## What changed
Report the automatic-update setting and update interval from the daemon's `settings.json` in the background-server check, labeling each value as configured. Report unreadable, invalid, or oversized settings files without displaying their values, with a 16 KiB size limit.
## Testing
Add snapshot coverage for disabled automatic updates and a configured interval when the updater PID file is missing, plus invalid boolean and zero-interval settings.
GitOrigin-RevId: e8e77d1a10448f7d62fd84d8325f3e61738a689b
## What changed
Add `terminal_name` and `multiplexer` attributes to `codex.tui.start` alongside `app_server_mode`. Use fixed terminal categories rather than versioned or user-provided identifiers, with `unknown` for unrecognized terminals. Report the multiplexer as `tmux`, `zellij`, or `none`.
## Testing
Extend the CLI worktree test to parse metric payloads and assert the exact startup attributes for an unrecognized terminal without a multiplexer. Keep coverage that no metrics are sent when analytics is disabled.
GitOrigin-RevId: 024c82653098b9bddd6c5e8d7133ff798b58dcd1
## What changed
Add `codex app-server daemon update` to check the latest stable release once, even when automatic updates are disabled. The command requires an installer-owned latest-channel standalone installation and reports `updated`, `noUpdate`, or `unsupported` as JSON, including installed and running versions.
Route manual requests through the updater so scheduled and manual installs share one owner and accepted updates continue if the CLI exits. Restart a running managed daemon when its binary or version differs from the selected installation; this may interrupt active or queued work. Return installer failures as command errors and retry requests across updater replacement.
## Testing
Add coverage for manual updates with automatic updates disabled, queued requests, same-version binary replacement, updater handoff retries, and unsupported installations or unmanaged servers.
GitOrigin-RevId: 240b63c79bae3a64a80768131a30da70900a4d62
## Why
The managed daemon's updater used a fixed hourly cadence with no saved preference to disable automatic updates.
## What changed
- Read `updater.autoUpdateEnabled` and `updater.updateIntervalMinutes` from `CODEX_HOME/app-server-daemon/settings.json`, defaulting to enabled with a 60-minute interval. Keep the initial five-minute delay and require a positive interval.
- Apply the enabled preference during daemon lifecycle operations and re-read settings before updates and recurring waits. Preserve updater preferences and unknown fields when saving remote-control settings, using atomic file replacement.
- Signal the updater's process group on Unix so stopping it also terminates installer children. Allow daemon shutdown even when settings are malformed.
- Document updater configuration and remote-control preference behavior. Manual `codex update` remains unaffected.
## Testing
Add tests for settings preservation, interval validation, recurring waits, enabling and disabling updates across restart and bootstrap, Unix installer termination, and shutdown with malformed settings.
GitOrigin-RevId: 5dbb72c5939e9ced2390b3760a7265608c8b61a0
## Why
Starting a latest-channel standalone daemon required a separate `bootstrap` to enable automatic updates. A missing updater could also leave a running server without automatic updates until `bootstrap` was run again.
## What changed
- Ensure a single supported updater after managed `start`, `restart`, and restarts caused by remote-control changes. Repeated starts recover a missing updater while reusing the running server.
- Report updater failures as warnings so successful server starts and restarts still succeed.
- Preserve an existing updater while the latest-channel marker and managed binary may be temporarily inconsistent during installation. Stop it when the latest-channel marker is removed.
- Document automatic updater startup and the limitations of detecting out-of-band binary replacements.
## Testing
Add Unix tests for updater reuse and recovery, invalid updater records, marker mismatches and release pinning, unmanaged servers, and bootstrap status for managed local builds.
GitOrigin-RevId: 44148a8d65709f68def2072f542494620d7e574b
## Why
Executor compatibility checks need a build identity that distinguishes commits
and compiler targets independently of the package release version.
## What changed
- Add optional `providerId` to exec-server environment metadata, cached at startup
and returned by initialization and `environment/info`.
- Derive the ID as SHA-256 of `git:<lowercase commit>:<target>`. It identifies a
standard build configuration, not exact executable bytes, and is omitted when
the commit stamp or target is unavailable or invalid.
