## Why
Command center failures need to remain visible while users retain their task selection and composer draft, including when a task is already managed by another app server.
## What changed
- Show action errors above the retained dashboard with a return option and a clear explanation for tasks open elsewhere.
- Keep the dashboard open until task attachment succeeds, and return to the conversation when selecting the already displayed task.
- Offer “View unsent task” in a pager when restoring a failed submission would overwrite newer input.
- Show task refresh failures inline and clear the notice after a successful refresh.
## Testing
Add regression tests and snapshots for attachment conflicts, preserved selection and drafts, successful attachment, inline refresh recovery, unsent task viewing, and visible action failures.
GitOrigin-RevId: 19670c5ea506414a835296141004db567b0cafef
## What changed
- Support `model_provider` and `model_providers` in managed requirements. Required selection overrides local and session configuration; each required provider definition replaces the corresponding local entry, including its authentication and headers.
- Merge provider requirement fragments before validation, preserving source-relative `auth.cwd` paths. Reject invalid cloud provider definitions before replacing the cached bundle, including unsupported Bedrock overrides.
- Expose `modelProvider` and `modelProviders` through the configuration requirements API and generated schemas. Reject writes to managed provider settings and omit their local origins, including for provider IDs containing dots.
## Testing
Add tests for requirement precedence, authentication fragment merging, path resolution, cloud cache preservation, and read-only configuration RPCs. Integration tests verify that model discovery and inference use the required gateway and ChatGPT authentication without leaking local headers, and that provider requirements survive configuration rebuilds.
GitOrigin-RevId: d1448604d4ef5662ebb5df7b693712d3b8ad6d54
## Why
An enabled shared analytics client could override a thread's explicit opt-out.
Delegated threads also emitted initialization events through the parent's client,
bypassing the child's analytics setting.
## What changed
- Use a disabled analytics client when `config.analytics_enabled` is `Some(false)`,
without disabling analytics for sibling threads or overriding a disabled host client.
- Emit delegated thread initialization events through the child's analytics client.
- Expose the effective analytics state through `CodexThread::analytics_enabled()`.
## Testing
Add regression tests for explicit and unset thread settings with enabled, disabled,
and absent shared clients, plus delegated child opt-outs with an enabled parent.
Update compaction and rollout-budget rollback tests to wait for thread idle after
turn completion and fail immediately on rollback errors.
GitOrigin-RevId: 547852909af1a6822b95c0bcd2336b0d6bc7aad1
## Why
The offline sandbox's non-loopback firewall block covered only outbound traffic. Add a matching inbound block for the offline sandbox user.
## What changed
- Configure an inbound firewall rule scoped to the offline user's SID, blocking all protocols and ports for non-loopback remote addresses.
- Make firewall rule direction explicit while preserving the existing outbound rules.
- Remove the new inbound rule during uninstall.
## Testing
Extend the elevated Windows sandbox integration test to inspect effective inbound and outbound rules, asserting their uniqueness, direction, block action, enabled state, profiles, address and port filters, protocol, and user scope.
GitOrigin-RevId: cbc1ca0d8d08a31fc53da5ad5be6ee5d51afa63d
## Why
A `503` from an issuer's OAuth metadata endpoint can block discovery even when its OIDC metadata is available, preventing expired OAuth tokens from being refreshed during MCP startup.
## What changed
Try the same issuer's OIDC discovery endpoints when an OAuth authorization-server metadata GET returns `503`. Support issuers with path components and keep all attempts within the original request's timeout.
Reuse existing header, origin, and response-size checks, leave issuer validation to RMCP, and do not follow fallback redirects. Preserve discovery errors when fallback fails instead of enabling legacy endpoint fallback, and propagate terminal HTTP failures.
## Testing
Add tests for OIDC candidate order, malformed metadata, issuer mismatches, header isolation, redirects, terminal failures, unaffected requests, and the shared timeout. Add startup coverage for refreshing expired persisted tokens after OIDC fallback in both legacy and coordinated refresh modes.
GitOrigin-RevId: 6d94fd09e9ba26cb83e029171449e91410a0f6cb
## Why
Reopening the agent command center focused the composer, requiring an extra focus change before browsing tasks.
## What changed
- Focus the task list when opening the overview from a session or returning after task lifecycle actions. Keep composer focus when starting directly in the overview.
- Fall back to the composer when no visible tasks remain, after discovery and pending metadata have resolved.
- Preserve unsent drafts and explicit focus changes across populated refreshes.
