## What changed
- Add the opt-in `executed_tool_call_metadata` feature to record model-attempted direct and code-mode tool calls.
- Attach recorded names and arguments to the matching tool output in the next Responses request, preserving the metadata across sampling retries.
- Bound pending calls and argument sizes, and emit truncation metadata when limits are exceeded.
## Testing
- Cover disabled-by-default behavior, namespaced and nested calls, blocked or failed attempts, retry handling, and recorder limits.
GitOrigin-RevId: 5ce917b73e797b0f6904d46477b9d2cf8ea71bf2
## What changed
Add integration coverage for managed network requests that verifies:
- Guardian allow and deny decisions apply only to the triggering request.
- A decision for a remote environment does not carry over to a local one.
- A user-granted remote session approval remains active after Guardian-reviewed requests.
- Guardian assessments receive the exact network action and execution environment for each request.
GitOrigin-RevId: 6701074c6d60b9f28a6d47ebaf910bb1e9f2fa07
## What changed
Add integration coverage for `apply_patch` with unified exec workspace roots. The test verifies that a normal file can be added while writes under existing `.git`, `.agents`, and `.codex` directories are rejected and do not create files.
GitOrigin-RevId: 21ad5ce7fb06e7c47b4086c1439f12d52d9235de
## What changed
Return telemetry tags directly from `CoreToolRuntime::telemetry_tags` instead of
wrapping them in a future, and update the MCP runtime and tool registry call site
accordingly.
GitOrigin-RevId: 54e03972fe23c0e644c68c73af504dba0871be8e
## What changed
- Force an online model-catalog refresh and verify that the mock server receives it.
- Allow the catalog mock to handle repeated requests.
- Bound the catalog refresh and session shutdown with timeouts, and explicitly wait for shutdown before completing the test.
GitOrigin-RevId: 503b52fd296928757b982abc053c74ed36700ff0
## What changed
- Replace fixed delays with explicit signals that pause the sideband connection after its HTTP handshake request begins.
- Release the handshake after closing the realtime conversation and verify that the connection ends before the handshake completes.
- Shut down the test session while rejecting stale realtime errors or duplicate close events from the canceled sideband task.
GitOrigin-RevId: 37072842b973fff41ec47235ceb9cfe3cf1a5a37
## What changed
- Disable shell snapshots in the file-change approval replay fixture.
- Wait for the thread to report `WaitingOnApproval` before resuming it.
- Gracefully shut down the app server and assert that it exits successfully.
GitOrigin-RevId: a1e18d31fcc819dcf9f0e066d0da73c25a47d984
## Why
The notification helper buffers unrelated server requests, so the session-scoped
file change approval test could overlook an unexpected second approval request.
## What changed
- Consume approval resolution and file change completion events directly and
verify their request, thread, turn, and item identities.
- Fail if the second patch requests approval after the first patch was accepted
for the session.
- Shut down the app server gracefully and assert that it exits successfully.
GitOrigin-RevId: 53a3f746940677043e097094862c28faf4db1a8d
## What changed
- Disable shell snapshot startup so the test stays focused on file change approval.
- Shut down the app server cleanly and assert that the turn makes exactly two Responses API requests.
GitOrigin-RevId: b19a67791d1bd371523e68ad6fae32d1dd426f2f
## What changed
- Seed approval scenarios with the bundled model catalog so their model metadata is deterministic.
- Make the patch approval helper surface unexpected exec approvals, errors, aborts, and shutdowns immediately instead of waiting for its timeout.
GitOrigin-RevId: b5ec88494ecaf571a480b4142300eb5f3f98def9
## Why
A phase-two memory job could release its lease while its consolidation agent was
still shutting down, allowing another worker to race the existing agent.
## What changed
- Await consolidation-agent shutdown before validating artifacts and completing
the job.
- Keep the lease until it expires if shutdown fails, and remove the agent from
the thread manager only after shutdown succeeds.
## Testing
Update startup tests to wait for the phase-two job lifecycle to finish and verify
that the consolidation thread has been removed.