- Embed the compiler target in `BuildInfo`, preserve compatibility with historical
metadata without a target, and stamp Cargo release builds with `STABLE_GIT_COMMIT`.
- Group Bazel build-script argument files under one `--arg-file` flag to reduce
Windows command-line length while preserving file order.
## Testing
Add deterministic build-ID vectors across targets, commit normalization and invalid
input coverage, and historical metadata compatibility tests. Extend exec-server
coverage for metadata caching and ensure runtime environment overrides cannot
replace the executor's build identity.
GitOrigin-RevId: 125a18c23de7ad006571940ba305836376c983f4
## Why
Selecting the first matching session name can target the wrong conversation when labels are duplicated. Session commands also need to accept preview text when no explicit name is set.
## What changed
- Share app-server label lookup across resume, fork, archive, unarchive, delete, and queue commands, matching the trimmed name or fallback preview.
- Reject distinct matching sessions across collections and source filters, and require a UUID when pagination prevents verifying uniqueness.
- Revalidate listed candidates with `thread/read`, skip unusable local rollouts, and retain compatibility with older servers that cannot read unloaded threads.
- Show ambiguous resume errors in the TUI without replacing the current conversation.
- Disable implicit local daemon reuse with `--oss`.
## Testing
Add regression coverage for name and preview lookup, provider filtering, duplicate labels across pages and collections, stale rollouts, older-server compatibility, queue ambiguity, and preserving the current conversation after an ambiguous resume.
GitOrigin-RevId: e2766276a16140fb674c9640f7050c11ac0d0f6f
## Why
Stamped Rust binaries consume workspace status files containing build user,
host, and timestamp values. These unrelated values prevent remote cache reuse
when building the same commit across developers and CI workers.
## What changed
Generate a compiler environment file containing only `STABLE_GIT_COMMIT` through
a small stamped template action. Use it for `codex`, `codex-tui`, and
`codex-voice-host`, with Rust binary stamping disabled so their build metadata
input changes only when the embedded commit changes.
Rename the crate macro option from `stamped_binaries` to
`binaries_with_build_commit` and add `bazel_lib` for template expansion.
GitOrigin-RevId: 21d0f2e3df97670a4c2cdbc3d1972cd14cc5b439
## Why
Binaries that do not consume build identity should not have their cached compilations invalidated by Git revisions or build timestamps.
## What changed
Add `stamped_binaries` to `codex_rust_crate`, defaulting to an empty list. Only listed binaries enable stamping and receive `STABLE_GIT_COMMIT`. Opt in `codex`, `codex-tui`, and `codex-voice-host`.
GitOrigin-RevId: 9bcac29f98f20129c988f696ce5b98057be7a158
## Why
`--worktree` previously supported only `codex exec` and `codex exec fork`. Interactive sessions need the same managed checkout support, with configuration and policy resolved for the destination before starting a turn.
## What changed
- Enable `codex --worktree` and `codex fork --worktree <session-id>` behind the `worktrees` feature, restricted to local sessions. Interactive forks require an explicit session selector.
- Resolve interactive and exec worktree forks from the session's latest saved working directory unless `--cd` is supplied. Keep relative `--add-dir` paths anchored to the invocation directory.
- Load interactive destination configuration before telemetry and login policy initialization, and bind checkout ownership before the first turn.
- Reject explicitly untrusted sources, including when destination cloud policy or refreshed configuration reveals distrust. Retain unbound interactive checkouts after startup failure and report manual recovery instructions.
## Testing
Add CLI integration and TUI tests for startup and named forks, destination instructions and configuration, ownership before the first request, trust enforcement, and retained-checkout recovery. Extend exec coverage for saved fork directories, explicit `--cd`, relative writable roots, and cloud policy rejection.
GitOrigin-RevId: 371583f7feca73b218a4ff188b2b85812c8439e6
## What changed
Remove the `codex mcp-server` subcommand and the standalone `codex-mcp-server` crate, including its tests, interface documentation, build dependencies, and run recipe.
## Testing
Update the strict configuration test to use `codex exec hello`, preserving coverage for rejecting unknown configuration overrides.
