## Why
An inaccessible user profile directory can prevent sandboxed PowerShell from preserving its working directory and resolving relative paths in a project beneath that profile.
## What changed
Pass `USERPROFILE` to elevated setup and refresh. When the command's working directory is beneath an absolute profile path, grant the sandbox group non-inheriting `FILE_READ_ATTRIBUTES` access to the profile directory.
Preserve existing permissions and deny ACEs during non-inheriting ACL updates without propagating changes to descendants. Expand generic deny masks when checking for conflicting permissions.
## Testing
Add a Windows regression test that checks PowerShell's working directory and reading `.\public.txt` beneath a protected profile. Add an ACL test that verifies a non-inheriting grant leaves an unprotected child's security descriptor unchanged.
GitOrigin-RevId: 7f142a7ffdee795c3255d4a6e79568fa9391c055
## What changed
- Start a turn-owned notification receiver using the same remote board client and session identity as the board tools. Deliver post previews as agent messages and cancel the receiver when the turn stops, aborts, or errors.
- Wait for the initial connection attempt before inference, then retry failed or disconnected streams without waking idle agents.
- Skip malformed notices, mismatched recipients or turns, and oversized previews. Reject delivery to stale or canceled turns and bound remote notices to a 1 KiB context budget.
## Testing
Extend remote board tests to cover interrupted setup, connection failures, reconnection, invalid and stale notices, preview delivery into model context, and receiver shutdown after turn completion.
GitOrigin-RevId: c7c8d977fe74b7a5cb3bd8216dc0146f3f297e44
## Why
`windows.allowed_sandbox_implementations` permits MXC regardless of the listed implementations. Managed requirements need a separate way to block both explicit MXC configuration and automatic selection through `prefer_mxc`.
## What changed
Add the optional managed requirement `windows.allow_mxc`. Setting it to `false` disables automatic MXC selection and rejects explicit `windows.sandbox = "mxc"` configuration with an error identifying the requirement. Leaving it unset or setting it to `true` preserves existing behavior.
## Testing
Add coverage for the requirement alongside allowed sandbox implementations, preference resolution, and cloud-managed opt-out behavior for implicit, elevated, and explicit MXC configurations.
GitOrigin-RevId: a458a7b4c92cf17e687dbbad8208884d1c097da5
## Why
Resuming a thread rereads persisted history even when a preloaded snapshot is unchanged. Reusing that snapshot must still account for writes committed before writer ownership is acquired.
## What changed
- Carry optional, non-serialized revisions from stored history and model context through thread and agent resume paths.
- Validate the revision under writer ownership and reuse the shared snapshot when it matches. Reload stored history when the revision is missing or changed, while preserving explicit history overrides.
- Resolve the selected rollout before loading context, validate compressed snapshots before materialization, and enforce archived-thread restrictions on canonical paths.
## Testing
Extend coverage for snapshot reuse and late-write refresh in legacy and paginated histories, compressed rollout reuse, archived rollout symlinks, and cold child restoration that includes edits made after preloading history.
GitOrigin-RevId: e1fd7aee6ef2b30f41951e6b7e6b01c3e1420cab
## Why
A stored history snapshot can become stale before a resumed thread acquires writer ownership. Resume must include writes committed before that acquisition.
## What changed
Make `ThreadStore::resume_thread` return the replay context and use it for session restoration and metadata initialization. The local store refreshes stored snapshots while holding writer ownership, reads through the installed writer to honor explicit rollout paths, and releases the writer if loading context fails. Explicit histories without a canonical session header retain their override semantics.
## Testing
Extend resume tests to cover edits made after the initial snapshot in both legacy and paginated history modes, stale SQLite rollout paths, and preservation of explicitly supplied history.
GitOrigin-RevId: 2361f524d324c859f5dfcf2863320e2045736c2e
## Why
User goal edits and clears need to reach the model as user instructions, including when a thread is unloaded or history is being compacted. Automatic goal lifecycle updates must not supply user authorization.
## What changed
- Add optional `origin` values of `user` and `automatic` to `thread/goal/set` and `thread/goal/clear`, and mark TUI goal requests as user actions. Omitted origins do not supply user authorization.
- Persist explicit user objective, status, and clear instructions before changing goal state. Recording failures leave goal state unchanged.
- Coordinate goal edits with thread resume, reload stored history under writer ownership, and preserve edits accepted after the compaction input snapshot.
- Update generated protocol schemas and TypeScript and Python bindings.
## Testing
Add coverage for user edits and clears on loaded and unloaded threads, concurrent path-based resume, exclusion of automatic goals from user instructions, preservation of edits during compaction, and recording failures that leave goal state unchanged.
