## What changed
- Initialize item and context-window ID generators per thread, reuse the stored window on resume, and give history reconstruction a separate item generator.
- Recover item ordinals from checkpoint replacement history, guardian history, and retained context without lowering the cursor established by earlier records.
- Stamp compaction resume metadata with the next item ordinal in append order, tracking the cursor in local and in-memory thread stores.
## Testing
Extend the history ordinal test to verify that a checkpoint records the cursor at its position in a batch, excluding later allocations.
GitOrigin-RevId: 7121b747a039dc5477235078702137d1ff74e789
## What changed
Add `transcript_selected_exec_results` to synchronous Guardian elastic budgeting so selected Code Mode `exec` outputs can receive a separate token reservation and entry cap from ordinary tool evidence.
Configure selection with `nested_tool_names`. Match results against the host-recorded inventory of completed nested tool calls, including normalized tool names, even when the original `exec` call has left review history. Leave the new section's reservation at zero when omitted.
## Testing
Add coverage for recorded-inventory matching and results whose calls are missing from history. Extend the elastic budgeting scenario to verify that selected output is retained while ordinary tool output is capped.
GitOrigin-RevId: 6a8de250e36b18f2acfdab993c83c254f101ce87
## Why
MCP servers discovered on different executors can share a name. Resolving them by name alone exposes only one server and prevents tools and resources from being addressed independently.
## What changed
- Add the disabled-by-default `multi_environment_mcp` feature to expose environment-scoped servers, including multiple installations of the same plugin.
- Carry exact `McpServerKey` identities through catalogs, connections, tool calls, resources, and approval tracking. Give environment-scoped tools stable namespaces derived from their environment.
- Include `environment_id` in scoped resource listings and accept it in resource requests. Require it for environment-owned servers when multiple environments are selected.
- Preserve server ownership through hooks and use the owning environment's permissions for scoped elicitation review.
## Testing
Add coverage for same-named servers across environments, independent calls and approvals, resource selection, plugin discovery, and rejection of hook changes to the tool environment.
GitOrigin-RevId: 5593372b06a15c16aa3220faa3b19f5d3b20e67e
## What changed
- Replace free-form `AgentMessageDisplay` actions with a version `1` contract using `show`, `hide`, and `block` modes, with typed annotations, replacements, block reasons, and trusted-contact handling.
- Discard invalid or unsupported display instructions and set `moderated` to `true` when reading moderation data in Rust and the Python SDK.
- Update generated JSON schemas, TypeScript types, and Python SDK models to match the contract.
## Testing
Add coverage for display variants, tolerance of extra fields, and unsupported-version or unknown-mode fallback. Update the final-answer moderation test and add Python coverage for thread history and item notifications.
GitOrigin-RevId: ec64070002da67e8e377dccb3728806ac8b290e7
## What changed
- Add the stable `incremental_tools_legacy_gcp` feature, enabled by default, to control incremental tool declarations on regular GCP Responses independently of Amazon Bedrock.
- Mark `incremental_tools_legacy` stable and keep it disabled by default for Amazon Bedrock.
- Expose the new flag in the configuration schema.
## Testing
Update integration coverage for GCP defaults and opt-out, independent provider flags, and incremental tool declarations during remote compaction.
GitOrigin-RevId: 7acf085789d44122fd2a5da97932a8b9e93e240e
## Why
Requests that exceed the server's advertised WebSocket message size limit can fall back to HTTP without first uploading the oversized message.
## What changed
Read `x-codex-websocket-max-message-bytes` from the handshake response and check the serialized request's byte length before sending. Route oversized requests through the existing HTTP fallback. Ignore missing or invalid limits, and remove the close-code-specific wording from the size-limit error.
## Testing
Add a fallback test that advertises a one-byte limit and verifies zero WebSocket generation requests and one HTTP request.
GitOrigin-RevId: 03b42012ca77d6b046e937fef8e6335d855a1c10
## Why
A WebSocket close with code `1009` before any text arrives indicates that the request exceeds the peer's message size limit. Retrying the request over another WebSocket does not address that limit.
## What changed
- Classify these early size rejections as requiring HTTP fallback and switch transports without exhausting WebSocket retries, including during prewarming.
- Preserve ordinary stream retry behavior for size closes after any text frame and for other close codes.
