## Why
Compaction and host-injected context can rewrite the model-visible conversation
without changing what the user authorized. Treating those updates as authorization
changes prevents Guardian from reusing an otherwise valid review.
## What changed
- Track a host-owned user-message revision separately from the conversation history
generation.
- Advance the revision for genuine user messages and history resets, while preserving
it across compaction and internal context injection.
- Use message content-kind metadata to distinguish host context from user input,
conservatively treating unknown or incomplete metadata as user authorization.
## Testing
Added coverage that cached Guardian authorization survives compaction and internal
context, but is invalidated by user input and rollback.
GitOrigin-RevId: c7960fa182d1686042c23764d2abc58acbc4b882
## What changed
- Cover the default, explicitly enabled, and explicitly disabled states of
`tools.update_plan.enabled`.
- Verify prompt tool lists remain consistent across requests, including when
custom base and developer instructions are configured.
- Explicitly enable `update_plan` in existing fixtures that depend on the tool.
GitOrigin-RevId: 3be279cb5195dfc5892c2c8ff6a1461fac879309
## What changed
- Add draft-local forward and backward literal search with `/` and `?`, plus
wrapped repeat navigation with `n` and `N`.
- Support search motions after delete, change, and yank operators, while keeping
queries separate from the draft and skipping atomic elements and partial
grapheme matches.
- Render and edit the query in the composer footer, highlight matches, and add
configurable `tui.keymap.vim_search` bindings to the keymap picker and schema.
## Testing
- Cover navigation, wrapping, operator composition, repeat behavior, Unicode
graphemes, atomic elements, query editing, paste handling, and rendering.
GitOrigin-RevId: 087b080ff8fd74e48456c6b899c07ea5eed38e0c
## Why
Resuming a thread without an explicit `cwd` should restore that thread's latest
retained setting. Forked history can contain settings copied from another
thread, while compaction can move the latest setting outside the replay window.
## What changed
- Record the owning thread ID on new settings snapshots and only use snapshots
owned by the resumed thread when restoring `cwd`. Older snapshots without an
owner remain readable but do not override the startup `cwd`.
- Checkpoint the current settings after compaction and serialize checkpoints
with settings updates so the retained history contains an accepted, current
snapshot.
- Cover resume behavior across compaction, forks, reverts, legacy histories,
and concurrent settings updates.
GitOrigin-RevId: 1efc9cf55472d6b88c465c4efe44672a232dbf64
## Why
Automatic goal continuations should remain attributable to the turn that created the goal. External input, hook context, or goal edits can make that attribution ambiguous and must not leave stale lineage metadata behind.
## What changed
- Carry the trusted root and previous parent turn through successive automatic goal continuations.
- Invalidate stored lineage when external context reaches an active turn or when a goal is edited or cleared.
- Preserve lineage for async hook results only when they belong to the receiving turn.
## Testing
- Cover goal continuations across intervening user turns and external objective edits.
- Cover active, buffered, and externally injected hook or response context.
GitOrigin-RevId: 22ccc07961cd0ed8f4b17912b7efa416b342bf50
## Why
The `core` and `tui` Bazel targets treated nearly their entire crate trees as
compile-time data, mixing embedded runtime resources with source files and test
fixtures.
## What changed
- Move embedded resources for `core` and `tui` into dedicated `assets/`
directories and update their `include_str!` paths.
- Restrict Bazel compile data to explicit asset and frame directories.
- Move test-only prompts into `tests/fixtures`, resolve the core prompt through
`find_resource!`, and reuse the integration-test file glob when assembling
Bazel test data.
GitOrigin-RevId: eee9b0e41df77ea2604215a7f7333a6fe8317bfa
## What changed
- Defer legacy sandbox policy projection until a working-directory change may require rebinding project-root writes.
- Keep client name and version updates from resolving filesystem paths or altering the existing permission snapshot.
## Testing
- Add regression coverage for updating client metadata with a managed, restricted filesystem policy that includes both a writable path and a nested denied path.
GitOrigin-RevId: d84dbcd09b9d1961a11b2889d79479e30eb54149
## What changed
- Add model message metadata for built-in tool descriptions.
- Use the active step model's catalog description for `send_user_message_async`, including after a mid-turn model change.
- Fall back to the built-in description when catalog metadata is absent, while preserving an explicitly empty description.
## Testing
- Cover catalog serialization, fallback and empty-value behavior, and model changes within a turn.
