## What changed
- Add lifecycle-backed gauges for in-flight and queued app requests, pending server requests and mailbox messages, active turns, and live MCP connections.
- Register each gauge on first use and decrement it when the tracked work or resource is dropped.
- Document the new `server/diagnostics` gauge names and account for the diagnostics request itself in the response example and test.
GitOrigin-RevId: 4bb82a3918af0b502d149b5d761ad669b2083f39
## What changed
- Classify HTTP connection failures separately from other network errors without exposing request URLs.
- For sampling requests, retry connection failures with exponential delays from 5 to 60 seconds and show a `Reconnecting... waiting for network` stream error.
- Preserve the normal stream retry budget while waiting for the provider to become reachable. Keep the existing bounded retry behavior for other retryable errors.
## Testing
- Verify connection errors are classified without leaking URL contents.
- Verify a turn recovers after its provider becomes reachable and still applies the configured retry limit to a subsequent incomplete stream.
GitOrigin-RevId: 646553290c865a1332abd30c4a64ed9266bbfc6f
## Why
Interrupting a turn should also stop code-mode work that the turn left running.
## What changed
- Add the disabled-by-default `code_mode_interrupt` feature.
- When an interrupted turn has the feature enabled, terminate all active code-mode cells and propagate cancellation through nested tool calls.
- Keep the reusable code-mode session alive so its stored state remains available to later turns.
## Testing
Add an integration test that interrupts a long-running nested tool, verifies that active and background cells are removed, and confirms that session state is preserved.
GitOrigin-RevId: 2b8634776a89b636318a39b9e9ad2eefc07cead8
## What changed
- Preserve executor-native working directories, workspace roots, and permission profiles when preparing remote `exec_command` requests instead of resolving them through the host platform.
- Send sandbox intent to the remote executor, including a restricted-token default for Windows executors and `-NoProfile` for elevated PowerShell commands.
- Reject intercepted cross-platform `apply_patch` commands when filesystem writes are restricted, while continuing to allow them for unsandboxed or full-disk-write profiles.
## Testing
Extended remote unified-exec coverage for foreign Windows workspaces, elevated PowerShell, sandbox metadata, and restricted and unrestricted intercepted patches.
GitOrigin-RevId: 9fd328879fa2c15594fd58e40b6b32e8ba0847e7
## What changed
- Add the tool call ID to `_meta.callId` for every MCP tool request.
- Rename `features.tool_registry.include_tool_metadata` to
`features.tool_registry.turn_metadata_includes_tool_info` to clarify that the
setting controls authoritative tool information in per-turn metadata.
- Update config parsing, schema generation, and session config locking for the
renamed setting.
## Testing
- Cover `callId` metadata for custom, plugin, and Codex Apps MCP calls.
- Update strict-config, config-loading, feature-config, and config-lock tests for
the renamed setting.
GitOrigin-RevId: ac0e58c489b03bd9b55a356f545de86c8ecaf865
## What changed
- Define skill config selectors, ordered rules, and layer-stack parsing in `codex-config`.
- Resolve disabled skill paths from generic skill name/path pairs, so configuration logic no longer depends on `SkillMetadata`.
- Update plugin and host skill consumers to use the `codex-config` API and consolidate the rule tests with the skill config tests.
GitOrigin-RevId: 3fe67869708df2652befe28d58cdeba933256f84
## What changed
- Remove the unused `core-skills` client for listing and exporting remote
skills.
- Remove its `codex-core-skills` and `codex-core` exports and dependencies that
are no longer needed.
GitOrigin-RevId: 747f760dc97da3d4dea10d619a2341f43410d0bf
## What changed
- Use `HostSkillRoot` throughout host root resolution and loading, including plugin roots.
- Remove the duplicate loader, root snapshot, and product-filtering implementation from `core-skills` now that loading is owned by the skills extension.
- Move and expand loader coverage for discovery, namespaces, filesystem routing, root merging, symlinks, and frontmatter parsing.
