## What changed
Add optional `TurnInputRequest.user_item_uuid` and carry it through turn starts and steering to the recorded user message. When supplied, use `msg_input_<uuid>` as the Responses item ID; inputs without a UUID retain generated IDs. Raw response items ignore this field.
Add `ResponseItemId` helpers to construct and recognize the reserved `msg_input_` namespace.
## Testing
Add regression coverage for steered inputs with identical text and client IDs, checking that each supplied UUID survives recording and UI item IDs remain distinct. Add a scenario test verifying that the assigned ID reaches Responses and persists in subsequent request history alongside an identical ordinary prompt.
GitOrigin-RevId: 440e306bfdaa7facb69b21930c5244a83db2fdae
## Why
A concurrent fork can inherit a PID reservation probe's file descriptor and keep its lock held after the probe closes it, making a stale reservation appear active.
## What changed
Add a drop guard that explicitly unlocks empty PID reservation probes on Unix, including when inspection fails or is cancelled.
## Testing
Extend the duplicated-handle regression test to cover empty PID files, read errors, and cancellation alongside missing PID files. Verify that cancellation occurs while the lock is held and that subsequent status checks do not report an active reservation.
GitOrigin-RevId: 793569c9bcaca02900662a66c33aa48f2bebfd5e
## What changed
Add `ReviewerPool::review_isolated` to run a review in a temporary session without reading or changing the reusable reviewer. Build the request context without a previous session and spawn without a cached snapshot.
## Testing
Add a test verifying that an isolated review receives no snapshot, uses a separate session, and preserves the prewarmed session for the next regular review.
GitOrigin-RevId: 6cceff0c399f30f3c3303b0bf5232c274c902e3a
## What changed
Keep original scheduled messages and heartbeat provenance during synchronous transcript collection. Add `prepare_sync_context` to compress repeated heartbeat instructions across the complete collected transcript before selecting the requested suffix, preserving reference numbering in full and delta prompts.
Route synchronous reviewer prompts through this preparation step and reject composition of unprepared scheduled messages. Move transcript profiles and REPL evidence rendering into the preparation module. Asynchronous heartbeat compression remains in collection.
## Testing
Extend heartbeat transcript coverage to compare prepared full and delta prompts with the existing rendering and verify that direct composition rejects unprepared scheduled messages.
GitOrigin-RevId: c9824b8862021301a1f537a74f83bc7eb20aa0ad
## What changed
Add selectable `profile` and `provider` items to the TUI status line, including setup previews and theme colors. Render them as `profile: <name>` and `provider: <id>`, omitting the profile when unset and the provider until a thread is active. Accept `model-provider` as an alias for `provider`.
## Testing
Extend status line tests to cover omitted values, the active thread's provider, provider updates, and a selected profile. Update the setup popup snapshot to include both items.
GitOrigin-RevId: e7cbb7fb1e7017cfbd6ee71e1df7d0ddb1836ed4
## What changed
Use directory-entry file types when expanding volume-root grants, and resolve metadata only for symbolic links. Skip links whose targets cannot be resolved, while preserving grants for ordinary children and valid links.
## Testing
Extend the volume-expansion test to cover dangling and self-referential links alongside an ordinary file, a valid symbolic link, and an explicit deny grant.
GitOrigin-RevId: 8acb4072a1f5edd4351738b5780ac659fdf94f01
## What changed
- Add `accountSession/list` and `accountSession/switch` for the active managed ChatGPT login, with optional workspace membership refresh.
- Validate membership and workspace policy, pause new turns, and unload running threads before switching credentials. Notify clients with `thread/closed` and `account/updated`; selecting the current workspace leaves threads running.
- Support browser sign-in for SSO through `allowBrowserLogin`, binding the callback to the requesting login and workspace. Require a separate sign-in for government workspaces.
- Preserve the selected workspace across token refresh and conditionally restore the previous workspace if routing validation fails. Guard credential writes against concurrent login or logout changes.
## Testing
Add app-server and auth tests covering workspace switching, credential preservation, policy and identity rejection, conditional rollback, stale sessions, and SSO callback validation.
GitOrigin-RevId: 1234abc33b71e69b66318da3e201fccc08867906
## Why
Replacing the Node process lets the native binary receive signals and report its termination directly.
## What changed
- Use `process.execve` on non-Windows platforms when available, preserving CLI arguments and the prepared environment.
- Install a `SIGXFSZ` handler before replacement so the native binary gets the default signal disposition instead of inheriting Node's ignored signal.
- Retain asynchronous spawning for Windows and older Node versions.