GitOrigin-RevId: 72b953214ab9708931065321debf12133f8d2d40
## What changed
- Add an optional `proactive` multi-agent mode message to model metadata.
- Use the catalog's proactive message for `Ultra` reasoning when no general mode hint is configured. A missing value falls back to the built-in proactive instructions, while an empty value suppresses the mode message.
- Keep explicit mode behavior for other reasoning efforts and refresh the applicable catalog message when the model changes.
## Testing
- Cover proactive overrides, built-in fallback, empty-value suppression, mode-hint precedence, non-`Ultra` behavior, and model switches.
GitOrigin-RevId: da0a9ebd9b58cf04ef13a703c210e5da2eed0884
## What changed
- Admit the curated remote Browser plugin's `Stop` and `SubagentStop` hooks when its listed `browser.turn_ended` tool matches the expected connector and is enabled by app policy.
- Carry trusted app routing metadata and the MCP environment through hook registration and execution.
- Register hooks from multiple executor environments, while deduplicating cleanup calls that share an event, MCP environment, server, and tool.
## Testing
- Cover Browser and Computer Use cleanup through separate MCP routes, including user- and managed-policy disablement.
- Verify routing metadata, environment selection, multi-environment registration, and target deduplication.
GitOrigin-RevId: 66de088fd201b9ed0db8b97c23d33de88135120d
## Why
Code mode wall time should measure the host operation itself, without including
client-side response delays or idle time between requests.
## What changed
- Measure each execute, wait, and terminate request in the code mode host.
- Carry the duration through the stdio and gRPC protocols and use it for
model-visible wall time.
- Emit a structured `codex.code_mode.host_timing` event correlated with the
conversation, turn, tool call, and cell.
## Testing
- Cover successful and failed execution timing, delayed response reads,
repeated waits, termination, and missing cells across stdio and gRPC.
- Verify timing survives protocol serialization and is reflected in app-server
model output and structured telemetry.
GitOrigin-RevId: d24af30c3fc5820521b4beba1f9970714dad6482
## What changed
- Advertise `openai/elicitation` form support when the client declares an
object-valued `form` capability, without deriving it from the legacy
`openai/form` capability.
- Handle `openai/elicitation/create` requests in `form` mode and forward their
metadata and opaque schema through app-server as `openaiForm`, preserving
`x-openai-*` annotations.
- Keep legacy form handling independent and have the TUI automatically decline
the new form requests it cannot render.
## Testing
- Add an app-server round-trip test for capability negotiation, request
forwarding, and accepted responses.
- Extend MCP capability filtering coverage for `openai/elicitation.form`.
GitOrigin-RevId: 88f39257bffafe4ee98a9c910e38507843cd7eeb
## Why
Executor-scoped cleanup hooks need to observe an interrupted turn as well as a
normally completed one.
## What changed
- Allow bundled executor plugins to register the allowlisted `Interrupt` hook
alongside `Stop`, while preserving multiple allowed hook entries from the
selected executor environment.
- Run interrupt hooks with the interrupted turn's last step discovery and turn
metadata. Turns without a step context do not reuse discovery from an earlier
turn.
- Keep executor-scoped interrupt hooks asynchronous and omit public hook
lifecycle events for them, matching executor `Stop` hook behavior.
## Testing
Added coverage for hook filtering and registration, interrupt execution and
metadata propagation, environment selection, and turns without a step context.
GitOrigin-RevId: f0c536b3382a37cf3bf693c4573d21f6f66ace4e
## What changed
- Store the most recently captured execution `StepContext` in the active turn state.
- Keep speculative model-fallback captures from replacing that context, and update it only when the fallback is selected for remote compaction.
- Preserve the retained context when a turn completes or is interrupted.
## Testing
- Add coverage for completed and interrupted turns, successful primary compaction, fallback compaction, and interruption while a fallback is running.
GitOrigin-RevId: c7dee36ec8e88ba2f4fb4a9c0322e5c86a0caf0e
## What changed
- Treat a surviving full world-state snapshot as a context baseline when a fork removes the associated user message.
- Restore the previous turn settings and reference context from that baseline, without treating the segment as a user turn for rollback.
- Ignore partial snapshots and full snapshots superseded by compaction.
## Testing
- Cover resumed rollout reconstruction with removed task messages, partial snapshots, and compaction.
- Verify nested agents inherit developer instructions and environment context exactly once across history modes and compacted histories.
GitOrigin-RevId: 9f9f6992d7ea8cff9ac82a7fcdf0c8fb764db81c
## What changed
- Add a positive `output_token_limit` setting to each entry under an MCP server's `tools` configuration.
