## What changed
- Add `CodexThread::agent_tree_id()` to identify a loaded agent tree. The root and native children share an ID; loading a new tree produces a new ID even when reusing a persisted thread ID.
- Add `EnvironmentManager::remove_environment()` to unregister an environment while preserving existing handles and the default environment ID.
## Testing
Extend tests to check tree IDs across child creation, forks, warm reuse, and cold reloads, and to verify environment removal and re-registration.
GitOrigin-RevId: 43944ed6766374508d9862cd5d333bc4cb67c338
## Why
Changes to nested tools should update the model's catalog without repeating the full `functions.exec` declaration or rewriting retained context.
## What changed
Pass structured exec definitions through the tool router into the session's tool world state. Enable granular updates for Responses Lite in `CodeModeOnly` when both `IncrementalTools` and `IncrementalExecTools` are enabled.
Append changed tool definitions, namespace instructions, and removals as developer messages. Keep common exec instructions and shared types frozen until compaction, then install the latest full catalog.
## Testing
Add feature-gating coverage and a scenario snapshot covering tool additions and removals, namespace instruction changes, eager/deferred transitions, re-enabling tools, retained context, and catalog restoration after compaction.
GitOrigin-RevId: bbf850d4e5018388eeb4c09345d885d776962e09
## What changed
Render stable entries for nested tool definitions and namespace instructions alongside the full `functions.exec` description. Add optional catalog tracking that emits complete replacements for added or changed entries and explicit notices for removed entries, while keeping the existing exec declaration unchanged.
Preserve entry hashes while exec is unavailable, then restore the full catalog and withdraw removed entries when it returns. Keep the existing snapshot format for ordinary tool catalogs.
This change provides the rendering and state support; runtime activation remains disabled.
## Testing
Add tests for definition rendering and namespace identity, batched additions and changes, removal notices, unchanged catalogs, and full catalog restoration after exec is hidden.
GitOrigin-RevId: f472bd3e8e770a8cad9663c72e290abe7d0473be
## What changed
Make `AgentServiceTier` reads asynchronous and have updates return a receipt for local acceptance. Await acceptance during root startup and settings updates outside state and registry locks, sharing the receipt with explicit same-tier retries.
Await shared-tier reads during child preparation, startup prewarm, and step capture. Allow cancellation while capturing a step, and keep host propagation independent of the acceptance wait.
## Testing
Extend the host-child WebSocket test to cover delayed acceptance, same-tier retries without duplicate updates, accessible settings while acceptance is pending, and tier inheritance during prewarm and subsequent steps.
GitOrigin-RevId: 0e2e1899834c37684e904c4a36e66344a0c6c7f3
## Why
A message's model-visible item ID may be unknown until the recipient records it. Message lifecycle observers need to capture publication state before that point.
## What changed
Remove `message_id` from `MessageLifecycleInput` and give each publication's `ExtensionData` a fresh UUID key. Stop assigning an item ID when publishing messages for lifecycle observers.
## Testing
Update the agent mailbox test to store a contributor-specific token in `ExtensionData` at publication and retrieve it at consumption, verifying that publication state survives queued delivery and recipient eviction.
GitOrigin-RevId: e254f94994d0976e61cb46ee23297f3248b9a389
## What changed
- Expose an optional `AgentServiceTier` provider so host-owned children, including detached children, inherit the root's committed tier during spawn preparation, startup prewarm, and each inference step.
- Reject per-turn tier overrides for children using the shared provider. Root updates apply to subsequent requests without changing requests already in flight.
- Preserve independent configured tiers and role overrides when no provider is installed, including across eviction and reload. Spawned children inherit the parent's thread preference rather than its per-turn override.
- Publish the latest committed root tier only after successful runtime registration, preventing failed duplicate starts from changing shared settings.
## Testing
Add coverage for detached-child WebSocket prewarm and between-step tier changes, shared-child override rejection, independent-tier inheritance and reload, and settings updates before registration.
GitOrigin-RevId: f0f3676813a1c59bd77baf95121e2d13e0163a8e
## What changed
Expose `AgentTurnOutcomeReporter` for hosts to install through `StartThreadOptions::thread_extension_init`. Await its callback after emitting the terminal turn event, independently of native parent notifications, so hosts can handle result delivery and retries.
