## What changed
Allow `model_catalog_url` under `[model_providers.openai]` while preserving the built-in provider's identity, authentication, and inference routing through `openai_base_url`. Reject other non-default overrides and require an HTTPS catalog URL on an allowed ChatGPT host, without embedded credentials.
Apply the same catalog override merging when checking managed provider requirements for existing threads, preserving each thread's inference endpoint even if user defaults change.
Document the required Codex catalog format, credential forwarding, and existing discovery and access restrictions.
## Testing
Add coverage for allowed and rejected catalog destinations, preservation of built-in provider settings, and managed requirement changes. Add integration coverage for API key and ChatGPT authentication that verifies separate catalog and inference routing.
GitOrigin-RevId: 4d91ada518ebd2a09cbf6ded0ddf4b11c92b77dd
## What changed
Add the default-disabled `critical_path_timing` feature to capture dependency paths for root-agent turns. Connect direct tool dispatch, execution-lock handoffs, and completed tool batches to turn timing so overlapping work shares its common history without double counting.
Omit captures for unsupported dependencies, including CodeMode, agent communication, approval review, and user waits. Settle aborted tasks before freezing timing, invalidate captures on forced teardown, and apply runtime feature changes only to future turns.
## Testing
Add coverage for serial and overlapping tool dispatch, execution-lock dependency handoffs, cancellation, unsupported paths, frozen timing after completion, and configuration refresh boundaries.
GitOrigin-RevId: 71458b654b1c4a05799886928b449c948ea33109
## Why
A pending agent-message wake can outlive an interrupt or a switch to Plan mode while model discovery is waiting. It must recheck whether it can start before consuming queued messages.
## What changed
- Revalidate reserved wakes after discovery and build the turn with the configuration selected during admission.
- Mark interrupted wake reservations as stopped so later agent messages cannot restart automatic work, while preserving queued messages for explicit turns.
- Keep finishing turns marked as running until completion is persisted, protecting their rollout writer from capacity eviction.
## Testing
Add regression tests for interrupts and Plan-mode changes during discovery, queued-message preservation, explicit follow-ups with `wake_on_agent_messages` disabled, and completion status and persistence with the feature enabled and disabled.
GitOrigin-RevId: afe1d57063a5ec491e8b16d6c62135caa69c0a3c
## What changed
- Support `model_provider = "gcp"` with a Vertex AI endpoint derived from `GOOGLE_CLOUD_PROJECT` and `GOOGLE_CLOUD_LOCATION`, defaulting to the `global` location.
- Obtain credentials through `gcloud auth application-default print-access-token` by default, and allow `base_url`, `auth`, and `http_headers` overrides under `model_providers.gcp`.
- Use a static model catalog tailored to Vertex AI, preserve function tools, namespaces, and client-side tool search, and support remote compaction V2. Disable unsupported reasoning summaries, Responses Lite, custom tools, web search, and image generation.
- Expose a `gcp` account type through the app-server protocol and generated clients without resolving credentials during account reads or requiring OpenAI authentication.
## Testing
Add coverage for endpoint resolution, configuration overrides, model catalog filtering, authenticated requests, unsupported request fields, missing credentials, account reporting across provider changes, and automatic remote compaction.
GitOrigin-RevId: 97a3158269e6dbc2605e2cf576998e09817ea12a
## Why
Incremental-tool windows recorded base instructions only at setup, so a catalog refresh for the same model could leave active instructions stale. Instruction changes need to reach the model without rewriting the existing history prefix.
## What changed
- Track model identity and instruction content independently, appending a `model_instructions` developer message when either changes. Explicitly mark replacement or removal of base instructions, and avoid repeating unchanged updates.
- Start new windows after compaction with the latest model instructions while preserving custom base instructions.
- Preserve the recorded window base during local compaction retries, including empty instructions, and rebuild current model instructions when reconstructing child context.
## Testing
Add integration tests and request snapshots for catalog refreshes, instruction removal, model switches, compaction, restart, and forks. Extend regression coverage for legacy snapshots and local compaction retries.
GitOrigin-RevId: eeca69067b4d9cd91c817732d79b4d5c1faa18b9
## What changed
- Add the disabled-by-default `executor_capability_discovery_v2` feature to acquire `capabilities/discoverV2` inventories from supporting remote executors using each selected environment's working directory and sandbox.
- Share snapshots with MCP and world-state contributors and skill providers without activating discovered plugins or publishing discovered skills to the model.
- Cache inventories by environment instance, executor session, working directory, and sandbox. Coalesce concurrent requests, refresh the cache at turn start, retry transient failures, and refresh MCP projections after recovery.
- Resolve the system skills root in the executor and pass it explicitly to capability location discovery.
## Testing
Add coverage for feature gating, unsupported executors, inert inventories, cache reuse and eviction, turn refreshes, failure recovery, executor replacement, and system skill locations.