GitOrigin-RevId: 8688b1f41862d7c2073ea2812a257c0087c55d9c
## What changed
- Configure the CLI and app server to use `tikv-jemallocator` on
`x86_64-unknown-linux-musl` and `aarch64-unknown-linux-musl`.
- Keep the dependency and global allocator selection scoped to those targets.
GitOrigin-RevId: 93c54c90d9acb7e48edffd032cd8ec685a782210
## Why
Windows sandbox setup reconciles persistent deny ACLs against the paths supplied for a session. The `codex sandbox --permission-profile` path supplied an empty list, which could discard the profile's deny-read restrictions.
## What changed
Resolve deny-read paths from the selected permission profile and workspace roots before starting a Windows sandbox session, and pass them through to setup.
## Testing
Add a Windows CLI integration test that launches the same managed-deny profile twice and verifies that denied file reads and DLL loads remain blocked while allowed access still works.
GitOrigin-RevId: 6ec8b6a13a33b862d7b152eadbbdde3146de4b7d
## What changed
- Load doctor configuration through the cloud-aware CLI configuration path while preserving invocation overrides such as `--cd`.
- Report configuration load time and clarify that diagnostics cover invocation configuration, including cloud-managed policy, but not active thread overrides.
- Add redacted filesystem sandbox diagnostics for denied-read rule counts, glob rule counts, glob scan depth, and the managed policy source.
## Testing
Add an integration test that verifies valid cloud-managed filesystem requirements are reported without exposing denied paths, and invalid requirements fail the configuration check.
GitOrigin-RevId: 65c3c9ad3fd42c1579ca0c9d8e209066f98e5407
## Why
Allow remote exec servers to connect directly to AWS-hosted registries that
authenticate registry requests and WebSocket handshakes with AWS SigV4.
## What changed
- Add `--remote-transport direct` with SigV4 profile, region, and service
options while keeping Noise as the default transport.
- Register the `direct_jsonrpc_v1` transport and carry plain exec-server
JSON-RPC messages over the authenticated WebSocket.
- Reuse direct registrations across transient disconnects, refresh them after
a `409 Conflict`, and require TLS for non-loopback endpoints.
## Testing
- Cover CLI validation and SigV4 request signing.
- Exercise direct registration, handshake retry behavior, JSON-RPC
interoperability, and process recovery after reconnecting.
GitOrigin-RevId: 0755df330ba3abe5db0a516fdaa49338d9bbe2d2
## What changed
- Wait for the directory trust prompt before shutting down the TUI.
- Retry the decline key while the trust screen drains pending input, and keep
consuming PTY output until the process exits.
- Include captured TUI output when shutdown times out.
GitOrigin-RevId: cb88523a72915787a436da4f16fb13450fa7a175
## What changed
- Add the macOS-only `allow_symlinked_codex_home` user setting. When enabled in the execution host's `$CODEX_HOME/config.toml`, writable roots at or beneath that home may traverse symlinks.
- Keep the exception disabled by default and prevent project config, command-line overrides, and ignored user config from enabling it. Other writable roots remain subject to symlink checks.
- Propagate the resolved setting through local, interactive, and exec-server sandbox paths, including `CODEX_HOME` aliases.
- Explain the opt-out in symlink rejection errors, including that it trusts targets outside `CODEX_HOME` and targets that change between commands.
## Testing
- Add macOS coverage for shell commands, patches, filesystem helpers, process execution, and interactive startup with enabled, disabled, aliased, and out-of-scope homes.
GitOrigin-RevId: 99fcdf611200c9e1b7713cf06f7fdea5bfa7f089
## What changed
- Add the experimental `worktrees` feature and a shared `--worktree` flag for new and forked `codex exec` sessions.
- Create each enabled session in a managed Git worktree, use that checkout as the session working directory, and bind the checkout to the new thread.
- Share the configured worktree pool with Desktop while leaving automatic cleanup disabled for CLI allocations.
- Reject unsupported commands, remote execution, ignored user configuration, ephemeral sessions, and use without the feature enabled before allocating a worktree.
## Testing
- Cover flag placement and inheritance, supported and rejected command combinations, worktree allocation and thread ownership, configuration gating, and compatibility with existing worktree-backed sessions.