## Testing
Add regression coverage for requested focus, draft and cursor preservation, arrow-key and Vim navigation, and empty-list fallback while metadata is pending. Add a snapshot of the reopened overview with list focus.
GitOrigin-RevId: 8713eadc4a2a72e2db4a962184d43c4028c7178d
## Why
Allow MCP authentication to complete when the browser cannot reach the callback page by accepting the full redirect URL copied from its address bar.
## What changed
- Add `codex mcp login <name> --no-browser` to print the authorization URL and accept a pasted callback without launching a browser. HTTP callbacks remain supported while waiting for input.
- Validate pasted redirect URLs and OAuth responses before exchanging tokens, hide terminal input, bound input size, and avoid echoing callback values in diagnostics.
- Preserve manual input across discovered-scope retries and support cancellation during callback input and token exchange.
## Testing
Add unit and CLI integration tests for callback validation, bounded input, credential storage, HTTP callback completion with stdin open, scope retries, and cancellation during token exchange.
GitOrigin-RevId: 16ea9c3221f72d93e6e3e5acdc6b9465293a0a65
## What changed
Add an optional `analytics_enabled` boolean to `x-codex-turn-metadata`, sourced from the session's selected analytics client. It reports collection state independently of event eligibility or delivery and is omitted without initialized session analytics context.
Reserve `analytics_enabled` so configured or client-supplied metadata cannot override it. Continue accepting existing configurations containing this key while filtering their values from request metadata.
## Testing
Add coverage for the selected analytics client's state taking precedence over turn configuration, reserved-key filtering and compatibility, enabled state in HTTP headers and body metadata, and disabled state in WebSocket prewarm and turn requests.
GitOrigin-RevId: d95375c5ebc27e9d763a7e1a98687a27e4a8d99c
## Why
Sandbox policies can exceed Windows command-line limits. Provide an environment transport for these larger MXC launch requests.
## What changed
- Make `MxcCommand` serializable and add JSON encoding and decoding through `CODEX_MXC_LAUNCH_*` environment variables.
- Split payloads into UTF-8-safe chunks of at most 4,096 bytes, with a 1,000,000-byte payload limit and at most 256 chunks.
- Reject malformed or duplicate transport entries and remove all transport variables during decoding, including on failure. Preserve unrelated environment variables.
## Testing
Add tests for large Unicode and escaped-argument round trips, stale variable removal, malformed transport rejection and cleanup, and oversized payload rejection without modifying the environment.
GitOrigin-RevId: 0e5ae2535ef313985a95eb8a5fd4884974dfb1eb
## Why
The TUI has no voice picker, and realtime start requests omit the voice preference. Voice selection also needs to reflect the active project's effective server settings, which can differ from cached local settings.
## What changed
- Add `/voice settings` with the server's voice catalog and current effective selection, falling back to the built-in catalog when unavailable.
- Save `realtime.voice` through the app server and reread effective settings before confirming the selection. Report save failures and overrides.
- Resolve the effective voice for each realtime start. Apply selections to the next voice conversation without interrupting live audio, and retain compatibility with servers that lack `config/read` or return unknown voice names.
## Testing
Add picker and confirmation snapshots, plus request tests covering persistence, server defaults, catalog fallback, unknown voices, config read failures, overrides, and project settings after thread switches.
GitOrigin-RevId: d47e3da6c1164053c5be9d1da0f5932f2a09261f
## Why
MXC rejected symbolic temporary-directory and minimal filesystem entries, preventing policies using them from reaching execution.
## What changed
- Resolve `Tmpdir` entries from absolute `TEMP` and `TMP` paths in the filtered command environment, matching variable names case-insensitively.
- Ignore `SlashTmp` entries because `/tmp` has no special meaning on the Windows executor.
- Include platform read roots when the policy requests platform defaults, preserving explicit denies.
## Testing
Add coverage for temporary paths and invalid environment values, optional platform roots, explicit denies, empty commands, and Windows case-insensitive read/write overrides.
GitOrigin-RevId: feb69157ff35bcf648fa0ed0e7d4376818bc1941
## Why
Tool response delivery handles kept discarded results alive until the cell ended.
## What changed
Add a local V8 handle scope in `resolve_tool_response` so delivery handles are released when response delivery finishes. Live promises continue to retain their results.
## Testing
Add a regression test that verifies a live promise preserves its response through garbage collection and that dropping the promise makes the response collectible before the cell ends.
