## Why
Prepared MCP calls cloned `ToolInfo` already stored in the binding's model-visible catalog, duplicating tool metadata.
## What changed
Store the binding catalog in an `Arc<[ToolInfo]>` and let prepared calls reference its entries by index. Keep separately owned metadata for tools hidden from the model and calls prepared outside the binding catalog.
## Testing
Extend the binding test to assert that advertised and prepared tool metadata share the same address, while preserving ready-client catalog selection and hidden-tool behavior when tool names collide.
GitOrigin-RevId: 24b92f7e1dbb421c9ebce875b9b1024f7d697c5e
## Why
Opening active EXE/DLL files with `MAXIMUM_ALLOWED` can request access that causes sharing violations during sandbox runtime ACL repair.
## What changed
Restrict `MAXIMUM_ALLOWED` opens to directories that need to suppress child ACL propagation. For files, request `READ_CONTROL | WRITE_DAC` only when an ACL update is needed.
Preserve the non-inheriting grant behavior from https://github.com/openai/codex/pull/49690, including existing permissions, deny ACEs, and null DACLs.
## Testing
Extend the Windows runtime repair regression test to hold `node.exe` open with `FILE_SHARE_READ` throughout repair and revalidation, while checking read/execute access and preserved denials.
GitOrigin-RevId: 2e087b51adc0221d0eda061fa0a34d2e98409662
## What changed
- Replace the separate MXC crates with the pinned `mxc-sdk` 1.0.0 dependency and update Cargo and Bazel lockfiles.
- Use the cached PSEC API-set check for availability and the SDK's native deny-path capability check before launch. Native creation and request-specific capabilities are validated at launch.
- Map empty environments to `None` to retain Windows user-profile defaults, while keeping nonempty environments explicit. Document the SDK's `SystemRoot` and `LOCALAPPDATA` requirements.
- Configure Bazel's LLVM resource compiler for Windows GNU builds, document Cargo's `RC_PATH` requirement, and add `libproc` and `libsandbox` to the macOS SDK libraries.
## Testing
Update the request-building test to verify that nonempty environments remain explicit and empty environments become `None`.
GitOrigin-RevId: f3ccbb92ceaa71f16c5d6cb185a7602a5bb8da53
## What changed
Enable `instant_interrupt` by default so new user input can preempt responses and yield foreground code-mode observations. Keep the feature marked as under development and update feature-policy tests to allow this exception.
Explicitly disable instant interrupts in core, TUI, and Python SDK tests that depend on responses completing before steering or processing subsequent input.
GitOrigin-RevId: a8cab2d6c445bfdbd10b0b2abcf7893d32ee8595
## Why
User-verification cancellations previously discarded failure reasons, leaving MCP servers unable to distinguish user cancellation from unavailable approval, interruption, or invalid proof.
## What changed
- Carry a bounded `openai/userVerificationReason` value in response `_meta` for verification failures, declines, and cancellations across the TUI, app server, and MCP client.
- Preserve recognized reasons and classify invalid responses, missing or invalid proofs, response errors, closed response channels, interruptions, and unavailable approval.
- Discard unknown reasons and unrelated metadata. Keep proof material out of decline and cancellation responses, and keep display messages and raw error diagnostics out of response metadata.
## Testing
Add and update tests for typed failure propagation, metadata filtering, invalid proofs, response-channel failures, interrupted requests, and unavailable approval, including TUI RPC and native MCP response coverage.
GitOrigin-RevId: 6b7f855ce8eb13e759b5b86d0dc2b1afdfcff7b3
Remove repeated `selected_capability_roots` initializers from two
`TurnEnvironmentSelection` fixtures so the registry test can compile.
GitOrigin-RevId: bef3fba18dd786b80610703a37d6d3243cf33401
## What changed
Add the `ultrafast` service tier to bundled catalogs for `openai.gpt-6.1-sol` on Bedrock Mantle and `global.openai.gpt-6.1-sol` and `us.openai.gpt-6.1-sol` on Bedrock Runtime. This exposes `/ultrafast` for these models while keeping tier selection opt-in.
## Testing
Extend catalog, app-server, core request, and TUI tests to cover GPT-6.1 Sol tier discovery and selection across all three model IDs, including toggling back to the default tier and honoring custom catalog commands.