GitOrigin-RevId: 7ac3a7369529822ac95fd2ee9dcb27d39c191d20
## What changed
Update the code mode yield and termination integration test to generate a
bounded output backlog, then wait on a file-backed gate until the session is
terminated. Remove the timeout that previously guarded submission of the
infinite-loop workload.
GitOrigin-RevId: dd48307f18ab12bfbf02dc26b0f3715f073402a7
## What changed
- Run the strict auto-review enabled and disabled scenarios as separate test cases on a two-thread Tokio runtime.
- Explicitly shut down each Codex instance after verifying that the approved folder grant allows the later `apply_patch` call.
GitOrigin-RevId: cbbf47d834c4a9adcf181b97b8aa72b5f0a513e2
## What changed
Build the `apply_patch` filesystem sandbox context from the executor's canonical permission profile instead of the execution attempt's materialized profile. Continue merging any additional permissions requested by the patch while keeping workspace roots scoped separately to the attempt.
## Testing
- Update the sandbox-context test to verify that executor `workspace-write` permissions are preserved when attempt workspace roots and additional file permissions are present.
GitOrigin-RevId: 2a9a8c2e1b1945e300283c400d0f1e573225a553
## What changed
- Track the first registered tool for each normalized code-mode identifier and use that tool consistently for dispatch metadata and model-facing code-mode declarations.
- Skip duplicate normalized names when building the code-mode executor while preserving shadowed tools in the registry and direct tool exposure where applicable.
- Cover collisions across dynamic and namespaced tools, direct and deferred exposure, code-mode-only operation, and Responses Lite metadata.
GitOrigin-RevId: a4acb57ce44e7de1398981b22af4b87e2a35870f
## What changed
- Retain bounded, non-completion agent messages in remote v2 compaction history so delegated tasks remain available on follow-up turns.
- Account for encrypted agent-message content when estimating token usage and place restored initial context before the latest real user or agent message.
- Exclude child completion messages from retained follow-up history and strip inherited parent agent messages when forking a child.
## Testing
- Extend compaction, history-estimation, and agent-fork tests to cover encrypted delegated tasks, child completions, context ordering, and fork sanitization.
GitOrigin-RevId: ba4392e9cfdf4ecbcdc9c7d8581d58a8d2d78260
## Why
External MCP, extension, and dynamic tools can collide with host-owned tool
names. In particular, a dynamic `tool_search` definition must not replace the
host implementation used to discover and route deferred tools.
## What changed
- Build each turn's tools through a single ordered `ToolRegistry` that retains
the first runtime registered for a name.
- Treat duplicate external tools as skippable collisions while preserving
strict duplicate checks for trusted host tools.
- Reserve host-owned code-mode and `tool_search` runtimes before producing the
model-visible tool list.
- Base hosted web-search fallback behavior on the extension runtime that
actually won registration.
## Testing
- Cover ordered registry mutation and duplicate handling.
- Verify a client-provided `tool_search` cannot shadow the host tool.
- Verify hosted web-search fallback follows the registered browser runtime.
GitOrigin-RevId: acebe360de8ec69ad7da2f684cc2542cbf18a984
## Why
Executor capability discovery can traverse plugin and skill roots, including
symlinks. Under restricted filesystem permissions, discovery must not expose
files outside the permitted paths.
## What changed
- Pass each environment's filesystem sandbox context through capability root
discovery and apply it to metadata, directory walks, and file reads.
- Enable discovery for restricted sessions so permitted executor skills remain
available while inaccessible roots and symlink targets are omitted.
- Key discovery caches by sandbox context and reject sandboxed discovery on
executors that do not advertise support for it.
- Split requests with more than 128 roots into supported-size batches.
## Testing
- Cover permitted and denied external symlink targets.
- Verify restricted skill listing excludes inaccessible skills.
- Verify cache separation across permission contexts and discovery of 129 roots.
GitOrigin-RevId: 44d16468ca003403bdb8b71a04ae8c9ff94ed494
## Why
Executor-backed skill resources must honor the active filesystem permission profile instead of reading outside its allowed roots.
