## What changed
- Cover forwarding a legacy `env_vars` entry when the portable MCP server has no `env` map.
- Use the test workspace variable instead of `PATH` in the stdio round-trip test, keeping overlay forwarding distinct from portable environment expansion.
GitOrigin-RevId: c5cfb333e553581fc856d43a04e5be0abd9f65ef
## What changed
- Increase the Guardian sampler's initial WebSocket pool from 2 connections to 8.
- Keep pool growth and recovery tests focused on the two-connection scenarios they exercise while making the remaining tests derive their expectations from the initial pool size.
GitOrigin-RevId: e2eabcdde5828ac7df333271f3253e74d696f396
## Why
Yielding once after spawning the test executor does not guarantee that its TCP
listener is ready, so the environment can race the server during setup.
## What changed
Poll the executor address until it accepts a TCP connection, with a five-second
timeout and a clear error if startup does not complete.
GitOrigin-RevId: b44b5bbef666a97da1299d05790f5e9c976d914f
## What changed
- Replace structured numeric classifier output with a single `high` or `low`
token and map those classifications to `1.0` and `0.0` risk scores.
- Require the classification contract in both default and overridden prompts,
including when classifier instructions are truncated.
- Return the first streamed classification immediately while draining the
remaining response for connection reuse and token accounting.
## Testing
- Cover prompt rendering and truncation, classification parsing, early streamed
results, conflicting later output, WebSocket reuse, and approval routing.
GitOrigin-RevId: 31a57e4eb9bf8df2a161b84aa3d5b16ab8f2937b
## What changed
- Add `ToolCallSource` to extension `ToolCall`s and propagate direct or Code Mode
invocation metadata, including the runtime cell and nested tool-call IDs.
- Add `ToolCall::response_byte_budget` so extension tools can bound direct-call
responses by the host truncation policy while allowing Code Mode responses up
to the tool's own limit.
- Share the skills extension's response-size limit between its `list` and `read`
tools.
## Testing
- Verify that Code Mode source metadata is preserved when core constructs an
extension tool call.
GitOrigin-RevId: b10aef01be30d35b67bee3af24a1a4175c9ee112
## Why
On macOS, rejecting a symlinked writable root during sandbox setup could be
misreported as corrupt session data because both paths surfaced an
`InvalidInput` I/O error.
## What changed
- Treat only `InvalidData` errors as evidence of corrupt session storage.
- Preserve `InvalidInput` failures so the original sandbox preparation error
and its actionable details reach the user.
## Testing
Add a macOS regression test that configures a symlinked writable root and
verifies thread creation reports the sandbox failure without suggesting that
session data is corrupt.
GitOrigin-RevId: 2b83d9f92a517407b88c21b471fa8bff5fd20d1d
## What changed
Set the local exec server's `shellSnapshotV2` capability on Unix, while
continuing to report it as unsupported on other platforms.
GitOrigin-RevId: 5e60cfb459c9312a3c56f020c11f7eece6643ab2
## What changed
Pass the session source associated with each MCP configuration snapshot into
selected-environment server projection. This keeps Guardian reviewer isolation
decisions aligned with the snapshot being projected instead of rereading the
session's mutable configuration.
GitOrigin-RevId: 61fd891fec13f62cfea9886d13e2f94f6f60922f
## What changed
- Apply local `env_vars` declarations from `.codex-plugin/plugin.json` to matching stdio servers loaded from an Agent Plugin manifest.
- Replace matching `${NAME}` entries in the portable server environment with host environment forwarding while preserving the portable command, arguments, and unrelated servers.
- Ignore remote-sourced environment variables and support both inline and file-based Codex MCP declarations.
## Testing
- Cover matching-server filtering, local and remote sources, inline declarations, and an end-to-end `PATH` forwarding round trip.
GitOrigin-RevId: 843e1232a084fa5f571fe56e07266995b87fd53d
## What changed
- Include `environmentInfo` in the exec-server `initialize` response and seed the Rust client's metadata cache from it.