- Apply the most restrictive limit when plugin and user policies overlap, while keeping approval policy independent.
- Carry the effective MCP output budget in conversation history so tool output, post-tool hook responses, and resumed sessions use the same truncation limit.
## Testing
- Cover configuration parsing, serialization, schema validation, and plugin policy merging.
- Cover MCP output below and above the configured limit, post-tool hook responses, and session resume.
GitOrigin-RevId: d0beb4fca9ba6055d9e1d31c137373b465d50d61
## What changed
- Add the disabled-by-default `omit_app_server_notification_media` feature.
- When enabled, remove inline image and audio content from `item/started`,
`item/completed`, and `rawResponseItem/completed` notifications, including
tool output and image-generation results.
- Keep the media in model input; the filter only changes app-server
notifications.
## Testing
- Verify that image content is absent from all three notification types while
the model request still receives it.
GitOrigin-RevId: 9a4434d18a3dac6d67c2e0c3723ff4595a9b3797
## What changed
- Re-run the HTTP headers helper after a same-origin `POST` receives a `401` or `403`, and retry the request once when the effective headers changed.
- Share refreshes across concurrent rejected requests, retain the previous headers when refresh fails, and keep the retry within the original timeout.
- Allow helpers to supply `Authorization` while preserving explicit OAuth or bearer credentials, OAuth insufficient-scope challenges, and redirect safety checks.
## Testing
- Cover rotating helper headers for MCP tool calls and same-origin OAuth token refreshes.
- Cover concurrent rejections, failed and unchanged refreshes, retry limits, timeouts, and redirects.
GitOrigin-RevId: c662edefdb1cd2876d9d02545a72d5bd6739864f
## Why
Managed configuration can disable resumable unified execution while leaving shell tools enabled. This should not remove command execution entirely or grant access to retained processes.
## What changed
- Keep `exec_command` available in completion-only mode when `unified_exec` is disabled.
- Remove `tty`, `yield_time_ms`, `session_id`, and `write_stdin` from that mode, and add a `timeout_ms` argument.
- Terminate one-shot commands on timeout or turn cancellation, reporting timed-out commands with exit code 124.
## Testing
Added integration coverage for tool availability, timeout cleanup, and interruption cleanup under managed configuration.
GitOrigin-RevId: a382d34f922fdc4ba52889272c6db985abd42e47
## What changed
- Generate a UUIDv7 turn ID for each Guardian classification and preserve it across retries.
- Record the owning turn as `parent_turn_id` and propagate its trusted `root_turn_id` when known, including through the tool lifecycle extension API.
- Omit ambiguous or unknown root lineage and keep classification identities distinct when reusing Guardian sessions and WebSocket connections.
## Testing
- Cover classification metadata across retries, connection reuse, concurrent samples, auth refresh, and consecutive owning turns.
GitOrigin-RevId: 78757f2ad031844e4b545802f634c678a9ee2298
## What changed
- Add an optional `timeoutMs` parameter to `thread/shellCommand` and propagate it to user shell execution.
- Preserve the one-hour default when the parameter is omitted or `null`, allow longer deadlines, and treat `0` as an immediate timeout.
- Reject negative or otherwise invalid values before execution. Timing out an auxiliary shell command leaves its active turn running.
## Testing
- Cover default, extended, immediate, invalid, standalone, active-turn, and interruption behavior.
GitOrigin-RevId: d72f67793d9766b7383f28d30140270a4a76a495
## What changed
- Limit the proactive-mode override to earlier developer instructions that require an explicit delegation request.
- Preserve user requests as higher-priority guidance.
- Encourage root agents and subagents to delegate parallel work when doing so could improve speed or quality.
## Testing
- Update the multi-agent world-state snapshot for the revised proactive-mode message.
GitOrigin-RevId: 0b61701980e0306dd37a925aceb23c75bf3c1af7
## Why
Fetching plugin recommendations while building the first-turn context delays that
context when the recommendation catalog is not already cached.
## What changed
- Start fetching recommendations during session initialization, in parallel with
MCP and plugin setup, and reuse the in-flight request when building context.
- Centralize the feature checks that enable plugin recommendations.
- Prevent an invalidated recommendation request from repopulating the cache after
a newer request has completed.
## Testing
Added coverage for startup feature gating, reuse of the in-flight fetch, legacy
behavior when recommendations are unavailable, and cache invalidation races.