GitOrigin-RevId: 1bdca28fa7f17622b27e2713ab3dcc0c13426889
## What changed
- Add the disabled-by-default `output_token_replay` feature to request `output.encrypted_content` from OpenAI providers.
- Preserve encrypted message and tool-call output, message and function-call status, and output-text `annotations` and `logprobs` through history and replay. Update the generated protocol schemas and SDK types.
- Strip output ciphertext from requests to other providers while retaining it in stored history, including after replay is disabled. Remove encrypted content from memory extraction inputs.
## Testing
Add integration coverage for the feature/provider combinations, metadata replay across follow-up requests, and history preservation when resuming with replay disabled.
GitOrigin-RevId: 77729a021b6771933402aebe74ece8eb39c057e2
## What changed
Pass the parent turn's `cyber_access_program` to Guardian reviewers and asynchronous classifiers. Use `daybreak_blue` for either Daybreak selection, preserve `standard`, and omit `access_programs` when no program is selected.
Capture the selection with the owning turn so asynchronous observations retain it across later turns. Resolve classifier programs using current authentication and the same provider and API-key feature policy as ordinary model requests.
## Testing
Add regression tests for program changes across reused reviewer sessions with API-key and ChatGPT authentication, snapshot and conversation classifiers at low and high risk, and enabled, disabled, and unsupported-provider API-key policies. Verify parent requests retain their selected program.
GitOrigin-RevId: 447f306df3a6bd6805464b819950690c751b04b4
## What changed
Add the disabled-by-default `guardian_trust_orchestrator_connectors` feature flag. When enabled, Guardian V2 accepts connectors with nonblank IDs from the host-owned plugin service orchestrator as a trusted source without requiring a matching user configuration declaration.
Distinguish orchestrator provenance from user configuration in trusted-tool context. Trust remains scoped to the exact server or connector identity and source; descriptions, outputs, other tools, and other connectors remain untrusted.
## Testing
Add coverage for host-owned connector context, rejection of extension-owned Apps lookalikes and blank connector IDs, source-specific trust metadata, and context token limits. Snapshot the connector approval request history.
GitOrigin-RevId: fbd87dd71110ca7b2b92d50eef02e1e739a74a02
## What changed
Support `plugins._default.enabled` with explicit per-plugin `enabled` overrides. Omission preserves existing source and account enablement; configuration cannot activate a plugin disabled at its source. Plugin settings such as remembered tool approvals inherit the default unless `enabled` is explicitly set.
Apply the policy to plugin skills, MCP servers, Apps, and hooks, including selected executor roots and runtime configuration refreshes. Preserve the latest plugin policy when adding MCP dependencies and rebuild hooks when concurrent configuration updates replace their inputs.
Report effective enablement in `plugin/list`, `plugin/installed`, `plugin/read`, and `plugin/share/list`. Remote installation still installs disabled packages, but skips MCP and Apps authentication setup without writing an enablement override.
## Testing
Add regression coverage for default inheritance and explicit overrides, source-disabled plugins, policy refreshes during active turns, disabled or malformed selected plugin roots, and remote installation authentication behavior.
GitOrigin-RevId: 83b70c5b47fc95474fec292f248683f1f887221e
## What changed
- Use the standard shell executor and remove the zsh fork escalation runtime, `codex-execve-wrapper`, and `shell-escalation` crate.
- Ignore `shell_zsh_fork` and `unified_exec_zsh_fork`, emit migration notices for legacy configuration, and warn when ignoring managed requirements for these flags.
- Keep the active session's `apply_patch` alias directory readable under restricted filesystem permissions.
## Testing
Add coverage for legacy configuration startup and shell execution, migration notice rendering, active alias directory selection, and nested `apply_patch` execution while other files in `CODEX_HOME` remain unreadable.
GitOrigin-RevId: 43af461fea32b4980550ee7237effd2bc0646ed8
## What changed
Add the `codex.tools.registered` histogram to count finalized tool registrations by `exposure` and `tool_mode`, including zero counts for empty exposure categories. Record it once per sampling request before transport retries, excluding hosted tools. These counts describe the registered inventory, not model visibility or tool reachability.
## Testing
Add an integration test covering a stream retry, direct and deferred namespace tools, a model-only tool, and hosted web search. Verify that registrations are recorded once, hosted tools are excluded, and metric labels contain no tool names or descriptions.
GitOrigin-RevId: 02b450743886e3d487d6c3bcda12eb65f6d1104b
## Why
Elevated Windows sandbox tests share machine-wide accounts. Running them in the sharded core suite can consume test deadlines while shards wait for the account lock.
## What changed
Move the Windows sandbox tests into the Windows-only `windows_sandbox` integration-test binary. Update the nextest account-sharing group to select the entire binary instead of individual test names, so tests queue before their timeouts start. Keep the existing guard for coordination with other test binaries.