## Testing
- Added focused unit and integration tests under `ext/skills` and `skills` for the consolidated loader behavior.
GitOrigin-RevId: 214d06d59bf3033ee0f220ea5959ee4feff66782
## Why
Persisted base instructions need to retain whether they were explicitly customized or generated from a model template. Without that distinction, forks and config-lock replays can treat model-generated instructions as custom and keep the wrong template after a model or personality change.
## What changed
- Record custom or model provenance with base instructions in rollouts and config locks.
- Preserve custom instructions across model changes, while allowing model-generated instructions to follow the selected model and personality.
- Keep legacy rollouts without provenance compatible and propagate provenance through forks and spawned agents.
## Testing
- Cover provenance serialization and legacy rollout decoding.
- Cover role personality changes, forked model changes, config-lock replay, and multi-agent configuration.
GitOrigin-RevId: 801c26559835f558027ce5112700c0cd31fcb21b
## What changed
- Inject the host skill loader into `PluginsManager` so plugin discovery and agent turns use the same loading and product-policy behavior.
- Share plugin skill snapshots across those paths, preserving a consistent view of skills across workspaces.
- Apply migrated-command precedence after product filtering, allowing an eligible migrated command to replace a filtered native skill with the same name.
## Testing
- Add coverage for product-restricted plugin skills, native-versus-migrated command precedence, and the skills exposed to agent turns.
GitOrigin-RevId: f5ef0d0766ebeeb30d73ffaf044d003c2906ea4d
## What changed
- Add a `codex-diagnostics` crate that snapshots the process ID, available
resident-memory measurements, and registered process-wide gauges.
- Provide guards that update gauges for the lifetime of measured objects.
- Track live `CodexThread` instances with the `core.threads.live` gauge.
## Testing
- Add unit coverage for gauge registration, guard lifetimes, process memory
snapshots, and live-thread reporting.
GitOrigin-RevId: 3236b086bd4ebe31ed4768ab87a5fa288b0891b0
## Why
Applying `project_doc_max_bytes` independently to every selected environment
allows the total project instruction payload to grow with the number of
environments.
## What changed
Treat `project_doc_max_bytes` as one shared byte budget. Consume it in selected
environment order, truncate the entry that reaches the remaining limit, and
skip later environments once the budget is exhausted.
Update the configuration descriptions to document the aggregate limit.
## Testing
Add unit and integration coverage for partial and exhausted budgets across
multiple environments.
GitOrigin-RevId: 4664bdf1f23b66986349d503f44cf51560b9024f
## What changed
- Add `load_local_config_layers` to return raw configuration and requirements layers with their sources, base directories, precedence order, and cloud insertion positions.
- Support projecting layer stacks to selected TOML paths while preserving non-table override blockers and adjusting cloud insertion positions when empty layers are removed.
- Reuse project discovery and trust handling for local reads, including linked-worktree hooks, without resolving relative paths or including profiles, session flags, thread layers, or cloud-provided values.
## Testing
- Cover layer ordering, raw relative paths, legacy requirements, trust filtering, projection semantics, and untrusted linked-worktree hook handling.
GitOrigin-RevId: a1098af5650ac44e5a230ba9a5fe918927986d05
## What changed
Rename `features.tool_registry.include_tool_namespaces_info` to
`features.tool_registry.include_tool_metadata` across configuration parsing,
schema generation, resolved configuration locking, and tests. Update its
description to cover authoritative tool information in request metadata.
GitOrigin-RevId: 93b404483b71fed04031d767a41ac2bb70b836b2
## What changed
- Add `features.tool_registry.include_tool_namespaces_info` to the TOML model,
generated schema, and resolved runtime configuration. The setting defaults to
`false` and controls whether per-turn request metadata includes the resolved
tool namespace inventory.
- Preserve the resolved setting in session configuration locks.
- Cover top-level and profile-scoped strict configuration, deserialization,
resolution, and lock-file persistence.
