## What changed
Add `CodexThread::current_turn_model` to return the model slug selected for the named running turn's next step, independently of settings for future turns. Return `None` when the turn ID does not match, the task is cancelled, or the turn is no longer running.
## Testing
Extend the step-settings test to verify that the accessor ignores model changes for future turns, reflects active-turn model updates, and returns `None` for a mismatched ID or a completed turn.
GitOrigin-RevId: 2cae7c07fa761ed4d64befaa3419a2f9bce4b161
## What changed
Add the disabled-by-default `guardianv2_decisions_comparison` feature to run Decisions alongside Guardian V2 snapshot classification using the same policy and evidence. Initialize the comparison sampler with `CODEX_GUARDIAN_DECISIONS_API_KEY`.
Publish the baseline score before awaiting comparison results, and keep comparison results and failures from changing approvals. Apply Guardian's input token budget, skip conversation evidence, and cancel comparison work when the baseline classification is superseded. Record success, failure, and skip outcomes with bounded diagnostic reasons, including setup failures.
## Testing
Add lifecycle tests covering disabled comparison, disagreeing classifications, backend failures, unchanged published scores, matching policy and evidence, and rejection of over-budget requests before either backend sends them.
GitOrigin-RevId: 743d34c8ee440362da94f001058366027b39bd11
## Why
Reloading an unloaded root from a surviving child can supply the shared instruction wrapper already registered for that root. Replacing its underlying provider with that same wrapper makes instruction loading recurse into itself.
## What changed
Reuse the existing wrapper without replacing its provider when both are the same `Arc`. Continue to accept distinct replacement providers.
## Testing
Extend regression coverage to reload the root from a surviving child and verify that shared instructions still update. Check wrapper reuse, replacement with a distinct shared provider, and freezing the shared snapshot when switching to a provider that does not share with subagents.
GitOrigin-RevId: 7b6b2f9031f206e203f6fa14e1478a36b305ec39
## Why
Unread queue-only messages prevented idle agents from unloading, and sending a
message to an evicted agent reloaded its session. Pending mail should not require
an idle recipient to occupy a loaded thread slot.
## What changed
- Retain queue-only mail in an in-memory runtime mailbox when a session unloads.
Queue new messages for locally evicted agents without reloading them or
starting a turn.
- Add `AgentControl::take_mailbox` and `AgentControl::watch_mailbox` so sessions
can consume retained mail and react to host mailbox notifications.
- Preserve message order across eviction, reload, and subsequent follow-ups.
Keep agents with outstanding durable sleep or turn-triggering mail loaded,
and discard retained mail when an agent is removed or its tree shuts down.
## Testing
Add integration coverage for retaining mail across eviction, sending while
unloaded, and ordering messages around a follow-up after reload. Add a host
controller test verifying that mailbox notifications wake `wait_agent` and
that the message is delivered exactly once.
GitOrigin-RevId: 4b55647f9ee9d1aaf3753f0688863bda81617327
## Why
Subagents spawned without forked history do not receive their parent's client-defined dynamic tools, preventing them from using those tools for delegated work.
## What changed
Add the disabled-by-default `multi_agent_v2_dynamic_tools` feature flag. When enabled, fresh V2 subagents inherit the parent's dynamic tool definitions and persist them in session metadata.
## Testing
Add coverage for V1 and V2 feature gating, tool persistence, and a fresh V2 subagent calling an inherited tool and receiving its result without inheriting parent history. Update TUI assertions and a snapshot to reflect blank-line separation and question text in recovered answers.
GitOrigin-RevId: a17a16bf5570f54ce922c1521cffb883022354f2
## What changed
- Centralize `windows-sys` at version `0.61.2` in the workspace and migrate dependent crates to it.
- Adapt Windows API calls to the updated handle, boolean, and type definitions. Replace custom handle owners with `OwnedHandle` and use `BorrowedHandle` where ownership stays with the caller.
- Add explicit wrappers for non-owning Windows handles passed between threads.
## Testing
Enable the MCP refresh cleanup test on Windows. Retain process handles to verify that a superseded MCP server stays alive during an in-flight call, exits after cancellation, and leaves the replacement running until shutdown.