GitOrigin-RevId: a74e78acae3ec9a465694d7503150aee123792ec
## Why
An unscored `exec_command` requesting additional permissions could reuse an earlier Guardian v2 approval score, even though that score did not cover the expanded permissions.
## What changed
When `UnscoredAction::AgeScore` applies, invalidate the cached score for default-namespace `exec_command` calls with `sandbox_permissions` set to `with_additional_permissions` by marking the call as a scoring failure.
## Testing
Extend the review-scope regression test to verify that an ordinary sandboxed command preserves cached approval, while a command requesting additional network permissions clears it and causes review to fail closed with `scoring_failure`.
GitOrigin-RevId: d6e3e1ec7d618dff2ef03ffcb92869249f0e547a
## What changed
- Consolidate callback address and port parsing in `enterprise_callback_settings`.
- Reuse `StoredOAuthTokens::has_refresh_token` for credential validation.
- Keep `EnterpriseOAuthHttpClient` private and inline removal of the `resource` parameter from authorization code token requests.
- Share the `complete_login` test helper across login and logout tests.
## Testing
Expand callback settings coverage to check default and configured ports, ports from callback URLs, and rejection of conflicting ports alongside loopback address validation.
GitOrigin-RevId: 42c9be5663ce13b7349cefac2c6a20c4fa974aef
## Why
`TERM=dumb` should not fail the terminal check when neither stdin nor stdout is a terminal. Terminal warnings should also not obscure more severe issues such as unreadable terminfo.
## What changed
- Report `TERM=dumb` as a warning in non-interactive runs, without suggesting a replacement `TERM` value. Keep it a failure when stdin or stdout is a terminal.
- Sort terminal issues by descending severity so failures appear first.
## Testing
Add coverage for terminal stream combinations, human output snapshots, and a non-interactive JSON report that retains an overall failure and exit code `1` when another check fails.
GitOrigin-RevId: 9af5483e371b4b06eb50e8fcdf15704f0bbc33f1
## What changed
Allow app-server to advertise `openai/elicitation.userVerification` and route verification requests to local stdio clients named `Codex Desktop` when `experimentalApi` is enabled and the device supports verification. Preserve support for the in-process `codex-tui` client.
Document the experimental verification API, local credential lifecycle, transport restrictions, and GUI requirements for cancellation and late proofs.
## Testing
Extend activation tests to cover desktop capability advertisement and request eligibility, including rejection for other transports, unrecognized client names, missing opt-in, and unsupported devices.
GitOrigin-RevId: ba4fd4b83b9c24541df3a490396d6c715e7b7433
## Why
Persisted turn-start events lack the originating root turn ID, so they cannot directly associate child turns with the root turn that initiated them.
## What changed
- Add optional `root_turn_id` to `TurnStartedEvent`. Use the inherited root turn ID when available, otherwise the turn's own ID.
- Centralize turn-start emission for regular turns, shell commands, and manual compaction so they record attribution consistently.
- Carry attribution into `ThreadHistoryTurnChange` when processing turn-start events and retain it through completion in the history builder.
- Keep older records compatible by defaulting missing attribution to `None`.
## Testing
Add coverage for root and child turn attribution, persistence when tool collisions fail a turn before sampling, history change propagation, and deserialization of older turn-start records.
GitOrigin-RevId: 54a80b828ca7d1c4c19f13d468c01d052e1b9130
## Why
Truncating diagnostic attachments can corrupt compressed archives, while skipping unreadable files can hide incomplete diagnostic delivery.
## What changed
- Remove attachment truncation and the 40,000,000-byte wire cap. Enforce the 200 MiB decoded envelope limit, including framing, and report oversized or unreadable attachments as upload failures.
- Use gzip only when it reduces envelope size, and set `Content-Encoding` according to the request bytes for both interactive and report uploads.
- Document that successful uploads mean HTTP acceptance, not durable attachment storage, and that callers must retain source files.
## Testing
Add coverage for incomplete uploads caused by missing or oversized files. Update large-file coverage to verify byte-for-byte delivery of JSONL files and a gzip archive exceeding the former wire cap, including successful archive decompression.
GitOrigin-RevId: a5316e9f407f16ee5a3dfb3f15122b1db51d6a94
## What changed
Remove `repo_url` from `SkillInvocationEventParams` and stop including it in
`skill_invocation` payloads. Update the analytics test fixtures and expected
serialized payload to match.
GitOrigin-RevId: 06762143fb861a31298fbd8ab737b9b969edfc89
## Why
MXC rejected filesystem policies containing `:root` or granting full disk write access, preventing these policies from being translated into native grants.