## Testing
Extend the exit-status test to check that `execve` leaves no child process and that `SIGHUP` and `SIGXFSZ` terminate it with the original signal, while retaining coverage for the spawn fallback.
GitOrigin-RevId: 7437f15af419fce5b10c1c00425c7d38160991fc
## Why
A concurrent fork can inherit a PID reservation probe's file descriptor and keep its lock alive after the probe closes it. This can make the app-server daemon appear to be starting even when no live startup reservation exists.
## What changed
Explicitly release the probe's lock on Unix before returning that no reservation is active, and propagate unlock failures.
## Testing
Add a regression test using a duplicated file handle to simulate fork inheritance and verify that the probe leaves the daemon inactive. Extend coverage to confirm that a held reservation still reports `Starting` when the PID file is missing, and include pruning results in release-retirement assertion failures.
GitOrigin-RevId: ecc58df1fe5cadecb6ed658352f1300c39237358
## What changed
Move planned-action construction from the core Guardian prompt builder into the exported `codex_guardian_reviewer::build_guardian_planned_action` helper. Keep the existing action kinds, MCP tool and connector descriptions, and reason selection unchanged.
GitOrigin-RevId: 119323523ed2e199c998c1139fb8e6255bc730d9
## What changed
- Add `--codex-ui-plugin-process` to `codex-code-mode-host` and a typed protocol for initializing, invoking, and closing UI plugin isolates.
- Support persistent module state and string results from synchronous or promise-based exports across up to 32 isolates in one helper process.
- Require sandbox-enabled V8 with JIT disabled, restrict executable loading and globals, and enforce execution deadlines and per-instance queue, source, result, and promise limits.
- Close affected isolates on script failures, cancellation, or overload, and return bounded script diagnostics.
- Bump the helper handshake to version 3 and increase the maximum frame size to 1 MiB.
## Testing
Add wire-level integration tests and runtime unit tests covering promise settlement, cancellation, loading restrictions, diagnostics, failure isolation, capacity reuse, transport bounds, and watchdog synchronization. Add CLI tests for argument validation before helper startup.
GitOrigin-RevId: bad6a57c84d9197c1fd76a78cf060502c5bc8bb8
## What changed
Move executor path-convention selection from the approval caller into `ReviewAction::from_approval_action`, using the supplied `GuardianReviewContext`. Preserve Windows and POSIX rendering based on the executor OS, with path inference for legacy executors that do not report an OS.
## Testing
Update the command approval test to exercise `ReviewAction` with Windows, Linux, and legacy executor contexts, checking both approval JSON and assessment working directories.
GitOrigin-RevId: b13fad1d4033976cb94b899b62a3779c97e171fa
## What changed
Move approval-request assessment and analytics mappings, target item lookup, and turn ID selection into `codex-guardian-reviewer`. Export the helpers from the crate and re-export them in core, preserving existing behavior.
## Testing
Move the apply-patch serialization test into the reviewer crate. It checks that Windows paths are preserved and patch text is omitted from the assessment action.
GitOrigin-RevId: 3a011db0bc51c653bb0877c4b0cb52eb61c63244
## Why
Copying in a WSL SSH session with X11 forwarding should use the forwarded display's clipboard instead of writing to the Windows host clipboard.
## What changed
Treat a nonempty `DISPLAY` in an SSH session as X11 forwarding and bypass the Windows clipboard backend on WSL. Keep terminal clipboard forwarding in place.
## Testing
Add a regression test that verifies a WSL SSH session with X11 forwarding uses the native clipboard without invoking the Windows clipboard backend.
GitOrigin-RevId: 29f98dc39e5851d63d0459a55e234346167da26f
## Why
macOS `lsof +D` can return status 1 even when it finds open files, causing release cleanup to be skipped. It can also escape non-ASCII installation paths, preventing full-path matching from recognizing releases in use.
## What changed
Accept `lsof` status 1 while preserving matches, and continue to reject other failures or any stderr. Match the installer-owned ASCII path suffix on macOS and recognize processes whose working directory is the release root. Apply these checks before and after moving a release for deletion.
## Testing
Add coverage for `lsof` exit statuses, output, and errors. Exercise release retention with a non-ASCII installation path and, on macOS, a process holding the release directory open.
GitOrigin-RevId: 06181467c7d1bb256b6781241a444976b890d7c9
## Why
Restoring killed text should restore its local image attachments along with their placeholders.
## What changed
Keep image paths in the composer's kill buffer, including across composer replacement, and restore attachments with fresh labels when text is pasted back. Preserve plain-text insertion in Vim Replace mode so per-character recovery continues to work.