GitOrigin-RevId: 86f53d9b300d13edff7154f4a7c32e34dacd2919
## What changed
Update `post_sampling_token_estimate_is_disabled_by_always_on_sinks` to register explicit event metadata with the subscriber and assert that its interest is `never`. This replaces the scoped default subscriber and global interest-cache rebuild with a direct check of the configured logging layers.
GitOrigin-RevId: 7c4ecd9c4adef148fd222394ad1ad326e8033d95
## Why
Environment changes and overlapping catalog refreshes can cause a step to use another step's selected plugins or executor skills. Model context and skill tools need to agree on the capabilities captured for that step.
## What changed
- Resolve selected plugins from each step's ready capability roots, honoring disabled plugins, and retain the snapshot with the step's extension data.
- Use that snapshot for skill attribution in World State and the first step's active-plugin telemetry.
- Return executor skill catalogs directly from refresh so overlapping requests render their own results while retaining thread caches.
## Testing
Add regression coverage for overlapping executor catalogs and environment changes during step preparation. Verify that `skills.list` retains the original step's skills, the next step advertises the new skills, and disabled executor and plugin skills remain absent from model context.
GitOrigin-RevId: 37d3cbe8c7e062fd06290aa985ada4d3b3462d43
## Why
Legacy MCP tool discovery discarded pagination cursors, leaving tools on later pages unavailable.
## What changed
Pass `tools/list` pagination cursors to the existing collector in both legacy and modern protocol modes. Legacy discovery now follows subsequent pages and applies the same pagination limits and cursor validation as modern discovery.
## Testing
Extend integration coverage to both protocol modes, checking that tools from later pages reach the model and can be called successfully, while catalogs with oversized cursors are rejected. Update the legacy discovery test to expect an error for a repeated cursor.
GitOrigin-RevId: a6daa8034d2a403c1f2a5846e385789d8a620af7
## Why
A user restriction such as “Cancel the deployment” can fall outside the recent-message window after unrelated status questions. Guardian reviews need that restriction when assessing delegated actions.
## What changed
- Preserve root user messages during handoff relevance filtering, subject to the existing shared message cap.
- Apply handoff filtering during heartbeats while retaining saved heartbeat instructions and the active turn's trusted skills.
- Mark assistant context as incomplete when handoff filtering omits it, so ordinary user replies are not interpreted without their missing context.
## Testing
Add regression coverage for restrictions followed by status questions, bounded user history, omitted assistant questions, and trusted skills across first and repeated heartbeats. Update the delegation request-history snapshot.
GitOrigin-RevId: 67f77313572dc54225713cd7cdb90f06b0fbe030
## Why
Concurrent Linux test spawns can inherit writable descriptors for executable fixtures, preventing those fixtures from being executed even after the writing test closes its descriptor.
## What changed
Replace direct executable fixture writes and copies across the Rust tests with `codex_utils_cargo_bin::write_executable` and `copy_executable`. These existing helpers complete writes and copies in separate processes on Linux.
Remove the empty temporary inode before creating fake bubblewrap executables, and stage tampered bubblewrap bytes in a separate data file before copying them into the executable fixture. Add the required test dependencies.
GitOrigin-RevId: c875c83088731a4933ef1574e8d79d8cecc12f54
## Why
Short sender replies such as `👍` need preceding assistant context to be understood during a delegation review. User messages alone omit that context.
## What changed
- Capture preceding assistant context alongside up to three recent sender user messages at delivery, for Guardian only. Label assistant messages as untrusted context rather than authorization or verified questions.
- Share the existing 900-byte budget per exchange, prioritize user evidence, and report unavailable assistant context.
- Recognize `cloud_threads.send_message` deliveries and accept both compact and indented delegation envelopes.
## Testing
Expand integration coverage for app, TUI, and cloud-thread deliveries, contextual replies, and budget-driven omissions. Assert that sender user and assistant context stays out of the delegated agent's prompt.
GitOrigin-RevId: 4eca369cbb30241635273f729dec81b78ea57faf
## Why
`codex exec` and the TypeScript SDK need a way to request a Cyber access program for an individual turn. Resuming with an API key can also leave compaction using a saved program that the current credentials cannot access.
## What changed
- Add `--cyber-access-program` with `standard`, `daybreak_blue`, and `daybreak_red`, and expose the equivalent `cyberAccessProgram` turn option and `CyberAccessProgram` type in the TypeScript SDK.
- Apply explicit selections to new, resumed, and prompted fork turns. Override automatic Daybreak selection for that turn without changing the saved choice. Reject the flag for review and forks without a prompt.