GitOrigin-RevId: b5bbde8615b73a1d73eb16db7952b10d044b9fa6
## What changed
Move `SandboxOverride` into the shared protocol and carry the controller's selection through tool attempts, execution requests, and exec-server process and filesystem sandbox preparation. Include it as `sandboxOverride` in filesystem sandbox contexts for observation without granting broader permissions or altering sandbox commands.
Default missing values to `NoOverride` and omit that value when serializing to preserve compatibility with existing requests.
## Testing
Extend tests to cover override propagation, wire round-trips for all three variants, and deserialization of requests without `sandboxOverride`.
GitOrigin-RevId: 2f438cf4aef1134e3149959d14aa731682168ae5
## Why
Tokio runtime tracing can cause SQLite log writes to enqueue more writes and exporter activity to generate further OTLP exports.
## What changed
- Exclude `tokio` and `runtime` spans from OTLP export alongside `h2` spans.
- Limit `tokio::` and `runtime::` targets to `INFO` in the default log filter, and reject their `TRACE` events directly in the SQLite sink even without an outer filter.
- Box and pin the session-loop future before spawning it.
- Reorder tracing and Tokio test attributes, restrict the skills concurrency test's subscriber to the catalog-refresh span, and use the default log filter in the SQLite formatter comparison test.
GitOrigin-RevId: f545013a2469088d7f9890c1f46bb93eb5446d2d
## What changed
Update the bundled `openai-docs` references to cover GPT-6 Astra, GPT-6.1 Sol, GPT-6 Sol, and GPT-6 Luna with model-specific reasoning, tool-calling, parameter, and data residency guidance.
Require verification of the exact target's availability and compatibility, preserve explicitly requested models, and use live guidance for model selection. Replace fixed role mappings with verified targets and clarify when to load migration and prompting fallbacks.
GitOrigin-RevId: 59067d0fc97af36d2e5b6508c45488181c6a4ace
## What changed
Consume enabled tool definitions and borrow their metadata when installing `tools` and `ALL_TOOLS`, avoiding copies of the tool catalog. Retain only tool names and kinds in runtime callback state, preserving each cell's original callback indices for its lifetime.
GitOrigin-RevId: 62eaf62abce6de1a0cd5cdb3332fbed754a23993
## What changed
Remove the duplicate tool metadata stored in `CachedMcpHandler` and compare incoming metadata directly with `McpHandler::tool_info()`.
Preserve complete agent plugin namespace descriptions in the handler, applying the existing 1,000-byte limit when building tool specs and search metadata. Truncation continues to respect UTF-8 character boundaries.
## Testing
Extend the agent plugin namespace description test to verify that the handler retains the full description while search output remains bounded.
GitOrigin-RevId: d0a9d5f6796143315235e658e77e059657e85f13
## Why
Guardian cannot capture sender instructions from another host when the sender thread is absent from the receiver's local runtime.
## What changed
Fall back to the authenticated thread store to reconstruct sender history without resuming the sender. Respect compaction and rollback, and label persisted evidence to indicate that newer unpersisted messages may be missing.
Limit storage reads to five seconds and capture sender context before acquiring the active-turn lock. Bind the captured evidence to the turn that accepts the delivery, allowing an existing turn to finish while the read is pending.
## Testing
Add cross-host scenarios for legacy and paginated history that verify sender evidence reaches only Guardian and excludes rolled-back permissions. Add a gated storage-read test that verifies turn completion remains unblocked and evidence is bound to the newly accepted turn.
GitOrigin-RevId: fe896f4e82fe3e32017fe4884846f3fa90a87949
Background discovery can cache a successful response before the test mounts
its unauthorized-response mock, bypassing the intended token refresh.
Mount the `401` mock before invalidating the route cached during login in
`external_auth_refreshes_on_unauthorized`.
GitOrigin-RevId: 8c280ca7287dab09230d534a44ca80d0835d2ef2
## What changed
Apply `code_mode_tool_description_first` when preparing nested tool definitions for Code Mode execution and tool search. When enabled, place each tool's description before its namespace description; otherwise, preserve namespace-first ordering.
Reuse cached MCP definitions only when both the input schema budget and description-order setting match.