## Testing
Add integration coverage for early size rejections during generation and prewarming, size closes after metadata, rate limits, or response creation, and ordinary closes.
GitOrigin-RevId: 4550d289bb414fec1faae2a195bcc635d394117b
## Why
A subagent can use a different model from its parent, with different supported access programs. Saved Daybreak choices need to resolve against the subagent's model and remain consistent throughout its turn, including compaction.
## What changed
- Resolve saved choices before native subagent turns start, preserving explicit turn overrides and applying saved toggles on later turns.
- Distinguish inherited parent programs from explicit child selections. Adapt inherited Daybreak Blue/Red selections to the child model while retaining the saved choice as the default for later turns and nested subagents.
- Validate the account associated with automatic selections and reject incompatible saved choices before sending model requests, while retaining rejected user input in conversation history.
- Require model changes to wait until the next turn when a saved Daybreak choice is present.
## Testing
Add coverage for both multi-agent spawn versions, model-specific selection, automatic compaction, WebSocket response reuse, account changes, unsupported choices, and rejected-input persistence across resume.
GitOrigin-RevId: 11971138d656600d9878187225e4d33217e68ad4
## What changed
Carry `ContextWindowId` through session metadata, compaction checkpoints, rollout recording, and thread creation instead of converting IDs to strings. Add deserialization and JSON schema support while preserving the serialized string format and legacy numeric compaction IDs.
Validate deserialized IDs as UUIDv7 values before restoring context windows, preserving the existing handling of unsupported IDs.
GitOrigin-RevId: fda329d0654f438171a955c9f75550817c32c047
## Why
Converting message content to tool output previously reduced file-backed audio to a text file ID, losing its audio type.
## What changed
- Allow `input_audio` tool output items to carry either `audio_url` or `file_id`, preserving both forms during content conversion.
- Account for file-backed tool audio in history estimates and output truncation, and prepare only inline audio data.
- Reject uploaded audio in raw function and custom tool output injection, extending the existing requirement to submit uploaded audio through typed turn input.
- Regenerate app-server schemas and TypeScript/Python types while preserving the Python inline audio class name.
## Testing
Add coverage for tool audio wire-format round trips, repeated file audio sharing text and audio output budgets, and rejection of raw uploaded audio injection across messages and tool outputs. Extend Python SDK coverage for the inline tool audio shape.
GitOrigin-RevId: f4704466e6151662d2c8b8dc3f5ca2ab2f5710a2
## Why
MCP config refreshes previously retained session app overrides, leaving connector approval changes unapplied in existing sessions.
## What changed
- Refresh explicit session `apps` overrides alongside `plugins`, allowing updated link approval settings to take effect on the next turn.
- Preserve overrides for omitted sections and restore inheritance when a section is an empty table.
- Validate app overrides and the effective app configuration, rejecting refreshes that expose invalid inherited settings.
## Testing
Add coverage for independent and combined app/plugin updates, clearing overrides, and rejecting invalid inherited app settings. Add an integration test verifying that changing a link's approval mode from `approve` to `prompt` requests approval before executing the next turn's tool call.
GitOrigin-RevId: 3fa36744a9ccd9e735e4cda7f061ccff1cf2a269
## Why
Background plugin cache refreshes fetched recommendations even when plugin recommendations were disabled.
## What changed
Pass the effective recommendation feature state into `PluginsConfigInput` and skip recommendation cache warming unless apps, plugins, and either `tool_suggest` or `recommended_plugins` are enabled. Installed-plugin cache refreshes continue independently.
Disable `tool_suggest` and `recommended_plugins` by default in core and app-server test helpers, with explicit overrides for recommendation tests.
## Testing
Update cache-warming and external-login recommendation tests to opt in explicitly. Update config RPC assertions to verify the test helpers' session flag overrides.
GitOrigin-RevId: dc04e2847c94e2b15842fcd95cc0cf1f104e1fac
## Why
Code Mode needs a way to forward mixed MCP tool results while preserving their content types and order.
## What changed
Add `content(block)` and `content(iterable)` so callers can forward tool output with `content(result.content)`. Text, image, and audio blocks become their corresponding output items; resource links and embedded resources are serialized as text. Invalid blocks and encrypted text are rejected, and iterators are closed when a block is rejected.