- Filter Cyber programs by the built-in OpenAI provider when starting turns and restoring previous-turn settings for compaction.
- Allow previous-model compaction fallback with API-key authentication, comparing both model and program so a program change can trigger a retry with the current pair even when the model is unchanged.
## Testing
Add CLI help, argument parsing, exec, and SDK coverage for per-turn selection and unsupported commands. Extend core tests for API-key compaction retries, denied explicit selections, custom-provider filtering, remote compaction, and WebSocket response reuse.
GitOrigin-RevId: 586f25b621924f3bc509c9a39b39fe2020ff9cd2
## Why
Executor skill reads need to use the environments and permissions captured for the current step, including newly approved grants. Cached continuation pages must remain bound to the filesystem and permissions that produced them.
## What changed
- Supply borrowed `EnvironmentAccess` to turn-input contributors and extension tools, with session and originating-turn grants already applied.
- Require executor skill reads to use filesystem access from an environment available to the callback, and replace separate optional read contexts with `SkillReadContext`.
- Bind skill pagination snapshots to `EnvironmentAccessKey`, which identifies the source filesystem and callback permissions.
- Route image-generation filesystem operations through the same accessor.
## Testing
Extend skill-read integration coverage to verify that a denied reference becomes readable after a turn-scoped grant is captured by the next model step. Update Windows coverage to verify that restricted reads fail when the executor cannot enforce a sandbox, and add a test requiring turn environment selection before exposing capability roots.
GitOrigin-RevId: 825b49302319965835d61c77fc5bcdb951e10543
## What changed
Replace the separate `WorldStateSection::snapshot` method with a typed `SectionTransition` returned by `render_diff`. Snapshot updates and model-context fragments are independently optional; omitting a snapshot preserves the stored comparison state.
Update all section implementations to use this contract, skip snapshot updates for unchanged sections where applicable, and cache the multi-agent usage-hint fingerprint.
## Testing
Adapt world-state and context-history tests to the combined return value, including an assertion that unchanged permissions return neither a snapshot nor a context fragment.
GitOrigin-RevId: 79c1977a87481009ff193ea4cce4546be87458fe
## Why
Background code-mode cells can continue running after a new turn starts. Looking up grants and strict review requirements through the active turn can make those cells lose their approved access or use another turn's permissions.
## What changed
- Keep turn-scoped grants and strict review state in `TurnContext`, retained by captured steps and background cells.
- Record permission responses against the requesting turn, including requests made after a later turn starts.
- Share live session-scoped grants across turns while keeping turn-scoped grants isolated.
- Use the originating turn's permissions and review requirements for tool execution, patches, MCP calls, file uploads, and terminal input.
## Testing
Add regression coverage for background cells retaining grants across turn changes, turn versus session scope, permission requests after the next turn starts, and strict review enabled while `write_stdin` is queued.
GitOrigin-RevId: 641502fbfd43553c2c42424d4aaa53ae8020c850
## What changed
- Add the `daybreak` configuration key, defaulting to `false`, with per-invocation overrides such as `-c daybreak=true`.
- Resolve access programs from the model catalog, preferring `daybreak_blue` over `daybreak_red` when enabled and selecting advertised `standard` access when disabled for signed-in ChatGPT accounts. Require the OpenAI provider, a signed-in ChatGPT account, and a compatible model to enable Daybreak.
- Save the choice for new persistent threads and inherit it on resume and fork, including ephemeral forks. Explicit CLI overrides apply only to the current invocation.
## Testing
Add protocol tests for advertised-program selection and exec integration tests for account and provider restrictions, saved choices, ephemeral forks, and invocation-only overrides.
GitOrigin-RevId: ac955f08b5a891e720cfc5f67fabb7b0f6d32bb8
## What changed
Return snapshots and model-visible fragments together from world-state rendering, and use those snapshots for history baselines, step updates, compaction, and new context windows.
Update `WorldStateSectionContribution` so its renderer returns an optional replacement snapshot and an optional fragment. A missing snapshot preserves stored section state, even when retained history requires a fresh render; a null snapshot removes the section. Derive step patches from the history baseline rather than a separately captured live world state.
Adapt skills and Git attribution contributors to the new contract.