GitOrigin-RevId: 613925c9398b5acc8440fa34c658680f31f65c8b
## Why
Interrupting a turn or terminating a Code Mode cell can drop a pending dynamic tool handler before it publishes its completion. Cancellation needs to settle the call in live events and persisted history without allowing a late response into model context.
## What changed
- Let dynamic tool handlers observe cancellation and publish their terminal item before dispatch finishes. Calls cancelled while awaiting a response complete with a failed item and a cancellation error.
- Keep readiness, dispatch admission, registry lock waits, hooks, and output processing cancellable so cancellation can finish even when a hook is blocked.
- Report an aborted tool lifecycle outcome when cancellation interrupts dispatch, including before handler execution.
## Testing
Add regression tests for turn interruption with pending calls or blocked hooks, cell termination with persisted failure and late-response exclusion, cancellation before dispatch admission, and exactly one completion when a response races cancellation.
GitOrigin-RevId: 0112fc74c8652c91503ed5bbfb334ae2e26930ef
## Why
A delayed detach or cleanup from an older realtime conversation must not close its replacement or end the replacement's history segment. Realtime start parameters can also contain credentials in text and transport endpoints, so diagnostics should avoid exposing them.
## What changed
- Add `RealtimeConversationAttach` to report the connection attempt's result through a reply channel, using the sequential start path.
- Add `RealtimeConversationDetach` to close only the matching `realtime_session_id` after earlier starts finish. Detaching an older session leaves the replacement connected.
- Emit the previous conversation's close event before starting its replacement, and prevent stale fanout cleanup from closing or clearing the replacement's context.
- Limit `ConversationStartParams` debug output to output modality, initial item count, and protocol version.
## Testing
Add coverage for attachment completion after the handshake, stale detaches, failed replacement and retry, natural-close ordering, handoff history after replacement, and debug redaction for existing-call and WebRTC transports.
GitOrigin-RevId: 23aee6f70522f0b17e6aa9349dbbcc2ea985f233
## Why
MCP contributors need the complete executor selection to distinguish an unavailable primary executor from a ready secondary. Ready capability roots alone do not preserve pending or failed selections.
## What changed
Add `with_selected_environments` and `selected_environments` to `McpServerContributionContext`, and pass the captured selections during thread MCP resolution and model-step plugin selection. Preserve priority order and pending or failed entries. Use `None` for threadless discovery and `Some(&[])` for an explicitly empty selection.
## Testing
Add regression coverage for executor ordering with pending and failed selections, environment context in model-step plugin selection, and the distinction between absent and explicitly empty selections.
GitOrigin-RevId: 2c1222fae72c7e2c75b2f40abfad3b2048cf9316
## Why
An interrupt or turn replacement can invalidate a pending-work wakeup while its turn context is being constructed. Task startup could then recreate a turn whose reservation was no longer active.
## What changed
- Recheck that the wakeup still owns the active turn reservation immediately before calling `start_task`, and return if it does not.
- Allow the remote-control re-enrollment test up to 45 seconds for the connection following reconnect backoff.
## Testing
Add a regression test that pauses wakeup context construction, processes an interrupt, and then resumes construction. It verifies that no additional turn starts and only the initial model request is sent.
GitOrigin-RevId: c857fdd9f0fac3790d35a95a1f21a6d41977bb29
## Why
Bedrock catalogs cleared all service-tier metadata, and requests omitted every selected tier. This prevented users from selecting `ultrafast` or using tiers defined in custom catalogs.
## What changed
- Advertise `ultrafast` for `openai.gpt-6-astra` on Mantle and the `global.openai.gpt-6-astra` and `us.openai.gpt-6-astra` Runtime variants, while retaining the implicit default tier unless users select otherwise.
- Preserve custom catalog speed tiers, service-tier definitions, and defaults while continuing to normalize Bedrock web search compatibility.
- Send selected service tiers only when the Bedrock model advertises them, including `flex`.
## Testing
Add coverage for `model/list` tier discovery, custom catalog preservation, configured and per-turn HTTP request tiers, and TUI slash-command selection, toggling, and model switching.
GitOrigin-RevId: 4793e7af7b9f604a6b7812611030da6adb8acd35
## Why
Subagents spawned without forked history do not receive their parent's client-defined dynamic tools, preventing them from using those tools for delegated work.
## What changed
Add the disabled-by-default `multi_agent_v2_dynamic_tools` feature flag. When enabled, fresh V2 subagents inherit the parent's dynamic tool definitions and persist them in session metadata.
## Testing
Add coverage for V1 and V2 feature gating, tool persistence, and a fresh V2 subagent calling an inherited tool and receiving its result without inheriting parent history. Update TUI assertions and a snapshot to reflect blank-line separation and question text in recovered answers.
