## What changed
Extract shared proxy setup into `credential_snapshot_proxy()` and split POSIX startup protection and inherited credential alias checks into separate tests, each with its own temporary directory and proxy. Preserve the existing assertions.
GitOrigin-RevId: 1799526c7c649c9bacd30a8cc4fa7038e70f192d
## Why
The external queue lifecycle test waits through watcher and retry intervals,
including explicit 11-second sleeps.
## What changed
Run the test on Tokio's current-thread runtime and use `advance_queue_poll()`
to pause time, advance it by 11 seconds, and resume it at polling boundaries.
This skips interval waits while keeping the clock advancing during real I/O.
GitOrigin-RevId: 0d1c3f53cc8b79559d6a20b5c9e70b58216e4b4d
## Why
Orphaned output mappings and pending calls from finished cells can exhaust recorder capacity, preventing fresh code mode calls from attaching complete executed tool call metadata.
## What changed
Reclaim output mappings without remaining cells when the mapping limit is reached. Under cell or pending-call pressure, evict finished cells without output mappings, invalidate their retained completion markers, and release their pending-call count. Preserve the cell being registered and keep late records until capacity pressure requires cleanup.
## Testing
Add regression coverage for preserving existing cells and late partial records under mapping pressure, and an integration test verifying that a fresh code mode call carries its executed calls, cell ID, and completion marker after orphaned mappings fill the recorder.
GitOrigin-RevId: 8894d1283a962088fbf8cad60078cc0cd07aaf17
## Why
Persisted transcripts rendered tool calls individually and displayed reasoning differently from live replay. Enabling raw reasoning also replaced the summary instead of retaining it.
## What changed
- Group computer activity and compatible exploration commands across intervening reasoning, retaining details for the expanded transcript. Respect visible content, command failure boundaries, and turn boundaries.
- Separate paginated history at every turn boundary before filtering hidden items, while adding completion metadata only for successful turns.
- Keep persisted reasoning out of the compact display, preserve hyperlinks in detailed rendering, and append enabled raw reasoning to the summary. Preserve standalone reasoning Markdown in transcript exports.
- Add helpers to rejoin activity groups and attach reasoning across page boundaries using persisted item identities and turn adjacency.
## Testing
Add regression coverage for reasoning replay parity, computer groups split across history pages, turn boundaries, and grouped terminal input. Update export and raw-reasoning tests to verify retained summaries and Markdown.
GitOrigin-RevId: a716db571440f891cc2c6894ae93fbe0e149aed4
## Why
Loaded transcripts reduce several tool calls and file changes to basic status summaries, losing details available in live history cells.
## What changed
- Reuse rich history cells for completed commands, MCP calls, patches, agent activity, image generation, and notices.
- Add dynamic tool cells with bounded output previews while retaining arguments and full output in detailed and raw views.
- Preserve last-known statuses for incomplete calls, unavailable results, and declined or failed operations. Keep legacy command text and terminal interaction output when rich reconstruction is unavailable.
- Remove redundant move annotations from patch diffs and retain patch activity IDs.
- Filter untrusted control characters before emitting terminal scrollback, while preserving semantic hyperlinks.
## Testing
Add unit and snapshot coverage for compact and detailed tool rendering, status fallbacks, retained output, patch restoration, and control-character filtering with and without hyperlinks.
GitOrigin-RevId: 73d754262768cf6d91f3ea4040116bf93cf87784
## What changed
- Add compact renderers for commands, MCP calls, computer activity, patches, and plans, with bounded previews and retained transcript details.
- Preserve logical source text, styles, and hyperlink metadata across wrapping so transcript copying can exclude display gutters while retaining meaningful labels. Wrap diff text at grapheme boundaries.
- Add activity identities, ordered detail retention, and deduplicated warning metadata to history cells.
- Hide background terminal interaction notices from chat while retaining them in the transcript, and keep local image-only user messages visible without duplicating image placeholders.
## Testing
Add regression and snapshot coverage for compact previews, retained patch diagnostics, wrapped source text and hyperlinks, question-and-answer labels, and local image placeholders.
GitOrigin-RevId: fd82fadd8ed3418eaba2bc74c4327d9c63d7e997
## Why
Display wrapping removes whitespace and adds gutters, so rendered rows alone cannot reliably describe the original logical text. Streaming previews also need to detect source changes that leave visible rows unchanged.