GitOrigin-RevId: d779d7c678a0c32a6ef76975dbe5b1400d1df245
## Why
Guardian and parent requests can arrive in either order after a command yields. A shared response sequence can let parent requests consume Guardian review decisions.
## What changed
Match Guardian responses separately and drive parent responses from the latest tool output in the strict automatic network review test. Poll running sessions with `write_stdin` until the process exits, and assert that the command and network request each receive Guardian review.
GitOrigin-RevId: 21300abd65a3b2d439e8c1ea04e4429d5bd528dd
## Why
Guardian does not consume skills, but host skill discovery can block its startup or turn creation when the primary executor is offline.
## What changed
Skip plugin and skill warmup during Guardian session initialization, and use an empty host skills snapshot when building Guardian turn contexts.
## Testing
Add a regression test that discovers skills for the parent session, disconnects its primary executor, and verifies that Guardian still reviews and denies a network permission request.
GitOrigin-RevId: 3c12129721c82cb78a3fa618d6b05faea631966a
## Why
Refreshing available model descriptions changes the `spawn_agent` tool schema. Keep model choices current while preserving tool definitions and earlier conversation input.
## What changed
- Add the disabled-by-default `model_catalog_in_context` feature for multi-agent V1 and V2. When enabled and model overrides are available, move model listings from tool descriptions into developer `<model_catalog>` messages.
- Include picker-visible, compatible models with descriptions, reasoning efforts, and service tiers in a listing bounded to 1,000 bytes. Point `spawn_agent` guidance to the latest catalog.
- Append updated listings only when their rendered content changes, restore missing listings, and invalidate retained catalogs when they no longer apply.
## Testing
Extend integration coverage for V1 and V2 with the feature enabled and disabled. Verify that catalog refreshes preserve tool definitions and prior input when enabled, append the updated listing once, and retain the existing tool-description behavior when disabled. Add a request-history snapshot for the V1 opt-in path.
GitOrigin-RevId: 67b11b4ad6c35f00d0e29edf6343bb0b4804d797
## Why
`TurnAborted` could be emitted before extension abort callbacks finished, allowing consumers to observe a terminal event while lifecycle cleanup was still pending.
## What changed
Await `on_turn_abort` within task abort handling before emitting `TurnAborted`, retaining callback delivery for already-cancelled tasks. Document that `on_turn_stop` and `on_turn_abort` complete before their corresponding terminal events, if emitted.
## Testing
Add regression coverage for interrupt, conditional interrupt, and shutdown. Hold the abort callback open to verify that `TurnAborted` waits for completion, then verify that the callback runs exactly once with the expected turn ID and abort reason.
GitOrigin-RevId: f34d7e94d04c02544178dc445b85abc65a6ce499
## Why
Login shell startup can reset `PATH`, preventing commands and their children from finding bundled tools such as `rg` in executor-reported directories.
## What changed
When `login_shell_package_path` is enabled, prepend missing executor-reported directories to `PATH` inside the POSIX login shell before running the requested command. Preserve existing entries and the order of newly added directories, and export `PATH` for child commands.
Respect explicit `PATH` overrides and preserve the requested login mode when directories are unusable or `PATH` is read-only. Keep shell diagnostics and `$LINENO` aligned with the original script, including when directory names contain newlines. The feature remains disabled by default.
## Testing
Add shell tests for nested tool lookup, existing entries, quoting, line numbers, and read-only `PATH`. Extend remote execution tests to cover feature gating, explicit overrides, unusable directories, and preservation of the original command in execution events.
GitOrigin-RevId: 301aa34e72cc6292293693250e190c19903f390a
## Why
Responses overload and exhausted-request errors could terminate despite server retry advice, and WebSocket-to-HTTP fallback could issue a request before the advised deadline.
## What changed
- Allow `ServerOverloaded` and `RetryLimit` errors to retry when server advice is present, within the configured retry budgets.
- Preserve `Retry-After` headers from rejected WebSocket upgrades and wait for the server deadline before falling back to HTTP.
- Keep quota, usage-limit, and policy failures terminal even when they include retry advice.
## Testing
Add coverage for HTTP overload and rate-limit recovery, WebSocket upgrade rejection and fallback timing, retry deadline preservation through error mapping, and retry limits for sampling and manual and automatic compaction.
GitOrigin-RevId: 72d30a9f078652664754dfa971fd7dc7a78f20e8
## What changed
Forward explicit `cyberAccessProgram` selections for the built-in OpenAI provider when both `api_key_cyber_access_programs` and `api_key_model_discovery` are enabled. The new feature defaults to disabled and can be toggled through the app server's experimental feature enablement API.