- Fall back to one lazy `environment/info` request when connecting to older servers that omit initialization metadata, then share the cached result across client clones and session recovery.
- Keep app-server `environment/info` requests uncached so they continue to probe the executor.
## Testing
- Cover initialization metadata, the legacy-server fallback, shared caching, accepted WebSocket environments, and repeated uncached app-server probes.
GitOrigin-RevId: 380132d9db183998d73e8c6b0954e4d70c7e8406
## What changed
- Use `gpt-live-1-codex` as the default model for frameless realtime sessions.
- Preserve an explicitly supplied per-session model override.
## Testing
- Cover both default and explicit model selection in the WebRTC frameless conversation test.
- Update the app-server live session request expectation for the new default.
GitOrigin-RevId: ce5dc978911ff0289d677b60fae2dd8cb1058d22
## What changed
- Include matching Codex tasks in the `@` mention popup when the active thread supports task tools, prioritizing tasks from the current working directory.
- Submit selected tasks as bounded live thread references so Codex can load their contents with `read_thread`.
- Preserve task mentions across composer history and thread start, resume, and fork flows.
## Testing
- Add coverage for task search and capability propagation, popup selection and rendering, submission encoding, history round-trips, and reference validation and limits.
GitOrigin-RevId: 17502be91bf6d4b01745668829eb69fb318cb5b9
## Why
The TUI rejected app-server dynamic tool calls as unsupported, so agents could
not inspect or manage other Codex tasks through a TUI session.
## What changed
- Add the `codex_tui` tool namespace for listing, reading, waiting on, creating,
forking, messaging, renaming, archiving, and restoring tasks.
- Handle tool calls through existing app-server thread operations, with bounded
inputs and responses and cleanup when calls complete or the TUI disconnects.
- Route delegation tools through an authenticated local MCP server with explicit
approval prompts, while respecting configured and managed MCP policies.
- Fall back to starting threads without dynamic tools when connected to an older
app server that does not support them.
## Testing
Add coverage for tool schemas and response bounds, task lifecycle operations,
approval-gated MCP transport, namespace dispatch, cancellation, and legacy
app-server fallback behavior.
GitOrigin-RevId: c782c11f0a3edceb3fa6909a4b92d6ce01a6eed3
## Why
The synthetic mount registry must remain private to the sandbox helper. A
writable bind overlapping its temporary directory could expose the registry,
and a pre-existing registry symlink could redirect bookkeeping into a writable
location.
## What changed
- Add the registry's read-only bind while constructing filesystem mounts, but
only when a writable bind exposes it and before applying deny masks.
- Reject a symlinked registry path before registering mounts or starting the
sandboxed command.
## Testing
Add coverage for symlink rejection and for denied temporary directories under
both full-root and minimal filesystem policies.
GitOrigin-RevId: 3adff28998f0ef8c8ec26a73e5a1183b4931c0e8
## What changed
- Show `SelfServeBusinessProLite` as `Business Premium` in TUI account displays instead of grouping it under `Business`.
- Update the display-name and app-server session tests for the new label.
GitOrigin-RevId: aac5c7abe9543f5d49f4e9dc9cbe20e7e3b41e5b
## What changed
- Add a dedicated contextual fragment for developer instructions that emits the
`generic.developer_instructions` content kind.
- Use the fragment when adding child-specific developer instructions to a
full-history subagent fork, preserving their classification and ensuring they
reach the child exactly once without appearing in the parent request.
## Testing
- Extend full-history subagent coverage to verify the child-only instructions'
annotation, placement, and count.
GitOrigin-RevId: 82589d311535225fed76d500a19458fda72f40f2
## What changed
- Build Responses Lite base instructions through a dedicated context fragment so the developer message carries the `model.base_instructions` content kind.
- Apply provider metadata cleanup after adding the base-instructions message, preserving the existing behavior for non-OpenAI providers.
## Testing
- Extend Responses Lite request coverage to verify the annotation is present for OpenAI requests and omitted for a third-party provider.
