## Why
Starting an archived session with `codex resume` or `codex fork` stopped with
guidance to run a separate `codex unarchive` command first.
## What changed
- Detect archived-session startup failures and offer to unarchive and retry the
requested operation.
- Allow the user to cancel without modifying the archived session.
- Render the confirmation in the alternate screen when available and preserve
inline terminal context when `--no-alt-screen` is set.
- Preserve `--no-alt-screen` whether it appears before or after the `resume` or
`fork` subcommand.
## Testing
- Cover confirmation, cancellation, retry behavior, and unrelated startup
failures for both resume and fork.
- Add prompt interaction and terminal rendering coverage, including narrow and
inline viewports.
GitOrigin-RevId: 382cdbd15b5d12c091e554d6d3a2f9b3589654f4
## Why
OAuth token endpoints can report an unusable refresh token with the standard
`invalid_grant` error instead of a legacy expired, reused, or revoked subtype.
## What changed
- Classify `400 Bad Request` responses with an `invalid_grant` error code as
permanent refresh failures, preserving the generic failure reason.
- Cache that failure so subsequent refresh attempts do not repeat the request.
- Keep other `400 Bad Request` errors transient and retryable.
## Testing
Added refresh tests covering terminal `invalid_grant` responses and retryable
`invalid_request` responses.
GitOrigin-RevId: 513d34b514a7e4118a70c76e9d0fe779c006d5d8
## What changed
- Render `StrictReviewRequired` notifications as warning history cells that explain tool calls may take extra time.
- Preserve the active command and task-running state when the notification arrives.
## Testing
- Add a TUI snapshot test covering the warning and continued command output.
GitOrigin-RevId: bf01b612a22b537b247b6df6818080fc73b5414d
## What changed
- Add `Config::resolve_permission_profile` to resolve named profiles from the
effective configuration and managed requirements.
- Make active-profile network proxy lookup public and re-export
`CodexThreadSettingsOverrides` from `codex-core-api`.
- Cover configured and managed profile inheritance, duplicate-name rejection,
and preservation of managed network settings.
GitOrigin-RevId: ffb5f54a932ef1a4b624677b5f051ecdcd1134b8
## What changed
- Exclude sandboxed `exec_command` and `shell_command` calls from Guardian v2 classification by default while continuing to classify calls that request `require_escalated` permissions.
- Add `guardianv2.review_scope.sandboxed_exec_commands` to opt sandboxed shell commands back into classification.
- Keep other tools and namespaced shell tools in scope, and advance tool-call progress when a call is skipped.
## Testing
- Cover the default and configured review scopes, tool namespaces, permission modes, and skipped-call progress tracking.
GitOrigin-RevId: 32fb540c69959b9a82569f0f2fc76b5517496e6b
## What changed
- Remove `untrusted` from the CLI, configuration schema, and MCP tool interface. Explicit `approval_policy = "untrusted"` settings now fail with an actionable error.
- Remove the known-safe command allowlist. Projects marked untrusted now request approval for every command unless an explicit exec policy rule allows it.
- Keep command parsing conservative by treating in-place `sed` forms as mutating and ignoring unrecognized commands when recording memory usage.
## Testing
- Cover rejection of the retired configuration value and approval requests for commands in untrusted projects.
GitOrigin-RevId: d6bf425edddfffbb325eee6acf383434af5fd33b
## Why
The Linux sandbox represents missing protected metadata paths such as `.git`
with empty read-only directories. Repository and project discovery treated any
`.git` directory as a checkout root, so this synthetic directory could hide a
real parent repository and its trust configuration.
## What changed
- Treat a `.git` directory as repository metadata only when it contains
`HEAD`, while continuing to recognize file-based `.git` entries.
- Protect missing `.git` paths with the same read-only synthetic mounts as
other workspace metadata without disrupting parent-repository discovery.
- Canonicalize and read-only bind the synthetic-mount registry into the
sandbox, and make protected-path cleanup handle read-only directory trees.
## Testing
Added coverage for repository, project-root, trust, synthetic-mount, and
Landlock behavior, including nested incomplete `.git` directories and a
redirected `TMPDIR`.