## What changed
- Retain shared logical text, styles, exact byte ranges, and display margins alongside wrapped rows; remap hyperlinks using those ranges.
- Preserve source metadata through prompt, Markdown, and prefixed history rendering, including spoken artifact annotations. Clear it when split-flap animation replaces the text.
- Include source metadata when comparing streaming previews and agent or plan tails.
- Keep compound graphemes intact, preserve explicit span styles, and reuse first-fit wrapping results when safe.
- Use the lighter history prompt background for submitted messages.
## Testing
Add regression coverage for source ranges and styles across widths and gutters, distinct repeated lines, source-only streaming updates, compound graphemes, and equivalence between reused and generic wrapping results. Extend Markdown, spoken artifact, and animation tests to check retained source metadata.
GitOrigin-RevId: 9e60746642fc9a8f91c1abfe7c77eefc1fe421ab
## What changed
- Remove the legacy selection-list appearance and use shared full-width selection, filled tabs, wrapped hints, and separate overflow rows throughout.
- Give resume and fork pickers separate toolbar and search rows. Collapse spacing on short screens, keep the focused toolbar control visible on narrow screens, and prioritize labeled primary actions in the footer.
- Apply shared selection styling and contrast-aware text colors to session rows and metadata. Clear inherited selection colors and reversal from the transcript loading overlay.
- Preserve clipped-header notices alongside results in small approval dialogs.
## Testing
Add rendering assertions and snapshots for session selection contrast, reversed selection, loading overlay styles, compact metadata and action labels, and keyboard-focused toolbar visibility. Extend approval clipping snapshots to shorter terminal heights.
GitOrigin-RevId: 6e34b14f5528baf33e97ff6cf746107a1bbe69ab
## Why
Prompt layouts use inconsistent selection styles, and long content can crowd out choices and keyboard hints in small terminals.
## What changed
- Apply shared picker surfaces, selection highlights, accent colors, and shortcut styling across approval, question, startup, and session prompts.
- Reuse numbered picker rows with wrapping and selected-item visibility. Bound folder paths to preserve trust disclosures and choices, prioritizing the repository root when space is limited.
- Give multiline prompts a shared layout for rendering and cursor placement, with Escape hints that reflect Vim mode.
- Present local providers as vertical choices with inline status, adding arrow-key and `j`/`k` navigation plus `1`/`2` selection shortcuts.
## Testing
Add snapshots and regression tests for narrow and short viewports, long trust paths, multiline cursor placement after resizing, selection styling, provider shortcuts, and confirmation behavior.
GitOrigin-RevId: 89bb133dfa0d085d568a3a84473afd9e2fb20838
## Why
Narrow completion popups can hide distinguishing filenames, parent paths, or category tags. Unified mentions also need a stable result viewport across searches and filters.
## What changed
- Use shared selection styling and `›` markers across command, file, skill, and unified mention popups.
- Give unified mentions a fixed-height picker layout with a header, filter tabs, query display, scroll indicators, and keyboard hints.
- Bound mention name columns to leave room for parent paths and measure alignment in terminal cells.
- Truncate file paths while retaining filenames and recalculating visible fuzzy highlights, preserving the full path for insertion.
- Keep category tags visible when skill and app descriptions are hidden.
## Testing
Add snapshots and assertions for narrow and clipped layouts, scrolling, empty filters, full-row selection styling, Unicode column alignment, long paths, preserved file selections, and category tags.
GitOrigin-RevId: 54c34cc2472b43bac22011206efed3041eb77308
## What changed
- Apply shared picker styling to apps, plugins, settings, skills, hooks, and multi-select views, with full-width selection highlights and compact key hints.
- Share row measurement and layout helpers, show scroll indicators, and let optional spacing yield on short screens to keep selected rows visible.
- Wrap headers and footers, simplify search fields, and use a compact hooks event table at narrow widths.
- Reserve plugin result rows while filtering and cap the plugin name column width.
## Testing
Add regression coverage for selected rows in short multi-select views, compact hooks navigation, and checkbox, preview, and overflow rendering. Extend experimental-feature and memory-reset wrapping snapshots to narrower widths and update affected popup snapshots.