Share MCP block conversion and image detail types with the protocol layer, while preserving existing `image()` and `audio()` input handling.
## Testing
Add coverage for mixed content ordering, iterator behavior and cleanup, invalid blocks, image metadata, short audio clips, and output suppression after exit. Add an integration scenario verifying that MCP text and image blocks reach the model in order.
GitOrigin-RevId: 83832ec6c530dd35ea1e3373680627997c6e13c1
## Why
Remote commands can use workspace paths from a different operating system. Preparing them on the client should preserve those paths and command arguments for the execution host.
## What changed
- Build exec-server requests directly, carrying the native command and sandbox context without applying the client's sandbox transform.
- Resolve workspace permissions and runtime read access in `SandboxManager` on the execution host, including helper binaries and validated managed-network CA bundles.
- Add explicit backend selection and required platform sandbox selection, rejecting launches when the required sandbox is unavailable.
## Testing
Extend request tests to cover foreign workspace paths, Unicode arguments, and empty arguments. Extend the remote process test on Unix to verify that restricted reads allow the sandbox helper and validated CA bundle while denying an untrusted certificate file.
GitOrigin-RevId: 5fc02ac4208912ecefb80a212742389afc14ac05
## Why
When a workspace has an unreadable ancestor, PowerShell can start with `$PWD` unset and its filesystem drive at the root, breaking relative paths.
## What changed
Prefix PowerShell commands in the MXC sandbox with a guarded workaround that restores the location from the process working directory when `$PWD` is unset. Preserve locations already initialized by startup or a profile.
## Testing
Extend the MXC PowerShell integration test to cover an unreadable ancestor, checking that `$PWD` matches the process working directory, relative file access works, and the parent and sibling file remain inaccessible.
GitOrigin-RevId: 4fb067db52a7f3c6e819169016fe6bd104a277a1
## Why
User-configured model catalogs can supply Guardian prompt templates that omit policy slots or add conflicting instructions. Managed rules need a trusted template to reach the reviewer.
## What changed
- Use the bundled Guardian policy template when managed policy or additional rules are present, while preserving explicit host-provided templates.
- Remove `auto_review.extra_policy` and `auto_review.experimental_policy_template` from configuration and the schema. Warn when they are used, directing additional rules to `guardian_extra_policy` in managed `requirements.toml`.
## Testing
Add regression coverage for managed rules with user-supplied catalog templates, explicit host templates, and migration warnings for the removed settings.
GitOrigin-RevId: 7f00bfaa85051272ed70ceb2fcb64ffc297b8755
## Why
Waiting for host acceptance of a service-tier update in the submission loop can block interrupts while the host receipt is pending.
## What changed
Move the host acceptance wait out of the submission loop while keeping explicit thread settings replies pending until acceptance completes. Report handoff failures to the caller while preserving the locally committed settings, and allow a subsequent explicit request for the same tier to retry a failed handoff.
## Testing
Add a WebSocket regression test covering interrupts with pending host receipts, failure reporting, same-tier retries, and continued thread operation after startup caller cancellation.
GitOrigin-RevId: 1b27d156eba3ebb47e717a987f41f4f595635be8
## Why
Holding the session MCP gate during `tools/list` blocks other runtime access. Releasing it requires preventing stale refresh results from publishing after configuration or authentication changes.
## What changed
- Capture the Apps client under the session gate, then release the gate before fetching tools.
- Validate runtime and authentication state before publishing the shared cache and client catalog; retry a superseded refresh once.
- Wait for in-flight Apps refreshes before capturing model tools, preparing Apps calls, or shutting down the runtime.
## Testing
Add regression coverage for stale refreshes after runtime invalidation or logout, publication validation after call preparation drains, and a model step that waits for refreshed Apps tools while MCP status queries remain available.
GitOrigin-RevId: 42d4be8c4a9218933f8e3d07fc7f32f2da9cbd9d
## Why
MCP tools marked with `readOnlyHint: true` could still require approval in automatic mode when `destructiveHint` was also true.
## What changed
Give `readOnlyHint` precedence over `destructiveHint` and `openWorldHint` when deciding whether annotations require approval. Explicit prompt mode and strict automatic review continue to require their respective approval checks.
