## Why
RPC sending and waiting do not depend on request or response types, and Markdown layout does not depend on the parser iterator. Share these implementations across typed calls and parser variants.
## What changed
- Extract `RpcClient::send_request_and_wait` into a non-generic async method, preserving registration before serialization and disconnected-client error precedence.
- Remove the iterator type parameter from `Writer` and pass iterators to event traversal methods, retaining static dispatch and dropping the parser before rendering state, including on unwind.
- Update streaming rendering and existing rendering tests to use the separate parser.
GitOrigin-RevId: 4cc07223111b7c08211028948d13fe04598f8fc7
## Why
Keep source locations available without full debug information in ordinary builds, and retain symbols until release packaging. macOS targets also need to avoid invoking `dsymutil` in Linux remote Rust actions where it is unavailable.
## What changed
- Set Cargo's `dev` profile to `line-tables-only` and let `ci-test` inherit it through `test`. Document environment overrides for full debug information.
- Patch `rules_rs` to use line tables for `fastbuild` and `opt`, full debug information for `dbg`, and no stripping in all three modes.
- Disable split debug information for macOS toolchains, matching Cargo's release policy.
GitOrigin-RevId: 9e92b28f9647cea7dd73084febd84726b1cee279
## Why
Repeated prewarm calls still prepared instructions, tools, and a prompt even when an existing WebSocket connection was already warm.
## What changed
Check for a previous request and a connection that is not known to be closed before startup prewarm preparation. Reuse this readiness check in `prewarm_websocket`, and record `ready` or `needs_prewarm` in the `codex.startup_prewarm.websocket_check` counter before preparation can fail.
## Testing
Extend the WebSocket resume test to verify that repeated prewarm calls skip instruction loading on a healthy connection, while a closed connection triggers preparation again.
GitOrigin-RevId: 6a1b361b36b4e7f16fb283e48a8ce4d4fb996ceb
## Why
History notes and image generation requests used default HTTP clients that did not carry the configured application network policy.
## What changed
Pass `Config::http_client_factory()` into both extension backends and create transports with `ClientRouteClass::Api`, so their requests honor application network restrictions and configured proxy behavior.
## Testing
Add regression coverage verifying that denied image requests never reach the server and that history notes context requests stop after the network policy becomes restrictive. Retain coverage for image file access restrictions.
GitOrigin-RevId: 7ba61fdc60fa1afe1842d869da9ccd744ab7d82f
## Why
Tool telemetry needs to distinguish product SKUs without turning arbitrary configuration values into metric labels.
## What changed
- Read `apps_mcp_product_sku` from the invoking turn when dispatching tools, replacing any stale SKU in the telemetry metadata.
- Add `product_sku` to tool call count and duration metrics and tool result log and trace events.
- Preserve `codex`, map other nonempty values to `other`, and omit the attribute for empty or missing values.
## Testing
Add coverage for SKU separation on a shared metrics client, normalization, and successful and failing dispatches with stale telemetry metadata. Extend export routing tests to check SKU attributes in logs and matching traces.
GitOrigin-RevId: 3fc58c9f7245fd5b65f7cba122e08d7ea838b2d6
## Why
Confirming an Astra model selection recursively polled the large event dispatcher on the TUI thread's stack.
## What changed
Unwrap `AstraSelectedFromModelPicker` before dispatching its model update, then trigger the sparkle afterward when eligible. Keep the eligibility check and model update in the same event so queued backend updates cannot turn a no-op confirmation into a sparkle.
## Testing
Add a regression test that confirms `gpt-6-astra` with `XHigh` reasoning on a thread with a 4 MiB stack and checks the resulting model and reasoning effort.
GitOrigin-RevId: 89df8b417a9fd0107ebb918edeb2d240b53d42bd
## Why
Exceeding the aggregate metadata budget previously replaced all tool result metadata with omission markers, discarding small results unnecessarily. Oversized results also lost resource-access evidence even when that evidence alone would fit.
## What changed
- Raise the executed-tool-call metadata budget per request from 32 KiB to 128 KiB while retaining the 32 KiB per-result limit.
- Reduce the largest result metadata first and stop once the request fits, preserving smaller results.