GitOrigin-RevId: b0317f92dfb9570860688b49e3a7668da516ee8c
## What changed
- Change the permission prompt content kind from
`generic.permissions_instructions` to `permissions.instructions`.
- Update request annotation tests to expect the new content kind.
GitOrigin-RevId: e1e39c74ac24668ac1f3467bb0cc1335a9408712
## What changed
- Derive each `InternalModelContextFragment` content kind from its source as
`<source>.internal_context` instead of using a shared generic kind.
- Cover the source-specific kind in the contextual user fragment test.
GitOrigin-RevId: 2075d558265fc1ae1ce394e9a865210d1bc270af
## What changed
Add a cross-platform pytest suite that extracts the CLI and app-server
archives and verifies:
- common CLI discovery commands;
- code-mode execution through both packaged entrypoints, including use of each
package's bundled `rg`; and
- the presence and usability of packaged debug symbols on Linux, macOS, and
Windows.
The suite accepts gzip or zstd package archives and isolates its Codex
configuration and state from the invoking environment.
GitOrigin-RevId: 25e517d349242c9f6226e95ef41e37a783e2373f
## Why
Image preparation can rewrite message content, including replacing images that
cannot be processed with model-visible error text. The positional content-kind
metadata must stay aligned with those rewrites.
## What changed
- Process message images together with their content-kind annotations.
- Preserve existing kinds for unchanged and resized content.
- Classify failed-image placeholders as `images.preparation_error`.
## Testing
- Cover metadata preservation across successful, resized, and failed images.
- Verify Responses Lite sends `user.image` and `images.preparation_error` kinds.
GitOrigin-RevId: 1be7bcbe47014251019bfff0d826c9dfe3239dec
## Why
Remote compaction's retained-message budget counted text but not images, so
image-heavy history could retain more context than the budget represented.
## What changed
- Add the opt-in `compaction_image_budget` feature to charge retained images
using the existing image size estimate.
- Keep images and their adjacent labels atomic when truncating a boundary
message, while preserving existing text, audio, metadata, and
client-authored developer-message behavior.
- Stop backfilling older messages when an image at the truncation boundary
does not fit.
## Testing
- Add unit coverage for image boundaries, annotations, audio, text-only
messages, and client-authored developer messages.
- Add an integration test covering repeated remote compaction with the feature
enabled, disabled, and left at its default.
GitOrigin-RevId: 88868bbd09d2858939dbae3f8402e1f497b4e3c6
## What changed
- Render omitted image and audio inputs as contextual fragments tagged with
`images.unsupported` and `audio.unsupported` content kinds.
- Normalize message media through annotated content so metadata for surrounding
content remains intact when switching to a model without media support.
## Testing
- Extend history and model-switching tests to verify content-kind annotations
before and after unsupported media is replaced.
GitOrigin-RevId: 4ee6577f8b78bd5a850ee01ea9d4590c20272850
## What changed
- Represent compaction summaries and Guardian-approved actions as typed contextual fragments.
- Inject subagent notifications through the same fragment path.
- Annotate the resulting request items with `compaction.summary`, `guardian.approved_action`, and `multi_agent.subagent_notification` content kinds while preserving their existing roles and text.
## Testing
- Verify the content-kind metadata on compacted summaries, approved actions, and subagent notifications.
GitOrigin-RevId: 01c93e7f08b2dc1c1e85ba69e82bfb5f56e6cca5
## Why
Local compaction rebuilds preserved user input as a single text item. Carrying
over the original per-item content kinds can leave its annotation metadata out
of sync with the rebuilt content.
## What changed
- Set the rebuilt item's content kind to `user.text` when the original message
had content-kind metadata.
- Preserve the remaining message and harness metadata.
## Testing
- Cover metadata normalization in compacted history.
- Verify persisted replacement history contains the merged text and a matching
`user.text` content kind.
GitOrigin-RevId: cd10b8ec68ef8ec2a272a90182e69875b60dc35c
## What changed
- Filter rolled-back model-switch instructions through annotated content so the
surviving developer fragments retain their matching content-kind metadata.