Track outstanding outcome handoffs and wait for them during graceful shutdown before running thread-stop hooks. Prevent new turns from starting once handoff registration closes.
## Testing
Add integration coverage for completed and errored outcomes, turn lineage, queued follow-up turns, and shutdown waiting for handoffs. Extend Guardian tests to verify that strict safety stops reach the reporter while default interruptions remain silent.
GitOrigin-RevId: 0d825f6208f0250969734488881f32fd1dcd7509
## Why
Guardian scoring and cached approvals need to use the requesting turn's captured policy even when the live thread configuration changes. Newly tightened mandatory review requirements must still prevent cached approvals.
## What changed
- Pass captured turn configuration through tool lifecycle and approval review inputs, and use it to resolve Guardian policy and classifier instructions.
- Apply current reviewer and model requirements before scoring and cached approval, including rechecking restrictions after collecting score authorization.
- Count computer-use JavaScript execution attempts even when background scoring is disabled, so a synchronous call consumes the initial-call allowance.
- Retain runtime configuration snapshots when applying agent role overrides, and share Guardian policy text resolution between configuration loading and runtime publication.
## Testing
Add and extend regression coverage for captured policy instructions, reviewer restrictions, stale cached evidence, and a synchronous computer-use call followed by an adaptive turn.
GitOrigin-RevId: 24ed4a1b6ce1733ad775790f30e440da614f9cd6
## What changed
- Expose `AgentSessionReader` and `AgentRef` for read-only access to host-owned agent session membership.
- Read direct children when rendering V2 environment context, using the existing roster size limits. Refresh membership when rebuilding context after compaction, and omit the roster if the provider is absent or the read fails.
- Preserve unrecorded initial input across suspension or interruption while waiting for a roster read. Resolve the roster before advancing the compaction window.
## Testing
Add coverage for roster refreshes after compaction, unchanged environments avoiding extra reads, unavailable rosters, recoverable input during blocked reads, and stale compaction results rejected after a concurrent history replacement.
GitOrigin-RevId: 3c7e3822af09e9295d405e53dabb87b020c8f00c
## What changed
- Add `direct_only_tool_namespaces` to `TurnStartOptions`. Omission inherits the thread configuration; an empty list clears direct-only routing for that turn. Steering ignores the option.
- Persist explicit overrides in turn context and restore them when recovering an interrupted turn, including turns started by standalone tool output.
- Keep subsequent turns and spawned or resumed child agents on the thread's routing defaults.
## Testing
Add coverage for routing changes across turns in Responses and Responses Lite, recovery without carrying overrides into subsequent turns, and child-agent inheritance.
GitOrigin-RevId: cea1a997424572d4cd372cd15b098626904c6796
## What changed
Store a shared `ContextWindowIdGenerator` in `LocalAgentRuntime` and pass it into each session. Use it for both initial context window IDs and subsequent window advances, retaining UUID v7 allocation by default.
Make `AutoCompactWindow` accept caller-provided IDs instead of allocating them directly.
## Testing
Update the window boundary test to verify that advancing installs the supplied ID while preserving the first and previous window IDs.
GitOrigin-RevId: a9da4232fe6ab9a53b75e239cb412ceae0fe3216
## What changed
Introduce `ItemIdGenerator` and pass the runtime-owned generator through sessions, model clients, history, hooks, tool outputs, and memory requests. Keep UUIDv7 generation as the default and replace direct calls to `ResponseItemId::new` with the shared callable.
Preserve existing item IDs and backfill missing or empty IDs through the same generator, including forked history before reconstruction and persistence.
## Testing
Extend coverage for UUIDv7 IDs on user messages, agent messages, and additional tools, and assert that forked model context matches the backfilled items persisted to history.
GitOrigin-RevId: 0dd9ccf0f46f0f1005a6acfc740133b03ce82259
## Why
Skill discovery and metadata loading used raw filesystem handles with unrestricted reads, and cache keys distinguished filesystems without accounting for captured permissions.
## What changed
- Pass borrowed `EnvironmentAccess` accessors through skill root resolution, discovery, canonicalization, and metadata reads.
- Include captured permissions in skill snapshot and empty remote root cache keys.
- Add fixed-path watches to `EnvironmentAccess`, falling back to live discovery when read restrictions prevent using unsandboxed executor watches.