GitOrigin-RevId: 0eedbbff307c84cc858629e578091bbbd59b2423
## Why
Menu layouts and hints vary across TUI flows, and mismatched measurement and rendering widths can clip subsequent choices when descriptions wrap.
## What changed
- Apply shared picker styling across selection menus, with stable columns, descriptions hidden when space is tight, and compact hints derived from configured key bindings.
- Measure rows at their actual rendering width, including caller insets, so wrapped options receive enough space.
- Wrap model menu headers and shortcut capture content, and use the shared panel surface for shortcut capture.
- Indicate clipped headers in non-searchable menus and show the configured `view all` shortcut only when the view supplies one.
## Testing
Add regression tests and snapshots for wrapping boundaries, narrow picker layouts, configured selection and cancellation keys, and clipped approval headers. Verify that copy/export actions retain complete payloads and composer drafts.
GitOrigin-RevId: 8416bcd3c66b6cd15db3f9c1804f5f005b7964c1
## Why
Theme colors and dimmed text can lose contrast against terminal and shaded backgrounds. Pickers also need to keep controls and the selected result visible when space is limited.
## What changed
- Add shared blue accents and contrast-aware foregrounds that account for painted backgrounds and terminal color depth, with terminal-default fallbacks for limited palettes.
- Apply readable colors to footer text, status lines, prompt attachment labels, and diff content. Remove dimming from syntax-highlighted diff text so it does not undo contrast correction.
- Use compact shortcut labels such as `ctrl+c`, emphasize complete key combinations, and separate composer footer actions with ` · `.
- Add an opt-in picker presentation with full-width selection, filled tabs, separate overflow indicators, and navigation based on visible rows. Enable it for `/keymap`, reserving result space to keep controls stable across filtering and tab changes.
## Testing
Add regression tests and snapshots for contrast after palette conversion, shaded diff backgrounds, shortcut typography, picker resizing and pagination, Unicode tab truncation, and stable `/keymap` geometry.
GitOrigin-RevId: f3c71879d3bcc4e3b29d70e63cf377dea5914916
## Why
Server version notices previously required both versions to be stable releases, leaving prerelease and local clients without notices about differing background services.
## What changed
- Use semantic version parsing to distinguish older servers from version mismatches.
- Compare stable clients against older releases, including prereleases. Compare prerelease clients by precedence within the same release line and report other release lines as different.
- Report differing versions for local clients (`0.0.0` or versions with build metadata). Ignore malformed versions.
- Show the corresponding `older than` or `different from` notice and `<` or `≠` overview indicator, while preserving `/daemon` guidance and the `show_server_version_notice` setting.
## Testing
Add version-policy tests and notice snapshots covering prerelease ordering, local builds, mismatches, and malformed versions. Add daemon tests for notice suppression and manual update guidance without scheduling an update.
GitOrigin-RevId: 29df4713a7dbcbddcf30d56995a8496e7e8d0c6a
## Why
Filesystem helpers use a `pre_exec` callback to close inherited descriptors on macOS, forcing a fork before execution. Native spawning needs to preserve that isolation and support the socket used for file descriptor transfer.
## What changed
- Launch filesystem helpers through `codex_utils_pty::Command`, using `posix_spawn` with `POSIX_SPAWN_CLOEXEC_DEFAULT` on macOS and returning native launch errors without a fork fallback.
- Extend the shared command wrapper with explicit descriptor and fallback policies, socket-backed stdin, and custom `argv[0]` support.
- Add `Child::wait_with_output` to drain stdout and stderr concurrently, retain kill-on-drop behavior on cancellation, and keep output pipes open until the child exits.
## Testing
Add regression tests for fork-free sandboxed reads, writes, and file descriptor transfers; sandbox denial of outside paths and symlink escapes; descriptor isolation; bidirectional socket stdin; custom `argv[0]`; executable-format errors; and output-pipe lifetimes.
GitOrigin-RevId: d49c00787f30ec0bc196f9e066a0770fc8151152
## Why
The native macOS backend cannot inspect every setting or callback on a Tokio command. A shared, constrained launch API makes the supported settings explicit for both backends.
## What changed
- Replace `spawn_child` with `codex_utils_pty::Command`, enforcing an explicitly supplied environment, piped stdio, and kill-on-drop behavior.