## Testing
Add regression coverage for restoring images after submission, transferring the kill buffer between composers, and preserving existing images and Backspace recovery in Vim Replace mode.
GitOrigin-RevId: 9bc052a1b372d5a1245ddc54c7ffafee4a637494
## What changed
Recognize `\%` as a literal `%` in inline and display math, so expressions such as `$3.8\%$` render as `3.8%`.
## Testing
Extend inline and display math snapshots to cover escaped percent signs, including an inline expression with multiplication and a fraction.
GitOrigin-RevId: a0f9935dc8492fe1cd5a0d33d62930c48c5433b8
## What changed
Add the disabled-by-default `omit_skill_descriptions` feature flag to omit descriptions from model-visible host, executor, and cloud skill catalogs while retaining names and locators. Adapt catalog introductions, usage instructions, and alias budget accounting to the selected policy.
Persist the description policy in catalog snapshots and refresh usage instructions when it changes. Ignore description-only edits in catalog deltas while descriptions are omitted.
## Testing
Add coverage for alias token budgets, policy changes with older snapshots, and suppressed description-only updates. Extend scenario snapshots to cover plugin visibility and catalog deduplication with descriptions omitted.
GitOrigin-RevId: 5bf1dcee8c04059c7a78998affc1efcdef8ec883
## What changed
- Retain captured root conversation sources until synchronous preparation applies request limits. Keep asynchronous snapshots limited to the bounded messages.
- Move approval-reason truncation and tool-description escaping and truncation from composition into preparation.
- Extract synchronous image preparation and admission into `guardian-context`, preserving the prompt token cap and model context-window checks.
GitOrigin-RevId: d3a864c77d8f16bd3e77df436d80c4d2738c43cc
## What changed
Move approval request serialization and model-visible action formatting from `codex-core` into `codex-guardian-reviewer`, expose both helpers publicly, and re-export them from core. Preserve the existing JSON shapes and formatting.
## Testing
Move the MCP tool-call and network-access trigger serialization tests into the reviewer crate, retaining coverage for omitted optional fields and Windows path rendering.
GitOrigin-RevId: c0093c023b2f4c1be16bac481f1173a5da6ac25c
## What changed
Export `GuardianPromptItems` and `compose_guardian_prompt` from `codex-guardian-reviewer`, and delegate prompt composition from core to the new helper. Core continues to collect context sections and choose the history version.
Preserve full and delta transcript selection, empty-transcript placeholders, cursor accounting, and Node REPL evidence sequencing.
GitOrigin-RevId: e3e2b2a87a42709ddb5441f47cbb7461b0130579
## Why
Migrating selected threads reads rollout headers even for unrelated threads. Use the state database to skip files whose indexed owner and canonical filename agree that they belong to an unselected thread.
## What changed
- Read thread IDs and rollout paths without creating or migrating the state database, and fall back to header inspection if the index cannot be read immediately.
- Keep inspecting selected, unindexed, misnamed, and conflicting paths so rollout headers still determine ownership.
- Recognize stable thread IDs in reverted rollout filenames and match plain and compressed paths when filtering.
## Testing
Add a regression test covering pruning of unrelated indexed rollouts, including archived and compressed files, while retaining header inspection for selected and ambiguously named files.
GitOrigin-RevId: d76827174c00f5bc9e38ad9b69dadeee91f4415f
## What changed
Export `GuardianApprovalRequest`, `GuardianNetworkAccessTrigger`, and
`GuardianMcpAnnotations` from `codex-guardian-reviewer` and re-export them in
core. Move environment lookup and scope classification with the request type,
preserving existing classification and credential-safe debug output.
GitOrigin-RevId: 5253a5124d5e370a1230b46aa7dc48b24b1c902e
## What changed
Move Guardian session-source detection, the reviewer name constant, and parent-thread prompt cache key generation into `codex-guardian-reviewer`. Re-export them from core, preserving existing behavior.
## Testing
Move the existing prompt cache key test into the reviewer crate, retaining coverage for parent-thread scoping, key length, and missing or inapplicable inputs.
GitOrigin-RevId: c14b3c030ba93676a0799aba56b23a676dbbc56d
## What changed
Extend the incremental Guardian review scenario with historical encrypted `send_message` calls in the default and custom tool namespaces. Add snapshots and assertions that both reviews retain each call and parent reply exactly once, in order, preserving call IDs, namespaces, and encryption metadata with a paired evidence-only output.
Verify that successive reviews reuse the same thread and append to the previous input. The scenarios use mocked ciphertext and decisions to check transport behavior, not backend decryption or authorization outcomes.