## What changed
- Propagate each environment's filesystem sandbox context into `skills.read` calls.
- Apply turn-scoped permission grants when reading executor skill resources.
- Fail closed when no matching sandbox context exists or a restricted Windows read cannot be sandboxed.
- Preserve the existing resource size limit for both sandboxed and streamed reads.
## Testing
- Cover reads within permitted roots and reads that succeed after a permission grant.
- Verify denied references do not expose their contents and disabled Windows sandboxing is rejected.
GitOrigin-RevId: 5cc679b9385b0621665ff20cf5848863cc6396a4
## What changed
- Add an optional `wait_until_ready` hook to `CoreToolRuntime` and invoke it
before acquiring the tool execution gate.
- Move MCP refresh and server-startup waiting into the MCP runtime's hook.
- Forward readiness waits through tool exposure and namespace wrappers.
- Test exact runtime selection for plain and namespaced tools, including
exposure overrides and missing tools.
GitOrigin-RevId: 8718589fa06f14d053a35a288186613f649d25ff
## What changed
- Split core tool planning from the assembly of MCP, extension, and dynamic tool runtimes.
- Build `ToolRouter` from a single ordered runtime list plus hosted tool specs.
- Centralize whether each `ToolExposure` variant is available in code mode.
- Preserve core, MCP, extension, and dynamic source ordering and existing name-collision priority.
## Testing
- Add coverage for unified source ordering and collisions, code-mode exposure, and standalone web search alongside MCP and dynamic `web.run` tools.
GitOrigin-RevId: b010c2e9728b92b75a35325ca9b2ec465c3bac12
## What changed
- Send the active turn ID in the `x-codex-image-turn-id` header for image generation and edit requests.
- Add `explicit_client_interrupt_requested_at_ms` to turn analytics. Record the earliest explicit interrupt request that receives a successful response, while excluding rejected requests.
- Track errors returned by `turn/interrupt` so pending analytics state is cleaned up correctly.
## Testing
- Cover turn ID headers for image generation and editing.
- Cover accepted, retried, and rejected explicit interrupt requests in analytics tests.
GitOrigin-RevId: 80fe996a161b4952b79c5c38238f75b7661b92af
## Why
Paginated thread history could reject valid rollout records when rate-limit
percentages were encoded as floating-point JSON values, preventing later final
answers from being projected.
## What changed
Deserialize each rollout line through `serde_json::Value` before converting it
to `RolloutLine`, preserving floating-point rate-limit values during history
materialization.
## Testing
Added coverage for projecting fractional, integral, very small, and large
floating-point rate-limit percentages across both catch-up materialization and
subsequent history appends.
GitOrigin-RevId: 68da907987ffe59f4a3033ef90f3b88c39734cb1
## Why
Ollama requests need to honor Codex's configured outbound proxy policy and custom CA handling.
## What changed
- Replace Ollama's direct `reqwest` client with a route-aware client created by `codex-http-client`.
- Preserve the five-second connection timeout and legacy system-root fallback for default-routed requests.
- Reuse one Ollama client for connectivity, version, model discovery, and model-pull checks.
- Surface HTTP transport initialization errors instead of replacing them with the generic Ollama connection error.
## Testing
- Cover system-proxy routing and invalid `CODEX_CA_CERTIFICATE` and `SSL_CERT_FILE` values under both outbound proxy policies.
- Verify that version and model checks reuse the existing Ollama client.
GitOrigin-RevId: c7cc36845a9bceb57ce5524b9e1b3cbe317897a3
## Why
`codex-http-client` is the intended owner of `reqwest`, while direct first-party
dependencies are tracked as migration debt.
## What changed
- Use `http` header and status types directly in core code and tests.
- Build the MCP test readiness client through `HttpClientBuilder`.
- Remove `reqwest` from `codex-core` and its temporary dependency-policy
exception.
GitOrigin-RevId: 8d5c7c86256294a7bb8aa1ae10cc5bea4cb1fc56
## What changed
- Propagate MCP tool `readOnlyHint` annotations through tool-call start and
completion events.