## Testing
Add coverage for skipped snapshot updates, explicit section removal, changed-state patch replay, unchanged-state deduplication, and matching live and persisted checkpoints when starting a new context window.
GitOrigin-RevId: af71606a278358ae937853cb76e8a019a501408e
## What changed
Add `turn_extension_init` to thread startup and settings, and expose `WithTurnExtensionData` for turn input, recovery, and settings requests. Accept or reject data updates together with the request that supplies them.
Each new turn captures the configured data, including automatically started turns. Accepted steering updates the data for future turns while preserving the running turn's capture. Plain requests preserve the configured data; an empty initializer clears it. The data is not persisted and must be supplied again on cold resume.
Expose `current_turn_extension_data` to retrieve typed data only when the requested turn is still running and has not been cancelled.
## Testing
Add an integration test covering initial capture, accepted and rejected steering, inheritance by an automatic turn, clearing future data without changing the active capture, and rejection of lookups for an earlier turn.
GitOrigin-RevId: dd81eda3e32c7b62d783c772221858f4c0e68264
## Why
Mixing every input on a multichannel audio device can include playback channels in microphone capture. Selecting only microphone inputs keeps those playback channels out of the captured audio.
## What changed
- Add `audio.microphone_channel` with one-based channel numbers, accepting a single value or an array such as `[1, 2]`. Leaving it unset preserves mixing of all inputs.
- Add an input-channel picker for the selected microphone when it has at least three channels. Require a nonempty selection and save it locally for the next voice conversation.
- Average only the selected channels, deduplicate selections, and reject empty or unavailable selections without falling back to other inputs.
- Clear saved channel selections when saving an input device and report configuration overrides that prevent the reset from taking effect.
## Testing
Add regression coverage for excluding playback channels, sample conversion, subset mixing, invalid selections, configuration loading, local persistence and overrides, and picker selection and cancellation. Update UI snapshots and verify channel selections are passed to the voice helper.
GitOrigin-RevId: 99960dcfa7b10cf38270768a90bb84a4be95a406
## What changed
Expose `ThreadManager::request_agent_tree_shutdown` and an `AgentTreeShutdown::wait` handle. Requests reject new starts in the shared runtime, cancel pending startup, and signal every session in that tree, including delegates outside the thread registry. Waiting covers admitted operations and session teardown, and reports cleanup or persistence writer failures. Other root trees remain unaffected; registry removal and persistence handoff remain caller responsibilities.
Retain tree membership through startup, cancelled spawn cleanup, residency eviction, and completion watchers. Release persistence resources before returning startup failures, and stop completion watchers during tree shutdown without reporting shutdown as a child result.
## Testing
Add coverage for tree isolation, children removed from the registry, delegate teardown, cancellation during required MCP initialization, aborted teardown, persistence writer failures, and successful retry after a failed resume releases its writer.
GitOrigin-RevId: a109e25adf23d20baf7595891099947050c6b6b5
## Why
Retained Guardian classifier conversations already contain previously delivered synchronous reviews. Appending those reviews again repeats evidence and consumes input budget.
## What changed
Track each review completion with a stable identity in host-only history metadata. Filter already delivered reviews before composing and budgeting continuation input, while preserving distinct completions even when their text is identical.
Fresh conversations receive the review evidence again, and shortened messages no longer count as complete delivery. Delivery metadata stays out of model requests.
## Testing
Add coverage for delivering retained reviews once, appending newly completed reviews, restoring evidence after failed streams, and retaining reviews when history lacks complete delivery metadata.
GitOrigin-RevId: b8d58ffdd7d9c484676af707c65fa50020aae73c
## What changed
- Add `features.guardianv2.async_classifier_mode` with `snapshot` and `conversation` modes. Local configuration overrides model defaults; snapshots remain the fallback.
- Retain completed classifier requests and responses in conversation mode, appending transcript deltas without repeating previously delivered user instructions.
- Rebuild retained history when authorization, classifier instructions, or parent compaction changes, after an incomplete response, or when the next request exceeds the configured token limit. Add `async_classifier_conversation_token_limit`, defaulting to 100,000 tokens, while preserving the model's input limit for fresh requests.
- Serialize conversation requests in observation order, bound outstanding work, and reject stale work after authorization changes or thread shutdown. Record retained and new input token costs.
## Testing
Add tests for configuration precedence, history reuse and resets, ordered admission, queue overflow, and stale or stopped requests. Exercise the approval matrix in both modes, including resume, fork, mandatory review, authorization changes, and stream failure after an early score.