## Testing
Extend deferred app tool integration tests to cover both description orders with and without ranked search, including consistency between search results and `ALL_TOOLS`. Extend the MCP cache test to reject reuse when the description-order setting changes.
GitOrigin-RevId: 1e3f84d2d95c200aef21ad710d367274b2169b4b
## What changed
Register `code_mode_tool_description_first` as an under-development feature, disabled by default, for placing tool descriptions before namespace descriptions in Code Mode. Add the boolean option to the configuration schema.
GitOrigin-RevId: 5d7e2f7cef87a040f9d96b0d97c2697880c12c17
Replace fixed 500 ms sleeps in `helper_attempt_is_shared_after_cancellation` with polling of the helper completion marker every 10 ms, bounded by a five-second timeout.
This lets the test observe completion independently of the cancelled headers or refresh request without assuming the helper finishes within 500 ms. Preserve the assertions that subsequent calls reuse the same helper attempt.
GitOrigin-RevId: 2612679aff756306ea3e05ef7bb9b4db02633fd5
## Why
Authorization updates during a pending Guardian approval can invalidate its decision. Retries need the updated guidance without inheriting the invalidated review or losing earlier valid context.
## What changed
- Validate authorization while the reviewer is reserved, before publishing its history checkpoint.
- Roll back stale attempts to the last committed review, preserving earlier valid reviews across repeated invalidations.
- Pin the issuing action's repository instruction snapshot for reviewers and retries, avoiding fresh instruction discovery through disconnected executors.
- Treat stale authorization as a request for a new review rather than a failed decision.
## Testing
Add regression coverage for repeated approval invalidation, retention of earlier valid context, exclusion of stale decisions, and execution of the pending action exactly once. Extend the disconnected-executor test to verify that retries retain repository instructions and use updated authorization.
GitOrigin-RevId: 0bff6cc551fee1f0905082eb97ccdecaa8628867
## Why
Elevated Windows sandbox tests share machine-wide accounts. Running them in the sharded core suite can consume test deadlines while shards wait for the account lock.
## What changed
Move the Windows sandbox tests into the Windows-only `windows_sandbox` integration-test binary. Update the nextest account-sharing group to select the entire binary instead of individual test names, so tests queue before their timeouts start. Keep the existing guard for coordination with other test binaries.
GitOrigin-RevId: 613925c9398b5acc8440fa34c658680f31f65c8b
## What changed
Increment `codex.agents_md.edit` for committed `apply_patch` changes to `AGENTS.md` and `AGENTS.override.md`, matching filenames case-insensitively and tagging the counter with the normalized filename.
Count additions, deletions, updates, and distinct move destinations, including changes committed before a later patch failure.
GitOrigin-RevId: bcbfa671acb37a2a24fe7e4effc9318981a22ec7
## Why
Failed Guardian review evidence was process-local, so restarting Codex lost the context needed for later diagnostic reports.
## What changed
- Persist failed-review records in SQLite before reviewer cleanup, retaining at most 64 records globally, eight per thread, and 8 MiB of evidence. Delete persisted evidence when its reviewed thread is deleted.
- Recover and deduplicate persisted and in-memory records for the reported task tree when uploading `auto-review-failures.jsonl`.
- Bound persistence attempts to 250 ms and retain an in-memory fallback when storage is unavailable. Keep capture gated by user opt-in and non-ephemeral sessions, and export evidence only when logs are included.
## Testing
Add coverage for persistence across reopen and process restart, retention limits, cascading deletion, busy-storage fallback, and report uploads with and without logs, including SQLite log failures.
GitOrigin-RevId: ea2da1818d4a5da3da29f211042ca45e834342bc
## Why
Resolving unapproved hostnames discloses them to DNS even when the proxy ultimately rejects the request. Allowing local binding in a managed macOS sandbox also granted direct outbound access to port `53`.
## What changed
- Require an allowlist match or policy approval before resolving a hostname for address checks.
- Recheck baseline restrictions after local and remote policy approval so approval cannot bypass explicit denies or local/private address restrictions.
- Preserve DNS checks for inner HTTPS requests after an approved CONNECT, including hosts without a persisted allowlist entry.
- Remove the Seatbelt allowance for external DNS while retaining local binding and loopback proxy access.