- Include the optional hint in persisted thread history and app-server
`mcpToolCall` items, preserving compatibility when the annotation is absent.
- Document that the hint describes tool capability, not the outcome of a
particular invocation.
## Testing
- Cover read-only and write-capable tools in live events and persisted rollout
data.
- Verify the hint survives thread reads and resumes for both in-progress and
completed MCP calls.
GitOrigin-RevId: dddfe905146075e5137a1094da485b86b99807f0
## What changed
Stop accepting the hidden, deprecated `--full-auto` flag in `codex exec` and
remove its implicit mapping to the `workspace-write` sandbox. Callers must now
select the sandbox mode explicitly with `--sandbox workspace-write`.
GitOrigin-RevId: 0a739eb028eb3e2dd16a7650569256a01123d742
## Why
External-agent migration treated symlinked empty text targets as overwritable files. Writing migrated configuration through such a target could modify a file outside the repository.
## What changed
- Use symlink metadata when checking whether a migration target is missing or empty, so only regular files are considered overwritable.
- Preserve symlinked `AGENTS.md` and `.codex/hooks.json` targets during both detection and import.
## Testing
Added Unix regression coverage for existing and dangling symlink targets for both guidance and hooks migration.
See https://github.com/openai/codex/pull/26021.
GitOrigin-RevId: 13c78e7458d1c02abdb22b38ba88ed66bb5a154b
## What changed
- Treat `codex.tool.call` and `codex.tool.call.duration_ms` as runtime-only metrics when using the built-in Statsig exporter.
- Continue exporting both metrics through explicitly configured OTLP exporters.
## Testing
- Verify the Statsig configuration omits the tool-call metrics while retaining unrelated metrics.
- Extend the OTLP HTTP loopback test to cover the tool-call counter and duration histogram.
GitOrigin-RevId: 46dd2642063b34e9a4c69b67d58b45721609fcf2
## Why
OAuth discovery failures do not establish that an MCP server lacks OAuth
support. Reporting those failures as `unsupported` conflates an inconclusive
check with a confirmed result.
## What changed
- Add an `unknown` MCP authentication status across the protocol, app server,
CLI, and TUI.
- Preserve OAuth discovery errors so callers can report `unknown`, while
retaining `unsupported` for servers known not to support OAuth.
- Document the distinction in the app server API.
## Testing
- Verify transient HTTP discovery errors are preserved.
- Verify `codex mcp list --json` reports `unknown` when discovery is rate
limited.
GitOrigin-RevId: e4562985971606740538e542ec7eeee502111964
## What changed
Classify `codex-responses-api-proxy` as an intentional `reqwest` exception in
`deny.toml` instead of a temporary migration exception. The proxy independently
owns its blocking upstream HTTP transport, and the allowed wrapper set remains
unchanged.
GitOrigin-RevId: 3db3281a13d67c9514051ea0009013ce50c439e6
## Why
MCP catalog discovery must not allow a server to keep pagination running or
growing without bounds.
## What changed
- Apply the shared pagination collector to tool, resource, and resource-template
discovery.
- Limit each catalog to 100 pages and 1,024 items, and reject pagination cursors
larger than 64 KiB or any repeated cursor.
- Bound the entire pagination operation by the configured tool timeout, falling
back to 30 seconds when no timeout is configured.
## Testing
Add unit coverage for every limit and an end-to-end MCP test that preserves
valid multi-page tools while excluding a server that returns an oversized
cursor.
GitOrigin-RevId: 961a1bfa5fe8a265daf56e342a919c980cd720fa
## Why
A failed network policy amendment must not grant access to the requested host or approve it for the rest of the session.
## What changed
- Only approve the host for the session after the allow amendment is applied successfully.
- Otherwise deny the pending request and record a policy-denial outcome for its owning call.
## Testing
Added a managed-network regression test that submits an invalid allow amendment, verifies that the request is blocked, and confirms that retrying the host prompts for approval again.
GitOrigin-RevId: b2014d19128133abd5e19b8a7e4eb27810a45306
## What changed
- Accept an optional thread name with `/fork`, trimming surrounding whitespace.