## What changed
- Resolve `:root` against every executor volume before applying permission precedence and read-only carveouts.
- Grant full disk write access across enumerated volumes while preserving explicit writable paths outside them, such as unmapped shares.
- Treat a `:root` deny as the default so narrower explicit grants survive, while retaining explicit path denies.
- Continue rejecting unsupported symbolic paths with a more specific error.
## Testing
Add regression tests for precedence across drives and working directories, volume grant expansion, explicit grants outside enumerated volumes, root denies with narrower grants, and restrictions on one volume preserving grants on another.
GitOrigin-RevId: 94c9fec9e6429913714ebbdeca382c4f1624b5a2
## Why
Background commands can outlive their launching turn. Their network reviews need the original execution environment even when current turn settings change, and pending reviews must stop when the execution is cancelled.
## What changed
- Capture the execution's environment snapshot for Guardian network reviews while continuing to use current review settings.
- Deny requests from already cancelled executions before checking session host grants, and resolve pending approvals as denied when execution cancellation interrupts review.
- Preserve accepted review results and session grants when cancellation happens after acceptance.
## Testing
Add regression coverage for same-turn and later-turn settings changes, the original review working directory, cancellation before and after review acceptance, late callbacks, background process termination, and reuse of accepted session grants by new executions.
GitOrigin-RevId: 29487488da9ab43700ba6684c61eea86f30a03a8
## Why
Model changes during a turn and catalog refreshes can leave Guardian reviews using settings or metadata that do not match the action being reviewed.
## What changed
- Use the action's captured model, reasoning effort, reasoning summary, and personality when configuring reviews.
- Preserve captured model metadata when falling back to the parent model, while resolving a separate reviewer against the current catalog on each attempt.
- Evaluate live managed review requirements against the action's model and use its metadata for computer-use review behavior.
- Include personality in the review session reuse key so personality changes invalidate cached sessions.
## Testing
Add regression coverage for delayed and new actions across model changes and catalog refreshes, required-review routing, and session reuse when policy or personality changes. Extend integration tests to cover reviewer reuse across parent model changes and verify that interrupted reviews cannot execute commands after a delayed approval arrives.
GitOrigin-RevId: 5b434568e113e44bf7177780f2ae13192b55e942
## Why
Extension-owned HTTP MCP servers previously inherited the default protocol mode. Extensions need to select a mode for their own server independently of other HTTP servers.
## What changed
- Add `McpServerContribution::SetWithProtocolMode` and re-export `McpProtocolMode` through the extension API.
- Carry the winning registration's protocol override through catalog resolution and materialization, and apply it to Streamable HTTP connections.
- Preserve existing defaults when no override is present. Selecting a protocol mode does not grant host-owned Apps cache access or environment authority.
## Testing
Add coverage for registration precedence and materialization, and extend cache isolation tests to cover explicit protocol selection. Add an integration test verifying that extension servers can select either the legacy or newer protocol while other HTTP servers retain the default mode.
GitOrigin-RevId: 606cecc03094a93258ffc433849f575020b81473
## Why
Transcript limits could shorten user instructions or omit later messages before Guardian evaluated the complete request budget, losing restrictions or prior approvals even when they would fit.
## What changed
- Keep user messages and manual approvals complete and in source order through transcript collection and retention.
- Preserve historical instructions while synchronous review can still compact history. If the final request still cannot fit, discard optional evidence before shortening older historical entries with truncation markers, preserving later restrictions where possible.
- Warn that shortened instructions and approvals are incomplete and that missing evidence does not authorize actions.
- Let asynchronous review defer to synchronous review when complete instructions exceed its budget.
## Testing
Add coverage for complete instruction retention, approval and restriction ordering, marked truncation of oversized Unicode text, compaction before truncation, and asynchronous fallback when instructions do not fit.
GitOrigin-RevId: e6159e876231347986b937ee7e07f944b83bfbe6
## Why
Truncating action arguments can leave approval reviewers evaluating incomplete actions. Large actions need complete review input and explicit handling when they exceed the review budget.
## What changed
- Remove action truncation and the fixed synchronous action byte limit. Admit complete actions against the whole-request budget, splitting long text losslessly into bounded transport parts and accounting for their framing.
- Route actions exceeding the asynchronous action budget to synchronous review. Prevent cached scores from covering oversized calls, including expanded approval arguments, while allowing later small actions to recover score reuse.