GitOrigin-RevId: 708774b9bfc472c9847973ae8b2774b66e7321e4
## What changed
- Include Windows safety guidance in the `exec_command` tool description when a
single ready environment reports Windows as its executor platform.
- Omit that guidance when the selected executor reports a non-Windows platform.
- Preserve the host-based behavior when platform information is unavailable or
the tool can target multiple environments.
## Testing
- Cover Windows, non-Windows, unknown-platform, and multi-environment tool plans.
- Verify remote environments expose guidance that matches their target OS.
GitOrigin-RevId: 95e09790446c684ffaff2a0be077db426fff4618
## What changed
Update the `send_user_message_async` tool guidance to reserve it for questions
that require missing information, preferences, constraints, clarification, or
approval. Ask models to keep these questions concise, understandable, and at
an appropriate level of abstraction for the user and task.
GitOrigin-RevId: 4a16754401fb5fc106bbf65759ac4a7a78b6c7b3
## What changed
Add an end-to-end core test that compresses a parent and forked child rollout,
then resumes the child through paginated history loading. Verify that the
resumed model input:
- retains the persisted compaction checkpoint and inherited history;
- includes child history through the fork boundary;
- excludes obsolete pre-checkpoint and post-fork parent messages; and
- reads the compressed ancestor without materializing its JSONL file.
GitOrigin-RevId: 1624c4d844345fe2671436f37bc39b3e59fb3dea
## Why
Rollout compression skips files that participate in paginated fork lineages because lineage readers rely on byte offsets into the original JSONL. This prevents shared rollout history from being compressed.
## What changed
- Add a seekable rollout reader that preserves logical JSONL offsets for plain and zstd-compressed files without materializing compressed data beside the rollout.
- Use the reader for lineage validation, model-context replay, and SQLite history projection, including when compression races with a read.
- Add the opt-in `local_thread_store_shared_compression` feature. The default mode continues to leave shared lineages uncompressed for compatibility, while the new mode includes referenced sources and fork pointers.
- Record the uncompressed size in new zstd frames so common prefix-bound checks can avoid decoding the full file.
## Testing
Add coverage for seekable compressed reads, prefix validation across zstd frame shapes, compressed lineage replay and projection, concurrent forks, and compression-mode behavior.
GitOrigin-RevId: 83e519f7eabf7448977eff37c55899858cc17a07
## Why
Manual terminal-input approvals shell-quote the proposed input, which cannot
preserve NUL bytes for an accurate review.
## What changed
Reject terminal input containing a NUL byte before creating an approval request
or sending any of the input to the terminal.
## Testing
Extend the unreviewable-input integration test to cover both oversized input
and NUL-containing input, and verify that rejected input is not executed.
GitOrigin-RevId: e738c59ba5570012663bf6168ad052be237ca226
## Why
An MCP binding can wait for one server while another connection updates a
shared tool catalog. Preferring the catalog captured before that wait can omit
newly available tools from the first model request.
## What changed
- Recheck the current MCP tool catalog before using the captured fallback.
- Keep the captured catalog when it expires during the wait, while honoring a
server that disables catalog caching.
## Testing
- Cover a shared Apps cache populated by a peer while binding capture waits.
- Cover cache opt-out while capture waits for another server.
GitOrigin-RevId: e4389c7ba23e4d8397dbae0930c9e36ba0a172fb
## What changed
- Mark `clock.curr_time` and `clock.sleep` as built-in control tools so their calls emit control-tool analytics.
- Cover completed, failed, and interrupted calls, verify analytics omit tool arguments and output, and keep the calls out of the dynamic-tool count.
GitOrigin-RevId: 489c8015f836be146ccc2c7e96ef7243b0599e16
## Why
An existing terminal keeps the sandbox, network settings, and grants it had at launch. Later `write_stdin` calls must account for that retained authority, including when permissions change between turns.
## What changed
- Capture each terminal's effective launch permissions and compare them with the current environment before accepting non-empty input.
- Request approval when the terminal bypassed the sandbox, retains additional grants, strict auto-review is active, or its sandbox or network settings differ from the current policy.
- Reject input when current denied-read or environment-owned network restrictions cannot be enforced by the existing terminal, while keeping empty polls and non-TTY interrupts available without review.
- Include the effective sandbox mode and user-visible additional grants in `write_stdin` approval actions without exposing host-owned grant paths.
## Testing
Added unit and end-to-end coverage for retained cross-turn grants, strict auto-review, sandbox and network policy changes, denied reads, Windows sandbox backends, and private grant redaction.