GitOrigin-RevId: 0724c54d56531143bb28011e4ca414cd3b0212be
## What changed
- Add the opt-in `cwd_relative_turn_diffs` feature.
- When enabled, render turn diff paths relative to each selected environment's
working directory instead of the detected Git root.
- Preserve repository-root-relative paths when the feature is disabled.
## Testing
- Cover enabled and disabled behavior for nested working directories across
supported originators.
GitOrigin-RevId: 8b4908706a82b01f33ccd035b0945f9a29fce26f
## Why
Renaming a writable directory could move protected descendants outside the
paths covered by their read-only or unreadable policy entries.
## What changed
- Deny unlink-style writes to directory ancestors of protected paths, placing
these rules after broader write allowances in the generated Seatbelt policy.
- Apply full write denies to unreadable glob matches and protect their directory
ancestors against renames.
- Support brace alternation and backslash escapes when translating filesystem
globs into Seatbelt regular expressions.
## Testing
Add coverage for ancestor rename attempts across explicit read-only and deny
entries, multiple glob forms, canonicalized glob paths, and the new glob syntax.
GitOrigin-RevId: edfda9d4c2bc7ba2ecd6b67744446871e526084f
## What changed
- Use `ExecutorFileSystem::read_file_stream` for capability files and executor skill resources regardless of whether filesystem sandboxing is active.
- Enforce per-file and bundle size limits incrementally as chunks arrive.
- Preserve the existing error for Windows resources when the required filesystem sandbox is unavailable.
GitOrigin-RevId: 1a40602a8f913588ec9a6ad7edd2d62eb82436e1
## Why
Windows Terminal can discard rows scrolled through a partial DEC scroll region instead of retaining them in terminal scrollback.
## What changed
- Detect Windows Terminal, including via `WT_SESSION`, and use full-screen scrolling for inline viewport growth and history insertion.
- Keep the existing terminal-wrapped history behavior for Zellij while centralizing terminal-specific scrollback selection.
## Testing
Add VT100-backed tests covering strategy selection and preservation of scrollback during history insertion and viewport growth.
GitOrigin-RevId: 209a7a8053a1fcf911d6e0aee764e563b8725bd1
## What changed
- Initialize custom text prompts with the main composer's editor keybindings and Vim setting.
- Support Vim mode transitions, operator sequences, cursor styles, keymap contexts, and mode-aware footer hints in these prompts.
- Start Vim prompts in insert mode, use the first `Esc` to enter normal mode, and preserve `Esc` cancellation outside Vim.
## Testing
- Cover remapped editor and Vim commands, mode and context transitions, paste handling, cancellation, and footer rendering at different widths.
GitOrigin-RevId: 7a678310639dafb938084197df23d6d2a080a051
## Why
A checkout could point its `.git` file at a trusted repository's worktree
directory without proving that the repository had registered that checkout.
This could cause project configuration from an unrelated checkout to be treated
as trusted.
## What changed
- Verify the linked worktree's `gitdir` backlink, `commondir`, registered
checkout, and main checkout ownership before resolving the main repository's
trust key.
- Reject missing, oversized, symlinked, mismatched, or swapped Git metadata.
- Preserve valid linked worktrees that use path aliases, separate Git
directories, or non-UTF-8 POSIX paths.
## Testing
Add resolver and config-loading coverage for forged worktrees, metadata races,
case-sensitive paths, moved worktrees, and host MCP startup from project config.
GitOrigin-RevId: 6052a7d10ad2d613436f20175c356abdef8c758e
## Why
An authorization server discovered for an MCP server can change. A stored refresh token must not be sent to a different issuer than the one that originally granted it.
## What changed
- Persist the discovered authorization server issuer with new OAuth credentials and preserve it across refreshes.
- Validate that issuer against a single pinned metadata snapshot before refreshing or adopting stored refresh credentials.
- Require reauthentication when refresh credentials have no issuer or the issuer changed. An unexpired access token can still be used without exposing its refresh token.
## Testing
Add coverage for issuer persistence, missing and changed issuers, metadata changes during startup, and refresh-token preservation.