- Keep user and plugin roots under host filesystem authority independently of the selected repository executor.
## Testing
Extend remote root cache coverage to verify that changing captured permissions triggers a fresh scan and that restricted accessors decline unsandboxed watches.
GitOrigin-RevId: 97d4bfdfcba78a93fc8845773c6397d4364494e3
## Why
A model requirement can force `auto_review` even when the requested reviewer is `user`. Persisting or sending that effective value back as an explicit choice loses the original selection, so removing the requirement cannot restore it on resume.
## What changed
- Retain `requested_approvals_reviewer` separately from the effective reviewer in configuration and thread settings, with a fallback for older histories.
- Restore the requested reviewer on resume while applying current model requirements and reviewer allowlists.
- Let ordinary TUI turns, continuations, retries, and forks inherit the server's reviewer instead of echoing its effective value as an explicit request.
- Preserve a worker's requested reviewer when reloading it rather than inheriting the sender's selection.
## Testing
Extend resume coverage for explicit `auto_review`, removal of a model requirement, and a tightened reviewer allowlist. Update TUI assertions for omitted reviewer overrides and verify worker reload preserves its reviewer.
GitOrigin-RevId: d8c9c3a7b89e55e63f0e8ae210d6a87cb5547933
## Why
Uploaded audio was rejected even for audio-capable models. Invalid or expired recordings also need to be excluded from later requests so users can continue the conversation.
## What changed
- Accept uploaded audio when the selected model supports audio; otherwise, preserve valid sibling input and report the unsupported attachment before inference.
- Track successful audio decoding by model and provider, and attribute provider rejections against the exact submitted request. Preserve attachments when attribution is ambiguous.
- Persist confirmed rejected file IDs across compaction and resume, omitting them from future requests without rewriting retained user history.
- Check audio availability before remote compaction and retry once without an unambiguously rejected recording. Include guidance to remove or replace affected attachments in audio errors.
## Testing
Add unit and scenario coverage for uploaded audio across follow-up turns, compaction, cold and paginated resume, model switching, ambiguous rejections, expired files, and queued or interrupted input.
GitOrigin-RevId: e701901e7b1c0865c9f2a5918197215f549b06c0
## What changed
- Share a lazily registered runtime across threads, model discovery, and extension clients when `runtime_agent_instances` is enabled, while honoring each thread's authentication mode and credential owner.
- Bind model catalogs to the effective provider and authentication context while preserving cache policy and live API-key discovery settings.
- Resolve credentials, routing, and transport policy together for each request. Preserve proxy and TLS settings, validate runtime account selectors, and prevent pooled connections from crossing runtime identities.
- Accept supported ChatGPT subdomains when selecting the registration environment.
## Testing
Add integration coverage for shared runtime registration, dual-header and assertion-only modes, disabled and third-party providers, credential replacement, subagents, and delegated review. Add coverage for catalog cache policy and runtime-aware connection reuse.
GitOrigin-RevId: 99dd9d987c29c93597a648f6586f98ac6a932c3c
## Why
Board notifications were skipped when recipients had no active turn accepting mailbox delivery. Queue them through the ordinary agent-message path so idle recipients can receive them in a later turn.
## What changed
- Submit board notices as `Op::InterAgentCommunication` with `trigger_turn` disabled, preserving normal mailbox scheduling without reopening finalized answers.
- Hold a residency guard through dispatch of submitted agent messages to coordinate delivery with agent eviction.
- Update board tool descriptions to describe the host's notification queueing and wake policy.
## Testing
Update local and HTTP board scenarios to cover queued idle notices, delivery after a finalized answer, and mailbox delivery before a pending tool call. Extend residency coverage to verify that submission waits for the eviction gate and queued messages survive eviction.
GitOrigin-RevId: a77137fc40932f5903852e14742483844e07c9bc
## Why
Waking an evicted worker from a sibling should preserve the worker's effective permissions, including runtime grants, denials, and network restrictions that a profile name alone cannot reconstruct.
## What changed
Retain the worker's effective configuration during eviction. On sender-driven reloads, restore its permissions and approvals reviewer while keeping the current wake configuration for other settings.