Reject explicit selections in OpenAI API-key sessions when either feature is disabled, instead of silently omitting the program. Leave entitlement and model restrictions to the server, and preserve the requested program when a server rejection triggers transport retries.
## Testing
Add app-server coverage for both feature gates, forwarding all three program values, and server rejection without fallback. Update core coverage for API-key resumes with disabled features and custom-provider omission.
GitOrigin-RevId: aa639afb841aa651b28f6f3f61198299372baa2d
## Why
Persistence and aggregate metadata budgets can omit tool-call observations that are still relevant to the current request, including tool result metadata needed during compaction.
## What changed
- Retain live direct-call observations separately from bounded persisted outputs, keyed by response item ID so reused call IDs cannot mix results.
- Restore those observations for sampling and compaction, pruning them only when sampling confirms they have left the history window. Preserve observations across shortened compaction retries.
- Remove aggregate prompt metadata caps while retaining per-call argument limits and the outgoing message size limit. Invalidate cell completeness when argument normalization truncates a recorded call.
## Testing
Add regression coverage for exhausted persistence budgets, reused call IDs and reversed completion order, shortened compaction retries, and completeness after argument truncation. Extend integration coverage for large Code Mode metadata, provider metadata support, and fork/resume behavior.
GitOrigin-RevId: 004082b69bff9cc8b05f36d1052057f163c67f07
## What changed
- Instrument MCP OAuth loads, saves, deletes, fallback cleanup, and refresh persistence with credential-free storage metrics, distinguishing configured policy from operations on a pinned store.
- Retain the originating client across background tasks, blocking storage operations, and session recovery, including recovery after startup found no credentials.
- Preserve typed keyring and lock error categories for metrics and remove raw error details from storage warnings.
## Testing
Add tests for policy and pinned-store outcomes, best-effort cleanup failures, wrapped lock errors, and successful or failed refresh persistence without duplicate observations. Add recovery tests that verify client attribution after anonymous startup and across threads with different originators.
GitOrigin-RevId: 5ea4528bcdcf500c8ffdf1d9c7008ea52112c726
## Why
Elevated sandbox tests share machine-local Windows accounts. Concurrent setup can rotate account passwords between another test's setup and logon.
## What changed
- Add a shared file-lock guard for elevated sandbox tests in `codex-core`, `codex-exec-server`, and `codex-windows-sandbox`, held through sandbox commands and cleanup.
- Queue these tests in a single-threaded Nextest group before their timeouts start, while retaining the file lock to coordinate other test processes.
- Limit account locking to tests that use elevated accounts and remove the sandbox crate's blanket Bazel `exclusive-if-local` tag.
GitOrigin-RevId: 26d4606cb1fdcac65926d29835bed4eac04c19c0
## Why
Denied-read policies previously kept explicitly approved commands within their original filesystem restrictions, preventing operations that need broader write access, such as updating Git metadata.
## What changed
- Apply broader filesystem permissions after approval of explicit escalation while retaining the sandbox, denied reads, and network policy. Command allow rules alone do not widen filesystem access.
- Reject escalation when the required local sandbox is unavailable or a remote exec server lacks support for preserving the restrictions.
- Track escalated terminal access so subsequent `write_stdin` calls still require review when stdin approval is enabled.
## Testing
Add coverage for approved and denied escalation, allow rules, remote server compatibility, and stdin approval before input delivery. Add a Windows integration test verifying that an approved `git pull` updates Git metadata while exact-path and glob-based read denials remain enforced. Serialize Windows sandbox integration tests across processes to protect shared test account credentials.
GitOrigin-RevId: 5dce6d41487ee4d39bd795c8d086398ab9794d5b
## What changed
Preserve catalog `multi_agent_version` values instead of forcing V1, allowing models that declare V2 to use it by default. Retain Ultra in supported reasoning levels so it appears in the Astra advanced reasoning picker for Bedrock Mantle and Runtime.
## Testing
Add coverage for preserving configured multi-agent versions, selecting V2 and exposing `collaboration.spawn_agent` and `collaboration.followup_task` without the V2 feature flag, and displaying and selecting Ultra in both Bedrock reasoning pickers.
GitOrigin-RevId: 4fb1336c79b3f86ce12fa5ea81fe2237a300840d
Add `gpt-6.1-sol` to the bundled model catalog with its capabilities,
reasoning levels, and availability message. Give it the highest catalog
priority and update older Sol descriptions to reflect their generations.
Update startup, model picker, and tool catalog snapshots to reflect the
new default and catalog contents.
GitOrigin-RevId: 1092a0524c6d1813ddd600c31c4fd0e708294ae9
## Why
A subagent stopped by repeated Guardian denials remained interrupted without notifying its parent. The parent needs guidance to report the stop and wait for explicit user confirmation before continuing the blocked work.