GitOrigin-RevId: 74124086c0d7de30094b411001f0ec0af490935d
## What changed
- Clamp `wait_agent` timeout requests below `min_wait_timeout_ms` instead of rejecting them.
- Include the timeout adjustment in the wait result message and document it in the tool output schema.
## Testing
- Update the handler test to verify the configured minimum is honored and the adjustment is reported.
- Update the schema test for the expanded result message.
GitOrigin-RevId: 2b4a770ed6d1e9c45b351b479f5ae50c9a3d5388
## What changed
- Add `features.code_mode.default_exec_yield_time_ms`, defaulting to 30 seconds.
- Apply the configured default to code-mode `exec` calls that omit `yield_time_ms` and reflect it in the tool description.
- Remove the `code_mode_buffered_exec` compatibility feature flag.
## Testing
- Cover config loading and tool descriptions for both default and custom yield timeouts.
GitOrigin-RevId: 581ffc737b04721c7b5fc81260b1da1cf7d87523
## What changed
- Add `ThreadManager::with_thread_id_generator` to configure ID allocation for new root, child, and forked threads.
- Keep the standard UUIDv7 generator as the default and preserve stored IDs when resuming threads.
- Add `ThreadId::from_u128` for constructing identifiers from UUID-compatible values.
## Testing
- Cover default allocation, custom IDs across roots, child agents, and forks, and ID preservation on resume.
GitOrigin-RevId: 6c38c862e30a50bad944a994bcbccf7d1e7ada24
## What changed
- Add `codex migrate-rollouts` with dry-run inspection by default, explicit `--apply`, thread filtering, optional I/O throttling, progress output, and JSON or verbose reports.
- Add the disabled-by-default `background_paginated_rollout_migration` feature to migrate legacy local sessions at startup before rollout compression begins.
- Persist a migration cursor and skipped-file fingerprints so later startups avoid full rescans while retrying changed files and recovering pending migrations.
- Coordinate migration with live writers and emit metrics for manual and startup runs.
## Testing
- Cover startup cursor advancement and lookback, pending migration recovery, live-writer coordination, changed empty rollouts, and progress reporting.
GitOrigin-RevId: 276ac506c50ebec5140fd319faca1bb998172061
## Why
Forked subagents can inherit a parent's compacted history, but their context-window metadata needs to identify the child and start a distinct window lineage.
## What changed
- Always identify context windows by agent name and remove the `features.token_budget.mode` setting.
- Persist the agent path in world state and emit context-window metadata as a standalone developer message when the identity changes.
- Reset inherited compaction metadata to the forked subagent's initial context window and restore that window in session state.
## Testing
Extend the full-history subagent test to verify parent and child world-state snapshots, agent identities, distinct window IDs, and the reset child checkpoint.
GitOrigin-RevId: 6584201e57b3d2fba0ce626b89a8b3b0b3c752db
## What changed
- Add an `x-codex-routing-hint` header containing the request model and, when selected, the service tier.
- Send the hint on Responses HTTP requests, remote compaction requests, and WebSocket handshakes, including prewarm connections.
- Limit the header to Codex-backend authentication with the OpenAI provider, omitting it for API-key and provider-specific credential paths.
## Testing
- Cover routing hints for HTTP, remote compaction, WebSocket streaming, and tiered prewarming, along with the credential paths where the header must be absent.
GitOrigin-RevId: d8d415d7fadddecf9a132d05920b856a35ac9960
## Why
Converting each environment's working directory to a host-native path caused
turn-input contributors to omit environments with foreign path formats.
## What changed
- Expose `TurnInputEnvironment.cwd` as a `PathUri`.
- Pass every turn environment to contributors without host-path conversion.
## Testing
Added an integration test that submits a foreign working-directory URI and
verifies the contributor receives the environment unchanged.
GitOrigin-RevId: a122526be47f5331614381e9c6e4b85087a96bed
## Why
An OAuth-backed Streamable HTTP MCP server can fail startup when its stored credentials are rejected. If a client then completes OAuth sign-in and replaces those credentials, the failed server needs to become available without restarting the Codex session.