GitOrigin-RevId: 011ff4639b09e8992c50d7b823df23e71798670e
## Why
Sandboxed commands inherit the user's controlling terminal. Without an explicit
restriction, a child can use `TIOCSTI` to queue input for the unsandboxed shell
that resumes after Codex exits.
## What changed
Append a `file-ioctl` denial for `TIOCSTI` after the shared Seatbelt policy
allowances used by `codex sandbox`.
## Testing
Add a macOS PTY integration test that first proves terminal input injection
works without the sandbox, then verifies Seatbelt rejects it with `EPERM`.
GitOrigin-RevId: 5a8b0a5b4fd980cc406ad184d04ceae9b0ea90e4
## What changed
- Honor `McpOAuthRefreshMode::Coordinated` for streamable HTTP MCP connections by letting RMCP refresh and persist credentials through the pinned credential store.
- Reread credentials while holding the refresh lock, persist refreshed tokens before retrying requests, and serialize login and logout writes with in-flight refreshes.
- Keep OAuth preparation outside MCP operation and handshake deadlines, and allow refresh persistence to finish if the initiating caller is cancelled.
## Testing
- Cover coordinated startup refresh, concurrent refreshes, `401` retries, credential mutation races, provider timeouts, and caller cancellation.
GitOrigin-RevId: 100ae788048087be23e26bb43f868b1fcebb007a
## Why
The managed app-server daemon and automatic TUI attachment were limited to
Unix, so Windows users could not share a background server across Codex
sessions.
## What changed
- Enable daemon lifecycle commands, `codex agents` startup, and AF_UNIX daemon
discovery on Windows.
- Require Windows daemons to start non-elevated and verify the discovered
socket directory and peer before connecting.
- Preflight detached process support, preserve path-based environment settings,
and keep daemon processes out of the launching project's working directory.
- Fall back to an embedded server when an implicitly discovered daemon cannot
connect, while preserving errors for explicit remote endpoints and bypassing
daemon reuse when `CODEX_EXEC_SERVER_URL` is set.
## Testing
Add coverage for Windows launch restrictions and socket validation, implicit
connection fallback, executor selection, daemon discovery, and the agents
dashboard startup result.
GitOrigin-RevId: e7fd63cf8690bcca8b5155266416f31f2f792aa2
## Why
Directly deserializing the flattened `RolloutLine` envelope can reject nested
decimal values, preventing affected paginated sessions from resuming.
## What changed
- Add canonical string, byte, and reverse-scanner helpers that decode rollout
records through `serde_json::Value` before decoding the flattened item.
- Route rollout readers across session discovery, history, migration, search,
thread storage, and transcript previews through those helpers.
- Remove `Deserialize` from `RolloutLine` so new readers cannot bypass the
canonical persistence decoder.
## Testing
Add coverage that resumes a paginated rollout after a token-count record with
a decimal rate-limit value and verifies that ordinal sequencing continues.
GitOrigin-RevId: 49abac1e0751c073daa5a93a840d8a483fd2d013
## Why
Exec-server process and network-policy events need stable attribution to the
launching tool call and executor without recording process payloads.
## What changed
- Add optional `ExecMetadata` to `ExecParams` and propagate the thread and tool
call IDs from unified exec.
- Emit bounded OpenTelemetry events for process start, spawn failure, sandbox
denial, and exit. Correlate them with the launch trace and registry-issued
executor identity while excluding arguments, paths, environment values,
output, and error text.
- Preserve launch attribution across long-running processes and reconnects, and
attach the same metadata to network-policy audit events.
- Keep the protocol backward compatible when metadata is omitted, and prevent
invalid trace headers from inheriting an unrelated active span.
## Testing
Add coverage for metadata serialization and propagation, lifecycle event
fields, trace relationships, reconnect behavior, spawn failures, sandbox
denials, and network-policy attribution.
GitOrigin-RevId: 7aa480a7289c73cb95e2c124c35500bb6f0d5084
## Why
Automatic startup work and `codex doctor` can run before a workspace is
trusted. A repository-controlled `PATH` must not be able to make those flows
execute workspace-provided helpers.
## What changed
- Resolve helpers used by automatic startup from trusted system installation
directories, and give plugin-sync Git subprocesses a sanitized environment.