- Retain `openai/resource_access` when full metadata exceeds capture, request, or direct-call retained-history limits. Keep resource lists intact, and discard optional result metadata before sacrificing call records, source evidence, or completion markers.
## Testing
Add regression coverage for selective reduction, resource-access retention, serialized request size, and direct-call and Code Mode behavior. Update compaction and truncation tests for the larger request budget.
GitOrigin-RevId: 698e47dcbdd3351e9a031e45ea39053608a5a0e4
## What changed
- Move `Provider` and `RetryConfig` into `codex-client`, retaining re-exports from `codex-api`, and switch `codex-model-provider-info` to depend on `codex-client`.
- Move feature-state metric emission into `codex-core`, preserving its behavior while removing the `codex-features` dependency on `codex-otel`.
- Explicitly enable TLS features for `tonic` in `codex-config` and `reqwest` in `codex-http-client`.
- Enable `png`'s `zlib-rs` feature directly in `codex-utils-image` to keep encoded PNG bytes stable when WebSocket dependencies are absent.
GitOrigin-RevId: 91fd63ab01b55d516b3e80e3644d06af8d5a01f6
## Why
Appending output to the completion transcript and pending polling buffer under separate locks allows cancellation to interrupt a chunk update between the two buffers.
## What changed
Store both buffers in `OutputBuffers` behind a shared mutex and append each chunk to both while holding that lock. Polling drains only the pending buffer, while completion events read the retained transcript. Apply this to both local and exec-server output handling.
## Testing
Extend the repeated-drain test to verify that the completion transcript preserves the expected bounded output after polling drains the pending buffer.
GitOrigin-RevId: ef8519582937b0d8c42e46375226501338df4a01
## What changed
Return completed startup prewarm sessions to the client cache and schedule resume prewarm through the normal session setup path. Keep in-flight warmups shared, remove the separate nonblocking prewarmed checks, and simplify the prewarm handle to own a single task.
## Testing
Update the resume prewarm integration test to assert `User-Agent` and `x-codex-window-id` handshake headers while retaining coverage for connection reuse, response continuation, and reconnection after closure. Remove the assertion that healthy resumes skip instruction preparation.
GitOrigin-RevId: a9b6d4810aca9aba2e6e41df181b7d9d90474230
## What changed
- Cast `POSIX_SPAWN_SETSID` to the inferred flag type in the `ProcessMode::NewSession` branch.
- Use `LoaderOverrides::without_managed_config_for_tests()` for both cases in `project_layers_disabled_when_untrusted_or_unknown` so host-managed configuration does not affect the test.
GitOrigin-RevId: 1b27ac3ea139507d3f9402f4c2e3e63933c4d05c
## Why
ChatGPT backend requests could bypass the configured network policy by using a default HTTP client. Requests using captured credentials must also retain the corresponding account policy so revocation continues to block them.
## What changed
- Use the configured HTTP client factory for ChatGPT GET and POST requests, enforcing managed network policy while retaining cookies.
- Capture authentication and network policy together for app reads and plugin reads and installs, preserving that policy across the post-install configuration reload.
- Bind GET requests to the current account policy before loading credentials.
## Testing
Add regression tests for revoked account policies, blocked connector destinations, and network policy enforcement after configuration reload with a cached app client.
GitOrigin-RevId: 5298842eec9664af49df70e89624653d1452fb33
## Why
A previously used WebSocket can close while a thread is idle. Hosts need a way to prepare the connection before the next turn without repeating warmup on a healthy connection.
## What changed
- Expose `CodexThread::prewarm()` using the existing startup warmup and next-turn handoff.
- Reuse healthy connections and pending warmups, retry failed warmups, and repair closed connections. Treat a finished WebSocket reader task as a closed connection.
- Skip scheduling during an active turn or shutdown, and stop warmup admission before shutdown takes the pending task.
- Expose `active_turn_environment_selections()` so hosts can inspect the environments captured by the active turn, including those still starting or failed, when authorizing steering.
## Testing
Add regression coverage for repeated idle prewarm calls, healthy connection reuse with preserved response continuation, reconnection with `generate: false`, and warmup rejection after shutdown. Update delayed MCP discovery coverage to verify prewarm repairs an eagerly closed socket and the first turn reuses it.