GitOrigin-RevId: 35b9800104648cde4f467086e678dee12458c3e5
## What changed
Remove the repository-root `AGENTS.md` from `codex-rs/core` test data and from the root Bazel `exports_files` list.
GitOrigin-RevId: 644052d50f79b4c798baf40e53aab824f0fd73c3
## What changed
When the model catalog is provided in context and model overrides are exposed, tell V2 `spawn_agent` callers to inherit the current model unless the user explicitly asks for a different model. Include this guidance even when spawn metadata is hidden.
## Testing
Extend tool-description tests to cover hidden metadata with both inline and context catalogs, and update request-level assertions for V1 and V2 model override guidance.
GitOrigin-RevId: b70b0f09b0b5987a0eccba578196b8ef7cee4baf
## What changed
Register `browser_annotation_api` as a stable, default-enabled feature intended for requirements rather than user configuration. It controls websites opening and customizing annotation tools in desktop apps, independently of ordinary user-driven annotation.
Add the key to the configuration schema, extending the browser requirements support introduced in https://github.com/openai/codex/pull/18956.
## Testing
Extend `browser_feature_requirements_are_valid` to verify that enterprise requirements setting `browser_annotation_api = false` disable the feature.
GitOrigin-RevId: 8c7bb65932e08560040958b4472fe45f6d1c916f
## What changed
Capture each environment's effective Windows sandbox backend in the MCP runtime and include it as `useMxc` in sandbox state metadata for supporting servers. Use the server's captured environment selection, including local fallback, so the local MXC preference does not leak into attached environments. Default missing backend information to `false`.
## Testing
Extend tests to cover MXC metadata handoff, attachment isolation, local fallback without a selected local environment, and preservation of captured backend settings across runtime refreshes.
GitOrigin-RevId: f559bffeff383838334e5a475b1eab608d571fa1
## What changed
Allow API-key sessions using the OpenAI provider to forward explicit cyber access programs when `features.api_key_cyber_access_programs` is enabled, regardless of `features.api_key_model_discovery`.
## Testing
Expand the app-server test to cover all four combinations of the two feature flags, checking forwarded programs and failures when forwarding is disabled. Default the API-key test helper to model discovery disabled.
GitOrigin-RevId: f9cf1d2bd7c231645d50178cc6721b55a8d63268
## Why
An inaccessible user profile directory can prevent sandboxed PowerShell from preserving its working directory and resolving relative paths in a project beneath that profile.
## What changed
Pass `USERPROFILE` to elevated setup and refresh. When the command's working directory is beneath an absolute profile path, grant the sandbox group non-inheriting `FILE_READ_ATTRIBUTES` access to the profile directory.
Preserve existing permissions and deny ACEs during non-inheriting ACL updates without propagating changes to descendants. Expand generic deny masks when checking for conflicting permissions.
## Testing
Add a Windows regression test that checks PowerShell's working directory and reading `.\public.txt` beneath a protected profile. Add an ACL test that verifies a non-inheriting grant leaves an unprotected child's security descriptor unchanged.
GitOrigin-RevId: 7f142a7ffdee795c3255d4a6e79568fa9391c055
## What changed
Emit `codex.skill_invocation` logs for explicit skill injection and detected implicit use, including skill-tool reads. Include skill name, invocation type, conversation, turn, model, and client metadata, plus scope, plugin ID, and ChatGPT user and account IDs when available.
Exclude skill contents, resource paths, email addresses, prompts, and tool payloads. Use the existing OTEL log exporter without an additional opt-in; `otel.exporter = "none"` continues to export no logs.
Document the event fields, exporter configuration, and detection semantics in `codex-rs/otel/README.md`.
GitOrigin-RevId: 0f9c492c3f224455f3de3660be89692d776c1951
## What changed
- Start a turn-owned notification receiver using the same remote board client and session identity as the board tools. Deliver post previews as agent messages and cancel the receiver when the turn stops, aborts, or errors.
- Wait for the initial connection attempt before inference, then retry failed or disconnected streams without waking idle agents.
- Skip malformed notices, mismatched recipients or turns, and oversized previews. Reject delivery to stale or canceled turns and bound remote notices to a 1 KiB context budget.