## Testing
Add regression tests for zero DNS lookups on unapproved hosts, private-address rejection after approval, local and remote approval ordering, and DNS checks after approved CONNECT requests. Add a macOS Seatbelt child test that verifies external UDP and TCP port `53` access is denied while local binding and proxy connectivity remain available.
GitOrigin-RevId: 490790462c51928e831dd8375ac098bc3a257bac
## What changed
Update retained instruction splitting and empty assistant-context detection to match `SectionContent::Other`, and convert assistant framing markers into `SectionContent`.
## Testing
Extend the snapshot-splitting regression test to use `prepare_transcript` with both line and JSON formats, with and without source message IDs. It checks evidence preservation, deduplication, and a stable instruction prefix as assistant context and reviews change.
GitOrigin-RevId: e2205eaf9b31a2b8291dc6c0c22a899596b10206
## Why
Retained assistant context changes as the conversation grows. Keeping it separate from retained user instructions lets independent Guardian snapshots preserve a reusable instruction and transcript prefix.
## What changed
Move retained user instructions before the transcript and place assistant originals and their omission notice in a separate `RETAINED ASSISTANT CONTEXT` section afterward. Preserve evidence, delivery roles, source metadata, and deduplication across both retained sections. Clear omission delivery metadata when a split assistant notice cannot be attributed to a single section.
## Testing
Add regression coverage for prefix stability as assistant context and previous reviews change, evidence preservation, repeated preparation, and deduplication. Update approval-routing and scorer tests to check the new section order and retention of assistant text outside a smaller transcript budget.
GitOrigin-RevId: 15cda59d24bee0106f6a66c067f6a790fa91df69
## Why
Published MCP elicitation requests could lose their response waiter without notifying the event consumer that the request was no longer answerable.
## What changed
- Add `ElicitationAbandoned` with the original server name and response token for requests published through unbounded event channels.
- Emit abandonment exactly once when a waiter is dropped, response delivery fails, or the MCP runtime shuts down.
- Close the elicitation router during shutdown, reject new requests on unbounded sources, and wait for terminal deliveries before shutdown completes. Preserve bounded sources' request-only behavior and backpressure.
## Testing
Add router tests for ordered, exactly-once abandonment, closed receivers, failed response delivery, shutdown coordination, and bounded-channel backpressure. Add a core integration scenario verifying that a pending form's abandonment precedes `ShutdownComplete`.
GitOrigin-RevId: 53fe9f4a8b32f7324be180288aa492f31f4d2057
## Why
DB-only listing and pagination failures must not look like exhausted history. This hardens the DB-only listing added in https://github.com/openai/codex/pull/18502 and page refilling added in https://github.com/openai/codex/pull/7509.
## What changed
- Return JSON-RPC error `-32603` when `useStateDbOnly: true` cannot query the local state database, including requests with an empty `cwd` array.
- Track all cursors encountered while filling a page and return `-32603` for repeated cursors, including on full pages.
- Document that callers can retry these errors; a successful response with `nextCursor: null` still indicates exhaustion. Default scan-and-repair requests retain their filesystem fallback.
## Testing
Add regression tests for missing or mismatched state databases versus healthy empty history, with active and archived listings and null or empty `cwd` filters. Cover repeated cursors during page refilling and on full pages using the in-memory thread store.
GitOrigin-RevId: 09653a84fc65f47316d8bbae9e4cf3dd8ce9948a
## Why
Clients displaying a saved manual thread order need to list the remaining threads without repeating those already loaded separately.
## What changed
Add optional `excludedThreadIds` to `thread/list` and the generated protocol bindings. Apply exclusions before the result limit, refilling pages until the requested limit is reached or history is exhausted while preserving existing filters and ordering. Clients must send the same exclusions on each page.
Accept up to 100 entries, counting duplicates toward the bound. Reject invalid IDs or oversized lists with JSON-RPC error `-32602` rather than truncating them. Omitted, null, and empty lists preserve existing behavior.
## Testing
Add integration coverage for page refill across database-only and scan/repair paths, archived threads, sort directions, and project/section scopes. Cover duplicate and unknown IDs, the 100-entry boundary, invalid input, and preservation of section order.