## Testing
Add regression coverage comparing loaded and reloaded workers with read-only, named, and legacy permission settings. Verify that worker permissions, active profiles, and network policies survive sibling wakeups and that parent and sender permissions remain unchanged.
GitOrigin-RevId: ffc353154535362cfbfbbe2b7fc43e08b42cf9b9
## Why
Removing an executor must detach its selection even when older turn snapshots still reference it. Connection events queued for a removed attachment must not leak into a later selection of the same executor.
## What changed
- Introduce `EnvironmentAttachment` with a detach signal shared by turn snapshots and a guard owned by the selection.
- Preserve attachments across workspace and configuration changes, while giving reselections and child threads independent attachment lifetimes.
- Stop forwarding connection events on detach and discard buffered events from detached attachments.
- Activate initial attachments after `SessionConfigured`, using configured bindings for startup discovery.
## Testing
Add coverage for discarding buffered connection events on reselection and extend snapshot tests to verify immediate detachment, fresh attachments on reselection, and independent parent and child lifetimes.
GitOrigin-RevId: 6cf882e0d17a296030c13d80c6e2866c80e04638
## What changed
Add optional `contentTokenCount` metadata to `item/completed` notifications, carrying the producer-supplied token count for each completed assistant message in default and plan modes. Counts include any sampled footer and are `null` when unavailable.
Keep this telemetry separate from stored thread items and omit it from subsequent model requests. Update the protocol schemas and generated TypeScript and Python types.
## Testing
Add coverage for per-message counts, including zero, in default and plan modes; missing and malformed metadata; backward-compatible notification decoding; and exclusion from subsequent model requests.
GitOrigin-RevId: 35973037a42650fa2d7569da8e88cb81215cf971
## What changed
Expose `InheritedSessionId` so a host can supply a root session ID through `ExtensionDataInit` when starting a fresh child thread. The child retains its distinct thread ID, and the inherited session ID is persisted in rollout metadata and restored on resume.
Reject inherited session IDs for resumed, forked, or native agent threads, and reject an inherited session ID that equals the child thread ID.
## Testing
Add an integration test covering distinct child identity, inherited session metadata, and restoration after shutdown and resume.
GitOrigin-RevId: e3462433f9d8a0bba24251ee2b6d5329557ddb31
## Why
Hosts need to apply subagent-style capability restrictions without changing a thread's session attribution, agent lineage, or permission profile.
## What changed
Add the public `RestrictRootCapabilities` marker to thread startup extension data. Capture the restriction once at startup and apply it alongside the restrictions native subagents already receive. Hosts must supply the marker again when cold-resuming a restricted thread.
Use the restriction to gate user-input and plugin-install requests, async user messaging, legacy MCP tool approvals, and Full Access MCP form input. Exclude inherited user messages from Guardian's retained authorization context for restricted threads, including after cold resume.
## Testing
Add coverage for host-restricted tool registration, MCP approval rejection, Full Access form-input handling, and inherited instruction authorization after cold resume. Update handler tests to exercise the shared restriction flag.
GitOrigin-RevId: 4d6d7102a20dc747431c7511a74a204c773e8420
## Why
Host-owned runtimes skip controller rollout-budget accounting. Give hosts an optional callback to account for inference spending and signal budget exhaustion.
## What changed
- Add `AgentUsageAccounting`, `AgentUsageReport`, and `UsageAccountingDecision`, captured at startup and supported by host child spawn reservations.
- Await per-response usage reports with thread and turn attribution, including provider budget units and foreground and background compaction usage.
- Map host exhaustion to `SessionBudgetExceeded` and accounting failures to fatal errors without retrying inference. Preserve the original error for incomplete responses.
- Keep controller accounting unchanged and leave accounting disabled for host-owned runtimes without a provider.
## Testing
Add coverage for usage attribution, child accounting, budget exhaustion, nonretryable accounting failures, incomplete responses, and compaction reporting, including background usage charged once to its originating turn.
GitOrigin-RevId: 887703f50fe882497e4e8cb33259072935ec82e0
## What changed
Add `AgentRuntimeOwnership::Host` and an `AgentTurnAdmission` provider so hosts can acquire execution capacity before runtime tasks run, including root turns. Require the provider at startup and retain its execution guard for the task lifetime. Controller ownership remains the default; host ownership skips controller rollout-budget accounting, budget reminders, and subagent roster context.