## What changed
- Track the credential store and OAuth tokens used for each MCP connection, and detect replacements after authentication failures.
- Refresh affected MCP servers before the next turn and include their recovered tools in the model request.
- Classify HTTP authentication challenges and rejected refresh tokens as requiring reauthentication, with sign-in guidance appropriate to local and client-managed environments.
## Testing
- Cover recovery from expired credentials through an externally written replacement token.
- Cover authentication-error classification, startup messaging, and `Auto` store migration from file credentials to the keyring.
GitOrigin-RevId: 9b090089d4e7a44ffc182f4e25da20a18e97b70f
## Why
Environment readiness can change between sampling requests. Extension turn-input contributors should receive the same refreshed environment snapshot used by the current step.
## What changed
Build `TurnInputContext.environments` from `StepContext` so newly ready environments are included in extension input for the current request.
GitOrigin-RevId: ee4444072162317974cd2bbfd57ffcf9a9445391
## Why
Checking the tool search cache currently rebuilds search metadata for every deferred tool, even when an immutable tool runtime has not changed.
## What changed
- Track immutable deferred tools by runtime identity and dynamic tools by their current search metadata.
- Rebuild the search handler when the deferred registry, dynamic metadata, or source-listing mode changes.
- Keep only weak references to immutable runtimes in the cache.
## Testing
Added unit coverage for immutable handler reuse, registry and exposure changes, source-listing changes, and refreshed dynamic tool metadata.
GitOrigin-RevId: 024c6f4498d431e7bbfaecde420f77fcf8c0dba7
## Why
MCP tool handlers and their Code Mode definitions are immutable for the lifetime
of a stable MCP binding, so rebuilding them for every sampling step repeats schema
construction unnecessarily.
## What changed
- Cache MCP handlers per session and reuse them while the same binding remains
active, invalidating the cache when the binding changes.
- Lazily cache schema-free Code Mode definitions on MCP handlers while continuing
to rebuild definitions for step-local tools whose specifications may change.
- Reapply current app enablement, tool policy, exposure, and plugin schema budgets
whenever cached handlers are registered for a step.
## Testing
- Cover handler and Code Mode definition reuse, binding invalidation, changing app
policy, stable continuation schemas, and step-local custom tool updates.
GitOrigin-RevId: 69c5011fb97c08580ac476e7fb2286b1e92e0359
## Why
Subagents can reuse cached MCP tool definitions without starting every optional
server before any of its tools are used.
## What changed
- Defer startup for subagent-owned, optional MCP servers when their cache has at
least one visible, allowed tool, and trigger startup on the first operation
that needs the live client.
- Keep root sessions, required servers, selected plugin servers, and explicit
reconnects eager.
- Exclude empty catalogs from cache eligibility and keep dormant servers out of
the initial startup summary.
## Testing
- Extend MCP tool-cache coverage for eager root startup, unused and filtered
subagent servers, deferred startup status events, and startup that survives an
interrupted first tool call.
GitOrigin-RevId: e7528ff08312583a6747cbc6550ea5b6eabda9a6
## Why
A model switch on the first turn has no prior turn settings to compare, and rolling that turn back could leave its model instructions in history.
## What changed
- Track the model that supplied the session's base instructions so first-turn switches inject the target model's instructions, including the selected personality.
- Preserve inherited custom base instructions when starting from an empty fork.
- Remove first-turn model-switch developer content during rollback so retries and cold resumes do not retain or duplicate stale instructions.
## Testing
Add integration coverage for first-turn switches, personality changes, empty-prefix forks, rollback retries, and cold resume.
GitOrigin-RevId: 9df532e9e337521ad3b315b77f8c98e039fb384e
## Why
Multi-agent v2 rejected `agent_type` when `fork_turns` was `all`, forcing callers to choose between a configured role and the parent's full conversation context.