GitOrigin-RevId: e2d71daf9358474c885998786c4928069100711c
## Why
The overload integration test coupled terminal error behavior to live retry timing and tracing events.
## What changed
- Verify retry attempts and exponential backoff directly with `run_with_retry` under paused Tokio time.
- Keep the overload integration test focused on request count and terminal error events.
- Add timeouts while waiting for retry telemetry, resumed requests, and turn completion so failures cannot hang the test.
GitOrigin-RevId: 571a6a6a36a6aded038000a63bff1958c7209913
## What changed
- Share the root thread's current service tier across its agent tree.
- Apply that tier to each subagent request when the selected child model supports it, including remote compaction requests.
- Propagate root service-tier updates to existing and newly spawned subagents without rewriting child-owned settings.
- Remove per-spawn and role-level service-tier overrides so routing remains controlled by the root thread.
## Testing
- Cover supported and unsupported child models, full-history forks, live tier changes, remote compaction, new subagents, and reloaded subagents.
GitOrigin-RevId: 6c299e224e90b41a558788fb7aa4d5f336fa383a
## Why
Realtime voice calls can span zero or many backing turns, so they need the
saved thread source to identify their origin consistently.
## What changed
- Add `thread_source` to `x-codex-turn-metadata` when starting realtime
WebSocket, existing-call, and WebRTC transports.
- Encode the metadata as header-safe ASCII and omit absent, invalid, or
larger-than-256-byte source values.
## Testing
- Cover source propagation, escaping, and size limits across realtime
transports, including child threads that share a parent session.
GitOrigin-RevId: b5a9eef8dfdbb83387bd0e364a4922b15030f4d6
## What changed
- Add a stable `sleep_tool` feature that can enable or disable registration of the built-in sleep tool independently of the clock tool.
- Support structured `features.sleep_tool` configuration with `model_driven` and `always_on` modes. The default `model_driven` mode preserves the existing model and `current_time_reminder` behavior, while `always_on` registers sleep whenever the feature is enabled.
- Preserve nested sleep-tool configuration across CLI overrides, config merges, and feature toggles, and expose the settings in the generated config schema.
## Testing
- Cover feature-map overrides, both selection modes, legacy clock settings, config merging and editing, and invalid mode rejection.
GitOrigin-RevId: 18eadc582f8a4445958c29d063e5be495276703e
## What changed
- Emit turn-scoped authentication recovery started and completed events when a model provider refreshes expired credentials.
- Add stable `modelProvider/authRecoveryStarted` and `modelProvider/authRecoveryCompleted` app-server notifications with the thread, turn, provider, and user-facing message.
- Show recovery progress in the TUI and `codex exec`, including Amazon Bedrock session reauthentication.
## Testing
- Cover provider recovery success and failure events, app-server routing, client rendering, and Amazon Bedrock credential refresh.
GitOrigin-RevId: 3010c38d0676f18bced27761cf86dd38344d09f9
## What changed
- Add the under-development `powershell_shell_version` feature flag.
- When enabled for a single local PowerShell environment, query the selected
shell executable and include its major/minor version in
`<environment_context>`.
- Cache version lookups, bound command execution and output, and report when a
previously visible version becomes unavailable.
## Testing
- Cover environment-context diffs when the shell version appears or disappears.
- Verify on Windows that the version is model-visible only when the feature is
enabled.
GitOrigin-RevId: 3ec8e80425ec3c193134dc1b69f61ef09ede375e
## Why
Microsoft Store PowerShell executables under `WindowsApps` can be inaccessible to the dedicated elevated sandbox account.
## What changed
- For local elevated sandbox commands that target Store PowerShell, select the first compatible `pwsh.exe` or `powershell.exe` from `PATH` or the standard fallback locations.
- Continue adding `-NoProfile`, and preserve the selected shell for remote execution and other sandbox modes.
## Testing
Added unit coverage for Store-path filtering, fallback ordering, local replacement, and remote-path preservation.
GitOrigin-RevId: 8ab3d0db925e886879701445040f13902fb1ad24
## What changed
Resolve the review model's token budget from the parent turn's original
configuration and model-default setting when deciding whether a Guardian
follow-up review needs context rollover. This preserves explicit token-budget
preferences instead of unconditionally applying the review model's defaults.
GitOrigin-RevId: cb3adaea7dad22f4975d84c6ee62dfc2bfbddbb9
## Why
Long-lived Guardian sessions can exhaust the review model's context window. After
a rollover, a transcript delta is insufficient because the new window no longer
contains the original transcript or persistent review instructions.