## What changed
Forward `TooManyDenials` interruptions from `MultiAgentV2` children to their parents with Guardian-specific guidance to inform the user and avoid resuming or retrying until the user explicitly confirms. Preserve the child's `Interrupted` status and keep ordinary interruptions silent.
## Testing
Add integration coverage for parent notifications under `CircuitBreakAction::Strict`, silence under `CircuitBreakAction::Default`, and preservation of the child's interrupted status. Add a unit test ensuring long denial messages stay within the notification token limit while retaining the guidance.
GitOrigin-RevId: c9bb90827393068d9c92edaf0443a52e6ff57f9f
## Why
Stale thread capability roots can reconnect executors that are not selected for the current turn and shadow selected roots with the same ID.
## What changed
Filter out roots whose environments are absent from the turn snapshot before deduplication and readiness resolution. Update app-server capability tests to explicitly select the executor environments used by each turn, including after resume.
## Testing
Add regression coverage for full-access and workspace-write permissions, verifying that stale roots never connect an unselected executor, selected roots with matching IDs remain available, and turns with no environments expose no roots.
GitOrigin-RevId: afe375047cc5e8aad06df83334149510460dcdcc
## Why
`TurnComplete` can arrive before the previous turn finishes teardown, making `start_turn_if_idle` race with cleanup in the encrypted parent reply scenario.
## What changed
Submit the reply through `Op::InterAgentCommunication` so it queues through the same mailbox path as real agent messages. The scenario continues to verify that the encrypted parent reply appears exactly once in each incremental Guardian review.
GitOrigin-RevId: 3d356c274442aa839324b9425490feafacd47313
## Why
Responses prewarm can reconnect and consume scripted WebSocket replies intended for realtime conversations when both share a test server.
## What changed
- Give realtime conversations a separate scripted server in tests for runtime replacement, prompts, and voice selection.
- Disable Responses WebSocket prewarm in the audio/text round-trip test while preserving coverage of the default realtime endpoint.
- Update connection counts and request assertions to address only realtime connections.
GitOrigin-RevId: 8e3b5ac86ee80777cf94063db468c80203966999
## What changed
Add `features.multi_agent_v2.message_board_remote` with a board URL and a bearer token supplied directly or through an environment variable. When configured, use the remote board in preference to local or in-memory storage, including in ephemeral sessions, while preserving the existing board tools and session identity.
Ignore remote board settings in project-local configuration and use the runtime HTTP client and clock for remote requests.
## Testing
Add a mock-server integration test and snapshot covering an ephemeral session posting through the existing tool, with the expected bearer authentication, session identity, timestamp, and returned post.
GitOrigin-RevId: 263413d90a1ee4c0bdba8c1b08ba9f68bdd7a986
## Why
Steering and recovery requests can have different traces from the turn they join. Sampling can also finish while tools remain in flight. Tracing needs to preserve that correlation and distinguish sampling time from time spent waiting for tools.
## What changed
- Add `codex.turn_input` spans with `conversation.id` and the accepted `turn.id` for started, steered, and recovered turns.
- Add sampling, tool-blocking, and automatic and manual compaction spans with `codex.turn.phase` and conversation and turn IDs. End the sampling span before draining outstanding tools.
- Emit a `codex.mailbox_preemption` event when pending mailbox input preempts sampling.
## Testing
Add integration coverage for cross-trace steering and recovery, sampling and tool-blocking boundaries through a blocked dynamic tool, and completion or interruption. Extend mailbox preemption tests to check event emission with preemption enabled or deferred.
GitOrigin-RevId: 59893c2d463c02cbd05f5c332e5afc2351cc8b62
## Why
Configuration reloads must honor current managed restrictions without granting new enterprise MCP authority to existing sessions or overwriting newer configuration with stale snapshots.
## What changed
- Allow enterprise managed authentication only for configured MCP servers. Remove plugin `ema_auth` overlays from the schema and disable servers that still use them.
- Refresh ordinary MCP settings while preserving session settings and initially admitted enterprise registrations. Disable enterprise MCP when its registration changes, policy revokes access, or configuration loading or resolution fails; require a new session to restore enterprise authority.
- Publish refreshes only when their captured configuration is still current, with bounded retries in app-server reloads. Preserve updated managed restrictions even when a refresh is rejected.
- Finish processing other thread refreshes before `config/mcpServer/reload` reports a rejection, and document that an error can accompany partially applied changes.