## Testing
Update unit tests for conflicting annotations, prompt mode, and strict automatic review. Extend app integration coverage to verify that read-only calls proceed while writes prompt in both automatic and writes approval modes.
GitOrigin-RevId: 11a930b857886bf41d09fd54c3a38607ae3d1b4e
## What changed
Allow GCP Responses requests to use `incremental_tools_legacy`. When enabled, tool declarations are sent through `additional_tools` inputs instead of the top-level `tools` array.
## Testing
Extend Vertex request coverage to check incremental tool declarations, including namespaces, tool search, and `exec_command`. Add GCP cases to the scenario that verifies tool catalog updates are appended without rewriting history, with incremental tools enabled and disabled.
GitOrigin-RevId: 8f4c02f8d62575e24e695d6fae0472a09625409f
## What changed
Move `ThreadMetadataBuilder` into its own module, make its fields private, and replace direct field assignments with fluent `with_*` methods. Initialize `updated_at` and `recency_at` from the creation time and default the approval mode to `OnRequest`.
Update `apply_rollout_items` to accept a boxed `ThreadMetadata` seed, keeping callers' async frames small while preserving existing database fields except for the seed rollout path. Add `build_thread_metadata` to use the state runtime's configured provider, and use `thread_id_from_rollout_path` directly for the doctor's filename fallback.
GitOrigin-RevId: a27e4c6b22832e902922dbdd60d7f5c11b4a1a83
## Why
An explicit denial from a workspace inference hook should stop the request, including retries and compaction model fallback.
## What changed
Recognize `inference_hook_denied` provider errors and preserve the provider's message, with a fallback when none is supplied. Expose the distinct `inferenceHookDenied` error through the app-server protocol and generated schemas and SDK types. Treat the denial as non-retryable during turns, compaction, and guardian review.
## Testing
Add coverage for terminal denials over HTTP, SSE, and WebSocket, error serialization and persistence in `thread/read`, and compaction failures that preserve token usage and history without retrying or falling back to another model.
GitOrigin-RevId: 2ebd480f01e52f4e6bd3db8a0f92d5814d18ccb1
## What changed
Route MCP elicitations through the standard handling paths for Xcode 26.4 clients. Remove the client-specific auto-deny flag and the synthetic acceptance of session elicitation requests without dispatching them to the client.
Simplify `request_mcp_server_elicitation` to return the optional response directly, and remove telemetry guards that depended on whether the workaround bypassed dispatch.
GitOrigin-RevId: ab540dcd67f8fa6d16c69bc7629f436e4b5aa73a
## What changed
Mark `untrusted_as_tool_output` as stable and enable it by default. Untrusted additional context, such as browser information and goal objectives, now reaches the model as `function_call_output` items in the `agent` namespace instead of user messages. Setting `features.untrusted_as_tool_output = false` preserves the message format.
## Testing
Update core, app-server, TUI, and Python SDK test expectations for the default output format. Cover context persistence, deduplication, goal continuation, and explicit opt-out behavior.
GitOrigin-RevId: 30828351e2ed584928f6055b6dcf276d8288c0fb
## Why
HTTP 400 responses with `context_length_exceeded` need to reach context-window recovery so manual compaction can retry with less history. Streaming context-window failures should end the stream immediately.
## What changed
- Map `context_length_exceeded` through the shared terminal provider error parser for HTTP 400 responses and events without an HTTP status.
- Return SSE context-window failures immediately.
- Preserve retryable handling for WebSocket errors carrying HTTP 503, even when their code is `context_length_exceeded`.
## Testing
Add coverage for WebSocket status handling and immediate SSE termination with retry headers. Update the manual compaction test to verify recovery from an HTTP 400 context-window error by dropping one history item and retrying.
GitOrigin-RevId: 56d8c831c2fad2ca1318318a3b4258fcc516d689
## Why
A `403` with `codex_workspace_access_denied` indicates that the account cannot use Codex in the selected workspace. Retrying or falling back to HTTP does not resolve that denial.
## What changed
Map `codex_workspace_access_denied` and `invalid_workspace_selected` responses to a shared workspace access denial error, and rename the error variant to reflect its broader scope. Keep workspace denials excluded from compaction model fallback.
## Testing
Extend API error mapping tests to cover the new code on `403` and preserve ordinary handling for `503`. Add WebSocket coverage verifying that an explicit workspace access denial does not trigger HTTP fallback.