- Request user approval when optional review exhausts its local input budget. Keep required review and compaction service failures closed to approval, and retire exhausted review sessions.
## Testing
Add coverage for complete large-action delivery, optional user fallback, required-review denial, subsequent review recovery, async overflow through MCP approval routing, and lossless text splitting with budget accounting.
GitOrigin-RevId: 08f06e68a94b2f779480dd6b6cf5bc30b241f6dd
## What changed
- Add `thread/attachment/add`, `thread/attachment/list`, and `thread/attachment/remove` to manage durable resource references without loading the owning thread or changing conversation history.
- Identify attachments by thread, `attachmentType`, and `identityKey`. Repeated adds return the existing attachment; repeated removals succeed without emitting another update. Listing supports cursor pagination.
- Broadcast `thread/attachment/updated` after creation or deletion, after responding to the requester. Serialize attachment mutations with thread lifecycle operations and reject stores that do not support attachments.
- Update protocol schemas, TypeScript and Python bindings, documentation, and TUI notification handling so attachment updates do not add untracked threads to the agent picker.
## Testing
Add coverage for unloaded threads, pagination, idempotent addition and removal, reattachment, invalid inputs, unsupported stores, response-before-notification ordering across clients, and TUI notification routing.
GitOrigin-RevId: 0d29cf903afd4e931a70a9cf96300475213b34aa
## Why
Codex Apps applies resource MIME filters to each request separately, so continuation requests must include the filter as well as the cursor.
## What changed
Add `McpResourceClient::list_codex_apps_resources` with a required `mime_type` and optional cursor. Send the filter as a top-level `mimeType` parameter in `resources/list` requests and return resources with the next cursor.
Require a host-owned `codex_apps` registration before sending filtered requests, rejecting extension servers that use the same name.
## Testing
Add integration tests covering MIME filters on both pagination requests, returned resource pages, and rejection of extension name collisions without sending a resource request.
GitOrigin-RevId: 4fb33da56c6ef99286564ead7f74b77d8b337335
## What changed
- Move assessment event construction, metrics, and analytics tracking into `codex-guardian-reviewer` through `ReviewReport`.
- Store denial accounting in thread extension data through `ReviewDenials`, with core retaining turn interruption and lifecycle cleanup.
- Move failed-review record selection and bounded serialization into the extension, with core supplying captured review context.
## Testing
Add coverage that denial accounting clears on turn completion and interruption. Move the oversized-record test into the extension and exercise the new API.
GitOrigin-RevId: 6e5b3d9d4128b356f99b1d0e74a68111e40261ab
## What changed
- Move reviewer configuration overrides, turn request construction, and deadline, cancellation, and completion handling into `codex-guardian-reviewer`.
- Adapt core sessions through `ReviewerRuntime`, keeping context construction, managed constraints, and live network rules in core.
- Make `GuardianReviewSession` crate-private and remove direct reviewer pool initialization and the reviewer dependency from `guardian-v2`.
## Testing
Update the turn-draining test to exercise `wait_for_guardian_review`, checking that prior-turn completion events are ignored and the session remains reusable after draining the current turn.
GitOrigin-RevId: fdf2b335b88b3f405d2370298ee68932808e1186
## Why
Stdio shutdown can hang on open pipes or blocked I/O, and Unix `SIGTERM` needs to run connection cleanup so owned commands terminate and session-end hooks execute.
## What changed
- Handle `SIGTERM` on a dedicated signal thread and close the stdio connection through the existing cleanup path.
- Move blocking stdin and stdout operations to dedicated threads so they do not hold the Tokio runtime open. Cancel message forwarding on `SIGTERM` to release blocked producers.
- When shutdown signal handling is enabled on Unix, start a shared 45-second watchdog on EOF or `SIGTERM`. Preserve the first deadline and exit with status `1` if cleanup or runtime teardown stalls, even when logging is blocked.
## Testing
Add Unix integration coverage for shutdown with open pipes, blocked stdout, blocked stderr, and a stalled filesystem write. Verify command and child-process termination, preserve the EOF deadline when `SIGTERM` follows, and extend session-end hook coverage to `SIGTERM`.
GitOrigin-RevId: 43a80b8277eb50519cdc293eb3b5dc2cad00b3aa
## Why
Session isolation relied on Guardian source attribution. An explicit policy lets callers control inherited capabilities independently of how a session is attributed.
## What changed
- Add `SessionIsolation` with default `Inherit` and opt-in `Isolated` modes, captured at session startup through `ExtensionDataInit`.