## Testing
Add regression coverage for stale refreshes, bounded retries, managed-policy revocation, persistent enterprise disablement, ordinary MCP transport changes, and rejection of plugin enterprise authentication. Verify that denied enterprise servers receive no requests.
GitOrigin-RevId: 34429cd339c1ec152a2ee8697cb29f0cff5d9e5f
## Why
Turn error hooks receive only a `CodexErrorInfo` category, which omits backend metadata such as usage-limit reset times and rate-limit snapshots.
## What changed
Add borrowed `CodexErrorDetails` to `TurnErrorInput` and pass the original details through turn and compaction error notifications, alongside the existing error category.
## Testing
Add coverage for usage-limit metadata during sampling, manual compaction, and post-turn compaction, including preservation of completed answers and existing error events. Extend lifecycle tests to verify that an `InvalidImageRequest` retains its details when surfaced as `BadRequest`.
GitOrigin-RevId: 6f2058992126da0f69508ef51998e7581557deea
## Why
Providers with `model_catalog_url` could advertise bundled models absent from their catalog or reuse stale models after a failed refresh. Model metadata could also match by prefix or namespaced suffix instead of the provider's exact model ID.
## What changed
- Suppress bundled model fallback and merging for explicit provider catalogs, including when discovery is disabled.
- Require unique, non-empty catalog slugs and match metadata by exact model ID.
- Serialize explicit catalog refreshes and invalidate in-memory and persisted catalog entries after fetch failures, preventing stale cache reuse.
- Report a clear configuration error when startup has no available model, while allowing an explicitly configured `model`.
## Testing
Add regression coverage for exact model matching, hidden catalog entries, cache invalidation across restart and recovery, invalid slugs, and empty-catalog startup with and without an explicit model. Update app-server model-list expectations and verify the TUI configuration error.
GitOrigin-RevId: ac323a94178e3c48df8d4a159a86fdbac20b03a2
## Why
Skills available from both cloud and executor providers consume duplicate catalog space, leaving less room for descriptions of unique skills.
## What changed
- Prefer model-visible cloud skills over executor listings with the same `plugin:skill` name before allocating the metadata budget.
- Preserve aliases from the full visible executor inventory so filtering duplicates does not renumber remaining packages. Continue choosing full locators when they fit the budget better.
- Keep executor packages available through `skills.list` and `skills.read`, and retain executor listings when cloud skills are disabled.
## Testing
Add regression tests and a model-request snapshot covering description retention, stable aliases across turns, executor availability changes, package reads, and full-locator selection after deduplication.
GitOrigin-RevId: 477e4cf16b8968dbe61438dd5af1eca9cbfa78c8
## Why
Responses stopped by `content_filter` previously followed generic stream-error retry handling without guidance about the block. Retried requests need instructions to explain the limitation and offer a permitted alternative.
## What changed
- Recognize content-filter failures as a distinct error while preserving retryability and the existing public error representation.
- Append developer guidance to the conversation after each sampling block, retaining delivered output and using the existing retry handling.
- Support a model catalog override through `model_messages.content_filter_guidance`. Missing, null, blank, or values exceeding 512 UTF-8 bytes fall back to bundled guidance.
- The bundled guidance tells the model to avoid reproducing or working around blocked content, briefly explain the limitation, offer a permitted alternative, and continue unrelated authorized work.
## Testing
Add a scenario and request-history snapshot covering repeated blocks, catalog guidance on each retry, retained partial output, and eventual completion. Add error-mapping assertions for retryability, public error classification, and error text.
GitOrigin-RevId: ba0c201b3a5a3acf5cfa971332027240e0690225
## Why
Sessions can share an analytics client while using different product SKUs. Analytics requests need per-thread attribution to reflect each session's configuration.
## What changed
- Register each thread's `apps_mcp_product_sku` and send `X-OpenAI-Product-Sku` on analytics requests grouped by product, without changing authentication.
- Send product groups concurrently while preserving event order within each group.
- Flush buffered tool events before changing or evicting their product attribution, and clear attribution when a session disables analytics.
- Bound retained thread registrations and concurrent product groups. Drop attribution when registration cannot be queued or a batch exceeds the product-group limit.
## Testing
Add tests for shared-session attribution, clearing attribution on resume with analytics disabled, buffered events across product changes, queue overflow recovery, registry limits, and concurrent delivery with preserved event order.
GitOrigin-RevId: 25a98788cd44d4a85f97ee87aadf3a6909607f6a
## Why
An offline secondary executor can stall Guardian approval revalidation while diff display setup searches for Git roots, even when the review concerns another executor.
## What changed
Use each environment's working directory as the diff display root for Guardian sessions, regardless of `CwdRelativeTurnDiffs`, so this setup does not wait for remote Git discovery.