## What changed
- Compact an exhausted Guardian session before submitting the next review while
respecting the review model's token-budget configuration.
- Detect whether the full transcript remains in the reviewer history. If it does
not, reset transcript and Node REPL evidence cursors so the next review replays
the complete transcript and associated image evidence.
- Restore the follow-up reminder and Node REPL policy when compaction removes
them.
## Testing
- Cover rollover both when the reviewer window is already exhausted and when a
follow-up reminder crosses the limit.
- Verify that multimodal reviews preserve the fallback buffer and replay browser
evidence after rollover.
GitOrigin-RevId: f2a02a84e1f25d15c6e2b8eddb93e2d1805449f5
## What changed
- Register both `clock.curr_time` and `clock.sleep` when a model lists `clock` in `experimental_supported_tools`.
- Keep current-time reminder injection controlled separately by the `current_time_reminder` feature.
## Testing
- Cover a model-advertised clock with reminders disabled, verifying that both tools are available and no reminder is added.
GitOrigin-RevId: c39b5cb6e2da397daaaa4e0ad81f0763b8dd91e9
## What changed
- Add the optional `platformOs` field to exec-server environment metadata, with
local exec servers reporting `std::env::consts::OS` and legacy servers
remaining compatible when the field is absent.
- Preserve the reported OS in each selected turn environment, including the
local environment.
## Testing
- Extend protocol serialization and environment-selection coverage for remote
and local platform values.
GitOrigin-RevId: 0f325f6cb83cd8f8c7ec1ce2a4041f45a29e8f38
## What changed
- Add an optional `multi_agent_reasoning_effort` field to model metadata.
- When `Ultra` is selected, use a supported catalog override when present. Otherwise, prefer `max`, then the highest supported non-`ultra` effort, and finally `medium` when the model has no reasoning levels.
- Preserve existing request behavior for other reasoning efforts, including mapping `persistent` to `disabled`.
## Testing
- Cover configured, missing, unsupported, and empty-catalog fallbacks for both parent and spawned-agent requests.
GitOrigin-RevId: b7ef576f32e0ea95ef38bf95c25789ed16aae94e
## What changed
- Count remote executor MCP discovery attempts, including refreshes, with `success` and `error` outcomes.
- Count each discovered server by name and report whether it was found or unavailable before policy and startup filtering.
GitOrigin-RevId: b912aa64b606e6243cce79df0fe85d485a2c3547
## What changed
- Report the executor's user home in environment metadata.
- Cache the reported home on selected turn environments and include it in
filesystem sandbox contexts, including `apply_patch` requests.
- Preserve compatibility with executors that do not report a home directory.
## Testing
- Cover local, remote, inherited, serialized, and `apply_patch` sandbox
contexts.
GitOrigin-RevId: ea65e68e33a80bc9bcfc7c53b1486ab944699470
## What changed
- Add `ToolLifecycleContributor::on_mcp_tool_result` with access to the
executed MCP tool context, rewritten arguments, extension data stores, and
mutable server result.
- Run contributors before publishing MCP completion and before preparing the
result for the model, so extensions can inspect or replace successful and
error results.
## Testing
- Cover unchanged, replaced, and error results for direct MCP calls, plus
replaced and error results through Code Mode.
- Verify completion waits for result processing and the processed result flows
to both completion events and subsequent model input.
GitOrigin-RevId: ece7acfe9c5eed4778cb78a29c3ffd06a74e1bcf
## What changed
- Add `mcp_optional_startup_grace_ms` with a default of 1,000 ms to control how long tool catalog capture waits for optional MCP servers.
- Treat a value of `0` as disabling the shared grace, so optional servers use their configured `startup_timeout_sec` instead.
- Apply updated grace values during runtime and MCP configuration refreshes, and reset cached startup deadlines when the configured duration changes.
## Testing
- Cover custom, disabled, refreshed, and shared startup grace behavior in MCP connection and core integration tests.
GitOrigin-RevId: 936196215ed6e0a29c9ec72cfee17663978df8ef
Expand Windows deny-read globs robustly across protected directories while preserving filesystem enforcement. Preserve structured MCP tool and resource errors through app-server responses. Bind cached Guardian classifications to current local and root authorization state so stale scores cannot approve actions.
Add regression coverage for the sandbox resolver, structured protocol errors, and authorization changes.
GitOrigin-RevId: 4b80ed724d869afeca79204222d8465fa99d3a24
