreshes, transient-failure fallback, configuration validation, and malformed inputs and responses.
GitOrigin-RevId: 5496851683c2dcf6aaad6840053b97f7c0be076e
## Why
Model-reachable child processes should not inherit Codex launch context.
## What changed
- Treat `OPENAI_FEDERATION_RULE_ID` and `OPENAI_IDENTITY_TOKEN_FILE` as non-inheritable environment variables, with case-insensitive matching.
- Remove them after shell environment policy overrides and before spawning commands across execution, MCP, hooks, Git helpers, and remote helper processes.
## Testing
- Cover inherited and explicitly configured variants, including mixed-case names.
- Verify the variables are absent from real child environments and app-server command and process execution.
GitOrigin-RevId: 2535527893985fef0995617f4c5b2462bea7c136
## What changed
- Add `executionMode` to `HookMetadata` returned by `hooks/list`, with `sync` as the default for compatibility.
- Propagate each discovered hook's `sync` or `async` mode through the app-server protocol and generated schemas.
- Show the execution mode in the TUI hooks browser.
## Testing
- Cover async and default-sync modes in `hooks/list` tests and TUI snapshots.
GitOrigin-RevId: 9c9f2890798fe417face76c15847616b2dea9db4
## Why
Hook configurations can mark command handlers as asynchronous, but Codex previously skipped those handlers outside `SessionEnd`.
## What changed
- Run asynchronous command hooks in the background with a per-session concurrency limit, while keeping `SessionEnd` hooks synchronous.
- Prevent asynchronous hooks from blocking, stopping, rewriting, or otherwise controlling the operation that launched them.
- Deliver warnings and additional context at safe turn boundaries: inject results into an active turn after sampling, or buffer them ahead of the next user prompt when the session is idle.
- Preserve in-flight hooks across configuration reloads, scope spilled output to the thread, and abort outstanding work during session shutdown.
## Testing
Add unit and integration coverage for background scheduling, concurrency, output parsing, active and idle result delivery, configuration reloads, and shutdown cleanup.
GitOrigin-RevId: 8094552e4afe7b47b09a61bb575bb20f4e491d8d
## What changed
- Export `GrpcCodeModeHost` as a transport-independent implementation of the
code-mode gRPC API.
- Support leased sessions, execution and wait lifecycle operations, filtered
nested tool-call subscriptions, tool completions, and notification
acknowledgements.
- Share host-wide request and active-cell limits across the existing and gRPC
transports, and bound identifiers, metadata, subscriptions, and pending
callbacks.
## Testing
- Add coverage for request conversion, ordered callback routing, cancellation,
session cleanup, backpressure, malformed input, and resource-limit handling.
GitOrigin-RevId: f146ba7e6fe4e4aa02f25dd3f961120980516d0e
## Why
External agent detection can spend time reading session transcripts. Sharing the
configuration serialization queue causes unrelated configuration requests to
wait for detection to finish.
## What changed
- Give `externalAgentConfig/detect` its own global serialization queue.
- Keep configuration reads, requirements reads, writes, and external agent
imports responsive while detection is still running.
## Testing
Add a Unix app-server test that blocks transcript detection on a FIFO and
verifies the unrelated requests complete before detection is released.
GitOrigin-RevId: d2764dcdb0e96d810c790c570c48fa45690a3dc1
## Why
Timing out a command hook can leave descendant processes running after the hook itself is stopped.
## What changed
- Run hook commands in a process group on Unix and a job object on Windows.
- Terminate the full process tree when hook execution is cancelled or fails, with `taskkill` as a Windows fallback.
- Preserve descendants when a hook completes successfully so intentionally detached helpers can continue running.
GitOrigin-RevId: 1a18653d34c6f1685ef8c4f8e8546663b276292a
## What changed
- Filter saved `allow` prefix rules from the execution policy for cyber-specialized models and models listed in `auto_review.ignore_rules`, while preserving prompt, forbidden, network, and host-executable policy entries.
- Apply the filtered policy consistently to permission instructions, shell commands, unified exec, and the zsh-fork backend.
- Limit cyber-model command approvals to one-time decisions without proposing reusable policy amendments. General models continue to honor saved prefixes, including after switching models within a thread.
## Testing
- Add policy-level coverage for filtering allow-prefix rules while retaining restrictive and network rules.
- Add end-to-end coverage across shell and unified exec paths, zsh-fork execution, user and automatic review, and model switching.
GitOrigin-RevId: f3bd3872424291b12354ec415f33986ec369a368
Adam Perry @ OpenAI