## Testing
Add a regression test that withdraws authorization during a pending approval and disconnects an unrelated secondary executor. Verify that Guardian retries with the updated authorization and denies the request.
GitOrigin-RevId: 3661759119935c68539e9eab8df2e862987d0d92
## Why
Spawning a subagent before an environment was ready dropped the starting environment from the child's selections. The child needs to retain that environment and receive its configuration or failure when preparation finishes.
## What changed
- Pass the spawning step's environment snapshot to children, preserving ready and starting environments and configuration ownership.
- Propagate the original owner's first configuration result through descendants, applying each session's validation and leaving independently configured children unchanged.
- Preserve pending configuration waits across executor retries. Later owner updates do not overwrite the child's inherited configuration.
## Testing
Add regression coverage for fresh and forked subagents, readiness through turn-settings updates, failure propagation to children and grandchildren, child configuration precedence, and executor retries. Add a request snapshot showing a child using `wait_for_environment` before execution tools become available.
GitOrigin-RevId: a2afed740391f88d195596cfe28e418332b60d43
## What changed
Update the `guardian_handoff_delegation` snapshot to include three separate `agent_message` items interleaved with user transcript messages, with corresponding transcript numbering and message counts.
GitOrigin-RevId: cae688e00f96d9545eccd7891426cfb4948a6dbf
Refresh the Code Mode messaging snapshot to include a native `agent_message`
entry between transcript segments, with updated message and action numbering.
Adjust retained-instruction spacing in the encrypted parent reply snapshot and
refresh assertion-line metadata in both snapshots.
GitOrigin-RevId: 1ee003cfb9df89faabd2f35e9d656423f16e0501
## What changed
Add the disabled-by-default `guardian_root_handoff_context` feature to select worker-specific root evidence for Guardian reviews. Use recorded `spawn_agent`, `send_message`, and `followup_task` calls targeting a worker or its ancestors to select the three preceding root messages per handoff, plus the three latest root messages so recent cancellations remain visible before another handoff.
Preserve verified tool answers and evidence without known ordering, and retain the existing shared message cap. Fall back to the existing root context when no usable handoff window remains or the latest authorization message is a heartbeat. Update the review context revision when the selection changes.
## Testing
Add a delegation scenario and Guardian request snapshot covering ancestor handoffs, separate worker branches, cancellation visibility, and fallback after compaction removes handoff calls. Extend heartbeat coverage to exercise the new feature and verify that the latest turn's trusted skills are retained.
GitOrigin-RevId: 87dc39158f78b2b7e9f4f2e4afc653257ea12025
## Why
Guardian transcripts omitted encrypted agent messages, leaving reviews without evidence such as encrypted parent replies.
## What changed
- Carry encrypted `agent_message` items through synchronous reviews and asynchronous scoring, preserving their order, author, recipient, and ciphertext.
- Account for native messages in context budgets and omit them whole with an explicit notice when limits require it.
- Support mixed text and native messages during review admission while retaining user-content annotations.
## Testing
Add coverage for transcript ordering and budget eviction in both reviewer profiles, plus a mocked scenario verifying that an encrypted parent reply appears exactly once in each of two incremental Guardian reviews.
GitOrigin-RevId: abc2f1ce5accd83beb06f799ef9ed9d7fa2cd90a
## Why
The transcript supplied to Guardian may omit earlier user instructions, restrictions, or revoked permissions. History retrieval lets the reviewer check relevant authorization before approving actions with side effects.
## What changed
- Add the disabled-by-default `guardian_conversation_history_tools` feature. With Apps enabled, expose `user_message.search_messages` and `user_message.read_messages` through the parent's live Apps connection and conversation identity.
- Recheck the parent's current app and tool policy on each call, rejecting disabled tools and calls requiring approval.
- Add retrieval instructions that distinguish user authorization from assistant context and account for later revocations and incomplete results. Allow overrides through `auto_review.experimental_conversation_history_prompt`.
- Limit history responses to an estimated 4,000 tokens by default, configurable through `auto_review.conversation_history_max_output_tokens`, while preserving stricter parent and reviewer limits.
- Allow explicit extension registries for isolated sessions and prevent those sessions from inheriting the implicit Apps connection.
## Testing
Add scenarios covering history tool exposure, parent connection and identity reuse, custom prompts, output truncation, stricter reviewer budgets, and live permission changes on a reused reviewer. Extend configuration coverage for blank prompt overrides.
GitOrigin-RevId: 055a69b113c8548bd58e7d5618ea026ba6d1ffb1
## Why
Microsoft Store PowerShell cannot run under MXC. The existing fallback to an unpackaged PowerShell executable only applied to the elevated Windows sandbox.