- Add `ProcessMode::Inherit` and `ProcessMode::NewGroup`, honoring the selected mode in native macOS and Tokio spawning.
- Share the `Child` wrapper across platforms and migrate local MCP server launching to the new API, retaining its new process group and Windows suspended-spawn support.
## Testing
Adapt the existing macOS spawn compatibility and child lifecycle tests to the new API. Add a regression test that checks inherited and new process groups with both backends.
GitOrigin-RevId: 3e7a401659e3a8a94a13c4ff58d67bdcd2eea33d
## What changed
Expose the shared `Child` type and `spawn_child` function from `codex-utils-pty`, and update the MCP stdio transport to use them. Move the existing macOS spawning implementation and its tests into the utility crate, preserving platform-specific spawning, piped stdio, and kill-on-drop behavior.
GitOrigin-RevId: 26c2fb2f22cdba907aa9d18cab7dc8c4ac1c909e
## Why
Shared thread instructions can change after an action is generated but before Guardian reviews it. Polling the live provider during review can give the reviewer different instructions from those applied to the action.
## What changed
Initialize Guardian reviewers with the user and thread instructions captured in the review session reuse key, keeping the review tied to the applied snapshot.
## Testing
Add a regression test that updates and removes shared instructions between action generation and review in a running descendant thread. Verify that the worker picks up each change, Guardian uses the applied instructions, and instruction changes create new reviewer sessions even while ancestor threads remain idle.
GitOrigin-RevId: 4980762bc7b6646a1691a43be93c71a7dc611ec6
## What changed
Reduce the initial recent-session seed from 20 to 10, alongside loaded sessions. Use a shared `RECENT_SESSION_LIMIT` for pagination, collection, and final truncation.
## Testing
Update the overview test for the 10-session limit and add a snapshot of the recent-session list after restart.
GitOrigin-RevId: f315f4848e8d2091eb229cfdc3c02932aaf7ba8c
Pass `Platform::native()` to `build_config_state` in the standalone network
proxy to satisfy its required executor OS argument and validate socket paths
for the host platform.
GitOrigin-RevId: d3ce8c513a3a6c5ffea6522d8b830deb40f1dfc8
## Why
Subagents inherit applied instruction snapshots, so later provider updates do not reach running descendants. Hosts need an explicit way to share current thread instructions across an agent tree.
## What changed
- Add `ThreadInstructionsProvider::share_with_subagents()`, defaulting to `false`. Opted-in descendants refresh instructions at their next model-request boundary.
- Retain shared providers across root unloads and descendant reloads. Let a resumed root replace the provider for surviving descendants, or preserve their last shared instructions when it supplies a non-sharing provider.
- Keep providers scoped to their root tree and preserve snapshot-only instructions for root forks and isolated sessions, including Guardian reviews.
## Testing
Add coverage for child and grandchild instruction updates and clearing, provider replacement after root restart, lazy descendant reloads, default snapshot inheritance, and isolation between roots and Guardian sessions.
GitOrigin-RevId: 44c9fb7fe9ae1f96156bdf3c47ab6c4a81bd65e9
## Why
Package context propagation was limited to verified `codex-command-runner.exe` processes, preventing other packaged callers from passing their OS-assigned identity to sandboxed children.
## What changed
Use the current process's OS package identity to decide whether to preserve desktop app context in both regular and ConPTY sandbox launches. Remove executable-name and staged-runner verification from this decision.
Reject callers without package identity when `CODEX_WINDOWS_REGISTERED_CORE=1`; otherwise, unpackaged callers continue without preserving app context.
GitOrigin-RevId: 52eb2fe33c8746d898b5d7ebf53bd001a55b5506
## What changed
Send an `async-question` notification when new unanswered questions arrive, honoring existing notification settings and taking priority over turn completion. Show a shortened question title for a single question or a count for a batch. Empty batches, duplicate deliveries, and replayed history do not trigger notifications.
## Testing
Add tests covering live arrival, replay and duplicate suppression, notification settings, priority over turn completion, batch summaries, and long-title truncation.
GitOrigin-RevId: 205dc3ff5461c2166159af5143b0ca7279a87f42
## Why
Allow the network policy proxy to run without a full Codex permissions profile.