- Make terminal detection environment-only and have doctor inspect executable
locations without running them. Fetch update metadata with the HTTP client
instead of `curl`.
- Fall back conservatively when trusted terminal helpers are unavailable,
including for tmux keyboard enhancement flags.
## Testing
Add black-box coverage with hostile workspace `PATH` entries for startup,
interactive tmux startup, support log collection, doctor, and curated plugin
sync. Add unit coverage for trusted executable resolution and bounded update
HTTP responses.
GitOrigin-RevId: 3b8995eb422b60ed53b0386951de59e8f9bfc542
## What changed
- Move remote exec-server configuration and startup into a dedicated helper.
- Build local and remote run futures before wrapping them with shutdown handling.
GitOrigin-RevId: 26819eacdbf8207a3119f48f4c8057b18cadb797
## Why
Clients need the executor's release version to make version-based compatibility decisions.
## What changed
- Add `executorVersion` to `EnvironmentInfo` and return it from both `initialize` and `environment/info`.
- Resolve the package release version at process startup so the advertised value remains stable for the server's lifetime.
- Use `0.0.0` when the version is unknown or omitted by a legacy executor.
## Testing
- Cover packaged and source-build initialization, startup caching, protocol serialization, and client-side metadata caching.
GitOrigin-RevId: a0c7f0b701a8e7e50345cd5fb1b5c5d2d38ff3b1
## What changed
- Add a shared runtime preparer that validates native build receipts, source and
file digests, dependency closure, and output containment before copying the
required voice plugins and libraries.
- Add macOS-specific Mach-O inspection and relocation that removes build-time
runpaths, rewrites non-system dependencies relative to each loader, applies
development ad-hoc signatures, and records the resulting payload in
`runtime.json`.
- Close the state runtime explicitly in the clear-memories CLI test.
## Testing
- Add macOS tests covering relocation after the source prefix is removed and
fail-closed handling of invalid receipts, changed inputs, unsafe paths,
dependency conflicts, malformed Mach-O metadata, and failed transforms.
GitOrigin-RevId: 3be7a6fabf0135a57036cbb0a9a3e597096930fd
## What changed
- Include remote catalog entries in `codex plugin list`, including their source,
version, install policy, and authentication policy in JSON output.
- Support adding and removing remote plugins through the existing plugin CLI.
- Cache remote catalogs by scope and collection. Prefer fresh cached results, and
refetch once when an add request misses a plugin in the cache.
- Preserve the local curated catalog when an unfiltered remote listing fails,
while surfacing errors for explicitly selected remote marketplaces.
## Testing
- Cover remote listing, installation, removal, catalog fallback, cache refresh,
collection isolation, and install failure behavior.
GitOrigin-RevId: 09796b2c393d102e00ba9289f784d78a2e166a54
## Why
Configured Git marketplaces may be defined outside the user config, but those definitions could not download or update their snapshots.
## What changed
- Select marketplace source, ref, and sparse-path settings from the effective merged configuration for startup synchronization and explicit upgrades.
- Preserve the initiating operation's configuration loader and overrides when reloading before activation.
- Roll back activation if the marketplace definition changed or configuration can no longer be loaded, without copying settings into the user config.
## Testing
- Cover system-defined marketplaces, CLI overrides, startup fallback after invalid user configuration, and rollback after configuration changes.
GitOrigin-RevId: 53d1eecf68a91ce2aa8430e5749d78697bfcd821
## Why
When the remote Sites plugin is installed and its local bundle is available, exposing the bundled copy as well creates duplicate catalog entries and can load the wrong skills.
## What changed
- Persist an account- and backend-scoped exclusion for `sites@openai-bundled` once the remote replacement is installed and loadable.
- Apply the exclusion to plugin catalogs, search, direct reads and installs, runtime loading, hooks, and skill caches while preserving the remote plugin's server-owned enabled state.
- Restore the bundled fallback when the remote plugin is absent or its local files are unavailable, and throttle repeated availability checks for 60 seconds.
## Testing
- Added manager tests for persistence across restarts, account/backend isolation, fallback restoration, concurrent checks, and refresh throttling.