GitOrigin-RevId: e601a22a0fa783a4ce5401a98ff9c8d3d9d1b074
## What changed
Recognize `content_policy_violation` in HTTP 400 responses and streamed errors as a dedicated, non-retryable error. Preserve the provider's message and available HTTP status, use a fallback message when needed, and report `CodexErrorInfo::InvalidPrompt` to clients.
End the response stream immediately on this error and stop compaction from falling back to the current model after a content policy rejection. Add redacted diagnostic output and a dedicated sampler failure reason.
## Testing
Extend coverage for HTTP and wrapped WebSocket errors, missing or blank provider messages, terminal stream failures with retry headers, and content policy rejections during local and remote compaction on model downshift.
GitOrigin-RevId: 592170ac30c07b0b303a8d5cb15bd35c8f821b55
## What changed
Recognize `access_program_not_enabled` in HTTP 403 responses and response stream errors as a dedicated, non-retryable error. Preserve HTTP diagnostic details and provider stream messages, with a default message when none is supplied.
Stop SSE streams immediately on this error and avoid triggering WebSocket fallback for explicit access program denials. Add a fixed diagnostic label for doctor output and telemetry.
## Testing
Extend coverage for HTTP and WebSocket denials, immediate SSE termination despite retry headers, and doctor diagnostic redaction.
GitOrigin-RevId: 3a41f7bb80ad5e13a87e831b458d17cdd19a4b62
## Why
HTTP 403 responses with `invalid_workspace_selected` were treated as unexpected status errors, allowing retries and compaction fallback to another model after the server rejected the selected workspace.
## What changed
Recognize the code in `detail.code` or `error.code`, falling back to the `x-error-json` header when the body has no code. Classify these 403 responses as `InvalidWorkspaceSelected` and disable retries and compaction model fallback while preserving the response details and HTTP status. Other 403 responses retain their existing retry behavior.
## Testing
Add coverage for body and header error codes, code precedence, HTTP and WebSocket retry behavior, and local and remote compaction during a model downshift.
GitOrigin-RevId: f44a3bee5ef06e601909839868ab99cea6dd7d03
## Why
Local compaction retried invalid requests and server overload errors without retry advice, and used local backoff even when the server supplied `Retry-After`.
## What changed
Use `CodexErr::retry_delay` to decide whether and when to retry local compaction. Honor the original `Retry-After` deadline when present, while retaining the configured retry limit and context-window trimming behavior.
## Testing
Add coverage verifying that manual local compaction does not retry invalid requests or overload responses without retry advice, but retries overload responses with `Retry-After`.
GitOrigin-RevId: abe6cbba661f701b97f8b1ab83b1fe86979f03c0
## Why
Approved filesystem access should make executor skills discoverable and readable for the lifetime of the grant. Turn-scoped access must not authorize persistent plugin servers or hooks, or bypass disabled-plugin policy.
## What changed
- Apply environment-specific session grants to capability discovery and refresh MCP after session grants change.
- Use a separate discovery inventory for skills with turn-scoped grants, keeping plugin servers and hooks on the session inventory. Reuse discovery results across unchanged model steps.
- Preserve disabled-plugin checks for unreadable manifests and symlinked manifest files or directories, including ancestor markers, while retaining standalone skill roots.
## Testing
Add coverage for V1 and V2 skill discovery before approval, after approval, and on the next turn; disabled-plugin ownership checks; discovery cache reuse; and session hooks surviving turn-scoped discovery failure.
GitOrigin-RevId: 929a7f8cb01f4bcfb4bee2c50ae02cd762066b2d
## Why
A pending realtime connection handshake can hold up subsequent attachment requests. Callers need to cancel obsolete attempts or limit how long they may take to establish a connection.
## What changed
- Add `RealtimeAttachmentOptions` with an optional cancellation receiver and `start_before` deadline to `Op::RealtimeConversationAttach`.
- Interrupt pending connection work and finish cleanup before acknowledging cancellation. Reject cancelled or expired requests before replacing an existing conversation, and recheck cancellation and the deadline before publishing a connection.
- Preserve a successfully published connection when cancellation arrives later. Dropping a cancellation sender whose value is `false` lets the attempt continue.