GitOrigin-RevId: aa164b91a399de2375eda3bf28397725439fce93
Use `tokio::select!` to listen for shutdown alongside `ws_stream.next()`
in the test server's request loop, allowing the server task to exit when
shutdown is requested while waiting for the next client message.
GitOrigin-RevId: ef77ae64322ab3bdf9b624645a9062a2a9f827cc
Drop the unused command receiver immediately in
`next_event_surfaces_lagged_markers`. Keeping it alive lets `shutdown()`
enqueue a command that nobody handles, causing it to wait for the response
timeout before completing.
GitOrigin-RevId: ce9e13b6f097d4545517ed465c1d3e2343c3d4da
## Why
Registered Windows sandbox setup could appear complete even when Windows rejected the stored account passwords. Checking account flags alone did not detect these failures before runtime logon.
## What changed
- Check stored credentials for both offline and online accounts before reusing completed setup during non-refresh provisioning.
- Classify logon failure, expired-password, and password-change-required errors as `SandboxAccountCredentialMismatch`, preserving the underlying Windows error.
- Trigger full setup to rotate credentials only after verifying that recorded account SIDs still match. Propagate credential-file and policy errors without triggering password repair, and skip credential checks for refresh-only requests.
## Testing
Add tests for native error classification, missing credential files, healthy credentials, password failures on either account, policy failures, and rejection of repair when account ownership validation fails.
GitOrigin-RevId: b3aa02f82841dd2605b0c3585ec93144727721e6
Create a temporary `.curlrc` containing `retry-all-errors` and set
`CURL_HOME` for the DotSlash installer in the shared CI setup action.
GitOrigin-RevId: 920a71c1d1e42016e46c3dd01baa97e082cb4045
## What changed
Call `ensure_rollout_materialized` after recording pending inter-agent communication, using the supplied persistence context. This also triggers the first execution checkpoint when an agent message starts the first turn.
## Testing
Extend the first-input persistence test to cover inter-agent communication, checking that the checkpoint is requested and sampling proceeds while durable metadata is blocked. Verify that prepared context precedes the agent message and that its author and recipient reach the model.
GitOrigin-RevId: 55779edb1a38fcf4d1c1cff24c09f5a810460c3d
## What changed
Remove the session-level capture mode and make thread-owned retained context the default throughout history management. Simplify input ordering, compaction identity preservation, fork handling, and approval freshness checks by removing legacy capture branches.
Keep checkpoint compatibility review separate: unknown or incompatible checkpoints can still use legacy review while retaining user evidence. Set the already-removed `guardianv2.thread_context` feature's default to false and remove redundant opt-out test variants.
## Testing
Update checkpoint tests to exercise legacy review through restored checkpoint data. Adapt existing compaction, resume, rollback, and fork tests to use unconditional context capture.
GitOrigin-RevId: ab23a0d7aca71d5a103458cff8b0c68137dd9708
## What changed
Always use `GuardianContextMode::ThreadOwned` for session capture and subagent history forks, regardless of `guardianv2.thread_context`. Continue selecting reviewer policy from saved checkpoints, preserving legacy review for incompatible checkpoints and removing the feature gate from reviewer compaction compatibility checks.
## Testing
Update coverage for unconditional retained context across compaction, resume, and subagent forks. Exercise legacy review with saved checkpoints, and verify that local and managed opt-outs do not disable sender context capture or checkpoint migration.
GitOrigin-RevId: cd74e2029c83f12bc655b6563242d06f29dd46af
## What changed
Use retained root context for subagent authorization reviews, removing the separate legacy history path. Remove the runtime `request_user_input` answer buffer and its response counter; authorization versions now track the user-message revision and retained-context completeness.
## Testing
Update authorization and input-handler tests to exercise retained context, and add coverage for the `user_messaging` connector in subagent reviews.
GitOrigin-RevId: 00ad151cf71b843af0e82ae90cbcf559d0c65f89
## What changed
- Deprecate and ignore `features.guardianv2.thread_context`, including profile overrides, with a migration notice. Ignore managed requirements for the removed flag with a warning.