GitOrigin-RevId: a17a16bf5570f54ce922c1521cffb883022354f2
## What changed
- Centralize `windows-sys` at version `0.61.2` in the workspace and migrate dependent crates to it.
- Adapt Windows API calls to the updated handle, boolean, and type definitions. Replace custom handle owners with `OwnedHandle` and use `BorrowedHandle` where ownership stays with the caller.
- Add explicit wrappers for non-owning Windows handles passed between threads.
## Testing
Enable the MCP refresh cleanup test on Windows. Retain process handles to verify that a superseded MCP server stays alive during an in-flight call, exits after cancellation, and leaves the replacement running until shutdown.
GitOrigin-RevId: 86f53d9b300d13edff7154f4a7c32e34dacd2919
## Why
`TurnAborted` could be emitted before extension abort callbacks finished, allowing consumers to observe a terminal event while lifecycle cleanup was still pending.
## What changed
Await `on_turn_abort` within task abort handling before emitting `TurnAborted`, retaining callback delivery for already-cancelled tasks. Document that `on_turn_stop` and `on_turn_abort` complete before their corresponding terminal events, if emitted.
## Testing
Add regression coverage for interrupt, conditional interrupt, and shutdown. Hold the abort callback open to verify that `TurnAborted` waits for completion, then verify that the callback runs exactly once with the expected turn ID and abort reason.
GitOrigin-RevId: f34d7e94d04c02544178dc445b85abc65a6ce499
## What changed
Preserve catalog `multi_agent_version` values instead of forcing V1, allowing models that declare V2 to use it by default. Retain Ultra in supported reasoning levels so it appears in the Astra advanced reasoning picker for Bedrock Mantle and Runtime.
## Testing
Add coverage for preserving configured multi-agent versions, selecting V2 and exposing `collaboration.spawn_agent` and `collaboration.followup_task` without the V2 feature flag, and displaying and selecting Ultra in both Bedrock reasoning pickers.
GitOrigin-RevId: 4fb1336c79b3f86ce12fa5ea81fe2237a300840d
## Why
Steering and recovery requests can have different traces from the turn they join. Sampling can also finish while tools remain in flight. Tracing needs to preserve that correlation and distinguish sampling time from time spent waiting for tools.
## What changed
- Add `codex.turn_input` spans with `conversation.id` and the accepted `turn.id` for started, steered, and recovered turns.
- Add sampling, tool-blocking, and automatic and manual compaction spans with `codex.turn.phase` and conversation and turn IDs. End the sampling span before draining outstanding tools.
- Emit a `codex.mailbox_preemption` event when pending mailbox input preempts sampling.
## Testing
Add integration coverage for cross-trace steering and recovery, sampling and tool-blocking boundaries through a blocked dynamic tool, and completion or interruption. Extend mailbox preemption tests to check event emission with preemption enabled or deferred.
GitOrigin-RevId: 59893c2d463c02cbd05f5c332e5afc2351cc8b62
## Why
Turn error hooks receive only a `CodexErrorInfo` category, which omits backend metadata such as usage-limit reset times and rate-limit snapshots.
## What changed
Add borrowed `CodexErrorDetails` to `TurnErrorInput` and pass the original details through turn and compaction error notifications, alongside the existing error category.
## Testing
Add coverage for usage-limit metadata during sampling, manual compaction, and post-turn compaction, including preservation of completed answers and existing error events. Extend lifecycle tests to verify that an `InvalidImageRequest` retains its details when surfaced as `BadRequest`.
GitOrigin-RevId: 6f2058992126da0f69508ef51998e7581557deea
## Why
Microsoft Store PowerShell cannot run under MXC. The existing fallback to an unpackaged PowerShell executable only applied to the elevated Windows sandbox.
## What changed
Extend local PowerShell fallback discovery to MXC in `unified_exec`, using the executor's Windows sandbox selection. Keep discovery local and automatic `-NoProfile` insertion specific to the elevated sandbox. Skip this preparation for non-Windows target paths.
## Testing
Extend command-preparation tests to cover MXC and add a Windows integration test that replaces a Store PowerShell path before launch, writes a file successfully, and verifies `windows_mxc` sandbox metadata.
GitOrigin-RevId: 6c581396525a8fec7e1fb538b3e63b0de2ddb926
## Why
Local `apply_patch` permission checks can treat a macOS system alias and its canonical spelling as different locations, sending writes covered by temporary-directory grants for unnecessary approval.
## What changed
- Normalize trusted top-level aliases in local policy roots and patch targets, reusing a prepared matcher for permission requests and patch safety checks.
- Share alias normalization with Seatbelt and the macOS executor sandbox while preserving mutable symlinks and missing descendants.
- Preserve read-only and deny precedence, protected metadata restrictions, and remote URI matching. Propagate normalization failures from fallible permission checks.