- Prepare the daemon startup test's socket directory with `codex_uds::prepare_private_socket_directory`.
## Testing
Add integration coverage for cancelling a held handshake, skipping cancelled or expired queued requests, preserving the next usable call, and releasing a pending handshake when its deadline expires without a cancellation receiver.
GitOrigin-RevId: 7144c1237bcbe3b859f10b654d919ae9ff20cbbb
## Why
Account changes during asynchronous request setup can invalidate the credentials selected for a generation request.
## What changed
- Restart HTTP request setup if the auth owner changes during the budget check.
- Validate the WebSocket connection's retained auth owner with `AuthOwner::is_current()` after budget checks.
## Testing
Add regression coverage for account switches during HTTP budget checks and external credential changes before WebSocket request setup, in both dual-header and assertion-only runtime auth modes.
GitOrigin-RevId: 7a1e1475a40aa2d34cd94f60f729ad697f3f7028
## Why
Aggregate resource listings omitted dormant MCP servers, leaving callers without their names for explicit queries.
## What changed
Include a sorted `deferredServers` list in aggregate `list_mcp_resources` and `list_mcp_resource_templates` results alongside resources from ready servers. Apply the listing filters to deferred servers and omit the field when empty. Discovery leaves dormant servers unstarted; callers can query them by passing `server` explicitly.
## Testing
Extend the resource discovery scenario for direct calls and Code Mode to verify deferred server names, confirm discovery leaves the server unstarted, and then list and read resources by server name.
GitOrigin-RevId: f95b8beb64bb1329f4ae3245e8c375614fcb3360
## What changed
Simplify the post-denial rule in the Guardian policy template: user re-approval after seeing the concrete risk sets `user_authorization` to `high`. Remove repeated qualifiers about explicit approval of the exact action and certainty that approval came from the user; the authorization scoring guidance still covers those requirements.
Update the Guardian extra-policy review snapshot to match the revised prompt.
GitOrigin-RevId: 63643222e8f9c46c9d902ac8f5d1e11d24fafe9c
## What changed
- Add `CodexThread::agent_tree_id()` to identify a loaded agent tree. The root and native children share an ID; loading a new tree produces a new ID even when reusing a persisted thread ID.
- Add `EnvironmentManager::remove_environment()` to unregister an environment while preserving existing handles and the default environment ID.
## Testing
Extend tests to check tree IDs across child creation, forks, warm reuse, and cold reloads, and to verify environment removal and re-registration.
GitOrigin-RevId: 43944ed6766374508d9862cd5d333bc4cb67c338
## What changed
Add `exec_tools_update_hint` and `exec_tools_removed_definitions_header` to `model_messages.tools.incremental_tools` and use them when rendering Code Mode catalog updates and removals.
Overrides are literal strings limited to 512 UTF-8 bytes per field. Missing, null, or oversized values use the existing bundled wording. Empty strings omit the guidance while retaining changed definitions and removal keys. Wording changes alone do not trigger catalog updates.
## Testing
Extend unit coverage for defaults, null fields, independent fallback, and UTF-8 byte limits. Add scenario assertions and a snapshot covering custom and empty wording, model switches, catalog changes, and restoration after compaction.
GitOrigin-RevId: da9e00fdb5197a2b5fa39ce533ba87c76ff3e82c
## What changed
- Cover incremental exec tool settings and catalog changes across resume, fork, tool mode switches, and compaction.
- Verify that adopting background compaction preserves live exec declarations, tool metadata updates, and retained conversation order after a model catalog refresh.
- Include an `exec` namespace in the top-level tool catalog ordering and snapshot round-trip test.
GitOrigin-RevId: 3df603b98a006abb55a5095b299080f036576242
## Why
Recovered answer history needs presentation instructions alongside the moderation flag so clients can apply the intended display behavior.
## What changed
- Add optional `display` metadata with an `action` and optional `blockType`, `cyberTrustedAccess`, and `checkTrustedContacts` fields.
- Carry display metadata through final answers, legacy events, thread history reconstruction, and legacy rollout migration.
- Expose the metadata in the app-server protocol and update generated JSON schemas, TypeScript types, and Python SDK models. Missing display fields remain compatible with existing stored moderation data; the app-server emits absent optional values as `null`.