- Preserve surviving legacy root instructions across compaction and resume when retained instructions are incomplete. Include unmatched instructions in worker authorization context with an explicit unknown-ordering notice, without replacing newer retained facts or expanding the reviewer's model window.
- Use surviving source calls to roll back verified answers from older checkpoints that lack acceptance-order metadata.
## Testing
Add regression coverage for legacy instruction recovery, compaction and resume, source matching, and answer rollback around same-turn user input. Update configuration and Guardian review tests to verify that the deprecated opt-out still uses thread-owned context and rejects incompatible compaction evidence.
GitOrigin-RevId: a65936c9e0b912e7667d1385a2ec53df726565de
## What changed
- Define `capabilities/discoverV2` request and inventory types and advertise `capabilityDiscoveryV2` in executor metadata.
- Prewarm installed plugin and global skill locations at server startup, with nonfatal scan failures.
- Add sandbox-scoped discovery caching with file watcher invalidation and request-time reloads when watching is unavailable.
- Batch metadata reads through the filesystem sandbox helper and bound discovery responses to 4 MiB and 2,048 capabilities.
- Share plugin identity and installed-version selection in `codex-core-plugin-common`, and fall back to `.app.json` when a plugin does not declare an apps configuration.
The V2 discovery manager is not yet wired into RPC request dispatch.
## Testing
Add coverage for inventory metadata, sandbox cache isolation, watcher invalidation, startup scan failures, response limits, and compatibility with older executor metadata.
GitOrigin-RevId: a223a5bc15fdf251023c0c71f468fd92c3b2d847
## Why
Detached work can keep request spans open beyond response enqueueing. Record explicit phase timings to distinguish request handling from the full span lifetime.
## What changed
- Record server dispatch and response enqueue offsets from request receipt, plus a response enqueue event for HTTP responses that bypass the dispatcher.
- Emit client request enqueue and response receipt events, including success or server-error outcomes and reader-to-caller delay. Carry completion timestamps to the awaiting task so receipt events retain its tracing context.
- Add spans for process startup, sandbox preparation, shell snapshot preparation and capture, and process spawning. Record process identifiers only when nonempty and at most 64 bytes long.
GitOrigin-RevId: 237db898b3284fe8a6a36cb0055b3c7991d8e8a4
## What changed
Add `ModelRequestContributor` and `ModelResponseInterceptor` to the extension API. Contributors can add filtered `client_metadata` without overwriting existing or reserved fields and create interceptors for individual requests.
Wire contributors into HTTP and WebSocket requests, distinguishing generation from warmup. Apply response interceptors in registration order before tracing and response bookkeeping so transformed output is recorded consistently. Interceptors can inspect, buffer, or transform events, with stream ownership carrying request state and cancellation.
## Testing
Add tests for metadata protection, incremental event transformation, interceptor ordering, upstream cancellation, and consistency between delivered output, traces, and WebSocket bookkeeping. Integration tests cover output gating and interruption over HTTP and WebSocket, including a contributor that bypasses gating for warmup requests.
GitOrigin-RevId: d4bc1745d2cacf8636728dbc0a58ab9f250e9392
## Why
Flowcharts with labels such as `A["Review & confirm"]` fell back to source display instead of rendering a diagram.
## What changed
Accept double-quoted node and edge labels, strip the surrounding quotes, and allow literal ampersands in flowchart labels. Keep other diagram families' label restrictions and continue rejecting HTML, entity escapes, and malformed quotes.
## Testing
Add parser and renderer regression tests for quoted labels, literal ampersands, statement separators, and unsupported text, plus TUI coverage for rendered labels and entity source fallback.
GitOrigin-RevId: 9e61a04665f0266d369fa3595411c9a72f10cb9d
## Why
MCP resource helpers use fixed descriptions and parameter schemas, preventing the model catalog from supplying model-specific guidance.
## What changed
Add `model_messages.tools.mcp_resources` entries for `list_mcp_resources`, `list_mcp_resource_templates`, and `read_mcp_resource`. Resolve these entries for the current model when constructing tool specs for direct calls and Code Mode.
Descriptions and parameter schemas override independently. Preserve bundled defaults for missing fields and fall back to bundled parameters with a warning when a supplied schema is invalid. MCP resource execution remains unchanged.