- Apply the name to the newly forked thread and update the active session metadata.
- Keep the successful fork active and show an error when naming it fails.
## Testing
- Cover unnamed and named `/fork` dispatch, persisted names, and naming failures.
GitOrigin-RevId: 1799576f82ef0856f992a0378f041e4bab89621b
## Why
Closing stdin could leave the app-server running when a remote-control client
was still connected.
## What changed
Track each connection's origin and shut down a stdio app-server when its stdio
connection closes, regardless of whether other connections remain. Report the
shutdown reason as `stdio_connection_closed`.
## Testing
Added a regression test that closes stdio while a remote-control connection is
active and verifies that the app-server exits and disconnects the remote client.
GitOrigin-RevId: 51ab14d45dfea7f40a0657a8bb167b54efaf0e48
## What changed
- Replace direct `reqwest` error types in `codex-protocol` with
`codex_http_client::HttpError`.
- Build the response-stream error test through
`codex_http_client::HttpResponse`.
- Remove `codex-protocol` from the direct `reqwest` dependency allowlist.
## Testing
- Update the response-stream failure test to cover status and URL propagation
through the shared HTTP response wrapper.
GitOrigin-RevId: 7abcbbe55f994acb13cccefef806a53c7008acde
## What changed
- Load the cloud configuration bundle before `codex mcp list`, `get`, `login`, and `logout` so those commands can resolve enterprise-managed MCP servers.
- Keep `codex mcp add` and `remove` scoped to user configuration, preventing managed server definitions from being copied into or deleted from `config.toml`.
## Testing
- Add CLI integration coverage for listing and inspecting a managed server, completing its OAuth login and logout flow, and preserving user configuration during add and remove operations.
GitOrigin-RevId: 9b64d70535aaba11303c42e44b9ad751c8745445
## What changed
- Pass server notifications to analytics tracking by reference.
- Clone only the notification variants that are recorded as analytics facts.
## Testing
- Add unit coverage that verifies a turn diff notification is enqueued and a command output delta notification is ignored.
GitOrigin-RevId: 2fa0711dbdcca33dce82c3ef78ee53a3f5a65bd9
## What changed
- Make targeted official documentation search and page retrieval the default first step, while retaining a manual-first path for broad Codex orientation and setup questions.
- Split Codex self-knowledge, documentation integration diagnostics, model migration, model selection, and general official documentation guidance into focused references, with at most one primary route loaded per request.
- Preserve explicitly requested model targets, reserve the latest-model resolver for dynamic migrations, and treat bundled model guidance as a disclosed fallback to current official sources.
- Expand the skill metadata and interface description to cover Codex self-knowledge, ChatGPT Work, and OpenAI model and API workflows.
GitOrigin-RevId: 22aba3fc6f58dac8a6cef637504b1fe6d2aaf0d0
## Why
Each connection set could restart the one-second startup grace for the same
cacheable optional MCP server, repeatedly delaying catalog capture while that
server was still pending.
## What changed
- Store the optional startup deadline in the shared tool catalog cache entry.
- Reuse that deadline until a catalog is published, and allow a fresh grace
period after the cached catalog expires.
- Preserve per-connection-set startup grace for servers that disable catalog
caching.
## Testing
Added a paused-time test covering shared deadlines, immediate cached-tool reuse,
cache expiration, and disabled caching.
GitOrigin-RevId: 3494969ee7002c70ce9e4ffd370e46a22d38cc11
## Why
Built-in pet downloads used a standalone blocking client, so CDN redirects did
not use Codex's configured route handling.
## What changed
- Download pet spritesheets asynchronously with a reusable
`RouteAwareClientPool`.
- Keep cache validation, asset installation, and pet decoding off the async
runtime while sharing one asset-and-load path across startup, previews, and
selection.
- Preserve the download size limit while consuming streamed response chunks,
and remove the TUI's direct `reqwest` dependency.
## Testing
Add coverage for oversized response chunks, cached built-in assets, pet loads
without an existing Tokio runtime, and stale preview and selection completions.