GitOrigin-RevId: 07e48ba892f627428a28bbed5cca4ad703e2a5fd
## Why
Deriving permissions from the parent of an already-writable patch target can
unnecessarily grant write access outside the intended workspace.
## What changed
Skip targets already covered by the active filesystem sandbox policy before
deriving additional parent-directory permissions. Targets outside the writable
area continue to request the required parent access.
## Testing
Added unit and CLI regression coverage for workspace-directory targets,
already-writable parents, and symlink escapes outside the workspace.
GitOrigin-RevId: 187109ff0b56a1a399cb8a9981b7e822977025d5
## Why
The fallback file contains OAuth credentials, so it must be private from the
moment it is created and writes must not follow links to another path.
## What changed
- Create the fallback file with mode `0600` on Unix before writing credentials.
- Reject symlinks and other non-regular files on Unix and Windows, including
Windows reparse points.
- Truncate and update an existing regular file through the validated file
handle, restoring private Unix permissions when needed.
## Testing
Added coverage for creation under a permissive umask, updates through an
existing hard link, permission restoration, and symlink rejection.
GitOrigin-RevId: d3e4be52e8f4cebb66c59d496a7f77a952a2d0d9
## What changed
- Add a `test_threads` option to `codex_rust_crate` that sets
`RUST_TEST_THREADS` for sharded integration tests when configured.
- Run the `core` and `app-server` Bazel integration tests with one Rust test
thread on macOS, leaving the thread count unchanged on other platforms.
GitOrigin-RevId: 118147413eb141f557d9ee82858860617d61acce
## What changed
- Require selected skill paths to resolve within the cloned repository and reject
symlinked path components.
- Reject special files and symlinks that escape the selected skill or resolve to
anything other than a regular file.
- Add regression tests showing that escaping symlinks are rejected while links
to regular files within the skill are installed as file contents.
GitOrigin-RevId: d4c3f09fb630dea96b34ea5552de571b36f1ceca
## Why
A model-provided shell path should select the requested shell type without
allowing that path to determine which executable Codex runs.
## What changed
- Resolve model-provided shells through Codex's normal shell discovery and
fallback logic after detecting their type.
- Keep the configured packaged zsh executable when the zsh-fork feature is
enabled and the file exists.
- Update shell, unified exec, and network approval expectations to use the
resolved local executable and arguments.
GitOrigin-RevId: ebe6f7eec2cfd1c0548d5bf1a26b7a30dba02cc2
## What changed
- Enable unprivileged user namespaces for every Linux job that uses the shared
`setup-ci` action.
- Disable AppArmor's unprivileged user namespace restriction when that sysctl is
available.
- Remove the duplicate setup from the two nextest workflow jobs.
GitOrigin-RevId: a5aebe0795ada435e687826134411c8b1c28bd98
## What changed
- Ignore Guardian warning notifications that report a successful automatic approval review, keeping approved reviews out of TUI history.
- Continue displaying all other Guardian warnings.
- Extend the approved-review history test to cover the notification path.
GitOrigin-RevId: 719e84bc5b20c0a5364d10f84be9c6ac96158719
## Why
Paste placeholders and deferred slash-command parsing can hide the meaning of an input until it is expanded or a session is configured. Draining such input as an ordinary message can accidentally treat pasted text beginning with `!` as a shell command or lose `/plan` behavior.
## What changed
- Track paste-expanded inputs that begin with `!` as literal model input through history, queue editing, retries, and startup queues.
- Defer `/plan` parsing when session or model state is unavailable, then submit it in plan mode with shell escapes disabled.
- Drain queued input only after session configuration, and keep later queued prompts pending when an initial prompt cannot be submitted.
- Suppress queue auto-send before applying a replayed thread session so input from the outgoing thread is not submitted during restoration.
## Testing
Add coverage for direct, recalled, edited, interrupted, rejected, startup-queued, and plan-mode paste flows, including placeholder collisions and rejected initial images.
GitOrigin-RevId: d482220d8df21754f166fea5b54e9945f622a978
## What changed
- Route PowerShell wrapper extraction and Windows safe-command classification through the tree-sitter lowerer.