## What changed
- Apply an explicitly selected role to full-history forks, including its model and developer instructions.
- Preserve the parent's developer instructions when the selected role does not define its own.
- Keep the inherited conversation history and model-switch context intact.
- Update the `spawn_agent` schema to clarify that roles apply independently of history inheritance.
## Testing
- Cover full-history role overrides and developer-instruction precedence in multi-agent v2 tests.
GitOrigin-RevId: cd4f35e31d75f56289760f245bff38dd0233abe6
## What changed
- Fetch the paginated installed-plugin snapshot without a `scope` query instead of issuing separate requests for global, user, and workspace plugins.
- Use the combined snapshot for installed-plugin caching and bundle synchronization while continuing to reconcile each scope's marketplace independently.
## Testing
- Cover pagination across mixed scopes, request query parameters, marketplace reconciliation, stale cache cleanup, and discoverable-plugin filtering.
GitOrigin-RevId: 7428a9db81d7ec04e65cc4b236b652278b200956
## What changed
- Add the gated `unified_image_budget` feature for models that support original image detail or Responses Lite.
- Apply one 6,000-pixel, 10,000-patch preprocessing limit regardless of legacy image detail hints.
- Hide detail controls from `view_image` and code mode while continuing to accept existing hints for compatibility.
- Preserve detail-based resizing and tool contracts for unsupported models.
## Testing
- Cover unified resizing limits, Responses Lite, legacy detail hints, unsupported models, and `view_image` integration in code mode.
GitOrigin-RevId: cb07bff1669a96599fdfd076b3d9ec80f2b6fff7
## What changed
- Add a storage-neutral queue extension for listing, adding, editing, reordering, deleting, and explicitly starting queued user messages.
- Dispatch queued messages in FIFO order when a thread becomes idle after a completed turn, while leaving them queued after interruptions or failures.
- Wait for user input to be persisted before removing its queue item, and report hook rejection, task termination, and persistence failures distinctly.
- Snapshot local image and audio attachments into validated data URLs before storing them, enforce input limits, and emit `ThreadQueueChanged` events after mutations.
## Testing
- Cover queue mutations, automatic and explicit dispatch, interruption and failure behavior, hook rejection, invalid records, input limits, and local attachment snapshotting.
GitOrigin-RevId: 14f39d7c8cbaccb767a6da84b82cced0edfcb4b9
## What changed
- Add a Guardian circuit-breaker policy for models whose catalog specialty is
`cyber`.
- Interrupt those models after the first Guardian denial while retaining the
existing denial thresholds for other models.
- Centralize the `cyber` model-specialty identifier for use across core,
protocol, app-server, and TUI code.
## Testing
- Cover the cyber-specific threshold in the circuit-breaker unit tests.
- Verify end to end that a denied command is not executed and the turn is
interrupted after one denial.
GitOrigin-RevId: fad24c9e7aa280432580db1f0e39d13535779710
## Why
Resumed sessions need the current multi-agent usage instructions when configuration changes or the saved history predates usage-hint tracking.
## What changed
- Store multi-agent usage hints in world state and refresh changed or previously untracked hints before re-emitting the active multi-agent mode.
- Present `wait_agent` polling guidance in the overridable developer instructions only when the tool is enabled, instead of embedding it in the tool schema.
## Testing
- Cover cold resumes, changes to `wait_agent` availability, custom usage hints, message ordering, and tool-schema behavior.
GitOrigin-RevId: a9c6798d5dc2dedc8dadc49e0a80ff50a757ab83
## What changed
- Remove namespace tools named `tool_search` before registering the built-in
search tool, preventing them from sharing its model-visible surface.
- Record removed namespace tools as collisions so strict collision handling
reports their qualified tool names.
## Testing
- Cover direct and deferred MCP tools that use the reserved namespace.
- Cover strict collision errors for both direct and deferred conflicts.
GitOrigin-RevId: 28fff918b4358a67b167467d92728fa545b951d7
## What changed
- Add `transparentBackground` to image-generation items and legacy completion events.