Keep pending admission interruptible without blocking input submission. Report admission failures through the turn lifecycle, record accepted input before exposing the error, and unwind task setup such as review mode. Preserve recoverable input during suspension. On interruption, skip prompts that still require a `UserPromptSubmit` hook rather than recording them without inspection.
## Testing
Add integration tests for missing-provider startup cleanup, denial and immediate retry, steering during admission, cancellation, execution guard lifetime, submit-hook handling, suspension recovery, and review-mode cleanup. Add a context snapshot verifying retained input reaches the next admitted turn.
GitOrigin-RevId: 9ee85fad2ecfbfb38735bac8ef88888fb179a967
## What changed
Replace `thread_store_from_config` with `ThreadStoreBuilder`, exported through `codex_core` and `codex_core_api`, and migrate callers to the builder.
Allow hosts to register `with_additional_cleanup` for permanent deletion in local stores. The callback runs after successful agent-board cleanup and before rollout deletion, under the existing deletion locks. Document that cleanup must be idempotent and must avoid thread-store operations that reacquire those locks. In-memory stores do not invoke the callback.
Preserve the existing backend selection, startup rollout migration, and compression behavior.
GitOrigin-RevId: f2853d7de06fe12ef29451b204cf9fcbb349c359
## Why
Delegation messages containing `<source_orbit_id>` fail sender provenance parsing, leaving Guardian without the sender's instructions.
## What changed
Accept an optional `<source_orbit_id>` between `<source_thread_id>` and `<input>`, rejecting values containing `<`. Continue to derive sender authority from the source thread ID.
## Testing
Update the cross-host sender context scenario and snapshot to include orbit attribution. The scenario checks that sender evidence reaches Guardian after compaction and rollback without exposing it to the receiving agent.
GitOrigin-RevId: 463b18667384d30297245eedcd0f6bcbf683634e
## Why
`start_or_steer_turn` rejected agent messages, preventing callers from submitting follow-up work through the turn input API.
## What changed
Route `TurnInput::InterAgentCommunication` through native agent message delivery and return `TurnInputSubmission::Accepted`, without implying an immediate turn ID. These submissions request work regardless of `trigger_turn`, retain the recipient's settings, and forward turn-start options.
Wrap plaintext messages with agent context while preserving encrypted content. Reject submissions to idle recipients when the host is draining.
## Testing
Add scenario tests and snapshots covering queued-message ordering, encrypted follow-ups, preemption at reasoning boundaries, and follow-ups arriving before or after a final answer. Extend drain-gate coverage to agent submissions with parent-turn lineage.
GitOrigin-RevId: 92d49465f97bb366babbf1b1bc18a1e8a6c6ed1c
## What changed
Introduce `ContextBudgeting::Elastic` to prepare captured root conversation and Node REPL evidence without the fixed per-section request caps. Elastic preparation preserves message text and candidates for later allocation while retaining storage omission notices and legacy source deduplication.
Keep `ContextBudgeting::Fixed` as the default and use it at existing call sites.
## Testing
Add tests covering elastic root message preservation and legacy source deduplication, plus REPL text, images, and omission counts in text-only and multimodal modes.
GitOrigin-RevId: ce4fae9d725694456525a413fb511166df6f5e2c
## What changed
Replace `PreparedThreadSpawn` with `PreparedChildContext`. `CodexThread::prepare_child` now captures parent inputs from a live tool invocation without requiring a child request. Hosts choose the child's name, role, and history, bind destination services, and apply child settings.
Expose captured instructions, environments, permissions, approval settings, disabled plugins, current inheritable dynamic tools, and an execution-policy snapshot with its original managed requirements. Retain those requirements across MCP configuration refreshes so hosts can assess policy-source compatibility.
Remove `ThreadManager::create_prepared_child`; `CodexThread::create_child` handles reserved child startup on the parent's manager with invocation-bound cancellation and cleanup.
## Testing
Add coverage for execution-policy snapshots and managed requirements after MCP refresh. Update child-spawn tests to verify captured instructions and permissions, current dynamic-tool declarations, and fresh versus forked history.