- Use the policy to control inherited instructions, extensions, execution rules, and MCP resources. Isolated sessions retain managed execution rules and omit executor-discovered MCP servers.
- Explicitly isolate Guardian reviewers while preserving source-based fallback for older callers and saved reviewers.
## Testing
Extend delegate tests to cover isolation independently of attribution, update execution-policy coverage to supply the explicit policy, and assert that managed reviewers do not inherit the parent's configured MCP tools.
GitOrigin-RevId: f0ab42fa2f0237860ec661e72693ab191216afbf
## Why
MCP tool and connector descriptions were included in required action JSON, consuming review input budget even though they are optional metadata.
## What changed
Move `tool_description` and `connector_description` into an optional, explicitly untrusted `guardian_tool_descriptions` fragment. Limit each description to 400 estimated tokens, escape closing tags, and allow budget enforcement to omit the fragment while retaining the required action JSON. Preserve nested arguments such as `arguments.description` and mention tool descriptions in the budget omission notice.
## Testing
Add regression coverage for oversized descriptions, escaped closing markers, and budget eviction without changing action arguments. Update MCP approval and elicitation tests to verify descriptions appear separately from the action JSON.
GitOrigin-RevId: 30734567c2ebc4b180110276c83d79ddb315ceab
## Why
HTTP 429 responses for exhausted quota, credit balances, and spending or usage limits were reported as retry-limit failures instead of usage-limit errors.
## What changed
Parse the API error's `code` and map `insufficient_quota`, `credit_balance_exhausted`, `organization_spend_limit_exceeded`, `project_spend_limit_exceeded`, and `organization_usage_limit_exceeded` to `CodexErr::QuotaExceeded`. Also recognize `insufficient_quota` in the error's `type` field.
## Testing
Add a regression test covering all recognized quota errors and verifying that `rate_limit_exceeded` and `slow_down` HTTP 429 errors retain their existing retry-limit mapping.
GitOrigin-RevId: b075dba199e08d29563630f5ada846e3e7fd11ff
## Why
Switching accounts could reuse a Responses WebSocket connection and incremental response state belonging to the previous account.
## What changed
Track auth ownership for cached WebSocket sessions and reconnect when it changes, including across turns. Clear incremental response state and `x-codex-turn-state` so the next request sends the full input with fresh routing state. Apply the same connection handling to prewarm requests and build request metadata after checking ownership.
## Testing
Add a regression test for account switches within a turn and between turns. Verify new account credentials on reconnect, full input without `previous_response_id` or stale routing state after the switch, and subsequent connection and incremental response reuse.
GitOrigin-RevId: 83b0636c0afec8b21b5d837a9937db32fb448237
## Why
Pre-turn compaction runs before incoming input is recorded, so failures could leave an accepted prompt out of conversation history. Reporting the error before prompt hooks finish also lets clients steer follow-up input into a turn still preserving its prompt.
## What changed
Record input and run prompt hooks on every pre-turn compaction failure. Defer local and remote compaction error events to `run_turn`, after prompt preservation completes, while retaining the remote error prefix.
## Testing
Extend the remote compaction output-validation test to trigger automatic compaction and assert that the prompt is emitted before the error, saved exactly once, and followed by no additional model request. Retain the assertion that usage is recorded for invalid compaction output.
GitOrigin-RevId: ab7ccb259836c084173e0e81dbbd4c610e95a6c8
## Why
Transient rate limits can end automatic approval reviews prematurely, and review failures currently report high risk even when no assessment completed.
## What changed
- Retry rate limits and recoverable exhausted-stream errors, while excluding non-transient HTTP failures.
- Preserve server retry delays after stream retries are exhausted and honor them within the review deadline. Scope retry advice to the current turn so reused sessions cannot apply stale delays.
- Keep failed reviews denied, but leave risk and authorization unset and explain that the review could not complete without declaring the action unsafe.
## Testing
Add an integration test covering rate-limit recovery through approval and tool execution, asserting that the action executes exactly once after approval. Update failure assertions to check absent assessment fields and the review-failure explanation.
GitOrigin-RevId: 1163cfde35c6b8eb23b6f24f1f24461b86ded838
## Why
Reused call IDs, ambiguous exec/wait associations, and missing history can make tool-call completeness claims unreliable. Truncating one cell's recorded calls should also preserve completeness for unrelated cells.
## What changed
- Track observed call and runtime cell IDs with bounded memory, including call IDs from initial history, and withhold completeness when evidence is missing or ambiguous.