## Testing
Extend the final-answer moderation test to cover display metadata in answer items and legacy events. Add serialization coverage for missing display data, nullable fields, and preservation of an explicit `false` value.
GitOrigin-RevId: b798a2ecc53c2a94c7659ef3d9663b3143b70a1a
## Why
Changes to nested tools should update the model's catalog without repeating the full `functions.exec` declaration or rewriting retained context.
## What changed
Pass structured exec definitions through the tool router into the session's tool world state. Enable granular updates for Responses Lite in `CodeModeOnly` when both `IncrementalTools` and `IncrementalExecTools` are enabled.
Append changed tool definitions, namespace instructions, and removals as developer messages. Keep common exec instructions and shared types frozen until compaction, then install the latest full catalog.
## Testing
Add feature-gating coverage and a scenario snapshot covering tool additions and removals, namespace instruction changes, eager/deferred transitions, re-enabling tools, retained context, and catalog restoration after compaction.
GitOrigin-RevId: bbf850d4e5018388eeb4c09345d885d776962e09
## What changed
- Honor `RuntimeAgentInstances` and the configured runtime auth mode for Analytics plan discovery and report requests to OpenAI endpoints.
- Share installation ID resolution and Codex runtime registration setup through `codex-runtime-agent-instance`.
- Preserve typed runtime authentication errors so expired credentials retain the “Sign in again to load Analytics” guidance.
## Testing
Add coverage for both runtime auth modes across regional and staging endpoints, fresh assertions for each request, sign-in guidance after bootstrap failure, redirect rejection, and invalid organization/project selectors.
GitOrigin-RevId: 50e0d959b3abd81ebe7a6a584e272f14cf52e504
## Why
Invalid assertions and paused or revoked runtime instances cannot recover through request retries or credential refresh. Permanent refresh-token failures also need to retain their sign-in error instead of becoming retryable stream errors.
## What changed
- Recognize terminal runtime denial codes in `401` and `403` response bodies and identity error headers, preserving HTTP diagnostics while stopping retries.
- Skip credential recovery for runtime denials in runtime-enabled model providers and backend requests, while preserving recovery for ordinary credential expiration.
- Propagate permanent refresh-token failures through runtime authentication as `RefreshTokenFailed` errors.
## Testing
Add coverage for body and header denials, preserved HTTP diagnostics, provider-scoped credential recovery, and cached permanent refresh failures. Complete-turn tests verify that runtime denials stop without retries or refreshes while expired credentials recover in both runtime authentication modes.
GitOrigin-RevId: 33f6f707454130e97e13f3b53e29d2c484602152
## What changed
Make `ModelRequestContributor::budget_exhausted` return an `ExtensionFuture` and await budget checks before HTTP and WebSocket generation. WebSocket warmup continues to skip budget checks.
If the account changes during the post-connect budget check, rebuild the request setup and reconnect before sending the WebSocket request.
## Testing
Update tests to cover a pending budget check that resolves to exhaustion, warmup connection reuse, and an account switch while the post-connect budget check is awaiting completion.
GitOrigin-RevId: 462c74b86a46a4b2276f901c69187fc7cbc3ff81
## What changed
Make `AgentServiceTier` reads asynchronous and have updates return a receipt for local acceptance. Await acceptance during root startup and settings updates outside state and registry locks, sharing the receipt with explicit same-tier retries.
Await shared-tier reads during child preparation, startup prewarm, and step capture. Allow cancellation while capturing a step, and keep host propagation independent of the acceptance wait.
## Testing
Extend the host-child WebSocket test to cover delayed acceptance, same-tier retries without duplicate updates, accessible settings while acceptance is pending, and tier inheritance during prewarm and subsequent steps.
GitOrigin-RevId: 0e2e1899834c37684e904c4a36e66344a0c6c7f3
## Why
An inherited turn can suppress a fork's configured developer instructions, leaving the first side-chat request without its developer policy.
## What changed
- Move shared side-conversation instructions and the history boundary into `codex-context-fragments`.
- Inject the developer policy before the user-role boundary when creating a TUI side-chat fork, while retaining the configured instructions.
- Distinguish attached and temporary policies, applying the worktree restriction only to temporary side chats.
- Add guidance to set up recurring monitors in the main chat or a new chat because temporary side chats cannot run scheduled updates.