- Add regression coverage for annotation preservation and request-level metadata
alignment after rolling back a first-turn model change.
GitOrigin-RevId: 42a3c0cf4c5727bc6fe40990254467f40f4686f9
## Why
Developer-message content and its positional `content_item_kinds` metadata must stay aligned when parent history is prepared for a spawned agent.
## What changed
- Filter and rewrite developer-message content as annotated content so each retained item keeps its matching kind.
- Rebuild both message content and annotation metadata together after removing parent-only instructions and multi-agent usage hints.
## Testing
- Extend forked-history coverage to verify retained annotation kinds.
- Assert that spawned child requests contain the same number of content items and annotation kinds.
GitOrigin-RevId: 59748d9e8c4fc06ef8e5b90389bcf40465589f90
## Why
Rebuilding a truncated message from its content fields can drop passthrough
metadata and leave positional content classifications out of sync with the
items that remain.
## What changed
- Convert message content and its classifications into `AnnotatedContent`
before applying the token budget, then write both back together.
- Preserve other message and envelope metadata during truncation.
- Assign the `unknown` classification to content from legacy messages that do
not provide classifications.
## Testing
Expanded truncation coverage to verify that retained text and image items keep
their matching classifications and that unrelated passthrough metadata is
preserved.
GitOrigin-RevId: f84e2ebc3e97392e45f321dec3c171713864bdcd
## What changed
- Recognize `cua_repl` alongside `node_repl` when collecting Guardian review evidence, applying computer-use policy, and capturing transcript images.
- Render `cua_repl.js` results with the compact REPL history and transcript views.
- Preserve failed MCP call status and result content when replaying app-server history.
## Testing
- Cover both REPL server names across Guardian policy, evidence, image capture, history rendering, and failed-call replay tests.
GitOrigin-RevId: 8c13a721f718add403b07e727c1634b59203c51a
## Why
Guardian reviews were reported with the generic `subagent` thread source, making them indistinguishable from other delegated threads in persisted metadata and analytics.
## What changed
- Add the `guardian_review` thread source to the core protocol and app-server schema.
- Assign it to Guardian reviewer sessions and propagate the configured source through turn metadata, rollouts, and analytics.
- Continue treating Guardian reviews like subagents for paginated history and trusted-provenance checks.
## Testing
- Cover protocol round trips, delegate source selection, emitted analytics, request metadata, and persisted rollout metadata.
GitOrigin-RevId: 07480c122715812874c9d3b48bb39fc5c86b2367
## What changed
- Keep the normal composer footer visible when a draft contains the word `plan`.
- Remove the contextual “Create a plan?” prompt, its Escape dismissal behavior, and its per-thread dismissal state.
## Testing
- Update wide and narrow composer snapshots to cover the standard footer for plan-related drafts.
GitOrigin-RevId: 1a3c8cfce9d4effa2149790975133f652aa7c914
## What changed
- Preserve each contextual fragment's `ContentItemKind` when converting it to a response message.
- Classify user text, image, and audio content as `user.text`, `user.image`, and `user.audio` in their original order.
- Give additional context key-specific `additional_content.<key>` kinds and retain annotations on generated messages such as image resize notices and interrupted-turn markers.
## Testing
- Expand request-level coverage to verify content-kind annotations across mixed-modality turns, additional context, reminders, budgets, skills, model switching, subagents, and image resizing.
GitOrigin-RevId: 671e4545f39b335525c60d2a5df4608e8068cafc
## What changed
- Set `thread_source` to `memory_consolidation` in turn metadata for detached memory requests.
- Verify that startup requests carry matching turn metadata in the request header and nested `client_metadata`.
GitOrigin-RevId: 318d6f097e07463ac7a1c52b35a926532e67b83d
## What changed
- Carry each contextual fragment's `ContentItemKind` through initial context assembly and world-state updates.
- Attach the classifications to merged response messages through `content_item_kinds`, preserving their order alongside the message content.
- Convert extension prompt fragments into annotated developer fragments and classify built-in developer and guardian instructions.