- Map Images API backgrounds to `true` for transparent, `false` for opaque, and `null` for automatic or unavailable values.
- Preserve the metadata in live notifications and persisted or resumed thread history while continuing to deserialize older items that omit it.
## Testing
- Cover transparent, opaque, and automatic backgrounds, including image edits and thread read/resume flows.
- Verify the stable JSON shape and optional TypeScript field.
GitOrigin-RevId: 08527f37f23431df45fab1ed34eb82b2139b49d7
## What changed
- Add `ExplicitSkillLookup` to decouple explicit mention selection from the
core skill-loading model.
- Export `collect_explicit_skill_mentions` from `codex-skills` and implement
the lookup interface for `SkillLoadOutcome`.
- Move the selection tests into `codex-skills` while keeping the prompt-size
boundary test with prompt injection.
GitOrigin-RevId: 21105af31c9b519c231c5ea02464da560705c293
## What changed
- Move the integration test for reusing plugin-manager skill snapshots into
`codex-core`, which owns both the plugin manager and host skills service
integration.
- Keep the `codex-core-plugins` test focused on resolving local and remote
plugin identities on effective skill roots, and remove its skills-extension
dev dependency.
- Use the skills extension's `HostSkillsSnapshot` type in its world-state
catalog implementation.
## Testing
- Verify the host skills service reuses the plugin manager's parsed snapshot
after the underlying skill file changes, while preserving plugin identity
metadata.
GitOrigin-RevId: afc8a0ebccb629360c59a4546bdb9a134c74da4f
## What changed
- Add `session_source()` to `McpServerContributionContext` for thread-scoped MCP resolution.
- Propagate each thread's `SessionSource` through initial setup, per-step resolution, and runtime refreshes.
## Testing
- Verify global contexts omit the source while thread-scoped contexts retain it.
- Verify MCP contributors observe distinct sources for a root thread and its spawned subagent.
GitOrigin-RevId: 23da1509858e023fbd9e2d179034ddc83553f17b
## What changed
- Load ordinary recursive host skill roots with the skills extension's host loader.
- Keep plugin-specific roots on the existing loader so plugin snapshot caching and namespacing continue to work.
- Merge both kinds of root snapshots through the existing precedence and deduplication logic, including discovery paths and source filesystem mappings.
- Move `HostSkillsSnapshot` into the skills extension as the owner of host skill loading.
## Testing
- Cover merged host and plugin catalogs, precedence for symlinked roots, discovery paths, and end-to-end rendering and invocation of host, repository, and plugin skills.
GitOrigin-RevId: c18080afb917c33c57bc17e36b40dd0f3c72d1d7
## What changed
- Add end-to-end coverage for a remote environment whose provisioning status is
reported ready before it is selected for a turn.
- Verify that `wait_for_environment` makes remote execution tools and selected
capability-root context available once the transport is ready.
- Update pending-environment and relay tests to cover separate materialization
and readiness reporting, including deferred connection and reconnection.
GitOrigin-RevId: d86d66e8f722e9bafac88b93d93e7c5244a7156e
## What changed
- Share an in-flight `git status --porcelain` invocation among concurrent workspace metadata requests for the same canonical repository root.
- Keep scans for different repositories independent, and start a fresh scan after an in-flight request completes or loses all consumers.
- Pass the known repository root into dirty-worktree detection so requests from sibling directories and symlink aliases use the same key.
## Testing
- Add coverage for request coalescing, repository and symlink keying, completed scans, and consumer cancellation.
GitOrigin-RevId: 4c197c1d5bb94ca83c02979be34b17f24aefde08
## What changed
- Add `include_apps_usage_instructions` to model metadata, defaulting to true for compatibility with existing metadata.
- Emit generic Apps guidance only when apps are available and the selected model enables it.
- Enable the capability for interactive model presets while leaving `codex-auto-review` and local models opted out.
## Testing
- Verify that missing metadata defaults to enabled and an explicit opt-out survives serialization.