GitOrigin-RevId: a0927531b6cdae496fefa2a7f35032f7413807b6
## What changed
Add mock guardian approvals for setup handoffs in `handoff_scenario` when native multi-agent history is enabled. Match only the trailing `function_call_output` so historical handoffs cannot consume the final command's separate denial response.
Require five approval requests with native history enabled and none with it disabled.
GitOrigin-RevId: 7b14c97aa85adc63c4d3bf95014c44831eae1c85
## What changed
Make tool descriptions precede namespace descriptions in Code Mode execution and tool search. Mark `code_mode_tool_description_first` as removed and simplify cached definitions to depend only on the input schema budget.
## Testing
Update Code Mode integration assertions and catalog snapshots to expect tool descriptions before namespace descriptions.
GitOrigin-RevId: 1344d4c264d1d2b18ee0388a064b6813ca81f770
## What changed
Export `token_usage_delta` from `codex-guardian-reviewer` and use it in the core review session. Preserve the existing calculation, including clamping negative deltas to zero.
## Testing
Move the existing nonnegative token usage delta test alongside the helper in the reviewer crate.
GitOrigin-RevId: fcfce24b8d50a63dcd1122a4204939bc6750feda
## What changed
Add `GuardianScope::for_multi_agent_tool` and use it for both tool review requirements and asynchronous scoring. Classify `spawn_agent`, `send_message`, `followup_task`, and `interrupt_agent` as native tools when they match the configured namespace, accepting default namespace spellings when none is configured. Keep review enablement checks at each call site.
GitOrigin-RevId: 9180ccdc629532f6c171d899dc5881e15b447141
## What changed
- Recognize `policy_capacity_unavailable` in HTTP and streaming API errors and expose it as `policyCapacityUnavailable` through the app-server protocol and generated bindings.
- Display “Policy-restricted capacity is unavailable. Please try again later.” while preserving overload retry behavior based on `Retry-After`.
- Handle the new error in TUI overload rendering, reviewer retries, and error telemetry.
## Testing
Add coverage for HTTP and streaming error classification, retry advice, WebSocket terminal error attribution, protocol serialization, and TUI rendering with and without an upstream message.
GitOrigin-RevId: 1b9536fba1e11cc891dcf689aee35410d82f5412
## What changed
When `GuardianNativeMultiAgentHistory` is enabled, require Guardian review for wrapped Multi-Agent V2 calls to `spawn_agent`, `send_message`, `followup_task`, and `interrupt_agent`.
Include these calls in Guardian's asynchronous native-tool scoring scope, honoring the configured multi-agent namespace and preserving that configuration across overrides.
## Testing
Extend the incremental-review scenario with an encrypted, namespaced `send_message` call. Verify that the encrypted parent reply remains present exactly once in both Guardian reviews and the subsequent agent request, and update the snapshot to cover native tool-call review evidence.
GitOrigin-RevId: 2af9561b0d69af4a8f878fa32365ce845368e02d
## Why
Native multi-agent calls must stay intact for backend decryption during Guardian review.
## What changed
When `guardian_native_multi_agent_history` is enabled for multi-agent v2, preserve `spawn_agent`, `send_message`, `followup_task`, and `interrupt_agent` function calls in the configured tool namespace as native transcript items. Use `functions` when no namespace is configured.
Include the paired evidence-only output in token accounting, and omit native evidence whole when limits require it.
## Testing
Extend transcript tests to cover native call ordering, paired-output budgeting, and whole-item omission. Add a native-history snapshot alongside the existing text-history delegation handoff scenario.
GitOrigin-RevId: e7d9b4f5ea772890bf14b79fdb53b0f9d0a842e4
## What changed
Register `guardian_native_multi_agent_history` as an under-development feature,
disabled by default, and expose it in the configuration schema.
GitOrigin-RevId: d434750c1aa0cc78b36d1d661a4df0def5426f02
## Why
Custom OpenAI base URLs caused Codex backend authentication to lose Responses headers and Guardian metadata when the URL did not match a recognized backend route.
## What changed
Apply model-scoped Responses headers, Guardian reviewer and classifier markers, and eligible ChatGPT parent credit requests based on the OpenAI provider and authentication configuration, regardless of the base URL. Keep API-key requests and other providers excluded from this behavior.
## Testing
Extend coverage for custom `/v1` URLs and direct `/api/codex` endpoints with ChatGPT, header-based, and API-key authentication, including HTTP fallback and WebSocket requests.
GitOrigin-RevId: cc4bb5b4a1a6596904ecf8965237c7a4f09e112b
## What changed
Pass `PreparedExecCommand` through the process manager and runtime instead of copying command, shell, environment, and permission fields into separate request structs. Move approval requirement evaluation and approval action construction onto the prepared command, and use it for shell snapshots and launch failure events.