## Testing
Extend remote board tests to cover interrupted setup, connection failures, reconnection, invalid and stale notices, preview delivery into model context, and receiver shutdown after turn completion.
GitOrigin-RevId: c7c8d977fe74b7a5cb3bd8216dc0146f3f297e44
## What changed
Register `in_app_voice` as a stable, default-enabled feature and add it to the configuration schema. The gate is intended for managed requirements to control permission for voice in desktop apps; permission does not establish voice availability or provider support.
## Testing
Add app-server coverage for reporting `in_app_voice = false` from `requirements.toml` in both requirements and feature-list responses. Extend the CLI feature-list test to verify that cloud-managed requirements disable the gate despite a user-configured `true` value, without rewriting the user configuration.
GitOrigin-RevId: 6ec3bc0176fdb3e1714b0136bf812bd56591f6a1
## Why
`windows.allowed_sandbox_implementations` permits MXC regardless of the listed implementations. Managed requirements need a separate way to block both explicit MXC configuration and automatic selection through `prefer_mxc`.
## What changed
Add the optional managed requirement `windows.allow_mxc`. Setting it to `false` disables automatic MXC selection and rejects explicit `windows.sandbox = "mxc"` configuration with an error identifying the requirement. Leaving it unset or setting it to `true` preserves existing behavior.
## Testing
Add coverage for the requirement alongside allowed sandbox implementations, preference resolution, and cloud-managed opt-out behavior for implicit, elevated, and explicit MXC configurations.
GitOrigin-RevId: a458a7b4c92cf17e687dbbad8208884d1c097da5
## Why
Resuming a thread rereads persisted history even when a preloaded snapshot is unchanged. Reusing that snapshot must still account for writes committed before writer ownership is acquired.
## What changed
- Carry optional, non-serialized revisions from stored history and model context through thread and agent resume paths.
- Validate the revision under writer ownership and reuse the shared snapshot when it matches. Reload stored history when the revision is missing or changed, while preserving explicit history overrides.
- Resolve the selected rollout before loading context, validate compressed snapshots before materialization, and enforce archived-thread restrictions on canonical paths.
## Testing
Extend coverage for snapshot reuse and late-write refresh in legacy and paginated histories, compressed rollout reuse, archived rollout symlinks, and cold child restoration that includes edits made after preloading history.
GitOrigin-RevId: e1fd7aee6ef2b30f41951e6b7e6b01c3e1420cab
## Why
A stored history snapshot can become stale before a resumed thread acquires writer ownership. Resume must include writes committed before that acquisition.
## What changed
Make `ThreadStore::resume_thread` return the replay context and use it for session restoration and metadata initialization. The local store refreshes stored snapshots while holding writer ownership, reads through the installed writer to honor explicit rollout paths, and releases the writer if loading context fails. Explicit histories without a canonical session header retain their override semantics.
## Testing
Extend resume tests to cover edits made after the initial snapshot in both legacy and paginated history modes, stale SQLite rollout paths, and preservation of explicitly supplied history.
GitOrigin-RevId: 2361f524d324c859f5dfcf2863320e2045736c2e
## Why
User goal edits and clears need to reach the model as user instructions, including when a thread is unloaded or history is being compacted. Automatic goal lifecycle updates must not supply user authorization.
## What changed
- Add optional `origin` values of `user` and `automatic` to `thread/goal/set` and `thread/goal/clear`, and mark TUI goal requests as user actions. Omitted origins do not supply user authorization.
- Persist explicit user objective, status, and clear instructions before changing goal state. Recording failures leave goal state unchanged.
- Coordinate goal edits with thread resume, reload stored history under writer ownership, and preserve edits accepted after the compaction input snapshot.
- Update generated protocol schemas and TypeScript and Python bindings.
## Testing
Add coverage for user edits and clears on loaded and unloaded threads, concurrent path-based resume, exclusion of automatic goals from user instructions, preservation of edits during compaction, and recording failures that leave goal state unchanged.
GitOrigin-RevId: d779d7c678a0c32a6ef76975dbe5b1400d1df245
## Why
Guardian and parent requests can arrive in either order after a command yields. A shared response sequence can let parent requests consume Guardian review decisions.
## What changed
Match Guardian responses separately and drive parent responses from the latest tool output in the strict automatic network review test. Poll running sessions with `write_stdin` until the process exits, and assert that the command and network request each receive Guardian review.