GitOrigin-RevId: f15b595b44997fa70cd0c9be0e92f470e1f333e1
## What changed
Add `AgentMcpMetadataRecipient` as a thread extension that lets the host select which MCP plugin registration receives `x-codex-root-turn-id` and `x-codex-cyber-access-program` in tool-call metadata.
Require an exact match on the plugin ID, installed root, server name, and transport configuration in the `local` MCP environment. Omit both keys without host opt-in or when the registration does not match, including same-name user overrides. Send JSON null for unset values on matching registrations.
## Testing
Add unit tests for registration matching and integration coverage for host opt-in, same-name user overrides, and an unset access program.
GitOrigin-RevId: eaa44e17b29aa0bdec6f6ed9faa86b8fc931faad
## What changed
Return `CatalogModel` from model lookups, keeping metadata together with its `Bundled`, `Provider`, `ExplicitConfig`, or `Synthetic` origin through config overrides and runtime snapshots. Replace `used_fallback_model_metadata` checks with explicit `Synthetic` origin checks.
Share the underlying `Arc<ModelInfo>` with extension stores and use copy-on-write for metadata changes. Keep origin tracking outside serialized model metadata.
## Testing
Extend coverage for origin retention across cache reloads, namespaced model lookups, catalog fallback, and config overrides. Verify that step snapshots and extension stores share the same model metadata allocation.
GitOrigin-RevId: bb6130c94a7a795aa168ee24664a1dd453579fba
## Why
Creating child history before persisting its parent-child relationship can leave history that parent subtree deletion cannot discover, especially when fork startup copies history. A relationship write failure must reject the spawn before child storage is created.
## What changed
- Reserve the child thread ID and persist its spawn edge before starting the child. Propagate persistence failures to the caller.
- Keep pending relationship writes owned through caller cancellation, and wait for them to finish before closing the edge during cleanup, including when a write commits but reports an error.
- Skip edge cleanup when publication was skipped, and reject IDs belonging to running threads before publication.
## Testing
Add regression coverage for cancellation before commit or acknowledgement, errors after commit, skipped publication, and duplicate child IDs. Integration tests cover fresh children and full-history forks, verifying that failed publication leaves no child history, execution, or creation notification and preserves unrelated history during parent deletion.
GitOrigin-RevId: 6e2e3f32d9558091312651ab47aa845d7d13b4ca
Set `native_call` to `None` in the `ToolCall` and `ToolInvocation` fixtures used by the agent host invocation and spawn tests.
GitOrigin-RevId: 2a6f9ccb95d99297085a2861bb44e5ce7599715c
## What changed
Move review evidence storage, authorization snapshots, sender exchange selection,
and bounded Node REPL evidence into `codex-guardian-reviewer`. Update core to
call or re-export these APIs while retaining host-specific context rendering and
capture-mode selection.
Move the existing Node REPL evidence and text truncation tests alongside their
implementations in the reviewer crate.
GitOrigin-RevId: d851cd353cf9f31eb47ce13f43f6f935dc2f5d93
## Why
Reloading an evicted sub-agent disabled its rollout tracing, leaving later turns out of the trace. Replacement Code Mode sessions could also reuse cell IDs from earlier sessions.
## What changed
- Reattach reloaded children to the root rollout trace and emit `ThreadResumed` without duplicating `ThreadStarted`.
- Reopen existing threads during replay, preserving their identity and history while clearing stale runtime cell and terminal process mappings.
- Allocate Code Mode cell generations across sessions for both gRPC and stdio hosts to prevent ID reuse after reload.
- Record an aborted trace when session startup fails before the session loop begins.
## Testing
Add regression coverage for child eviction and reload, including a failed reload, continued inference tracing, distinct cell IDs, and preserved mail and follow-up context. Extend replay tests for history preservation and reused runtime handles, and host tests for cell IDs across session replacement and reconnection.
GitOrigin-RevId: 6c146c04b5cda9295afb7d973c0d5474b363a822
## What changed
- Add `CodexThread::create_child` to create an idle child from a live tool invocation using a host-reserved thread ID and controller.
- Add `prepare_child` and `ThreadManager::create_prepared_child` to capture inherited settings and fresh or forked history, then start the child on another manager even after the parent shuts down. Reject detached preparation when live bindings cannot be transferred.