## What changed
- Add `codex-network-proxy --config <PATH>` to load a standalone JSON file containing a `network` object and run the proxy independently of Codex.
- Require `network.enabled = true`, limit configuration size to 1 MiB, and reject unknown fields, including nested MITM hook fields, and trailing JSON values.
- Enable HTTPS MITM automatically for limited mode or configured `mitm_hooks`, while supporting explicit `mitm` configuration.
- Document the standalone configuration and invocation.
## Testing
Add tests for MITM defaults, dynamic policy keys, unknown fields, and trailing JSON values. Add a regression test that verifies `wait()` promptly returns an error when either the HTTP or SOCKS listener fails.
GitOrigin-RevId: ba20b9c3022b16abaa5597f473c418cfc06c18ee
## What changed
- Support an optional cloud provider alongside executor plugins, refreshing its thread-scoped catalog at each regular turn when plugins are enabled.
- Use cloud connector metadata for app attribution without starting cloud-declared MCP servers.
- Scope cached catalogs to authentication and Apps availability. Retain the previous catalog on discovery failure within the same scope, clear stale catalogs on auth changes, and reject results completed under outdated credentials.
- Add a cancellable regular-task startup phase that reconciles MCP before discovery and reapplies contributor state afterward without invalidating resource caches.
## Testing
Add regression coverage for per-turn refresh, empty catalogs, discovery failures, plugin disabling, auth changes during discovery, MCP reconciliation and cancellation, and cloud app attribution alongside executor MCP tools.
GitOrigin-RevId: 8469eb109ea316e21cbc4122c52ad8000caeef03
## Why
Implicit temporary-directory grants can bypass filesystem restrictions and
protected project metadata. Moving an ancestor can also relocate protected
paths beyond their pathname exclusions.
## What changed
- Route process scratch access through the normal Seatbelt exclusion rules so
it respects unreadable paths, read-only paths, and protected project metadata.
- Protect the parents of both logical symlink paths and their resolved targets
against relocation.
- Apply privileged daemon socket protections after all grants, deny access to
the socket directory itself, and prevent ancestor removal or renaming while
allowing sibling writes.
GitOrigin-RevId: f4cbcf5867e204b0cded0812aac1851b3d444328
## What changed
Add an `auth_mode` tag to `codex.remote_models.fetch_update.duration_ms`: `api_key` when a provider API key is configured or API key authentication is active, `chatgpt` for other available authentication, and `none` when neither applies. Start the timer after retrieving authentication.
GitOrigin-RevId: 7aa8f3af4a9fe38fc903fa2c8698b537b692850a
## What changed
Set `turn_trigger` to `exec` for exec turns and `user` for TUI turns when sending `turn/start` requests.
## Testing
Extend exec resume and embedded TUI tests to check `x-codex-turn-metadata`, including thread IDs, the TUI turn ID, and the expected triggers. Update the active-turn steering test to verify that user steering preserves the original `goal` trigger.
GitOrigin-RevId: 56125f64b5c47e7c538663d748b3a5f404e68316
## Why
When a selected environment is unavailable, permission fallbacks can use the turn's initial environment and workspace roots. Daemon recovery can also miss a local environment that finishes starting after the turn begins.
## What changed
- Resolve fallback permissions from thread defaults using the captured selection's workspace root URIs, including when setup is starting or has failed.
- Apply this resolution to Guardian reviews, permission instructions, and sandbox context selection.
- Capture daemon recovery from the latest step inputs and refresh environment readiness before checking recovery eligibility.
## Testing
Add regression tests for Guardian resolving project-root restrictions against an unavailable captured environment's workspace and for daemon recovery including a local environment that finishes starting during a turn.
GitOrigin-RevId: c76d83d786fdc9c444b78ecbc335b02a20805c58
## What changed
- Move catalog types and the `PluginProvider` listing interface into `codex-core-plugins`, with a concrete `PluginListQuery` carrying thread, turn, and MCP resource context.
- Remove root resolution from `PluginProvider`; keep executor package access in `ExecutorPluginProvider::resolve_bound`, which retains the filesystem used to resolve the package.
- Add shared provider result and error types, and re-export the listing API from `codex-mcp-extension`.