GitOrigin-RevId: e9a884e642ae25d166aff7e275469d1d43179c6c
## What changed
- Extract `create_parser()`, `assemble_package()`, and `archive_package()` from the packaging CLI so callers can assemble a package directory, add files, and archive it separately.
- Support DotSlash artifacts with `format: "gz"` by decompressing the executable directly to its destination.
## Testing
Extend the zsh manifest override test to verify executable contents for both `tar.gz` and `gz` artifacts.
GitOrigin-RevId: 3542b795eea1f2320bef1402d575a9396be43df2
## Why
Interrupting a turn or terminating a Code Mode cell can drop a pending dynamic tool handler before it publishes its completion. Cancellation needs to settle the call in live events and persisted history without allowing a late response into model context.
## What changed
- Let dynamic tool handlers observe cancellation and publish their terminal item before dispatch finishes. Calls cancelled while awaiting a response complete with a failed item and a cancellation error.
- Keep readiness, dispatch admission, registry lock waits, hooks, and output processing cancellable so cancellation can finish even when a hook is blocked.
- Report an aborted tool lifecycle outcome when cancellation interrupts dispatch, including before handler execution.
## Testing
Add regression tests for turn interruption with pending calls or blocked hooks, cell termination with persisted failure and late-response exclusion, cancellation before dispatch admission, and exactly one completion when a response races cancellation.
GitOrigin-RevId: 0112fc74c8652c91503ed5bbfb334ae2e26930ef
## What changed
Add `windows.allow_mxc` to configuration and its JSON schema. Setting it to `false` blocks automatic MXC selection even when `features.prefer_mxc` is enabled, and rejects explicit `windows.sandbox = "mxc"` configuration with a clear error. Omitting the setting preserves existing behavior.
## Testing
Extend configuration tests to cover disabling automatic MXC selection and rejecting explicit MXC configuration when `windows.allow_mxc = false`.
GitOrigin-RevId: bf7c0648cfcb3cc1d0dc41b9faffcb8078672780
## Why
A delayed detach or cleanup from an older realtime conversation must not close its replacement or end the replacement's history segment. Realtime start parameters can also contain credentials in text and transport endpoints, so diagnostics should avoid exposing them.
## What changed
- Add `RealtimeConversationAttach` to report the connection attempt's result through a reply channel, using the sequential start path.
- Add `RealtimeConversationDetach` to close only the matching `realtime_session_id` after earlier starts finish. Detaching an older session leaves the replacement connected.
- Emit the previous conversation's close event before starting its replacement, and prevent stale fanout cleanup from closing or clearing the replacement's context.
- Limit `ConversationStartParams` debug output to output modality, initial item count, and protocol version.
## Testing
Add coverage for attachment completion after the handshake, stale detaches, failed replacement and retry, natural-close ordering, handoff history after replacement, and debug redaction for existing-call and WebRTC transports.
GitOrigin-RevId: 23aee6f70522f0b17e6aa9349dbbcc2ea985f233
## Why
User ripgrep configuration can suppress the file list used to construct Linux sandbox deny masks. For example, `--quiet` in `RIPGREP_CONFIG_PATH` can leave files matching deny globs unmasked.
## What changed
Pass `--no-config` to the ripgrep invocation that expands denied-file globs.
## Testing
Extend the multiple-denied-files regression test with a ripgrep configuration containing `--quiet`, checking that denied files remain unreadable and unwritable while allowed files remain accessible. Skip the ripgrep-specific case when no protected `rg` executable is available.
GitOrigin-RevId: 06a6e27e0edec92e79e99af5144b57f86079953f
## Why
Executor config reads omitted the startup `features.prefer_mxc` override, so clients could not see the CLI sandbox preference.
## What changed
- Include the explicit CLI `features.prefer_mxc` value in `environmentConfig/read` as a `session-flags` layer, above project config and below legacy managed file and MDM config.
- Retain only this preference from startup overrides.
- Expose `windows_mxc_allowed_by_config` to share MXC eligibility checks after callers resolve the active permission profile.
## Testing
Add CLI and remote executor coverage for preference propagation and filtering, plus a unit test verifying that both legacy managed config sources retain precedence.
GitOrigin-RevId: 5ac6f5257f1e807c2f197dcf5dcb2385cedca0ea
## Why
Attachment stores need to distinguish uploads from ephemeral threads, which intentionally skip durable persistence.