GitOrigin-RevId: 21300abd65a3b2d439e8c1ea04e4429d5bd528dd
## Why
Guardian does not consume skills, but host skill discovery can block its startup or turn creation when the primary executor is offline.
## What changed
Skip plugin and skill warmup during Guardian session initialization, and use an empty host skills snapshot when building Guardian turn contexts.
## Testing
Add a regression test that discovers skills for the parent session, disconnects its primary executor, and verifies that Guardian still reviews and denies a network permission request.
GitOrigin-RevId: 3c12129721c82cb78a3fa618d6b05faea631966a
## Why
Refreshing available model descriptions changes the `spawn_agent` tool schema. Keep model choices current while preserving tool definitions and earlier conversation input.
## What changed
- Add the disabled-by-default `model_catalog_in_context` feature for multi-agent V1 and V2. When enabled and model overrides are available, move model listings from tool descriptions into developer `<model_catalog>` messages.
- Include picker-visible, compatible models with descriptions, reasoning efforts, and service tiers in a listing bounded to 1,000 bytes. Point `spawn_agent` guidance to the latest catalog.
- Append updated listings only when their rendered content changes, restore missing listings, and invalidate retained catalogs when they no longer apply.
## Testing
Extend integration coverage for V1 and V2 with the feature enabled and disabled. Verify that catalog refreshes preserve tool definitions and prior input when enabled, append the updated listing once, and retain the existing tool-description behavior when disabled. Add a request-history snapshot for the V1 opt-in path.
GitOrigin-RevId: 67b11b4ad6c35f00d0e29edf6343bb0b4804d797
## What changed
- Fork the selected conversation and open the new session with `f`, configurable through `agents.fork` in the TUI keymap.
- Move the default search shortcuts to `F3` and `/`, preserving unshadowed defaults when custom bindings conflict.
- Keep queued input on the source conversation while attaching and forking, and require closing an open side conversation before forking another task.
- Expose the fork action in command-center help and the keymap picker.
## Testing
Add regression coverage for queued-input preservation, side-conversation protection, configurable fork shortcuts, metadata editing, disconnected actions, and search fallback bindings. Update help and keymap snapshots.
GitOrigin-RevId: b11ae21ef6a2053609b31ce97c646104f18806a3
## What changed
Add a debug-only analytics test that switches accounts after the first isolated event request. Assert that only the first request reaches the server and carries the original account's credentials, so subsequent batches do not send stale credentials after the switch.
Remove an unused `ToolCallSource` import.
GitOrigin-RevId: e66904c7a7176f1eaa37662b836132586328884a
## Why
`TurnAborted` could be emitted before extension abort callbacks finished, allowing consumers to observe a terminal event while lifecycle cleanup was still pending.
## What changed
Await `on_turn_abort` within task abort handling before emitting `TurnAborted`, retaining callback delivery for already-cancelled tasks. Document that `on_turn_stop` and `on_turn_abort` complete before their corresponding terminal events, if emitted.
## Testing
Add regression coverage for interrupt, conditional interrupt, and shutdown. Hold the abort callback open to verify that `TurnAborted` waits for completion, then verify that the callback runs exactly once with the expected turn ID and abort reason.
GitOrigin-RevId: f34d7e94d04c02544178dc445b85abc65a6ce499
## Why
Login shell startup can reset `PATH`, preventing commands and their children from finding bundled tools such as `rg` in executor-reported directories.
## What changed
When `login_shell_package_path` is enabled, prepend missing executor-reported directories to `PATH` inside the POSIX login shell before running the requested command. Preserve existing entries and the order of newly added directories, and export `PATH` for child commands.
Respect explicit `PATH` overrides and preserve the requested login mode when directories are unusable or `PATH` is read-only. Keep shell diagnostics and `$LINENO` aligned with the original script, including when directory names contain newlines. The feature remains disabled by default.
## Testing
Add shell tests for nested tool lookup, existing entries, quoting, line numbers, and read-only `PATH`. Extend remote execution tests to cover feature gating, explicit overrides, unusable directories, and preservation of the original command in execution events.
GitOrigin-RevId: 301aa34e72cc6292293693250e190c19903f390a
## Why
Responses overload and exhausted-request errors could terminate despite server retry advice, and WebSocket-to-HTTP fallback could issue a request before the advised deadline.