## Testing
Update executor and manifest tests to use `resolve_bound`, and assert that malformed manifest errors preserve the underlying `serde_json::Error` as their source.
GitOrigin-RevId: c6cd5a0269ed3b8ac9b93f306a70821e63e3671e
## Why
An unavailable thread blocked slash commands even while the server remained connected, preventing users from starting or resuming a conversation and accessing local commands.
## What changed
- Allow explicitly supported recovery and local commands, including `/new`, `/clear`, `/resume`, `/status`, and `/copy`, through configured submit keys when the current thread is unavailable.
- Keep other drafts and attachments intact, require commands to occupy a single line, and expand collapsed pastes without dispatching them on the same keypress. Disconnected input remains restricted to editing.
- Clear stale review and MCP startup activity and recover prompts awaiting turn start into the retained input queue so recovery commands can proceed.
## Testing
Add composer and app tests for command routing, custom submit bindings, blocked draft preservation, paste expansion, and `/new` and `/clear` creating writable sessions despite stale activity.
GitOrigin-RevId: 2f5589d615276eb50c69490829dc042bba3f12a9
## Why
Reasoning summaries need to retain their position among computer actions and exploration commands, including when they arrive before a running call completes.
## What changed
Share ordered call and reasoning storage through `ActivityGroup` and let history cells accept reasoning through `append_reasoning`. Computer activity and exploration groups now retain reasoning while calls are running, showing it in order in the expanded transcript while keeping compact previews and raw output free of reasoning.
## Testing
Add regression snapshots for reasoning during a follow-up exploration command and for computer activity with multiple intervening and trailing summaries. Verify identical live and replayed computer activity across compact, expanded, and raw output.
GitOrigin-RevId: 92607b38fd4b0379616c1ae50b5da1068c8534c3
## What changed
- Rename the extension providers to `PluginMcpProvider` and `PluginAppProvider`, and use app terminology for plugin app declarations.
- Rename the MCP contributor to `PluginContributor` and its installation entry point to `install_plugins`; update the app-server call site and existing tests.
- Move the corresponding modules and tests to plugin-based names, change the contributor ID to `plugin`, and update tracing spans and log messages to match.
GitOrigin-RevId: 7106d2965675265f39e186e57cc334161bdb90d3
## Why
Login and enterprise configuration bootstrap can fail when their endpoints are reachable only through the system proxy, before cloud configuration can enable `respect_system_proxy`.
## What changed
- Enable `features.system_proxy_fallback` by default, honor managed feature requirements, and prevent project configuration from changing it.
- Retry account discovery and cloud configuration GETs through the system proxy after connection failures or timeouts, bounding the initial request and body read to five seconds.
- Retry OAuth authorization-code exchange only on connection failures before any redirect, with a ten-second connection timeout. Reuse the successful client for the subsequent API-key exchange to avoid changing routes.
- Increase workspace discovery and cloud configuration timeouts to 15 and 20 seconds, respectively, to accommodate fallback.
## Testing
Add coverage for proxy-only browser login through the first completed turn, including cloud configuration enabling `respect_system_proxy` without a restart. Cover stalled GET bodies, preserved request headers, disabled fallback, managed requirements, and project configuration restrictions. Verify that OAuth HTTP errors, redirects followed by connection failures, and failures after sending the POST do not trigger proxy retries, while successful redirects remain supported.
GitOrigin-RevId: 854eeeac186bb4865218ce645019c1e4bff85425
## Why
Providers need to serve Codex model metadata independently of their inference endpoint. A custom inference `base_url` alone should not opt API-key sessions into remote catalog discovery.
## What changed
- Add `model_catalog_url` to provider configuration and thread-config serialization. Fetch the full catalog URL with provider authentication, headers, query parameters, and `client_version`, while preserving inference routing.
- Require an explicit catalog URL for API-key discovery with a custom base URL. Keep default OpenAI discovery on the Codex backend, and apply `api_key_model_discovery` gating to provider API keys and cached catalogs.
- Include the catalog URL in cache identity so different catalogs do not share cached metadata.
- Limit explicitly configured catalog responses to 1 MiB, reject redirects, and suppress URL and response diagnostics that could expose credentials.