## Testing
Add macOS regressions for multi-file patches with missing parent directories through both direct `apply_patch` calls and shell interception, asserting automatic approval and file contents. Add unit coverage for alias restriction precedence, mutable symlink preservation, missing descendants, and remote permission isolation.
GitOrigin-RevId: 0822ff951eaab728cb1ad91281745fa1b8809f15
## What changed
Add a `TestCodexBuilder::with_thread_manager` hook for configuring the thread manager before test threads start, and register an integration suite using a test `AgentControl` implementation.
The tests verify:
- Controller factory calls for new roots, forks, and cold resumes, with reuse for warm resumes and shared session identity for internal sessions.
- Child session identity, persisted parent lineage, message-board authorship, and routing of child reloads through the host controller.
- Preservation of the controller's service tier when child threads start or root starts are rejected.
- Dispatch of `spawn_agent`, `send_message`, and `list_agents` to the host controller, including propagation of its errors to tool results.
GitOrigin-RevId: bc6a6c6dbcde9ecc3ce15456aaf7a0610a14eceb
## Why
New user input during a Guardian review invalidated an in-flight approval and aborted the pending action, even when the input was only a status inquiry. Review the action again against the latest authorization evidence so it can proceed or be denied based on the updated instructions.
## What changed
- Treat stale authorization as a retryable review error within the existing attempt budget and shared deadline.
- Refresh authorization evidence for each attempt while keeping the pending action fixed, and record evidence from the completed attempt.
- Preserve cancellation and history-reset aborts, and deny approval if stale authorization exhausts the retry budget.
## Testing
Add and update coverage for parent status updates, authorization revocation, repeated updates, cancellation, history resets, and retry deadlines. Verify that refreshed reviews see the latest input and that the pending action executes exactly once only after approval.
GitOrigin-RevId: c683e2efb6f07840b99d0d34acf0d38c9ddfe9bd
## What changed
Add `ModelRequestContributor` and `ModelResponseInterceptor` to the extension API. Contributors can add filtered `client_metadata` without overwriting existing or reserved fields and create interceptors for individual requests.
Wire contributors into HTTP and WebSocket requests, distinguishing generation from warmup. Apply response interceptors in registration order before tracing and response bookkeeping so transformed output is recorded consistently. Interceptors can inspect, buffer, or transform events, with stream ownership carrying request state and cancellation.
## Testing
Add tests for metadata protection, incremental event transformation, interceptor ordering, upstream cancellation, and consistency between delivered output, traces, and WebSocket bookkeeping. Integration tests cover output gating and interruption over HTTP and WebSocket, including a contributor that bypasses gating for warmup requests.
GitOrigin-RevId: d4bc1745d2cacf8636728dbc0a58ab9f250e9392
Add a regression test that fails `exec_command` with a missing working directory, pauses command completion, and interrupts the turn before releasing completion.
Verify that the command emits exactly one start and completion, retains its failure status and launch diagnostic, and persists the completion in the rollout. Check that reconstructed history includes the failed command in the interrupted turn.
GitOrigin-RevId: 5962f0791b298ebb05e752138d02b0e0b3af4c63
## What changed
- Load `application.network` requirements at startup and explicit config/account reloads, applying local policy before authentication and cloud configuration bootstrap.
- Block traffic when policy loading fails, cancel requests that a new policy no longer permits, and reject configuration loads based on superseded policy snapshots. Local requirements edits take effect on the next explicit reload or restart.
- Bind authenticated clients to the current account and revoke them when account ownership changes. Carry policy enforcement through backend requests, realtime connections, workload identity exchanges, and code-mode gRPC streams while preserving gRPC trailers.
- Treat denied credential refreshes as policy errors without retrying them or invalidating stored credentials.
## Testing
Add regression coverage for startup restrictions, reload ordering, cancellation after restrictive or malformed requirements edits, account revocation, gRPC destination denial, workload identity cancellation, and credential preservation after denied OAuth refresh.
GitOrigin-RevId: 0cb4c720a906397e9df06675f01ecf60d741101f
## Why
Standalone web search used a default HTTP client, bypassing the configured system proxy route when `respect_system_proxy` was enabled.
## What changed
Pass the configured `HttpClientFactory` to the web search tool and create its client asynchronously for the provider's search URL using the API route policy. Export and reuse `SEARCH_ENDPOINT` so route selection and search requests use the same endpoint.
## Testing
Add an isolated regression test with environment proxies removed and a mock system proxy. Verify that standalone web search reaches the proxy and returns its result in the follow-up model request.
GitOrigin-RevId: 3b64803a777b9d1eb0ccf694e06658b0fd562129
## What changed
- Add `tools.code_mode` catalog messages for `exec`, `wait`, deferred-tool guidance, and shared MCP TypeScript definitions.
- Render `{{ default_exec_yield_time_ms }}` and `{{ image_helper }}` in `exec` descriptions while preserving runtime tool declarations and the freeform grammar.