## What changed
- Allow `ServerOverloaded` and `RetryLimit` errors to retry when server advice is present, within the configured retry budgets.
- Preserve `Retry-After` headers from rejected WebSocket upgrades and wait for the server deadline before falling back to HTTP.
- Keep quota, usage-limit, and policy failures terminal even when they include retry advice.
## Testing
Add coverage for HTTP overload and rate-limit recovery, WebSocket upgrade rejection and fallback timing, retry deadline preservation through error mapping, and retry limits for sampling and manual and automatic compaction.
GitOrigin-RevId: 72d30a9f078652664754dfa971fd7dc7a78f20e8
## What changed
Update the replay assertion in the recorder refresh test to compare `executed_tool_call_metadata()` instead of entire response items. This keeps the assertion focused on preserving recorded tool call metadata across a configuration refresh.
GitOrigin-RevId: 763173a918f4e0bc79c3c04466453cafb9629775
## What changed
Forward explicit `cyberAccessProgram` selections for the built-in OpenAI provider when both `api_key_cyber_access_programs` and `api_key_model_discovery` are enabled. The new feature defaults to disabled and can be toggled through the app server's experimental feature enablement API.
Reject explicit selections in OpenAI API-key sessions when either feature is disabled, instead of silently omitting the program. Leave entitlement and model restrictions to the server, and preserve the requested program when a server rejection triggers transport retries.
## Testing
Add app-server coverage for both feature gates, forwarding all three program values, and server rejection without fallback. Update core coverage for API-key resumes with disabled features and custom-provider omission.
GitOrigin-RevId: aa639afb841aa651b28f6f3f61198299372baa2d
## What changed
Register `login_shell_package_path` as a disabled-by-default experimental feature and add it to the configuration schema. Expose it in `/experimental` as “Bundled tools in login shells,” with a description explaining its intended use when login shell startup resets `PATH`.
## Testing
Extend the experimental feature metadata snapshot test to cover the new feature's label, description, and unchecked default state.
GitOrigin-RevId: dc110486ccd8d2d76ac788ba5a413a1374699ff8
## Why
Persistence and aggregate metadata budgets can omit tool-call observations that are still relevant to the current request, including tool result metadata needed during compaction.
## What changed
- Retain live direct-call observations separately from bounded persisted outputs, keyed by response item ID so reused call IDs cannot mix results.
- Restore those observations for sampling and compaction, pruning them only when sampling confirms they have left the history window. Preserve observations across shortened compaction retries.
- Remove aggregate prompt metadata caps while retaining per-call argument limits and the outgoing message size limit. Invalidate cell completeness when argument normalization truncates a recorded call.
## Testing
Add regression coverage for exhausted persistence budgets, reused call IDs and reversed completion order, shortened compaction retries, and completeness after argument truncation. Extend integration coverage for large Code Mode metadata, provider metadata support, and fork/resume behavior.
GitOrigin-RevId: 004082b69bff9cc8b05f36d1052057f163c67f07
## What changed
- Instrument MCP OAuth loads, saves, deletes, fallback cleanup, and refresh persistence with credential-free storage metrics, distinguishing configured policy from operations on a pinned store.
- Retain the originating client across background tasks, blocking storage operations, and session recovery, including recovery after startup found no credentials.
- Preserve typed keyring and lock error categories for metrics and remove raw error details from storage warnings.
## Testing
Add tests for policy and pinned-store outcomes, best-effort cleanup failures, wrapped lock errors, and successful or failed refresh persistence without duplicate observations. Add recovery tests that verify client attribution after anonymous startup and across threads with different originators.
GitOrigin-RevId: 5ea4528bcdcf500c8ffdf1d9c7008ea52112c726
## Why
Elevated sandbox tests share machine-local Windows accounts. Concurrent setup can rotate account passwords between another test's setup and logon.
## What changed
- Add a shared file-lock guard for elevated sandbox tests in `codex-core`, `codex-exec-server`, and `codex-windows-sandbox`, held through sandbox commands and cleanup.
- Queue these tests in a single-threaded Nextest group before their timeouts start, while retaining the file lock to coordinate other test processes.
- Limit account locking to tests that use elevated accounts and remove the sandbox crate's blanket Bazel `exclusive-if-local` tag.
GitOrigin-RevId: 26d4606cb1fdcac65926d29835bed4eac04c19c0
sayan-oai