## Testing
- Add an integration test covering roles and content annotations in the first request.
- Update world-state and persisted-history tests to account for annotation metadata.
GitOrigin-RevId: 71c48dad5b17bffd47ba03263e3eb6d5e74fbf4b
## What changed
- Require each `ContextualUserFragment` to provide a stable `<feature>.<name>`
`ContentItemKind`.
- Add `AnnotatedContent` and `RenderedFragment` so rendered text, its role, and
its classification can travel together to API boundaries.
- Derive extension-owned world-state classifications from the extension ID and
keep the skills catalog classification with its fragment implementation.
## Testing
- Verify that an extension-owned world-state section renders with an
`<extension-id>.instructions` content kind.
GitOrigin-RevId: e46b74a0bb41e0b6112667c9d36bc9e7f2714451
## Why
Collaboration can resume an archived descendant without unarchiving its
rollout. Archiving the parent again previously skipped shutdown for that
descendant because only rollouts newly marked as archived were prepared.
## What changed
Prepare every loaded thread in the spawn subtree for archival, including
descendants whose rollouts are already archived, before updating archive
state.
## Testing
Add an app-server integration test that resumes an archived child through its
parent and verifies that archiving the parent unloads the entire subtree.
GitOrigin-RevId: aca8c0d6ddb8900aad16becbeb594426cea1e3a6
## What changed
- Require each `PromptFragment` to include a producer-owned `ContentItemKind`.
- Re-export `ContentItemKind` from `codex_extension_api` and assign stable kinds to skills, memories, examples, and test contributors.
- Limit prompt slots to developer policy and developer capabilities, and combine contributed fragments into a single developer update.
## Testing
- Update extension registry tests to verify fragment ordering with the new content-kind metadata.
GitOrigin-RevId: ef8624a9b4ae9dce025bca9c0954d91dd8075e85
## What changed
- Add `ContentItemKind` as an open-ended string classification and carry an
optional list of kinds in `InternalChatMessageMetadataPassthrough`.
- Keep unknown classification values intact during round trips, while treating
a malformed `content_item_kinds` value as absent so the response item can
still be loaded.
## Testing
- Cover round trips for future classification values and deserialization of
malformed metadata.
GitOrigin-RevId: 5398cae5bb294a9f71ddd192e297177fab54a576
## What changed
- Cover live and replayed patch approvals recovering their file changes for the full-screen pager.
- Verify scrolling, resizing, dismissing and reopening the pager, and accepting or canceling a request exactly once.
- Document why approval requests recover diff contents from the matching stored item.
GitOrigin-RevId: 0b1ef25998aa466409ea79731e2c913a6d42388a
## Why
Showing the cursor before moving it can briefly expose it at its previous
position during a draw.
## What changed
Reorder terminal cursor updates so the cursor is positioned before it is made
visible.
## Testing
Add a regression test that verifies the cursor move escape sequence is emitted
before the show-cursor sequence.
GitOrigin-RevId: 2df277ba315bef4a7a56c11ecb78fcd52c354ac5
## What changed
- Add a global `codex exec --thread-source <SOURCE>` option and propagate it to newly created and forked threads.
- Default the source to `user` when the option is omitted.
- Expose the classification as `threadSource` in the TypeScript SDK. It applies when a thread is first created and does not override the source when resuming an existing thread.
## Testing
- Cover CLI parsing and persisted metadata for new, resumed, and forked threads.
- Verify that the TypeScript SDK forwards `threadSource` only for new threads.
GitOrigin-RevId: 67a55a2b1f91b3a88f946c2af1c2a0989abb3130
## What changed
- Mark Guardian classifier requests with `thread_source: guardian_classifier` in turn metadata.
- Remove the classifier-specific `request_kind` and `is_guardian_mode` fields.
- Update sampler and extension tests to expect the new metadata shape.
GitOrigin-RevId: 1654389ea538b7bd879045634816cbace4bd8f5c
## Why
MCP inventory can be cached or collected separately from a thread's live
connections, so tool availability alone does not describe the current runtime
state.