## Testing
Add a TUI integration test that checks the first side-chat model request contains the policy and boundary. Add a core request-history snapshot covering an attached side chat that preserves inherited context, policy, and its prior answer after resuming from disk.
GitOrigin-RevId: 889cb317dc3327457cd9ef0879ec9f77dbfaeeba
## Why
Guardian Decisions requests used bearer keys directly, bypassing runtime authentication. Memory startup quota checks used the app-level auth manager instead of the thread's provider auth context.
## What changed
- Bind Decisions credentials to runtime authentication and use route-aware HTTP clients with sensitive header protection. Preserve workload identity credentials, reuse the saved-login runtime binding, and isolate explicit API key bindings.
- Select the staging Decisions endpoint when the ChatGPT environment is staging.
- Use the thread's `ProviderAuthContext` for memory startup and quota checks, preserving account-bound network policy and applying runtime authentication.
- Keep custom destinations independent of runtime assertions.
## Testing
Add regression tests for dual-header and assertion-only authentication, fresh Decisions assertions, saved versus explicit credential isolation, workload identity, staging routing, redirect header protection, and memory quota authentication with custom destinations.
GitOrigin-RevId: 27bc7821a1cad1f5d1d2a71680527ea91ace95db
## Why
An open WebSocket can remain usable after its runtime is paused. Runtime-authenticated requests need a fresh handshake to revalidate access before submitting more work.
## What changed
- Reconnect before each runtime-authenticated Responses request and skip speculative preconnection. Preserve turn routing when the runtime identity is unchanged.
- Open a fresh connection for each runtime-authenticated Guardian classification instead of prewarming or reusing pooled sockets.
- Preserve HTTP fallback for unsupported upgrades and connection failures, while propagating authentication, authorization, rate-limit, and policy errors.
## Testing
Add regression coverage for pause and unpause behavior, credential changes, fresh assertions, and Guardian HTTP and WebSocket transports in both runtime authentication modes.
GitOrigin-RevId: 9f650147260da5cbbf5bb23dfff0af095fff3955
## Why
Child startup can lose remote model capabilities such as `tool_search` when the selected catalog is uninitialized or disk data is older than the parent's in-memory snapshot.
## What changed
- Initialize the final provider, auth, and originator catalog before resolving a child's startup model, then read it from memory.
- Preserve loaded catalogs, including empty responses and updates that failed to persist, without overwriting concurrent refreshes.
- Reuse catalogs across retry and WebSocket transport overrides while retaining routing and header distinctions.
## Testing
Add regression coverage for child tool search with warm, cold, and disabled caches; failed cache writes; concurrent refreshes; empty catalogs; and Guardian reviewer catalog reuse.
GitOrigin-RevId: 01d995a65b623cc7d6f26e2dc9b6e8cf380de782
## Why
Stale saved grants or malformed rules can cause valid network denials to be discarded. A failed rule write can also leave the in-memory policy inconsistent with native enforcement.
## What changed
- Add a helper to derive MCP network policy from controller and environment policies, permission profiles, approval settings, and saved rules. Preserve managed restrictions and conservatively deny traffic that requires review, request hooks, or DNS checks the metadata cannot express.
- Retain valid saved denials when grants violate managed constraints or a rule batch is malformed.
- Serialize runtime updates and persistence, publishing denials before the write so they remain effective if saving fails. Publish saved grants after a successful write.
- Extract validation of listener settings for running proxy updates.
## Testing
Add coverage for policy composition, mixed-executor local binding, native proxy denial parity, stale grants, malformed denials, failed persistence, and compatibility with trusted MCP servers without policy negotiation support.
GitOrigin-RevId: ef00632acb48a51fc582f18d20a3e713f953a191
## What changed
Gate `incremental_tools_legacy` on the `amazon-bedrock` and
`amazon-bedrock-runtime` provider IDs instead of the OpenAI provider for regular
Responses requests. Responses Lite continues to use `incremental_tools`.
## Testing
Expand the tool catalog update scenarios to cover both Bedrock provider IDs with
legacy incremental tools enabled and disabled. Update the regular Responses tool
removal scenario to use the Bedrock provider.
GitOrigin-RevId: ad0ff31975166a2a7fdcee6fefc272ecc79dd448
Ruslan Nigmatullin