- Compile the PowerShell AST subprocess parser only in tests, where it remains available as an oracle.
GitOrigin-RevId: 3690bc32e8987ac9de820ef39ff7401d98ea8d83
## What changed
- Register `send_user_message_async` as `DirectModelOnly` so supported models can call it directly without exposing it through code mode.
- Exercise the async message flow with a code-mode-only model configuration and verify that the tool remains directly visible.
GitOrigin-RevId: ce22d5f63471ce90ac55ae2f3d0048f6cda57e01
## Why
A sandboxed process could replace a writable directory root, changing the
authority boundary used to construct a later sandbox policy.
## What changed
- Deny unlinking or renaming directory roots granted write access by Seatbelt,
while preserving replacement and deletion behavior for writable files.
- Reject writable roots with nested symlink components and report these as
Seatbelt preparation errors instead of network proxy failures.
- Normalize writable roots before adding them to the generated Seatbelt policy.
## Testing
Add coverage for symlink rejection, error classification, directory-root
replacement and rename protection, newly created roots, and writable file
replacement.
GitOrigin-RevId: ab1ed4e55f20034bc43e028e6529d3d1f0d8181c
## Why
Environment-owned permission profiles and workspace roots must remain effective
without being persisted or restored as thread-owned settings.
## What changed
- Keep thread settings snapshots and restore data separate from the effective
configuration supplied by the primary environment.
- Use resolved environment permissions, active profiles, workspace roots, and
network policy when building turn context and session events.
- Preserve environment selections when agents are evicted, resumed, or spawned,
and validate owner configuration when it becomes ready.
- Start memory initialization only after the primary environment is configured.
## Testing
- Extend remote-environment and multi-agent tests to cover settings persistence,
owner permission profiles, workspace roots, spawning, eviction, and resume.
GitOrigin-RevId: d82f126981cd0190233020bbdd61d96c70558868
## What changed
- Stop writing `last_updated` and `last_revision` to marketplace entries in
`config.toml`; keep the activated revision in
`.codex-marketplace-install.json` instead.
- Use installed marketplace metadata to detect up-to-date checkouts.
- Snapshot the installed marketplace before activation and roll back a stale
upgrade if another installation changed the destination concurrently.
## Testing
- Verify marketplace add and upgrade operations leave `config.toml` unchanged.
- Cover restoring a newer concurrently installed marketplace when a stale
activation is rejected.
GitOrigin-RevId: 10942c3fc7c6c3f68b7d5953e8c1b5e86bf71866
## Why
The Responses API accepts tool names up to 128 bytes, but MCP tool name
normalization limited model-visible names to 64 bytes.
## What changed
- Preserve MCP tool names up to the 128-byte Responses API limit.
- Continue shortening and hashing names that exceed the limit so generated
names remain bounded and unique.
## Testing
- Cover names at the 128-byte boundary and immediately above it.
- Verify distinct long names remain 128 bytes and code-mode compatible.
GitOrigin-RevId: 75544d00e75dd0e9328b3e2ac763d26f9cc99a48
## Why
Warnings emitted while querying SQLite or acquiring a connection must not be
written back through the same SQLite log sink.
## What changed
- Disable the `sqlx::query` and `sqlx::pool::acquire` targets for the SQLite
log filter.
- Keep warnings from other `sqlx` targets so useful diagnostics remain
available.
## Testing
Extend the log filter test to verify that query and pool-acquisition warnings
are dropped while another `sqlx` warning is retained.
GitOrigin-RevId: cec9d4e07d113de8eccec7445ede0ae68e21886d
## Why
Plugin installation skips symlinks while copying a plugin into the cache. A
symlinked manifest could therefore be used during source validation but omitted
from the staged copy, allowing a lower-precedence manifest to take its place.
## What changed
- Require discoverable manifests and their parent directories to be regular
files and directories, rejecting symlinks and other non-regular entries at a
higher-precedence manifest path.
- Verify that staging preserves the selected manifest path and contents before
activating the cached plugin.
- Preserve generated fallback manifests by injecting and validating them in the
staged plugin.