## Testing
Add unit coverage for independent overrides, literal descriptions, and invalid-schema fallback. Add integration coverage for resource discovery and reading through direct calls and Code Mode, plus assertions that resource tool specs follow model changes between steps.
GitOrigin-RevId: 40b5beddb38b2b61c19dc9cd6013d6ba5d756dbc
## Why
Incomplete setup for the installed app reported the same error as an owner mismatch or removal in progress, obscuring the need to retry sandbox setup.
## What changed
- Distinguish owner mismatch, Codex home mismatch, removal in progress, and incomplete setup when authorizing the registered runner receipt.
- Tell users to retry sandbox setup when the receipt is not ready for the installed app.
- Add operation and account context to provisioning failures, including account logon, profile preparation, package queries, alias resolution, and registration persistence.
## Testing
Add a unit test covering distinct authorization errors and their precedence, acceptance of a ready receipt, and rejection after the app package changes.
GitOrigin-RevId: 4e7620c4670e8b02a411a176cc89bd72dcd6e478
## Why
Windows 10 rejects the Object Manager drive-letter link when opening a directory with `OBJ_DONT_REPARSE`, preventing ordinary local-drive paths from opening successfully.
## What changed
Resolve drive-letter aliases with `QueryDosDeviceW` before calling `NtCreateFile`. Accept only direct disk-volume mappings, rejecting other devices and volume subpaths. Leave filesystem components unresolved so `OBJ_DONT_REPARSE` continues to reject filesystem reparse points.
## Testing
Add tests for drive-root opens and NT path construction using ordinary and verbatim drive paths, plus validation of accepted disk-volume mappings and rejected device or subpath mappings.
GitOrigin-RevId: 2fe81913a7ac8d0122ec423db5750e80241def56
## Why
Channel tools use bundled descriptions even when the model catalog supplies tool messages. Let their descriptions follow the active model, including model changes within a turn.
## What changed
- Add channel tool entries to `MultiAgentToolMessages` and pass them to the message board extension for each step.
- Apply catalog descriptions while retaining bundled text for missing or null values and honoring empty strings. Ignore parameter overrides with a warning and keep bundled schemas.
- Clarify bundled descriptions for channel discovery, thread reading, posting, and subscription notifications.
## Testing
Add coverage for full and partial overrides in namespaced and Code Mode tools, preserving Code Mode declarations and parameter schemas. Extend the mid-turn model-change test to verify that the `post` description follows the active model.
GitOrigin-RevId: fca20bed1203d5214713f82cb16a91eeebb38f56
## Why
Output produced before the streaming subscriber attaches can be missing from command completion events, even when it was returned to the model.
## What changed
Record the bounded completion transcript directly in `UnifiedExecProcess` as local and exec-server output arrives. Keep it independent of output polling and streaming delta delivery, and use it for completion events.
## Testing
Add regression coverage for output collected before subscription, both with and without later output. Strengthen the lifecycle test to assert that `aggregated_output` includes both early and late output.
GitOrigin-RevId: 9825acbd706dc4845837c8b4ab1347d8267ce0af
## Why
The default transport fallback bypassed managed application network policy when using `ReqwestDefault` proxy handling or running inside the Codex sandbox.
## What changed
Use a `RouteAwareClientPool` whenever application network policy is managed, retaining policy enforcement for requests and redirects while preserving legacy proxy behavior and custom CA fallback.
## Testing
Add code mode web search regression cases for denied initial requests and denied redirect destinations, verifying that policy errors reach tool output and no requests reach the denied destination.
GitOrigin-RevId: 74ba0e6e4dcad03f3e83c0450b8b17bcefcc267c
## Why
Tool lifecycle observers need visibility into calls rejected before execution starts and timing that remains available on cancellation, independently of tracing settings.
## What changed
- Add `on_tool_dispatch` and `on_tool_timing` callbacks to `ToolLifecycleContributor`, with thread, turn, and call IDs for correlation.
- Report direct calls before readiness, dispatch waiting, and hooks. Report handler duration when dispatch completes or is dropped, excluding readiness and gate waiting and returning zero if the call never passes the gate.
- Expose code-mode host durations as a separate `HostOperation` timing boundary. Exclude nested code-mode calls from dispatch and handler timing observations to avoid double counting.