- Validate exec/wait input-output associations and keep invalidated completeness from returning on retries. Withhold wait completeness after resume or fork, where runtime cell IDs can be reused.
- Keep truncation markers and omission counts local to each output, clearing completeness across the affected cell while preserving unrelated cells within the metadata budget.
- Refresh recording enablement from runtime configuration without changing execution features, and preserve the live recorder during legacy configuration reloads.
## Testing
Add regression coverage for reused IDs, compaction, resumed waits, mismatched wrappers, runtime recording changes, and metadata budgeting that preserves unrelated complete calls.
GitOrigin-RevId: 0bc85964bee079879620ec0664eea530a13b61fb
## What changed
- Add `Ctrl+E` to archive the selected task and its child agents, and `Delete` to permanently delete their history. Both actions require confirmation, with Cancel selected by default.
- Expose `agents.archive` and `agents.delete` in keymap configuration and the shortcut picker. Default bindings yield to existing custom bindings and chords.
- Show progress while requests run, keeping rendering responsive and blocking task switching. Refresh overview state afterward and keep the dashboard open when the current task is removed.
- Report failures and preserve the current attachment and draft when a rejected operation leaves the task loaded.
## Testing
Add coverage for confirmation and cancellation, active and background task removal, child-agent attachments, stale refresh invalidation, failure recovery, and draft preservation. Add progress input-isolation tests, shortcut conflict tests, and snapshots for confirmation, errors, progress, and keymap rendering.
GitOrigin-RevId: b327bb8834699d0058f9ffb903ace525ae270500
## What changed
- Add `Ctrl+W` to hide the selected task without stopping it. Hidden tasks stay hidden through activity and metadata refreshes until explicitly resumed or the TUI restarts.
- Expose `agents.hide` in keymap configuration and the shortcut picker, and let the default binding yield to existing custom shortcuts.
- Wrap overview footer hints while keeping shortcuts and their labels together when they fit.
## Testing
Add coverage for hiding filtered tasks across statuses, visibility through activity and refreshes, explicit resume, existing keybinding compatibility, and custom chord footer rendering at narrow widths.
GitOrigin-RevId: 980726e1095b8d5bad8901be919decdde8c0f925
## What changed
Add the default-off `api_key_model_discovery` feature and expose it through app-server experimental feature enablement, respecting user configuration overrides.
When enabled, fetch OpenAI API-key model metadata from the Codex backend, honoring explicit provider base URLs. Treat remote catalogs containing visible models as authoritative. When disabled at startup, skip discovery requests and cached catalogs and retain bundled models.
## Testing
Add coverage for feature enablement and user overrides, cached catalogs across sessions, provider routing, and API-key `model/list` results. Extend coverage for remote instructions and auth-specific cache isolation.
GitOrigin-RevId: 4b189c37c615a7f808cb6ff5f0858a9a55f36ebc
## Why
Pressing `Esc` in the agents overview task list dismissed the overview or
exited Codex when no primary thread existed, instead of returning to the draft.
## What changed
Make list cancellation return focus to the composer, including while
reconnecting, preserving the draft and cursor position.
## Testing
Add regression coverage for returning from the list to the composer with Vim
mode enabled or disabled, both online and reconnecting. Verify draft and cursor
preservation, resumed text entry, and the absence of app events.
GitOrigin-RevId: 8920677c42b0c9ff5023979e198f069abcfcf54b
## Why
Status-only discovery could retain an `OAuth` status based on stored credentials even after the connection attempt failed authentication. This discovery path has no event channel to report the failure.
## What changed
Update the snapshot to report `NotLoggedIn` for servers previously marked `OAuth` whose connection attempts failed authentication. Preserve other authentication statuses and OAuth statuses for failures unrelated to authentication.
## Testing
Add a regression test covering OAuth authentication failure, successful OAuth startup, an unrelated provider error, and a bearer-token authentication failure.
GitOrigin-RevId: 9df68fb1f818e40acab0c71bb4fda118f03a7611
## What changed
Replace duplicated footer wrapping in the MCP elicitation and request-user-input overlays with `wrap_hint_rows`. Preserve whole-hint grouping, display-width and separator accounting, oversized hints, and the single empty row for empty input.
## Testing
Add unit tests for Unicode display widths, whole-hint wrapping, oversized hints at zero width, and empty input.
GitOrigin-RevId: 4d8ead0acbfa3bf9241baedb86d2476566d26ebc
## What changed
Replace full additional permission profiles with network-only metadata in Guardian reviewed actions, and remove the `program` field from `execve` analytics. Preserve absent and empty permission requests and the optional `network.enabled` value.