- Added app-server and agent-turn tests confirming that catalog, search, and skill loading prefer remote Sites.
GitOrigin-RevId: bc1154f79d3107910fee9fa27389a0ddb48ce6cf
## Why
Vite+ launches Codex through the same JavaScript shim as npm, so Codex could
misidentify Vite+-owned installations and recommend npm for updates.
## What changed
- Detect Vite+ global installs from their package ownership metadata and pass a
dedicated `CODEX_MANAGED_BY_VITE_PLUS` marker to the native binary.
- Represent Vite+ in install context and `codex doctor` output.
- Recommend `vp install -g @openai/codex` in update and repair flows for
Vite+-managed installs.
See https://github.com/openai/codex/pull/30880.
GitOrigin-RevId: 8add724eefd31170a078086392609dbbd7f20b26
## What changed
- Show the exact `codex resume <thread-id>` command on its own indented line.
- When a thread has a name, also explain that users can run `codex resume` and select the named thread from the picker.
- Apply command highlighting to both resume options when color is enabled.
## Testing
- Cover unnamed, empty-name, named, colored, and embedded-session exit summaries.
GitOrigin-RevId: d97c04db8a34376c6d9ea839b515b04a384b85d1
## What changed
- Allow MCP server names to contain `:`, `@`, `/`, and `.`, enabling names such as `npm:@modelcontextprotocol/server-sequential.thinking`.
- Preserve these names across `mcp add`, `get`, `list`, and `remove`, runtime tool namespaces, and OAuth credential lookup.
- Quote non-bare server names in generated `config.toml` recovery hints and keep similarly escaped OAuth credential names isolated.
## Testing
- Add CLI and runtime round-trip coverage for npm-style names.
- Add snapshot coverage for quoted recovery hints and a regression test for OAuth credential-name collisions.
GitOrigin-RevId: 97e9353cdbc544db4eb2377ddbfa1d2d539b1e04
## Why
Cloud task requests can use saved ChatGPT credentials, so their destination must be constrained before authentication is loaded or any request is made.
## What changed
- Validate `CODEX_CLOUD_TASKS_BASE_URL` against trusted ChatGPT HTTPS origins on port 443 and reject URLs containing user information, queries, or fragments.
- Disable redirects for cloud task backend and environment-discovery clients so credentials are never forwarded to a redirect destination.
- Normalize the validated base URL before configuring authentication and HTTP clients.
## Testing
Add a CLI integration test that verifies a custom cloud backend is rejected without receiving a request, while the staging origin continues to use explicit token authentication.
GitOrigin-RevId: f0dddf363b4e44ea3530f81d9a817e978c15ead2
## What changed
- Resolve plugin activation, MCP server policy, and marketplace definitions from the effective configuration stack, including system settings and trusted project overrides.
- Load plugin skills independently for each working directory passed to `skills/list`.
- Exclude project configuration from catalog requests whose `cwds` are omitted or empty.
- Cache up to eight loaded plugin configurations with least-recently-used eviction so requests for different working directories can reuse their results.
## Testing
- Cover layered plugin and MCP policy across trusted and untrusted projects.
- Cover per-directory skill and plugin catalog results, cache reuse and eviction, and system-defined marketplaces.
GitOrigin-RevId: cb68b2b1bdab1da48e05ca7562bc05014431fc71
## What changed
- Classify `response.failed` events with the `rate_limit_exceeded` code as a distinct retryable error while preserving any parsed retry delay.
- Expose the error as `rateLimitExceeded` through the core protocol and app-server schemas after stream retries are exhausted.
- Preserve the upstream message for TUI display while keeping it out of telemetry summaries.
## Testing
- Cover SSE classification, retry metadata, protocol conversion and serialization, exhausted stream retries, telemetry redaction, and TUI rendering.
GitOrigin-RevId: 02dab4d3477dcd7653a58c49c4bd38687a616579
## What changed
- Accept only `http://` and `https://` gRPC endpoints for app server
`--code-mode-host` connections.
- Limit the standalone code-mode host to stdio and gRPC listeners.
- Remove the WebSocket session provider, dual-WebSocket negotiation, transport
lanes, and related dependencies and tests.