## Testing
Add tests for callback ordering on completed and rejected calls, timing on cancellation, zero handler duration before gate admission without tracing, and code-mode host timing without nested dispatch or handler timing observations.
GitOrigin-RevId: 97998b5094564c13cb2cfad089bb0a9d6615eb5c
## What changed
Use a dedicated default catalog for Bedrock Mantle endpoints whose host starts with `bedrock-mantle.us-gov-` and ends with `.api.aws`. Include only GPT-5.6 Terra, GPT-5.6 Luna, and GPT-5.4, with GPT-5.6 Terra as the default.
## Testing
Add model picker snapshot coverage for `us-gov-west-1` and `us-gov-east-1`. Update the configured-catalog test to use a GovCloud endpoint, verifying that a custom catalog is preserved while service tiers remain normalized.
GitOrigin-RevId: 5f22ba6983bd60be52d8845c9709112a4766839d
Update the Bazel release archive version and checksum from `0.153.1` to
`0.156.1`, and point `exec-server-stable-release-test` at the new archive.
GitOrigin-RevId: 1d28566d2447c027a67c4197b213458a0838fde0
## Why
Linux descriptor cleanup used allocating directory enumeration after `fork`. The child needs allocation-free cleanup while preserving Rust's spawn-error channel until `exec` succeeds.
## What changed
- Mark unrelated descriptors close-on-exec with `close_range(CLOSE_RANGE_CLOEXEC)`, leaving stdio and explicitly preserved descriptors' flags untouched.
- Fall back to stack-backed `getdents64` enumeration of the child's descriptor table when `close_range` fails.
- Document best-effort cleanup: failures allow launch to proceed and may leave unrelated descriptors inherited.
## Testing
Add Linux tests for descriptor inheritance, unsorted and duplicate allowlists, unchanged parent descriptors, fallback cleanup above a lowered descriptor limit, preserved exec-error reporting, and successful launch when both cleanup paths fail. Retain MCP coverage for descriptor exclusion in servers and descendants.
GitOrigin-RevId: 13abb95f82557324c7b40feb36bd6f806d60674e
## Why
Selected rollouts can reference history stored in ancestor rollouts through `history_base`. Attaching only the selected files leaves that inherited history out of diagnostic reports.
## What changed
When `include_logs` is enabled, follow nested `history_base` references and attach ancestor prefixes up to the recorded byte offsets. Deduplicate ancestors, retain the largest requested prefix, and skip rollouts already selected for upload.
Bound discovery to 64 ancestors and five seconds, and enforce attachment size limits. Missing, unreadable, or incomplete ancestor prefixes are best effort and do not prevent the report upload.
## Testing
Add a unit test verifying that nested parent and grandparent history bases are attached with the expected filenames and contents.
GitOrigin-RevId: d9bba3e50573d25843d2eaedeae775946223ed0e
## What changed
Add `otel.log_agent_responses`, disabled by default and requiring an OTLP HTTP or gRPC log exporter. Emit `codex.agent_response` for completed `final_answer` messages from main agents and spawned task agents, with session, turn, item, and available parent/root attribution.
Strip memory citations from exported text, preserve the stored answer, and cap responses at 64 KiB on a UTF-8 character boundary. Include the original byte length and a truncation flag, and suppress duplicate item completions within each turn. Exclude commentary and non-task agents.
## Testing
Extend configuration tests for default-off and explicit opt-in behavior, the agent execution test for main/subagent response attribution, and the log-buffer test for response-event exclusion.
GitOrigin-RevId: eacda1150de2e6bac2c667d71b57214b0a086f1a
## Why
App-server clients need a way to connect to executors that require bearer authentication through `environment/add` and `environments.toml`.
## What changed
- Add optional `authBearerToken` to `environment/add` and `auth_bearer_token` to URL entries in `environments.toml`.
- Send the token as an `Authorization: Bearer` header on initial connections and reconnects, without automatic refresh. Require `wss://` or a loopback destination when a token is supplied.
- Redact tokens in debug output, mark connection headers sensitive, and omit source text from TOML parse errors.
- Preserve unauthenticated behavior when tokens are omitted, including requests with a null `authBearerToken`.