## What changed
- Add a nullable `runtimeStatus` to `mcpServerStatus/list` for thread-scoped
requests, covering not-started, starting, connected, authentication-required,
failed, cancelled, and disabled connections.
- Observe published connection state without starting or reconnecting servers,
and return an unknown status when no thread is supplied or the active
configuration no longer matches the published registration.
- Show connection state and tool counts in the compact `/mcp` view while
retaining the detailed inventory in `/mcp verbose` and compatibility with
servers that omit `runtimeStatus`.
## Testing
- Cover runtime status transitions, deferred and disabled servers, closed
transports, configuration changes, protocol compatibility, and TUI rendering.
GitOrigin-RevId: e3bb6efe652f0fa8b3c97d5c53e4729b3a87cd91
## Why
An active root turn needs to be stopped without marking it complete or aborted
before another runtime can recover the same turn ID.
## What changed
- Add `CodexThread::suspend_turn_and_shutdown` and `SuspendTurnOutcome`.
- Flush history, stop the active regular task, close the history writer, and
shut down the session without recording a terminal turn event.
- Reject suspension when no supported turn is active or the loaded agent
subtree still contains a live descendant.
## Testing
- Verify that suspension preserves unfinished history and allows the turn to be
recovered under its original ID after the descendant guard is cleared.
GitOrigin-RevId: 1f9b019d07c51474ec2d991d263bc15cdd4f89ad
## What changed
Propagate canonical denial, timeout, and abort responses from strict MCP
auto-review instead of replacing them with a generic decline. This preserves
the reviewer's action and metadata, including denial rationale, while still
failing closed when no canonical decision is available.
Update the fallback message to direct the agent to request explicit user
approval before proceeding.
## Testing
Add unit and app-server integration coverage for strict auto-review denials
and cancellations.
GitOrigin-RevId: d8126ab223ab546b95e2d984f6e4dd540a324a59
## What changed
- Emit a structured log event for each completed Guardian V2 classification with its thread, turn, tool call, risk score, review threshold, sample time, and whether the score was accepted or superseded.
- Verify that accepted async classification events appear in the reviewed thread's log export with the expected context and decision fields.
GitOrigin-RevId: a027d5991b12a1968b9327da57e2993f0a529ca1
## What changed
- Use the shared approval-policy check for unified exec sandbox escalation so
`require_escalated` commands can prompt when granular `sandbox_approval` is
enabled and remain rejected when it is disabled.
- Add an approval scenario covering sandbox escalation with granular approvals
enabled.
GitOrigin-RevId: 98907960cd9df181e1b2fd9d7fea11fa3c0ed7e6
## What changed
Propagate tool cancellation tokens into Guardian approval reviews so interrupting a tool also aborts its pending review. Apply the same cancellation behavior to server-initiated MCP approval elicitation.
## Testing
Add integration coverage for cancellation from direct tool calls, code-mode turns, background code-mode cells, and MCP elicitation.
GitOrigin-RevId: cbee4b422bbcbf6984e415ef6409cee705beebdc
## Testing
- Verify an executor plugin's `Stop` hook starts running after its environment
attaches and stops after disconnection.
- Confirm hook calls carry the expected session, thread, turn, model, and request
metadata.
- Reject hooks whose MCP server belongs to a different executor environment.
- Cover the current restriction to the first executor environment and handler.
GitOrigin-RevId: ef13baf61379997f117cc57515363cc9880d3724
## What changed
- Add typed `browser_use` settings for history access and per-origin access,
download, upload, and full CDP policies.
- Add typed `computer_use` settings for default app access, macOS bundle IDs,
Windows AUMIDs, and Windows executable identities.
- Expose the merged settings through app-server config reads and generated
Rust, TypeScript, and JSON schemas.
## Testing
- Cover TOML serialization round trips, layered config reads with origin
metadata, and app-server batch writes.
GitOrigin-RevId: 78065f6fec990602071fc81ff639ff97f7ad8cd5
jif