## Testing
Add coverage for catalog configuration round-trips, query encoding, authentication and header reuse, cache identity and discovery gating, oversized responses, and redirect rejection without credential forwarding. Add an integration test verifying that catalog model metadata and instructions reach conversation requests.
GitOrigin-RevId: 7f6ac5eec257278685e1867a6bcebae6514a365a
Remove the obsolete `windows_sandbox_private_desktop` field from the
`EnvironmentConfig` initializer in the active-turn environment fallback test
so it matches the current struct definition.
GitOrigin-RevId: 4441dc8ed3d4bfcd4c1de093e829c065d323f41a
## What changed
Replace direct access to the shared rollout budget with controller methods for
recording token usage, retrieving pending reminders, and marking reminders as
delivered. Move the `SessionBudgetExceeded` check into the controller and update
session and guardian callers, preserving reminder acknowledgment after insertion
into conversation history.
## Testing
Replace the shared-budget pointer assertion with a behavioral check: recording
25 output tokens in a reviewer session leaves 75 tokens in the parent session's
budget reminder when the initial budget is 100 tokens.
GitOrigin-RevId: 003bc2b56e526787c1864c09729bbad1006e243d
## What changed
- Add `PluginCatalog` types for discovery snapshots, warnings, plugin metadata, stable identities, and cloud or executor source locations. Keep MCP server declaration values out of debug output.
- Extend `PluginProvider` with a generic list query, asynchronous catalog listing, and shared error and future types. Provide empty defaults for listing and root resolution so providers can implement their supported operation.
- Add `PluginListQuery` in the MCP extension with thread and turn identifiers and an optional MCP resource client.
GitOrigin-RevId: 0bf2a1713c25d912c41daab788b88729d4871fcf
Read `initial_environments` in `active_turn_environment_selections` to
return the environment selections captured at turn start.
GitOrigin-RevId: 445b52508733ef971eb6d2d7eea2b2f019542d5f
## Why
Background processes can outlive their launching turn. Their approval reviews need the originating environment's filesystem restrictions, even when the active turn uses a different environment. Remote restrictions must also be resolved using executor paths rather than the local filesystem.
## What changed
- Capture settings and environment selections together in `StepInputs`. Preserve the captured selection during active model updates while allowing environment startup to finish.
- Carry environment IDs into Guardian network and `execve` requests, and use the owning process's environment with current review settings. Refresh environment readiness for network requests that fall back to the active turn.
- Resolve remote denied paths and globs using the executor's policy context. Decline automatic approval when the request's environment is unavailable or an explicitly denied temporary directory cannot be resolved.
## Testing
Add regression coverage for active model updates retaining their environment while the next turn adopts a new selection, background approvals using their owning environment, newly ready network environments, and remote denied paths and globs, including Windows paths and missing temporary-directory metadata.
GitOrigin-RevId: b620d4b030c597a4f430fe0500864fa5469db3d4
## Why
An executor can renew its registration while retaining its Noise identity. Connection refresh must distinguish registrations even when their keys match, and a stale registry lookup must not retire a session that recovery has already renewed.
## What changed
- Track the installed session's registration and expose it through `Environment::cached_executor_registration_id()` without connecting. Publish registration changes only when the new connection is installed.
- Require both registration and executor key to match before refresh reuses a session. Retry stale lookups and prevent recovery from installing a connection after retirement.
- Pin session recovery to the original Noise key while allowing registration renewal to preserve the session and running processes.
- Expose `CodexThread::active_turn_environment_selections()` so hosts can authorize steering against the active turn's selections, including starting and failed environments, independently of later settings updates.
## Testing
Add regression coverage for registration replacement, renewal with a running process, stale refresh lookups, missing sessions, and rejection of changed Noise keys. Extend active-turn tests to check selection snapshots across settings updates, deferred startup, and turn completion.
GitOrigin-RevId: 4395bc6c57f137691887e6585f52dcc5b958101c
## What changed
- Remove the private-desktop opt-out from elevated and unelevated Windows sandbox launches.
- Remove `windows.sandbox_private_desktop` and its managed requirement and API fields. Warn users to remove the obsolete setting.
- Require a private desktop name when launching through the Windows sandbox wrapper and command runner.
## Testing
Add coverage for the obsolete-setting migration warning and update wrapper tests to verify a live private desktop is passed and a missing desktop name is rejected.