## What changed
Add `ephemeral` to `UploadRequest` and propagate the turn configuration through image preparation for messages, tool outputs, and history replay. Include the flag in debug output while keeping attachment bytes redacted.
## Testing
Extend the Guardian context-budget test to assert that a persistent Guardian uploads exactly one image with `ephemeral: false`. Update the attachment debug-output assertion to include the new field.
GitOrigin-RevId: 42814c514a571ed6798e4dcf79a22028ee4efc28
## Why
Agent tree shutdown previously returned a generic error without identifying which operation or thread failed, making cleanup failures difficult to diagnose.
## What changed
- Add `AgentTreeShutdown::wait_detailed()` and public report types while preserving the existing `wait()` result and error message.
- Record operation, optional thread ID, and either an abandoned teardown guard or a failed phase with a payload-free error category across session cleanup, child spawn cleanup, and resident eviction.
- Give each tree a correlation ID, log each failure, and retain up to 64 failures with a count of additional failures omitted. Record failures before releasing tree membership so all completed waiters observe the same report.
## Testing
Add unit coverage for aborted and completed teardown, cloned guard context, concurrent and repeated waiters, omitted failure counts, and report formatting without raw error payloads. Extend integration coverage for successful tree shutdown and persistence writer failures, including compatibility with `wait()`.
GitOrigin-RevId: 68784af28b63e875b00a55d78729f0cc5b01ac15
## Why
Windows temp grants could fall back to host `TEMP`/`TMP` values and bypass read-only or denied subpaths. Sandbox permissions must match the environment passed to the child process.
## What changed
- Resolve `:tmpdir` from absolute `TEMP`/`TMP` paths in the completed workload environment, preserving access modes and missing-path rules without falling back to host values.
- Deduplicate Windows environment keys case-insensitively in a deterministic order so permission resolution and the child environment select the same value.
- Use the resolved temp policy for elevated sandbox overrides across core execution, exec-server, and direct spawning.
- Launch direct-spawn sandbox wrappers with the supplied Codex executable, materializing an inner helper only when it is that executable.
## Testing
Add Windows regression coverage for temp-only writes, read-only and denied carveouts, mixed-case and duplicate environment keys, unavailable temp paths, and empty or missing write-root overrides. Exercise core execution and direct spawning, and extend exec-server RPC coverage to the elevated backend with temp values set through the environment policy.
GitOrigin-RevId: 16b8bd4702cc434fd743a08c75a3e4515780bff3
## Why
On Windows 10, strict native opens can reject the DOS drive alias itself as a reparse point, preventing no-follow filesystem operations on ordinary drive-letter paths.
## What changed
Retry rejected drive-letter opens relative to a verified local volume root. Require the root to resolve to a physical disk volume directory without reparse attributes, and retain `OBJ_DONT_REPARSE` for paths beneath it so junctions remain blocked.
## Testing
Add Windows tests for file creation and reading through the volume fallback, opening the drive root, and rejecting junction traversal and creation. Validate accepted volume-root names and verify that named pipes are rejected without establishing a client connection.
GitOrigin-RevId: 51ffde4f77d2af45d18dfc4cb026d73a0e69b061
## Why
Live preferences can be newer than the last successful configuration load. Starting a new thread after a reload failure could overwrite those preferences with stale settings.
## What changed
Carry local settings alongside the new-session configuration, retaining the live settings when reloading fails and applying the staged settings when the new thread starts. During resume and agent selection, replace staged local settings only when the directory-trust check actually reloads configuration.
## Testing
Add a regression test that changes a live rendering preference, writes invalid `config.toml`, and verifies that loading a new thread's configuration preserves the live local settings.
GitOrigin-RevId: 4ac3c70de6d627e1609cc0a5d4ba5df5a61a8b20
## Why
MCP contributors need the complete executor selection to distinguish an unavailable primary executor from a ready secondary. Ready capability roots alone do not preserve pending or failed selections.
## What changed
Add `with_selected_environments` and `selected_environments` to `McpServerContributionContext`, and pass the captured selections during thread MCP resolution and model-step plugin selection. Preserve priority order and pending or failed entries. Use `None` for threadless discovery and `Some(&[])` for an explicitly empty selection.