- Resolve `wait` descriptions and parameter schemas independently, falling back to bundled parameters for invalid or unsupported schemas.
- Use the active model's Code Mode messages, including after mid-turn model changes. Missing overrides retain bundled defaults; empty text overrides suppress the corresponding text.
## Testing
Add coverage for literal template substitution, runtime section preservation, independent `wait` overrides and fallback behavior, mid-turn model changes, and a yielded cell completing through `wait` with catalog messages.
GitOrigin-RevId: e542a0cd47a7138a414871192cee47790ed1214e
## Why
Realtime WebSockets connected directly, bypassing the configured proxy policy for Voice's WebRTC sideband.
## What changed
Pass the configured `HttpClientFactory` into `RealtimeWebsocketClient` and connect through the shared `WebSocketConnector`. Add support for supplying an existing Rustls configuration to preserve custom CA handling and Windows platform trust.
## Testing
Add an integration test that enables `respect_system_proxy`, starts a WebRTC conversation, and verifies that the sideband establishes its session through an HTTP `CONNECT` proxy and closes successfully.
GitOrigin-RevId: d974c9275d7fe29f388d56a9d5d8ce0c483eb8d0
## Why
The parent could receive a Guardian decision before the review's terminal event was flushed, allowing the reviewed action to start while completion was still being saved.
## What changed
Flush the review transcript and `TurnComplete` event together before delivering completion to the parent. Clear the reviewer's active turn before delivery so the parent can immediately request another review. Skip redundant completion flushes for Guardian reviewers while retaining the existing pre-completion flush on errors and cancellation.
## Testing
Add a gated thread-store regression test covering two consecutive reviews in the same reviewer thread. Verify that each save includes `TurnComplete` and that the approved command cannot start while the save is blocked.
GitOrigin-RevId: 9274b08ddba1ea93d4fb4709bbfdc2ccaea866ab
## Why
Providers configured with `gateway_oauth` need gateway credentials alongside primary authentication for inference and model discovery.
## What changed
- Attach gateway tokens through the configured header or cookie while preserving primary authentication, including WebSocket handshake headers.
- Share gateway credential managers across matching provider instances and model discovery so they observe refreshed tokens.
- Reject authentication on gateway setup or token failures, invalid token values, and conflicting auth headers. Mark gateway headers sensitive and avoid exposing issuer error details.
- Include gateway OAuth configuration in model catalog cache identity to prevent reuse across different gateway configurations.
## Testing
Add provider and core integration tests covering combined credentials, header and cookie delivery, token refresh, shared credential state, cache isolation, and request blocking on gateway token or HTTP client initialization failures.
GitOrigin-RevId: cb74125cf7e87660967d49edacf14646cf0b99c4
## Why
Model catalog description overrides only covered `spawn_agent`, leaving the other multi-agent V2 tools with fixed descriptions.
## What changed
Extend `model_messages.tools.multi_agent` description overrides to `send_message`, `followup_task`, `wait_agent`, `interrupt_agent`, and `list_agents`. Resolve each override by tool name across namespaced, plain, and Code Mode exposure.
Missing or null descriptions retain bundled text; empty strings suppress static text without disabling tools. Preserve `spawn_agent` runtime guidance, tool schemas, and execution behavior. Descriptions follow mid-turn model changes.
## Testing
Expand integration coverage to all six tools, including missing, null, empty, and sparse overrides; plain, namespaced, and Code Mode exposure; unchanged V1 behavior; and mid-turn model changes.
GitOrigin-RevId: a2c47eb8efb28c3eeebcc6482e36c188c38a6dd1
## Why
Asynchronous score publication updated the risk score, authorization, and tool-call coverage separately. Approval checks could therefore read inconsistent evidence when deciding whether to reuse a cached score.
## What changed
Keep Guardian's cached score and observation state under one lock, and use consistent snapshots for approval checks. Publish successful scores together with their authorization and classified tool-call index. Preserve timestamp ordering, fail-closed precedence on timestamp ties, and per-call oversized-action tracking.
## Testing
Add regression coverage for rejected delayed results and timestamp ties. Add a gated integration test showing that a delayed score becomes stale after intervening tool calls, while a sufficiently fresh score permits cached approval.
GitOrigin-RevId: 8df6fafd5e0ee59aa0f78f541eac562efce3d4d0
## Why
A delegated task can omit restrictions from the sender's user messages. Guardian needs that context when reviewing actions in the receiving thread.
## What changed
- When thread-owned Guardian context is enabled, capture up to three recent local user messages when a `send_message_to_thread` delivery from `codex_app` or `codex_tui` is accepted.
- Provide a bounded snapshot to synchronous and asynchronous reviewers, with explicit notices for unavailable evidence and a reminder that historical context does not transfer permission. Keep the snapshot out of the worker prompt.