## Testing
Add coverage for symlinked manifest files and directories, precedence changes,
and fallback-manifest staging.
GitOrigin-RevId: 1b69c1e75cdfecb8cab4070a32aa9739833a70de
## Why
Reducing a heredoc shell script to its inner executable lets a prefix rule for
that executable apply to the entire wrapper, even though the full script was
not parsed as a plain command.
## What changed
- Fall back to evaluating the complete shell wrapper when plain-command parsing
fails, including for heredoc scripts.
- Keep these commands sandboxed when only the inner executable is allowed.
- Propose the full wrapper as the exec policy amendment when approval is needed.
## Testing
Added exec policy, Unix escalation, and approval scenario coverage for unparsed
and heredoc shell wrappers.
GitOrigin-RevId: 8f65133acb6b7c638263917e1d9137e45990772c
## What changed
- Pass `--unshare-ipc` when building Bubblewrap arguments for both restricted-filesystem and full-filesystem sandbox paths.
- Update the Bubblewrap argument tests to cover the new namespace flag.
GitOrigin-RevId: 61fb1d5150d09626a3b6ee7a9c6a508108c52e80
## Why
The pre-trust remote lookup must not inherit Git configuration from the
repository that launched Codex, where URL rewrites can invoke custom transport
helpers during an automatic plugin sync.
## What changed
- Add a Unix regression test that runs the startup lookup from a repository
with a local `insteadOf` rewrite to an `ext` transport and verifies that the
helper is not executed.
- Reuse `OPENAI_PLUGINS_GIT_URL` for the lookup so the production command and
regression fixture target the same remote.
GitOrigin-RevId: e53af4a82a4206c31bf0f4733f908dcc064a4795
## What changed
- Add `just assemble-codex-package` as the documented entry point for the package builder.
- Export `CODEX_REPO_ROOT` from `just` and release CI, and require the package builder to use it for repository-relative inputs.
- Resolve the ripgrep and zsh manifests relative to their Python modules.
GitOrigin-RevId: 039d12107a49171f064b0119adc6b99cf97c6c1e
## Why
Repository configuration can cause even read-only Git commands to execute
helpers, so Git command arguments alone are not enough to establish trust.
## What changed
- Remove Git commands from the known-safe command classification on Unix and
Windows, including commands nested in supported shells.
- Under the `unless-trusted` approval policy, require approval for commands such
as `git status` unless an explicit execution policy rule allows them.
## Testing
- Cover direct, shell-wrapped, absolute-path, and PowerShell Git commands.
- Verify `git status` approval behavior with and without an explicit allow rule.
GitOrigin-RevId: dd04e0ddca0c56ba64ae64abe6e658bae7bf5a4d
## Why
New non-ephemeral threads have no persisted rollout or preview until their first
turn, so moving them into a section could leave them absent from section-filtered
thread lists.
## What changed
- Materialize and flush a non-ephemeral thread before applying an explicit
section move.
- Include explicitly sectioned threads with empty previews in section-filtered
queries, and update the partial indexes to cover them.
## Testing
- Add an app-server test that moves a newly started thread into and out of the
pinned section before its first turn.
- Cover empty-preview threads in recency and section-position query tests.
GitOrigin-RevId: aa3c4daf9890f06c08b93cd60f146099cbc6cfb2
## Why
Background marketplace and plugin refreshes can otherwise inherit repository-local or command-scoped Git configuration from the project that launched Codex. That configuration can redirect remotes or invoke Git helpers during an automatic operation.
## What changed
- Run automatic marketplace upgrades, plugin cache refreshes, and curated marketplace lookups with repository-scoped Git environment variables removed and a temporary trusted repository under the Codex home.
- Carry the automatic/manual trust mode through marketplace upgrades and plugin materialization.
- Preserve the caller's Git configuration for explicit marketplace upgrades, plugin installs, and refreshes.
## Testing
- Add regression coverage for repository URL rewrites, protocol helpers, command-scoped configuration, and manual Git filters.
GitOrigin-RevId: 957f45fa3bd7ce7e1b83355f276cf65dc5e99c8e
## What changed
Replace the custom `HeadTailBuffer::drain` helper with `std::mem::take` at
the output collection call site. This moves the buffered output out while
resetting the shared buffer to its default empty state.