- Keep coverage for shared and prewarmed gRPC hosts and reject WebSocket host
URLs in CLI parsing tests.
GitOrigin-RevId: 8792604e79ffd54ce776074a4dc3f7d55e63752a
## Why
MCP servers can share an OAuth callback URL. Without a validated issuer or a
server-specific callback path, an authorization response could be associated
with the wrong server.
## What changed
- Use stable callbacks when authorization metadata advertises issuer-bound
responses, and validate the returned issuer before exchanging the code.
- Retain server-specific callback IDs for providers without issuer support,
including fallback to the global or default callback for legacy registered
clients.
- Persist registered callback URLs for MCP servers and plugins, and insert the
active listener port into portless loopback redirects.
## Testing
Add coverage for issuer validation, callback-mode discovery, registered and
legacy clients, plugin OAuth, CLI persistence, and loopback listener ports.
GitOrigin-RevId: 2878c92e237fc17fd3def0bd2e1cce3e104a3db8
## Why
Diagnostic uploads skip the doctor attachment if report generation exceeds its
overall timeout. SQLite integrity scans can be delayed by large databases or
lock contention.
## What changed
- Give each database integrity scan a one-second deadline when collecting a
diagnostic attachment.
- Interrupt scans and lock waits at the deadline, preserve any corruption rows
already returned, and report an incomplete clean scan as a warning.
- Keep direct `codex doctor` integrity checks unbounded.
## Testing
- Cover interrupted scans, lock waits, retries without a deadline, and
corruption results returned before interruption.
GitOrigin-RevId: 4817fb459ac53953669a9ba5f03397a6fc82c72e
## Why
Removing a base-user marketplace must not delete a snapshot that is still
referenced by another enabled configuration layer.
## What changed
- Load the current configuration stack for marketplace commands in the CLI and
app server.
- Reject removal when a matching marketplace is defined by another enabled
layer, and identify the configuration source that must be updated instead.
- Allow cleanup of an installed marketplace snapshot even when no base-user
entry exists.
## Testing
Cover project, enterprise-managed, system, and session-flag configurations, as
well as snapshot-only removal through the CLI and app server.
GitOrigin-RevId: 4f0853a40c2b5fae0410696b79eee4284239c7a9
## What changed
- Report `Session archived: <thread-id>` after successfully archiving the current session.
- Show the session ID when no resume hint is available, including for non-fatal exits.
- Keep deleted-thread exits distinct from successful archive exits.
## Testing
- Add coverage for archive lifecycle handling and exit-message formatting.
GitOrigin-RevId: 1812374e4c74fa1b3f11feb323de18a9dbff745b
## Why
Exiting a TUI connected to a persistent app server can leave work running, so
the existing session-exit summary does not explain how to reconnect or stop the
active turn.
## What changed
- Distinguish disconnects, interrupted turns, and removed threads when building
exit summaries.
- For daemon and remote sessions, report whether work may still be running and
print commands to reconnect or stop the current turn.
- Sanitize remote WebSocket addresses in displayed commands and preserve the
configured remote authentication environment-variable option.
- Keep the existing token-usage and resume summary for embedded sessions.
## Testing
Add coverage for daemon, remote, interrupted, embedded, archived, and deleted
session exits, including credential sanitization.
GitOrigin-RevId: 9cbbf9c7dd36423a5ed99909a2b4cb32e3e87712
## What changed
- Add the under-development `transcript_v2` feature for the interactive
transcript composer and turn-selection UI.
- Keep it disabled by default and expose it through the configuration schema
and `codex features enable transcript_v2`.
## Testing
- Verify explicit configuration overrides and CLI persistence for the new
feature.
GitOrigin-RevId: 138ab7851621c066e8121cc3eb6cd4e7299f9c31
## What changed
- Add the experimental `amazonBedrockAccessKeys` app-server login flow, persist its credentials in the configured auth store, and use them for SigV4-signed Bedrock requests.
- Report `bedrockAccessKeys` as a distinct auth mode and document access-key login alongside AWS profile and environment credential setup.
- Clear the selected Bedrock provider, AWS settings, and Bedrock-specific model on logout while leaving external AWS credentials and `.env` untouched.