- Retain snapshots with their deliveries across replay, compaction, and rollback, and strip them from forked agent history.
## Testing
Add coverage for reviewer-only visibility, missing sender provenance, context-budget preservation, checkpoint replay and rollback, fork isolation, and input serialization that rejects harness metadata.
GitOrigin-RevId: 3870ba762aa81689713b56d4cb3b98566bffed88
## What changed
Read the static V2 `spawn_agent` description from `model_messages.tools.multi_agent.spawn_agent.description`, independently of the runtime tool namespace. Missing or null values retain the bundled description; an empty string suppresses it.
Preserve generated model guidance, local usage hints, and tool parameters when applying an override. Resolve the description from the active model so it follows mid-turn model changes.
## Testing
Add coverage for sparse and empty catalog values, preservation of generated context and outbound tool schemas, and description updates after mid-turn model changes.
GitOrigin-RevId: 96cfa180f8f374dc868e4fabc337e49380e405da
## Why
MCP requests that need human input, including browser sign-in, must be handled by the root thread. Subagents need guidance to hand these blockers to their parent without prompting the user or automatically accepting requests that require input.
## What changed
- Reject interactive MCP elicitations and tool approval prompts in subagents with guidance to ask the parent and wait before retrying.
- Recognize browser authentication and `codex_requires_user_input` metadata even when the form schema is empty, while preserving automatic permission approvals and review decisions.
- Carry user-interaction eligibility through MCP runtime creation and connection reuse, and guard prompt registration.
- Preserve connector authentication diagnostics alongside handoff guidance, subject to normal tool-output limits.
## Testing
Add unit and integration coverage for blocked subagent prompts, root browser authentication, automatic approval and review, connection reuse, and authentication diagnostic preservation and truncation. Add a request-history snapshot for browser-auth handoff guidance.
GitOrigin-RevId: 83e146b6e5c1a2a22a34681ad45615f504b3c96c
## Why
Server-level tool exposure settings apply to every connector on the apps server. Individual connectors need a way to opt out of deferred discovery without changing exposure for other apps.
## What changed
Add `apps.<connector_id>.omit_tools_from` with support for `code_mode`, `deferred`, and `direct`. Combine connector omissions with server omissions so app settings preserve server restrictions.
For example, `omit_tools_from = ["deferred"]` makes a connector's tools available without tool search, through direct calls or Code Mode as permitted by the active tool mode and remaining restrictions.
Expose the setting in the app-server protocol, JSON schemas, and generated TypeScript and Python types.
## Testing
Add integration coverage for connector-specific exposure and MCP dispatch across tool modes, server restrictions, and direct-only namespaces. Extend config tests to cover populated, absent, and empty omission lists, and add a Code Mode request-history snapshot.
GitOrigin-RevId: cc99ab290c8a878d06d8d7ccf2d1dbd7c46bfa8a
## Why
Older compaction checkpoints can lack a producer model hash. Enabling thread-owned Guardian context must accommodate those checkpoints without losing user instructions or verified answers.
## What changed
- Select review policy from each history snapshot independently of the session's evidence capture policy.
- Keep legacy review for checkpoints with missing or empty producer hashes when the transcript preserves the evidence. Preserve strict compatibility checks when review depends on retained-only evidence.
- Continue capturing retained instructions and answers during migration, while supplying legacy reviews with runtime answers and subagent reviews with root authorization evidence.
- Record producer model hashes on new compactions regardless of context mode.
## Testing
Add coverage for checkpoint migration across compaction and resume in both history storage modes, snapshot policy stability, retained-evidence preservation, and authorization revalidation for owning sessions and subagents.
GitOrigin-RevId: ec72b4a51d40729173e24ac1b53b7d516ddaa825
## Why
Disabling a connector's canonical plugin could leave its tools available when another enabled plugin contributed the same connector.
## What changed
Retain `canonical_app_id` in the remote installed-plugin cache and use ownership metadata for the current account when building connector snapshots. A disabled canonical owner now excludes its connector even when another plugin contributes it or the owner's bundle is absent from the host. Match owners by plugin name and marketplace, and ignore ownership metadata when the cache no longer matches the current authentication.
Build these snapshots through `PluginsManager` when the plugins feature is enabled; otherwise use an empty snapshot.
## Testing
Add manager coverage for combined local and canonical exclusions, marketplace matching, and authentication changes. Add an integration test showing that disabling a noncanonical contributor preserves shared calendar tools, disabling the canonical owner hides them, and clearing the exclusion restores them.
GitOrigin-RevId: ee2981d1277825fefb671dd7d1078cd7ea5c0ea5
## Why
Persisting user input received during an active turn currently blocks the next model request. Stores that support background persistence can overlap this checkpoint with inference.