- Add opt-in `HostToolInvocationLookup` to track live calls and reject duplicate active call IDs within a turn. Revoke invocation access when dispatch ends and clean up provisional children when startup fails or is cancelled.
## Testing
Add tests for invocation lifetime and call ID reservation, inherited policy and live bindings, detached startup with fresh and full history, and cancellation cleanup.
GitOrigin-RevId: 71f17ecb4cd7636517e675df59289a8e8c7105b8
## Why
Image files can become unavailable between turns. Model requests should reflect their current availability while preserving the original references in saved history.
## What changed
- Add opt-in availability checks through `AttachmentStore::is_resolvable`, retaining references by default and on backend or access errors.
- Check distinct file IDs concurrently for each prepared request and replace confirmed-missing images with `[image unavailable]` in messages and tool outputs.
- Apply the same handling to compaction requests, with background image checks running outside the session lock without delaying foreground turn completion.
## Testing
Add unit tests and multi-turn scenarios covering placeholders, preserved history and annotations, concurrent deduplicated checks, backend errors, and nonblocking background compaction.
GitOrigin-RevId: ec98c7014c6e6b5063d87b943d2cd66a9ce7c1e3
## What changed
Add `CodexThread::replace_dynamic_tools` to replace the tool catalog without starting a turn. Updates apply to subsequent model steps and future turns while preserving in-flight calls; an empty list clears the catalog.
Require host opt-in through `allow_persistent_dynamic_tool_updates` for persistent threads. Persist replacements before publishing them, restore the latest catalog on resume, and preserve replacements and explicit clears through compaction. Keep explicit resume overrides separate from the persisted catalog.
## Testing
Add coverage for pending calls during replacement, replacement and clearing across restart, compaction recovery, resume overrides, submission ordering after caller cancellation, host opt-in, and persistence failures.
GitOrigin-RevId: fd2634906895a9b72ae7892ddd9435dced45eccb
## What changed
- Retain captured root conversation sources until synchronous preparation applies request limits. Keep asynchronous snapshots limited to the bounded messages.
- Move approval-reason truncation and tool-description escaping and truncation from composition into preparation.
- Extract synchronous image preparation and admission into `guardian-context`, preserving the prompt token cap and model context-window checks.
GitOrigin-RevId: d3a864c77d8f16bd3e77df436d80c4d2738c43cc
## Why
Verified answers omitted because of request-size limits must be marked as missing. Legacy checkpoint messages also need to match retained excerpts after truncation so workers receive only one copy.
## What changed
Move root message preparation into `codex-guardian-context::prepare_root_context`, including handoff selection, shared message limits, legacy matching, and incomplete-context markers. Pass original legacy text into preparation and mark verified answers incomplete when oversized records are excluded.
## Testing
Add a handoff regression scenario for an ID-less checkpoint with a retained excerpt and an oversized verified answer. Assert that the worker receives one capped user message, both incomplete-evidence markers, and an incomplete authorization version.
GitOrigin-RevId: bd3f5fe164ae2fddba440e9269fd63b52e8b12f8
## What changed
- Separate native child spawn preparation from submission and move forked-history loading and filtering into `agent::history`.
- Group resolved session startup dependencies in `ThreadStartupContext` and extract helpers for effective spawn configuration and inherited environment requests.
- Share loaded-recipient message submission and capture only the content needed for communication logging, avoiding a clone of the full message.
GitOrigin-RevId: 4417ba6ca35e9f293064600f0a54932de514636f
## Why
Local administrators need to require managed configuration from a specific customer-hosted server before a session can start.
## What changed
- Add a local managed `config_server` requirement with an HTTPS base URL and optional OAuth settings. Validate endpoints and derive the bundle route as `codex/config/bundle` beneath the base URL.
- Replace the entire `config_server` block when a higher-priority requirements layer supplies one, keeping the endpoint and OAuth settings together. Reject this setting in fetched policy.
- Track the applied server through configuration snapshots, role overrides, and refreshes. Reject session startup and managed refreshes when the applied server does not match the requirement; user refreshes retain the session's managed configuration.
## Testing
Add coverage for missing, mismatched, and matching server configuration at session startup, whole-block replacement, rejection of server settings in fetched policy, and preservation across role overrides and refreshes.