- Reject managed access-key login when higher-precedence configuration would prevent its region or profile settings from taking effect.
## Testing
- Cover access-key login, storage, request signing, configuration conflicts, status reporting, and logout cleanup.
GitOrigin-RevId: bbf297887c6503d3651ceb2aad85c4d626e32723
## Why
Windows update commands could be influenced by the current project through
relative `PATH` entries or project-local package-manager configuration.
## What changed
- Resolve package-manager commands and `powershell.exe` using only absolute
`PATH` entries before starting an update.
- Run the resolved command from a temporary directory so the current project
does not affect the update, while retaining Windows `.cmd` and `.bat`
handling.
- Reject a relative-only `PATH` with guidance to update manually.
## Testing
Added a Windows regression test that verifies relative `PATH` entries and
current-directory command decoys are ignored.
GitOrigin-RevId: 15303165af42718244b99786f939f400dc6cbd07
## What changed
- Add an extension API for spawning host-owned internal sessions and a
`ThreadReadyInput` lifecycle callback that runs after thread registration.
- Add Guardian reviewer session scaffolding that records the parent thread and
effective model, plus the under-development `guardian_ext` feature flag.
- Start internal sessions with fresh history while preserving parent lineage,
shared session controls, and internal-thread visibility rules.
- Scope internal-session prompt cache keys to their source and parent thread,
and expose `guardian` as an internal session source.
## Testing
- Cover internal-session spawning, parent metadata, history isolation, prompt
cache keys, and extension spawner argument forwarding.
GitOrigin-RevId: 682dae80397d62bb36247796b447042e760ca364
## Why
App-server logs can be persisted or included in submitted diagnostics, so credentials used by model providers, authentication refreshes, and attestation requests must not appear in diagnostic output.
## What changed
- Add `RedactedString`, which preserves serialization and string access while replacing debug output with `<redacted>`.
- Use it for model-provider bearer tokens, header and query values, authentication command arguments, and attestation tokens.
- Avoid logging JSON-RPC error payloads and parser or authentication errors that may echo credentials; retain safe context such as error codes and categories.
## Testing
- Add an app-server regression test that exercises provider credentials, refreshed authentication tokens, and attestation tokens, then verifies none appear in persisted SQLite or submitted diagnostic logs.
GitOrigin-RevId: 8c50408adf94d93847658b1320682cf3b637d2cc
## Why
`codex agents` rejected invocation-specific configuration, preventing the
dashboard from applying settings when starting a shared thread.
## What changed
- Accept interactive options such as model, approval, sandbox, search, working
directory, and configuration overrides when opening the agents dashboard.
- Forward supported session-flag configuration into threads started through an
embedded or remote app server, while excluding unrelated values.
- Continue to reject initial prompts and images, along with local provider and
additional-directory settings that cannot be applied to a remote server.
## Testing
- Cover accepted dashboard options and rejected incompatible inputs.
- Verify that explicit feature and sandbox overrides reach shared threads in
both embedded and remote modes.
GitOrigin-RevId: f10aa1e16ff62b49d55679e987d9e458438ba3f8
## What changed
- Require macOS Desktop app bundles to pass strict `codesign` verification for the Codex bundle identifier and OpenAI signing team.
- Verify downloaded apps before installation and existing apps before launch.
- Add tests that reject unsigned bundles, ad-hoc signatures, and attempts to launch an unsigned existing app.
GitOrigin-RevId: 9b23739281d8abf7fc30c5366960eb1bb07a1b7d
## What changed
- Add the `shellSnapshotV2` executor capability and an optional shell snapshot request to `ExecParams`.
- Capture and restore Unix shell state and profile exports from an in-memory, attachment-scoped cache for `bash`, `zsh`, and `sh`.
- Apply environment policies, runtime `PATH` entries, sandbox context, and live managed-proxy settings when preparing restored commands.
- Bound snapshot size, capture time, scope length, and cache capacity, and fall back to the original command when capture fails.
## Testing
- Cover local, remote, TTY, sandboxed, and supported-shell execution, plus environment filtering, proxy handling, in-memory reuse, and capture failure fallback.
GitOrigin-RevId: 624f747972c249c88c6f10f42cf0af97b75b5541