## What changed
Extend local PowerShell fallback discovery to MXC in `unified_exec`, using the executor's Windows sandbox selection. Keep discovery local and automatic `-NoProfile` insertion specific to the elevated sandbox. Skip this preparation for non-Windows target paths.
## Testing
Extend command-preparation tests to cover MXC and add a Windows integration test that replaces a Store PowerShell path before launch, writes a file successfully, and verifies `windows_mxc` sandbox metadata.
GitOrigin-RevId: 6c581396525a8fec7e1fb538b3e63b0de2ddb926
## Why
Message-board notifications delivered as ordinary injected input could cause an agent to sample again after its final answer.
## What changed
Route notifications through the current turn's mailbox as `InterAgentCommunication`, checking atomically that the turn is running and still accepts mailbox delivery. Skip notifications when delivery is closed. Accepted notifications may remain in conversation history for a later turn without reopening the finalized answer or starting a new turn.
Report pending inter-agent communications as mailbox activity, while preserving priority for steering input.
## Testing
Add regression scenarios for notifications arriving before and after finalization, asserting no extra sampling and the expected notification presence in the next turn. Extend input-queue coverage to recognize already-pending mailbox activity.
GitOrigin-RevId: 41d786041b4eccc5ccf926f2f190473676a3ac2f
## Why
Startup prewarm can reconnect after its empty WebSocket connection closes,
consuming the scripted realtime session reply in the environment-key fallback
test with ChatGPT authentication.
## What changed
Use separate WebSocket servers for startup and realtime traffic, configuring
`experimental_realtime_ws_base_url` to point to the realtime server. Assert that
it receives exactly one handshake and that the handshake uses the environment
key for authorization.
GitOrigin-RevId: 0e8ba4bdd66ef8aa3c619e36454dded9dcf55444
## What changed
- Add `CodexThread::prewarm_with_history()` to prepare a WebSocket response with existing conversation history and executed-tool metadata using `generate: false`. The next turn can reuse the prepared response when its prompt extends that history and request settings match.
- Keep startup prewarming and `prewarm()` on the existing empty-input path, and skip preparation when the cached WebSocket is ready.
- Label prewarm telemetry by input mode and WebSocket continuation metrics with `after_prewarm`.
- Rename `persistent_mode_enabled` to `persistent_execution_enabled` without changing its behavior.
## Testing
Extend WebSocket coverage to check history preservation during reconnect prewarming, reuse of the prepared response on the next turn, and omission of `previous_response_id` for a non-prefix prompt.
GitOrigin-RevId: c7731541b11b2e6668027a47f37f696213268c66
## Why
Guardian reviews need to retain original evidence across parent compaction when checkpoint reuse is disabled, including after resume and rollback.
## What changed
- Make disabling `guardian_reuse_parent_compaction` select a bounded, independent review transcript while preserving thread-owned authorization.
- Keep synchronous reviews and asynchronous scoring independent of parent checkpoints, and allow reviewer sessions to continue using transcript deltas across parent compaction.
- Persist transcript entries with rollback provenance while remaining compatible with older checkpoint readers and metadata-free checkpoints.
- Exclude compaction output from the transcript and synthetic summaries from rollback turn boundaries. Use acceptance ordering to remove rolled-back evidence even when persistence order differs.
## Testing
Add regression coverage for reviewer continuity, evidence retention across compaction and resume, rollback after local and remote compaction, and checkpoint serialization compatibility.
GitOrigin-RevId: fea0852cc5537372854f4a34bacb6bfda6d13e88
## Why
Defaulting missing or unsupported display preferences to `inline` prevents clients from applying resource display defaults.
## What changed
Populate `mcpAppUi` only when a tool descriptor has a resource URI and an explicit `inline` or `fullscreen` preference. Preserve `mcpAppResourceUri` independently in tool-call events, including when `mcpAppUi` is unset, and document the behavior.
## Testing
Update integration coverage for explicit display modes, missing and unsupported preferences, and legacy resource URIs, checking tool-call events and resumed history.
GitOrigin-RevId: 4876cced068d8e464adeb265abd053d8abe667ce
## Why
Guardian needs the assistant's delivered question to interpret a user's reply. Messages sent through nested Code Mode tools must remain available as review context, and approvals based on earlier context must become stale when a new delivery is confirmed. Assistant messages do not themselves grant authorization.
## What changed
- Capture successful hosted User Messaging sends after input rewriting and before result callbacks or post-tool hooks.
- Retain bounded delivery text in acceptance order, persist it through cancellation and shutdown, and preserve it across compaction and resume with an older-client-compatible rollout encoding.