GitOrigin-RevId: 725e76f3ddb7e84b7212769892f28dc0add15741
## What changed
- Add `thread/section/move` to atomically move a thread into, within, or out of a section. Threads can be inserted before an existing member or appended, and moves within a section preserve `sectionEnteredAt`.
- Add `section_position` sorting to `thread/list`, with ascending order as its default, and expose `sectionEnteredAt` in thread responses.
- Persist section positions and entry times in SQLite, including migration of existing section members into recency order. Section membership is no longer updated through `thread/metadata/update`.
## Testing
- Cover section moves, reordering, pagination, persistence across restarts and rollout reconciliation, concurrent updates, and rank renumbering.
GitOrigin-RevId: aec6d7ddedca5277029b5caf5c074975397e956c
## What changed
- Keep `ClientResponsePayload` typed through the app-server outgoing queue and serialize it at the transport boundary, avoiding an intermediate `serde_json::Value` while preserving the JSON-RPC wire shape.
- Return a JSON-RPC internal error when a response cannot be serialized, including over remote control, and skip unserializable analytics responses.
- Scan reverse JSONL input a chunk at a time with a larger buffer instead of processing each byte individually.
## Testing
- Cover typed response serialization and serialization failures for direct and remote-control transports.
- Cover filtering unserializable responses from analytics.
GitOrigin-RevId: cc4fd7a43461a273315bb95261bd1ae3ff65fbf7
## Why
File arguments for MCP app tools can use a path convention that differs from
the host running Codex. Resolving those arguments with host-native path handling
can therefore point uploads at the wrong file.
## What changed
- Resolve file arguments against the selected turn environment's working
directory with `PathUri::join`.
- Use the resolved URI's inferred native spelling for errors and derive the
uploaded filename without converting through a host-native path.
## Testing
Run the existing MCP file upload integration test under Wine and reduce its
streaming fixture to 2 MiB.
GitOrigin-RevId: 0a659c19e73f5a26ddfc864e39dad6a4a404057b
## What changed
- Update the Rust MCP SDK from `3.0.0-beta.3` to `3.0.0` and adapt to its renamed metadata and server discovery types.
- Accept discovery responses without server identity metadata, using the configured server name as a fallback, and rely on the SDK's native support for namespaced server identity metadata.
- Preserve typed OAuth HTTP errors so transport failures, cross-origin redirects, and transient HTTP responses are reported instead of being treated as anonymous access.
## Testing
- Cover modern discovery with namespaced or missing server identity over HTTP, SSE, and stdio.
- Cover OAuth discovery error propagation for transport failures, redirects, and transient status codes.
GitOrigin-RevId: 12c1e45136cca89ce4fb15986c2b5df14608682a
## What changed
- Remove the `v8` 146.4.0 crate archive from `MODULE.bazel`.
- Remove the corresponding bindings, static libraries, and platform filegroups
from `third_party/v8/BUILD.bazel`, leaving the 150.4.0 targets in place.
GitOrigin-RevId: 86f93819c3f3f69217a1273df50702abe04682f4
## What changed
- Move the migration flow, model, and source picker under the
`external_agent_config_migration` module.
- Keep their tests and snapshots alongside the corresponding module files and
update imports and snapshot source paths.
GitOrigin-RevId: 4b2f83ca689534e4d9cd1dc7aaa8424e76166bba
## Why
The executor protocol supports Codex releases back to `0.145.0`, so compatibility needs to hold when either side of the app-server/exec-server connection is upgraded first.
## What changed
- Define `MINIMUM_SUPPORTED_CODEX_VERSION` in `codex-exec-server-protocol`.
- Add a Unix test harness that runs current-to-released and released-to-current command execution over authenticated Noise connections.
- Test the current binary against itself, the latest release, and the minimum supported release by default, while allowing explicit release versions.
- Verify that the remote command runs successfully and relay payloads remain encrypted, and increase the relay test timeout to accommodate the end-to-end scenarios.
GitOrigin-RevId: faea8d44fce161f40ed15170876a1282a6de4c22