## Testing
Add integration coverage for authenticated and unauthenticated executors through both RPC and TOML configuration, including missing, null, incorrect, and malformed RPC tokens. Extend tests for reconnect authorization headers, token redaction, URL-only token configuration, and timeout preservation.
GitOrigin-RevId: 2a5d48a1846df1720e4a9b295968348378c287c6
## Why
The Browser connector on `codex_apps` needs the computer-use policies and review handling already applied to `node_repl` and `cua_repl`.
## What changed
- Classify `connector_openai_browser` using registered tool metadata and preserve its computer-use scope through Guardian review.
- Extend confirmation-policy forwarding, review evidence capture, JavaScript execution tracking, and initial-call approval handling to the Browser connector.
- Correlate Browser elicitations with live invocations so nested actions retain their own review identity while assessments are attributed to the originating call. Require verified Browser identity for strict nested review.
- Include the Browser connector in computer-use policy prompts and bundled model messages.
## Testing
Add integration coverage for ordinary and strict Browser nested reviews, including policy injection and action attribution. Verify strict review declines requests with missing or unknown invocation correlation or a non-Browser registration.
GitOrigin-RevId: b04af6fb9db1bac2203dc4265913d210746df90b
## What changed
Add `model_messages.tools.indirect_description_prefixes` with selectors for exact namespaces and configured MCP server names. Apply the selected model's guidance to namespace documentation embedded in `CodeModeOnly` prompts, `ALL_TOOLS` descriptions, and namespaces returned by tool search.
Trim prefix values, treat empty values as no prefix, and reject conflicting selectors for the same namespace. Apply prefixes during rendering so model changes take effect without altering direct tool specifications, search ranking, or tool dispatch.
## Testing
Add unit tests for prefix normalization, namespace grouping, MCP server mapping, and conflicts. Add scenarios covering both Code Mode variants, clearing prefixes on model changes, unchanged tool dispatch, and conflict rejection before a model request.
GitOrigin-RevId: 0c7ce6d418c775945c2ccfdab3c605fa4d431b55
## Why
HTTP retries used local backoff even when the server supplied `Retry-After`. Relative retry delays also failed to account for time spent propagating errors or reporting retries.
## What changed
- Parse `Retry-After` delay seconds and HTTP dates into a monotonic deadline captured when response headers arrive.
- Honor that deadline for HTTP retries, falling back to local backoff when valid advice is absent.
- Preserve deadlines through API and Bedrock error mapping, stream retries, and exhausted retry state. Expired advice remains a zero delay instead of triggering local backoff.
## Testing
Add coverage for header parsing, deadline countdown and expiry, error mapping after exhausted HTTP retries, and delayed stream retry notifications. Update Responses and remote compaction tests to verify that HTTP retries honor `Retry-After`.
GitOrigin-RevId: a2eff02946e5524f29e06f7ba1431e3d339261a4
## What changed
- Add `tui.copy_on_select` with `auto` (default), `always`, and `never` modes, and apply it to the fullscreen transcript, transcript overlay, and resume/fork previews.
- Enable `auto` in tmux and Zellij, and in direct macOS terminals except Ghostty and Kitty. On other platforms, enable it in direct terminals identified as iTerm2 or Terminal.app.
- Copy nonempty mouse selections on release, including word and line selections, while retaining their highlight. Preserve link activation and ignore empty selections.
- Clear composer selections after confirmed keyboard copies, matching right-click copies, while preserving the draft and cursor. Keep selections when copying fails or delivery is unconfirmed.
## Testing
Add coverage for terminal defaults and configuration overrides, copying on release, retained highlights, repeated clicks, link activation, and empty drags. Extend composer coverage to verify selection clearing for `Cmd-C`, `Ctrl-C`, and right-click across clipboard outcomes.
GitOrigin-RevId: 24e6f9e267ef3ab249c5356db736e094127f68b8
## Why
Transient connection and registry failures can reach remote filesystem callers as generic `io::ErrorKind::Other` errors. Callers need a typed signal to identify failures that read-only preparation can retry.
## What changed
- Add `ExecServerError::is_retryable_preparation_error()` to classify transient registry, connection, handshake, timeout, and session-attachment failures, including errors wrapped in `ConnectionAttempt`.