## Testing
Add regression coverage for executor ordering with pending and failed selections, environment context in model-step plugin selection, and the distinction between absent and explicitly empty selections.
GitOrigin-RevId: 2c1222fae72c7e2c75b2f40abfad3b2048cf9316
## Why
A stalled rendezvous WebSocket upgrade can prevent reconnects, while short-lived connections reset reconnect backoff too early. Blocked relay writes also prevent received pongs from clearing their heartbeat deadline.
## What changed
- Bound rendezvous WebSocket connection attempts with `DEFAULT_REMOTE_EXEC_SERVER_CONNECT_TIMEOUT`.
- Retain exponential reconnect backoff across short-lived connections, resetting it only after a connection lasts at least 120 seconds.
- Process pongs during blocked data writes while preserving the in-flight send and its independent write timeout. Prefer queued pongs over an expired heartbeat deadline.
- Abort the relay writer when its owning connection task is dropped.
## Testing
Add coverage for pongs arriving during blocked writes, missing and queued pongs, independent write timeouts, and writer cancellation. Extend reconnect tests to cover stalled WebSocket upgrades without re-registration and backoff reset after a stable session.
GitOrigin-RevId: 0efa350c2b4ada9b89e23df8909063fbb69f33dc
## What changed
- Use `p` to pin or unpin the selected task, with a configurable `agents.toggle_pin` binding.
- Display pinned tasks first in a `Pinned` group, preserving shared section order and applying search and status filters.
- Load pins from the shared thread section, including tasks outside the recent-task window, and refresh after pin changes. Disable pinning when the server does not support shared sections.
## Testing
Add coverage for shared pin/unpin state, paginated pin discovery and refreshing pins on reopen, shortcut dispatch and duplicate-action suppression, and pinned-group and custom-help snapshots.
GitOrigin-RevId: d1a2cab6642d059c3c8df8480b5c59a10c493936
## What changed
Move full rollout history reading and parsing into one blocking worker for both plain `.jsonl` and compressed `.jsonl.zst` files. Use the shared cancellation-aware line iterator so canceled loads stop before processing another record, while preserving rollout items, thread IDs, and parse-error counts.
## Testing
Add regression tests for cancellation between records and equivalent history-loading results across plain and compressed files, including Unicode, CRLF line endings, malformed records, empty files, and invalid UTF-8.
GitOrigin-RevId: 65e1bd7ebcdbbd0ab5f560e73b2c7f074f627f8f
## Why
Capability discovery needs the roots captured with each environment snapshot. Threads sharing an executor can select different roots, and changing environment order must preserve executor skill aliases.
## What changed
- Attach the receiving thread's capability roots when constructing `TurnEnvironmentSelection` at startup and settings updates, including roots loaded from saved history.
- Resolve capability roots from environment snapshots while preserving their original order. Retain startup roots so deselecting and reselecting an environment restores its capabilities.
- Match inherited configuration by environment and workspace so differences in capability root metadata do not interrupt configuration propagation.
## Testing
Add regression coverage for root ordering across environment states and configuration changes, independent root selections on a shared executor, reselection with startup or saved roots, active turn updates, and pending configuration failures reaching child and grandchild threads.
GitOrigin-RevId: 4f2e4bb414d27195a6752406117a6050718a1198
## What changed
Remove `workspace_roots`, `current_date`, `timezone`, `network`, `personality`, and `multi_agent_mode` from `TurnContextItem` and stop recording them in rollouts. Update the precomputed protocol schema accordingly.
Make `summary` optional when reading turn context and write `"none"` as a compatibility placeholder for older readers, rather than persisting the active reasoning-summary setting.
## Testing
Update protocol tests to cover omitted `summary` fields and compatibility-placeholder serialization. Extend compaction tests to verify that model requests retain the updated reasoning-summary setting after compaction while the rollout checkpoint records the placeholder.
GitOrigin-RevId: d49eabaa1b340be1d79f7f09115281a307ea8a64
## Why
A malformed plugin manifest still marks a capability root as plugin-owned. Discovery or metadata failures must not be treated as evidence that a root is standalone.