GitOrigin-RevId: 7a93d1312f2cea0d7913a5264eeb01726b45e0ea
## What changed
- Select user and agent summary items using the materialized `item_type` column.
- Fall back to the type in `item_json` when `item_type` is empty so rows written by older clients still produce the correct summary.
## Testing
- Extend the summary materialization test to cover items inserted without a stored item type.
GitOrigin-RevId: 45ca1107900e9b8d46561cea210a27ecd661cedc
## What changed
- Emit `codex_control_tool_call_event` for built-in control tools such as
`request_user_input`, `update_plan`, `view_image`, and goal tools.
- Record correlation and timing metadata plus completed, failed, rejected, or
interrupted outcomes, and include these calls in turn-level tool counts.
- Keep tool arguments out of control-tool analytics events.
## Testing
- Extend the app-server turn profile test to cover successful and failed
control tools, event correlation, turn counts, and argument exclusion.
GitOrigin-RevId: c20f73dfb79654e31b4b5040eddb0e0d91cae10d
## What changed
- Add a focused Code Mode integration test with Guardian transcript images enabled and enhanced Node REPL transcripts disabled.
- Verify that the Guardian request and parent request omit both the screenshot and its surrounding transcript markers.
- Remove this configuration from the broader parameterized transcript-evidence test.
GitOrigin-RevId: 1309de12337a28a7e1d49eca509ba73207d4d9be
## What changed
Move circular-value coverage for the `text()` helper from the core integration
suite to the in-process code mode runtime tests. Verify that stringification
returns no content and surfaces the V8 circular-structure error without needing
a mock server or network access.
GitOrigin-RevId: d506591af5ae8ce0a8c7305d633a7b0f2e458335
## What changed
Update the unified image budget integration test to resize a `6401x1` image to
`6000x1` and verify that the model receives the corresponding resize notice.
GitOrigin-RevId: 401e9728dc4bd6f0122bbc62f996a0b961e22b3a
## What changed
- Keep validating normalized dynamic tool visibility for both Responses and Responses Lite.
- Exercise the normalized dynamic tool call and its returned metadata only for Responses Lite.
- Let the standard Responses case complete in a single mocked response without expecting a dynamic tool request.
GitOrigin-RevId: 7793e6f6df07fc58c2976a773a1198496af08dfd
## What changed
Stop setting explicit one-second `timeout_ms` and `yield_time_ms` values in the
mock command calls. The shell command and unified exec variants now use their
default timing behavior while testing cyber exec policy.
GitOrigin-RevId: b1c25304ca47e7b08f023fe678467fc00330158b
## What changed
Use a 2049-by-32 image in the Guardian transcript evidence test and verify that
it is resized to 2048-by-32 while preserving its aspect ratio.
GitOrigin-RevId: 4b1b404c0fc76c46739379ef154e629bf8d669f3
## What changed
- Parameterize `HeadTailBuffer` by a const `MAX_BYTES` value and derive its
head and tail budgets from that value.
- Keep `UNIFIED_EXEC_OUTPUT_MAX_BYTES` as the default capacity for production
call sites.
- Update focused buffer tests to select their smaller capacities through the
type parameter.
GitOrigin-RevId: 106e81a2c2db935f7f77a4f301ef591017958287
## What changed
- Co-locate the Bash and zsh snapshot-script tests with
`codex-shell-command`, where `snapshot_script` is implemented.
- Add `tempfile` as a dev dependency for the relocated tests.
- Keep the higher-level snapshot lifecycle tests in `codex-core`.
GitOrigin-RevId: 6d5e9ab95962722f7c89ea40512bd70ee81d8da2
## What changed
- Move the Guardian thread lifecycle contributor and subagent-spawn context into `codex-guardian-v2`.
- Install the lifecycle contributor and asynchronous risk scorer through a single extension entry point.
- Remove the redundant `codex-guardian` crate and group the existing scorer implementation under `async_scorer`.
GitOrigin-RevId: 97141190c843e588b8c09c9ccd3fe00e1fae39a4