- Track assistant review context separately from user authorization, invalidating pending and cached approvals for both local and worker reviews when that context changes.
- Associate retained deliveries with the correct instruction or communication boundary during rollback.
## Testing
Add coverage for nested messaging review context, fast replies and communication ordering, shutdown persistence, stale local and worker approvals, rollout compatibility, and rollback retention.
GitOrigin-RevId: 1bc1ec9e8947560b99f4b39a42ddb9f2099f519b
## What changed
Add `Features::persistent_mode_enabled` and use it for persistent instructions and current-time reminder defaults. Enablement still requires `ReasoningEffort::Persistent`.
Change `PersistentModeState::new` to accept an explicit enablement boolean, separating instruction rendering from reasoning-effort selection.
## Testing
Update persistent-context tests to use boolean enablement while preserving coverage for instruction replacement, removal, deduplication, and retained history without a snapshot.
GitOrigin-RevId: f412b90d783438d1526956a56c11b9e66385ee0e
## Why
Long descriptions could exhaust the 4 KiB tool summary budget and hide later namespace names, limiting their visibility for tool discovery.
## What changed
- Reserve space for all namespace names before sharing the remaining budget across descriptions, including added and removed groups.
- Truncate descriptions at UTF-8 boundaries with `...`, including at the existing 250-character cap. Omit whole namespaces only when names alone exceed the budget, reserving omission notices only in that case.
- Render namespace names and descriptions without XML escaping.
## Testing
Add unit and snapshot coverage for description allocation, Unicode boundaries, namespace omissions, and empty-state notices. Add a scenario verifying that a crowded catalog retains every namespace name, allows discovery of a late namespace with its full description, and keeps the summary unchanged on follow-up.
GitOrigin-RevId: 9743cda5aa14190db22c788c9e91e1785a32682b
## Why
Private IP destinations always bypassed inherited upstream proxies, preventing their use for private networks reachable through an upstream VPN proxy.
## What changed
- Add `codex exec-server --proxy-private-ips-via-upstream`, also configurable with `CODEX_EXEC_SERVER_PROXY_PRIVATE_IPS_VIA_UPSTREAM=true`. The setting defaults to disabled.
- Allow permitted RFC 1918, carrier-grade NAT, and IPv6 unique-local destinations to use an applicable upstream proxy. Loopback and link-local destinations retain direct routing, and destination access policy still applies.
- Keep connections direct when no valid upstream proxy applies or `allow_upstream_proxy=false`. Errors after selecting an upstream proxy do not trigger a direct retry.
- Rename `ExecServerRuntimePaths` to `ExecServerRuntimeOptions` and carry the routing setting from executor startup into the managed network proxy.
## Testing
Add routing coverage for private address ranges, special-use addresses, and public targets with the option enabled and disabled. Verify that HTTP and CONNECT requests still enforce destination allowlists and denylists, and update the CLI help snapshot.
GitOrigin-RevId: b7c9cc7da0e0f545694a6521b74c9b36b7b92769
## Why
Steering an active WebSocket response previously dropped the connection and
resent the full history. Draining the response preserves the connection and
allows the follow-up request to continue with `previous_response_id`.
## What changed
- Drain WebSocket responses when steering. For models using
`use_responses_lite`, first send `response.interrupt` with
`mode: "discard_partial_items"` once the response ID is available.
- Treat `response.incomplete` with reason `interrupted` as completion with
`end_turn: false`, preserving token usage and allowing the turn to continue.
Other incomplete reasons remain errors.
## Testing
Update the steering integration test to cover completed and discarded reasoning
items, asserting connection reuse, incremental follow-up input, and token usage
from the interrupted response.
GitOrigin-RevId: bc714b713e797cf1a67e3b26ffbf7664cb92eb33
## Why
Changes in executor availability can alter cloud skill catalog rendering under a shared budget and repeat an unchanged executor catalog when it reconnects.
## What changed
- Cap cloud skills at three quarters of the metadata budget initially, leaving the remaining budget and unused cloud allowance for filesystem skills. Reduce the cloud cap only when doing so allows all skill entries to fit; description truncation alone does not trigger rebalancing.
- Persist the allocation across disconnects, compaction, and thread resume. Recompute it when the cloud inventory or total budget changes.
- Emit a short availability update when an unchanged selected-environment catalog returns and its full text remains in history. Reinject the full catalog when that text is missing.
## Testing
Add coverage for allocation stability, catalog and budget changes, omission handling, and full catalog reinjection after compaction and resume. Extend the selected capability stack test to verify reconnection avoids repeating the catalog.
GitOrigin-RevId: 839fe98024e00c4082a46e6a40675e15fd2c16c6
johnl-oai