GitOrigin-RevId: 51e8a1738dabdb117ae858120f6fb09ae2ff1261
## What changed
Store `RolloutItem::SessionMeta` and `RolloutItem::Compacted` payloads in `Box` values and update their producers, consumers, and test fixtures. Preserve the existing serialized rollout format.
GitOrigin-RevId: 59fcc4beb47d23160872dcb6e95ace9b142d3d11
## What changed
Add `MessageLifecycleContributor` hooks to capture extension state when local agent control publishes a message and notify contributors when the recipient commits it to history, before sampling.
Carry shared delivery state through submissions, input queues, and mailbox eviction with `PendingAgentMessage`. Notify consumption at most once per delivery, release captured state when consumed or abandoned, and drop pending mail outside queue locks. Preserve the serialized message format without republishing restored history.
## Testing
Extend the mailbox eviction test to verify that publication state survives eviction and retained messages are consumed before the first resumed model sample.
GitOrigin-RevId: 9a1f6832bd48ec646a3fd179485c095e8dcc72cc
## What changed
Expose `PromptCacheKey` through `StartThreadOptions` with three policies: retain the default session-derived key, send a custom key, or omit `prompt_cache_key` from model requests. Keep session identity headers independent of this policy.
Propagate the policy to child agents, delegated sessions, and guardian review sessions. Hosts must reapply the policy when resuming a thread from storage.
## Testing
Add coverage for all three policies across turns, including unchanged session and thread headers. Extend subagent coverage to verify inheritance of the default and omitted-key policies.
GitOrigin-RevId: f9e8ab31fcf568636f9712726760e4e9a4672428
## What changed
Default `features.multi_agent_v2.preserve_fork_prefix` to `true`, so full-history forks retain the parent's model-visible history and append child instructions. Keep `preserve_fork_prefix = false` as an explicit opt-out for instruction filtering, and update the configuration schema documentation.
## Testing
Update coverage to verify inherited prefixes across child and grandchild forks, child instruction ordering after compaction, and explicit filtering opt-outs.
GitOrigin-RevId: f14eae5b924cdeac555d112d0aba3fbbb063b0ea
## Why
Temporary environment attachments for a parent turn should not become a
subagent's persistent environments. Children also need to retain their
configured executor bindings when their runtime is evicted and reloaded.
## What changed
- Add the disabled-by-default `subagent_thread_environments` feature flag.
When enabled, both subagent implementations inherit configured thread
environments captured with the invoking step, excluding turn-only attachments.
- Track configured bindings separately from active turn attachments, preserving
pending configuration ownership and sharing completed executor startup.
- Retain configured selections and bindings across idle eviction. Reload children
using retained bindings when the parent changes workspace, while continuing to
validate current parent roots and permissions for matching workspaces.
## Testing
Extend regression coverage for configured, empty, forked, pending, and legacy
inheritance; temporary attachment removal across eviction; and reload behavior
with changed workspaces, deferred startup, and restricted permissions.
GitOrigin-RevId: 15692ecd99deb38002014b44fd859d793bd54373
## What changed
- Remove `subagent_thread_environments` and the separate configured environment bindings. Spawned agents inherit the invoking step's environment snapshot.
- Retain environment selections across child eviction without retaining executor bindings. Reload V2 children against the parent's captured environments, requiring matching environment IDs, working directories, and workspace roots while preserving permission validation.
GitOrigin-RevId: d820c63ea20f5834ed88071d16c60683f2545406
## Why
Temporary environment attachments for a parent's turn should not become a child's persistent environment configuration or survive child eviction.
## What changed
- Add the default-disabled `subagent_thread_environments` feature flag. When enabled, subagents inherit configured thread environments captured with the spawning step instead of active turn selections.
- Track configured bindings separately from turn attachments, preserving pending configuration ownership when turn selections change.
- Retain configured bindings across child eviction and reload, excluding temporary attachments. Preserve the child's workspace when the parent switches workspaces, while enforcing current roots and permissions when the parent still configures the same workspace.
## Testing
Extend coverage for both multi-agent versions, forked children, empty configured environments, pending configuration, and legacy inheritance. Add eviction and reload cases covering temporary attachments, workspace changes, deferred executor startup, and permission validation.
GitOrigin-RevId: 4533645503d5f863a9ccc064386ed7ca169d98b7
richardopenai