- Map these failures to `io::ErrorKind::BrokenPipe` in the remote filesystem adapter.
- Keep authentication, TLS, and malformed protocol failures outside the retryable classification; error text alone does not trigger it.
## Testing
Add a regression test showing that a wrapped registry service-unavailable error maps to `BrokenPipe`, while a protocol error containing transport-closed text remains `Other`.
GitOrigin-RevId: c3e1bbab8f977a0b421eba5d6d3071ada72c09ff
## Why
Startup prewarm waited for tool discovery before opening its WebSocket connection. Slow MCP startup therefore delayed connection setup even though the handshake could proceed independently.
## What changed
- Run the WebSocket handshake concurrently with tool capture, then send `generate=false` with the discovered tools and finalized request metadata.
- Include model and effective service-tier routing hints in preconnect, including the inherited tier for spawned subagents. Omit routing hints for guardian reviewer requests.
- Recover authentication failures during preconnect and switch to HTTP fallback on `426 Upgrade Required`.
## Testing
Add and extend regression coverage for handshake overlap with delayed MCP discovery, cancellation before warmup, finalized Responses Lite tool metadata, socket reuse and reconnection, service-tier changes and inheritance, and authentication recovery during preconnect.
GitOrigin-RevId: ecb53540765df8227e55e79910a13a05260a4c8d
## What changed
Use `agent_control.resolve` for message board agent lookups and path validation instead of accessing `local_agent_runtime` directly. Derive paths from the session source, with a root fallback, and verify that each path resolves to the agent that owns it.
Validate the requested caller's thread for path and clock queries, and apply the same path ownership check to notification recipients.
GitOrigin-RevId: 92632a31b493b6519d2154f49e9d1d4a1019b394
## Why
Actions targeting a secondary environment could be reviewed with the primary environment's denied-read restrictions. Each review needs the permission context of the environment that owns the action, including when a Guardian session is reused across environments.
## What changed
- Carry `environment_id` through environment-scoped approval requests and their planned-action JSON.
- Select and label permission context using the target environment, explicitly stating when it has no denied-read paths or globs.
- Reject reviews for unavailable target environments and reject environment IDs longer than 256 bytes before Guardian inference, while preserving manual approval routing for oversized IDs.
## Testing
Add coverage for `exec_command`, `apply_patch`, and `request_permissions` reviews switching environments while preserving the existing review prefix. Extend tests for environment-specific restrictions, unavailable environments, action serialization, and the 256-byte ID boundary.
GitOrigin-RevId: ad3292edddb1c6f5b180142c6857cba6f1308328
## What changed
Add `AgentControl::ensure_child_loaded` and use the parent's configured agent control in `ThreadManager` to reload recorded V2 children. The local implementation delegates to the existing loader using the live parent's current configuration, preserving parent-controlled restoration without sending input.
GitOrigin-RevId: 67cadf79cbc034eb271c5ae13145f1a42722fe69
## Why
Enabling `features.token_budget.use_history_notes_extension`, explicitly or through model defaults, rejected session startup when the model lacked `supports_experimental_context`, even with experimental mode disabled.
## What changed
Remove that startup restriction so token-budget history and notes can be used independently of the model's experimental context capability.
## Testing
Extend core tests to cover explicit configuration and model defaults on startup and cold resume, checking `new_context`, token-budget contexts, and `history_ingest_requested` metadata. Add app-server coverage for native history and notes tools and context-window hints without experimental context capability.
GitOrigin-RevId: 6157479aeb75ffd785b8d4b2f48b11c6f46e8f35
## Why
Messages sent through the singular `user_message` connector were omitted from Guardian's delivered assistant message evidence because only `user_messaging` tool names were recognized.
## What changed
Accept both namespaced and flat `user_message` forms of `send_message` alongside the existing `user_messaging` forms.
## Testing
Extend Guardian subagent authorization tests to cover the singular connector and flat tool names, including blocked post-tool hooks and cancellation before confirmation. Add a negative case ensuring `send_message_to_thread` is not treated as delivered message evidence.
GitOrigin-RevId: 68495642ef4b78eec71df4fee2bacfda407adc47
Ahmed Ibrahim