GitOrigin-RevId: c7135f8d211aac8d812180691c2c1e433d77cde4
## What changed
Return thread IDs, metadata, and status from `LocalAgentControl::list_agents` using the shared `LiveAgent` type. Move conversion to `ListedAgent` into the tool handler, preserving the `list_agents` response fields and the thread ID fallback for agents without a path.
GitOrigin-RevId: c935cf96ab2a370645a4b74e3306540fc2d168a5
## What changed
Have `Session` capture terminal child state in an `AgentTurnOutcome` and delegate delivery to `LocalAgentControl`. Move parent notification and completion activity routing into `agent/control/completion.rs`, so routing no longer takes the child's live `TurnContext`.
Preserve best-effort, queue-only parent delivery, completion activity for the initiating agent, and result tracing only after successful delivery.
GitOrigin-RevId: e06871d92c9ca8660de29f50356cf7c37f7e5199
## What changed
Add `build-codex-packages` to build unsigned CLI and app-server packages for a supplied Rust target and package version. Support release optimizations or faster, unoptimized builds using the release profile.
Prepare platform-specific tools and bundled binaries, archive debug symbols, and produce both `.tar.gz` and `.tar.zst` packages.
## Testing
Run the existing package smoke tests against both compression formats and the symbols archive. Reject host `rg`, and host `bwrap` on Linux, on `PATH` so the tests exercise packaged tools.
GitOrigin-RevId: e843db1ec94681a33a37862fa0cbbb8d715f3b5f
## Why
Clients need to know the incoming size limit for single-frame requests so they can reject oversized requests before the socket closes.
## What changed
Add `x-codex-websocket-max-unfragmented-message-bytes` to successful control socket WebSocket handshake responses. Derive the advertised byte limit from the minimum configured frame and message size limits, using the same `WebSocketConfig` for the connection.
## Testing
Extend the control socket upgrade test to verify that the header contains a numeric value matching the effective default limit.
GitOrigin-RevId: c4f46d12e00e20f56d4c14a3e84f9fe6e2f020fa
## What changed
Add a public, object-safe `AgentControl` trait and request/response types for coordinating an agent tree independently of where its threads run. Define contracts for lifecycle operations, message delivery, status observation, execution admission, usage accounting, shared configuration, and guardian evidence.
Move shared agent types out of the local controller and export them from `codex-core`. Let `AgentExecutionGuard` own a backend-provided reservation while preserving the local limiter's release-on-drop behavior. Include `root_thread_id` in `GuardianRootSnapshot` to identify the source of authorization evidence.
## Testing
Add tests for reservation release when a guard is dropped or a turn is cancelled, and extend the guardian authorization test to assert the root thread identity. Check trait object safety at compile time.
GitOrigin-RevId: 9385c9fbfd189f08429539fd89061ef8c9efe0d9
## Why
Recording response items in an initialized thread builds a turn context without starting a turn. Running host skill discovery for that context is unnecessary.
## What changed
Use a dedicated context build mode that skips host skill discovery for history injection. Preserve full discovery for initial context creation, startup prewarming, and execution. If compaction clears the reference context during preparation, rebuild a full context before initializing history.
## Testing
Add a regression test verifying that initial injection discovers skills, subsequent injection records items without discovery, and a real turn still discovers skills and sends the selected skill body and both injected messages to the model.
GitOrigin-RevId: 4a64e04eb0f21698f9b47160bfcfe5b6d6a68554
## What changed
Add an optional `onboardingSkill` summary to `plugin/read` responses and update the generated schemas, TypeScript types, and Python models.
- Resolve local declarations from `extensions["com.openai"].onboardingSkill`, accepting relative paths with or without `./`. Require the resolved path to stay within the plugin root and match a loaded skill.
- Match remote release metadata's `onboarding_skill_name` against the plugin's skills.
- Return the summary only when the plugin and matching visible skill are enabled; remote plugins must also be available. Otherwise, return `null`.
## Testing
Add parameterized local and remote `plugin/read` tests covering matching, missing, and unmatched declarations, disabled plugins and skills, and unavailable remote plugins.
GitOrigin-RevId: 88cabdfddbecba5efba756617da0cb1ff064bdf7