## Testing
Add serialization tests for enabled and disabled network permissions, absent and empty permission requests, and an unset network permission value.
GitOrigin-RevId: 9904e5f5bd6723d0c09fb423b4818cb8bf12d397
## Why
Attachment mutations must coordinate with thread deletion so queued requests cannot use metadata belonging to a deleted thread.
## What changed
- Add typed `ThreadStore` operations for idempotent attachment creation, paginated listing, and removal, with capability detection and unsupported defaults.
- Implement attachment operations for SQLite-backed `LocalThreadStore`, including unloaded threads, and preserve invalid-request and missing-thread errors.
- Coordinate attachment mutations with lifecycle locks and move SQLite cleanup into thread-store deletion. Remove state rows only after rollout deletion, preserving retries after cleanup failures.
- Give the in-memory store ownership of its associated SQLite cleanup and remove duplicate cleanup from the app-server.
## Testing
Add coverage for attachment pagination and idempotency, unsupported stores, error categories, lifecycle exclusion, mutations queued behind single and batch deletion, cleanup failure retries, and in-memory state cleanup. Extend the app-server descendant deletion test to verify SQLite rows are removed.
GitOrigin-RevId: f0157538c7c5c2ee1362ce40eac157101c5d4505
## Why
Forked threads reported `startup`, causing startup hooks to run again even when their context was inherited from the parent. Resuming with supplied history also reported `startup` instead of `resume`.
## What changed
- Add `fork` as a `SessionStart` source and expose it in the hook input schema.
- Report `fork` for histories with a fork parent and `resume` for supplied histories without one.
- Continue dispatching `SubagentStart` for spawned subagents with either fresh or forked context.
## Testing
Add regression coverage for fork hook matching without duplicate startup context, resume hooks with supplied history, and `SubagentStart` context injection for fresh and forked subagents.
GitOrigin-RevId: 5ac1ae4ab8adcbbbceb8cb0ffb9b32b6402c585b
## Why
RMCP's standard input request union excludes custom methods, so tool continuations need explicit handling for OpenAI form elicitation and native user verification.
## What changed
- Route MCP `2026-07-28` tool inputs through the existing client service, preserving capability checks and verification response validation.
- Support `openai/elicitation/create` form and `openai/userVerification` inputs alongside standard MCP inputs, and return responses with the server's opaque `requestState`.
- Bound continuation rounds, back off for state-only responses, and reject unsupported or malformed inputs.
- Give concurrent verification prompts distinct cancellation ownership and release pending prompts and timeout pauses when the connection closes.
- Prevent session recovery from restarting a tool after submitting a verification proof while preserving authentication challenges.
## Testing
Add HTTP continuation tests covering mixed input types, proof validation, request metadata preservation, invalid requests, round limits, authentication challenges, session expiry after proof submission, and independent prompt cancellation. Add duplex transport tests for pending-input cleanup on cancellation and transport closure.
GitOrigin-RevId: b7db6d47fa0969b6a938220dfe3610e5ba5188b2
## What changed
Allow `Right` to open the selected task from the task list or an empty, focused composer. Preserve editor keybindings and guard against pending input, active popups, and offline state. Keep metadata editing unaffected and show the shortcut in navigation hints.
## Testing
Add regression tests for opening the current or highlighted task, preserving cursor movement and renaming, and preventing navigation while offline. Update snapshots to cover the new hints.
GitOrigin-RevId: 9fc01b62ad0829b964509ae6286a041fc4936b9d
## Why
Remote-control connections and queued operations must not carry over to a different signed-in user or account. Token refreshes for the same identity should preserve the live relay connection.
## What changed
- Scope relay state and authentication recovery to a login lifetime. Retire the session on logout or identity changes and leave remote control disabled until enabled again.
- Reject stale incoming messages and queued RPCs, and cancel pending remote-control operations when their authentication owner changes.
- Start replacement sessions with fresh client, replay, and enrollment state, and prevent retired sessions from publishing status into their replacements.
- Serialize enrollment and preference persistence across sessions, retaining write permits through caller cancellation and draining admitted writes on shutdown.
## Testing
Add regression coverage for same-owner refreshes, user and account changes, stale pairing and client-revocation work, unauthorized enrollment recovery after logging in again, and persistence during cancellation.
GitOrigin-RevId: 5e6ecd23588aab1e2e6168a21f575fb24bbb341c