## What changed
- Add `ExecutorPluginProvider::root_ownership` and export `PluginRootOwnership` to distinguish plugin-owned roots from standalone roots before capability parsing.
- Use discovery results when conclusive; otherwise probe manifest files at the selected root and its ancestors using the supplied filesystem sandbox. Nested plugin manifests do not establish ownership of their parent root.
- Share manifest lookup with plugin resolution and pipeline up to 256 metadata probes while preserving ancestor and manifest priority, including error ordering.
## Testing
Add tests for malformed ancestor manifests, discovery failures, ancestor versus nested ownership, concurrent probe ordering, and sandboxed metadata checks without reading manifest contents.
GitOrigin-RevId: 3512452cf1df22f52c2a2b422f96c760d98c24ac
## Why
Rendezvous connection warnings report only a generic WebSocket error, while debug logs include raw error text. Structured diagnostics make failures easier to investigate without logging potentially sensitive error payloads.
## What changed
- Generate a request ID for each connection attempt, send it as `x-request-id`, and include it in the connection span and connection, disconnection, and failure logs alongside the attempt count.
- Replace raw error logging with typed error categories, I/O error kinds, HTTP status codes, and allowlisted values from `x-codex-rendezvous-rejection-reason`.
- Ignore unknown rejection reasons and response bodies.
## Testing
Add tests for rejection-header allowlisting, typed I/O failures, and a rejected WebSocket handshake that verifies the request ID header and preserves the HTTP status and known rejection reason.
GitOrigin-RevId: a8274fec965bcf5b8453b047c0bb79396cdf6ba4
## Why
Skill selection and disabled-path matching need to recognize equivalent Windows paths across case and separator differences while preserving literal spaces, `%`, and `#` in native filenames.
## What changed
- Carry `PathUri` through skill metadata, discovery mappings, filesystem lookups, disabled-path sets, and invocation analytics.
- Match linked skill mentions and TUI selections by parsed path identity.
- Use `LegacyAppPathString` for app-server skill paths and regenerate schemas and SDK types, preserving native path strings on the wire.
- Preserve native catalog display paths and ordering. Keep host filesystem probes and configuration writes restricted to host-compatible paths.
## Testing
Add regression tests for Windows path identity and disabled-skill matching, literal filename characters, catalog resource reads, native path ordering, and foreign-path analytics normalization.
GitOrigin-RevId: c212916dc9fef0e7616542726e107f0d6a313267
## Why
Changing the incremental tools setting on resume should not move tool declarations and base instructions within an existing context window.
## What changed
- Determine the current window's tool declaration mode from its history, and apply the incremental tools setting when building a new window after compaction or a context reset.
- Use that mode consistently for sampling, remote compaction, startup prewarm, prompt debugging, and Guardian input budgeting.
- Preserve tool declarations alongside their comparison baseline in full-history agent forks, including compacted histories; remove them together when rebuilding context.
## Testing
Add request snapshots covering legacy resume, migration after remote compaction or a context reset, disabling incremental tools, and tool updates after restart. Extend agent fork and WebSocket startup prewarm tests to cover retained declarations and incremental tools.
GitOrigin-RevId: 7c46849a1788027a8435082e4d1f7e7f48d2700c
## Why
The hooks browser rendered detail URLs as plain text. Long URLs in hook commands can wrap or be truncated, so their visible text may omit part of the destination.
## What changed
Render web URLs in hook details as terminal hyperlinks, preserving the complete destination across wrapped lines and truncated text. Keep truncation ellipses outside the links.
## Testing
Add a regression test and snapshot for a wrapped, truncated hook command URL, checking that linked cells retain the complete destination and the ellipsis remains unlinked.
GitOrigin-RevId: 488562266bd5ef880c03bf313bc4cfa7d3104c7b
## What changed
Render web URLs in selection labels and descriptions as terminal hyperlinks, preserving their complete destinations when text wraps or is truncated. Carry hyperlink ranges through two-column layouts and keep truncation ellipses outside links.
## Testing
Add regression assertions and a snapshot covering wrapped and single-line rows, prefixed labels, descriptions, and wide Unicode characters. Verify that visible URL fragments retain complete destinations and ellipses are not linked.
GitOrigin-RevId: 9d50b3ced79cbd29200e48a676445ec169d60758
Owen Lin