## What changed
- Add `PersistContext::SteeredUserInput` and `allows_background_persistence()` so stores may enqueue these checkpoints, with durability and error reporting enforced by later flush or shutdown operations.
- Use the new context for accepted steered user input and apply the same metadata handling as turn-start persistence.
- Keep tool outputs synchronous, including in mixed input batches, and allow stores to retain synchronous persistence for all contexts.
## Testing
Add gated-store integration tests covering background user-input persistence, synchronous stores, and synchronous tool-output checkpoints. Verify that the next request includes the steered input and waits for persistence when required.
GitOrigin-RevId: c60b7b6c9b483245fd3169306bcf0de248ccdf35
## Why
Callers need to tie isolated threads to an explicit lifetime and wait for cleanup even when startup is cancelled or its result is never received.
## What changed
- Add `ThreadManager::start_thread_until` to run an isolated thread until a caller-provided future completes or the thread exits, with a `TaskTracker` covering cleanup and deregistration.
- Retain persistence and session resources across interrupted startup so cleanup can release partially initialized resources or shut down a running session using normal history rules.
- Reject resumed history and startup without explicit session isolation.
## Testing
Add integration tests for cancellation during stalled required MCP initialization, dropping an unconsumed startup result, and owner cancellation that preserves history and parent usability. Also verify that failed duplicate startup leaves the existing thread's writer intact.
GitOrigin-RevId: 47251c1b0c43821ab8f950816c6d341d39cdc823
## Why
Direct tool-call records need to stay associated with the invocation that produced each output, including when call IDs are reused. Completeness must describe the recorded call inventory, independently of tool success.
## What changed
- Attach direct-call records to outputs before they enter history, and set `tool_calls_complete` when the invocation's arguments are fully recorded.
- Bound pending recordings and retained metadata, release reservations on completion or cancellation, and invalidate pending records when capture is disabled.
- Apply request budgets to direct metadata and strip it from inference and compaction inputs when capture is disabled.
- Remove executed-call metadata from app-server raw response notifications and exclude its size from Guardian history retention budgets.
- Track call IDs that bypass dispatch so their reuse cannot incorrectly establish Code Mode completeness.
## Testing
Add regression coverage for direct-call attribution, malformed calls, metadata budgets, cancellation, configuration changes, compaction, notification filtering, and Guardian context isolation.
GitOrigin-RevId: 2ebd39c7f141d04788736491495109841656b4c0
## What changed
Add two integration scenarios for `gpt-6-astra` that snapshot request history and settings:
- A multi-turn conversation with local and plugin skills, remote compaction, and a follow-up containing an image.
- A release check combining direct collaboration calls with Code Mode shell commands, MCP calls, image viewing, and patch application, including reading back the edited file.
GitOrigin-RevId: 9b8a48a817c3dba4b139d1b0d015e8084dcb219b
## Why
Enterprise MCP authorization must remain controlled by host, user, or managed configuration. Project settings and plugin declarations must not redirect enterprise credentials or downgrade the selected authentication mode.
## What changed
- Add `auth = "ema_auth"`, shared `mcp_enterprise_managed_auth` IdP configuration, and per-plugin enterprise registration settings.
- Require enterprise registrations to come from one non-project configuration layer, preserve managed IdP precedence, and reject project overrides that change authorization or re-enable disabled enterprise servers.
- Add the disabled-by-default `use_xaa` feature flag and require non-project opt-in or a managed requirement.
- Reject plugin declarations that select `ema_auth`. Keep EMA connections unsupported and block ordinary MCP OAuth login and credential fallback for this mode.
- Extend the configuration schema and serialization for the new settings.
## Testing
Add coverage for IdP precedence, incomplete registrations, alternate credential validation, project-only opt-in, plugin self-declaration rejection, configuration round-tripping, and trusted-project attempts to downgrade enterprise auth to OAuth or ChatGPT auth.
GitOrigin-RevId: f193bdfda74208c98e496a23bf2916955b131a1c
## What changed
- Support `model_provider` and `model_providers` in managed requirements. Required selection overrides local and session configuration; each required provider definition replaces the corresponding local entry, including its authentication and headers.
- Merge provider requirement fragments before validation, preserving source-relative `auth.cwd` paths. Reject invalid cloud provider definitions before replacing the cached bundle, including unsupported Bedrock overrides.
- Expose `modelProvider` and `modelProviders` through the configuration requirements API and generated schemas. Reject writes to managed provider settings and omit their local origins, including for provider IDs containing dots.
## Testing
Add tests for requirement precedence, authentication fragment merging, path resolution, cloud cache preservation, and read-only configuration RPCs. Integration tests verify that model discovery and inference use the required gateway and ChatGPT authentication without leaking local headers, and that provider requirements survive configuration rebuilds.
GitOrigin-RevId: d1448604d4ef5662ebb5df7b693712d3b8ad6d54
jamy-OAI