GitOrigin-RevId: 6a20573cddfd3b80083d2b4b015829b49e6cc283
## Why
Symlinked skills have a canonical `SKILL.md` path that can differ from the path
under the configured skill root. A catalog entry that advertises the discovery
path must still select the canonical skill.
## What changed
- Track each loaded skill's discovery path alongside its canonical identity.
- Render discovery paths in the skill catalog and accept either form for
structured selections and linked skill mentions.
- Preserve enabled-state checks, deduplication, and product filtering when
resolving discovery paths.
## Testing
Added loader, catalog, mention-resolution, and end-to-end turn coverage for
skills discovered through directory symlinks.
GitOrigin-RevId: bae539b766cc3782c7c121a4276c337699cbb509
## What changed
- Add the disabled-by-default `image_resize_notice` feature.
- When enabled, append a developer message after resized images from user
messages or tool outputs. The notice identifies each image and reports its
original and prepared dimensions.
- Persist notices with new history while avoiding backfilled notices for images
processed when a session is resumed.
## Testing
- Cover notice placement, image numbering, failed images, user and tool image
sources, and resumed-session replay.
GitOrigin-RevId: 11dd808b3ad47eac35e9e2f4a4370f85d0122770
## Why
Authentication restrictions must apply before stored or environment-provided credentials can be used, including during bootstrap before cloud requirements are fetched.
## What changed
- Add local `requirements.toml` allowlists for login methods and ChatGPT workspaces. Ignore these fields in cloud-provided requirements.
- Combine managed workspace allowlists with existing workspace restrictions by intersection, and fail closed when the resulting policy permits no usable login method.
- Centralize policy checks in the authentication manager so CLI, TUI, app-server, external-auth, and credential-loading paths consistently reject disallowed authentication before token hydration or network requests.
## Testing
- Cover policy composition, workspace intersection, invalid stored and external credentials, bootstrap enforcement, and login endpoint restrictions.
GitOrigin-RevId: efef22b248f3c3333e9aa55423e539efa2d2dd48
## What changed
- Move permission hooks, reviewer routing, approval caching, and user approval requests into the session-level approval flow.
- Have shell, unified exec, and apply-patch runtimes describe requests as `ApprovalAction` values, which now provide their hook payloads and cache keys.
- Pass a shared `ApprovalContext` through initial and retry approvals so telemetry and approval reasons are handled consistently.
GitOrigin-RevId: 5bfa61daa97e4427f3a648f6cf9d1c27f1551942
## What changed
- Select `gpt-5.6-luna` for Guardian approval reviews authenticated with an API key, while retaining `codex-auto-review` for ChatGPT authentication.
- Exercise API-key reviews through Responses Lite and fall back to the bundled Guardian policy when the selected model has no catalog-provided review policy.
- Refine the bundled policy's handling of trusted authorization, sensitive-data egress, credential probing, destructive command targets, and post-denial approval.
## Testing
- Cover provider model selection for API-key and ChatGPT authentication.
- Verify Guardian prewarming and review reuse with both Responses Lite and standard Responses requests.
GitOrigin-RevId: e35c43e1692fd643ab8faad1444c0d6a869b3e0c
## What changed
Store the output buffer, notifications, closed state, and cancellation token
together in `OutputHandles`. Pass that shared bundle through output collection
and local output tasks instead of cloning and forwarding each field separately.
GitOrigin-RevId: 2f0f66dd419778e0b17ff47323c795f5dc88fe33
## Why
The 4 KiB aggregate limit can truncate source metadata before it reaches the
model through the tool search description.
## What changed
Raise the aggregate source-description limit to 512 KiB while retaining the
existing character-boundary-safe truncation and bounded output.
## Testing
Expand unit and RMCP round-trip coverage to verify that substantially longer
Unicode descriptions remain complete within the new limit.
GitOrigin-RevId: 002760cdd2e8741e531b45f75f8624ef84334d24