GitOrigin-RevId: 3e9f87e0974218fea6fffc0f7740616d696b9800
## What changed
Move argument parsing, working-directory and shell resolution, permission validation, and command lifetime setup into `unified_exec::preparation` with crate-visible parsed and prepared command types.
Update `ExecCommandHandler` to use the extracted preparation flow, preserving implicit skill event emission between parsing and preparation.
GitOrigin-RevId: 79e9be5d87c1b0ab905afdf1e343ac141fb7d4c6
## What changed
- Add `CoreToolRuntime::requires_guardian_review` to review opted-in function calls before dispatch and stop execution when review rejects the call.
- Deliver proposed calls as native review evidence, preserving encrypted argument metadata. When hooks rewrite arguments, review the updated arguments and discard the original encrypted replay content.
- Deduplicate native call evidence against reviewer history and include paired evidence outputs in input budgets.
- Keep review accounting and metrics for native calls without emitting action-specific client assessment events, and omit approval payloads from debug output.
## Testing
Extend regression coverage for rewritten native calls across review retries, denied calls that never execute their handlers, oversized native evidence, and review metrics without client events.
GitOrigin-RevId: c3b22c0220344581c2b38f233001abaed49cba34
## What changed
Add a parameterized app-server test that sets a paused goal after a worker has spawned and completed its first Guardian review, then asks the worker to check again.
Verify that a user-origin goal appears in the subsequent review's root authorization context as user-set, while an automatic-origin goal is excluded. Also assert that the initial review does not contain the later goal.
GitOrigin-RevId: 1d67c4a5481a717eac706b64ee714e7da2fc5511
## Why
Verified answers omitted because of request-size limits must be marked as missing. Legacy checkpoint messages also need to match retained excerpts after truncation so workers receive only one copy.
## What changed
Move root message preparation into `codex-guardian-context::prepare_root_context`, including handoff selection, shared message limits, legacy matching, and incomplete-context markers. Pass original legacy text into preparation and mark verified answers incomplete when oversized records are excluded.
## Testing
Add a handoff regression scenario for an ID-less checkpoint with a retained excerpt and an oversized verified answer. Assert that the worker receives one capped user message, both incomplete-evidence markers, and an incomplete authorization version.
GitOrigin-RevId: bd3f5fe164ae2fddba440e9269fd63b52e8b12f8
## Why
Older servers can omit thread item timestamps. The TypeScript contract should accept those responses while still allowing explicit `null` values.
## What changed
Mark `ThreadItem.startedAtMs` and `ThreadItem.completedAtMs` as optional nullable fields. Update the generated TypeScript and precomputed stable and experimental exports, and allow these fields in the optional-nullable export check.
GitOrigin-RevId: 186be7aa45a3e7c65f133b1e320809a9912ff1f3
## What changed
- Add `account/gcp/setup` to configure the built-in Vertex AI provider with a project, optional location (defaulting to `global`), and optional credential file. Omitting the file clears the active user override and uses Application Default Credentials.
- Validate configuration and obtain an access token before saving, return structured credential failure reasons, and reload the model catalog on the next `model/list` request.
- Share configuration previews and version-checked writes with Bedrock setup to reject conflicting settings and concurrent configuration changes.
## Testing
Add tests for credential selection and ADC fallback, catalog refresh, invalid credentials, policy and endpoint conflicts, cancellation when network permission is revoked, and configuration version conflicts.
GitOrigin-RevId: 6f411a85893f8da49581427451e0180529955b16
## What changed
- Stack integral limits above and below the integral in top-level display math, while keeping compact limits in lists and blockquotes.
- Render `pmatrix` environments with centered cells and scalable Unicode parentheses, aligning surrounding math to the matrix midpoint.
- Require spatial layouts, including single-row matrices, to fit the available width; preserve the source when they cannot fit or appear in nested Markdown.
## Testing
Add snapshots for integral limits and matrices, narrow-width fallback assertions, and rejection tests for ragged matrices and mismatched environment endings.
GitOrigin-RevId: 73b589c4422568b90d15f55bf7c9dddec0dccc97
## Why
Terminal reports still in flight when Codex exits can leak into the parent shell's input.
## What changed
Pause terminal event polling during shutdown and flush pending input before restoring normal terminal input mode. On Unix, use a primary device attributes (DA1) reply to wait for outstanding reports after disabling reporting, with a two-second timeout when startup detected DA1 support. During panic unwinding, flush queued input without locking the event reader.
## Testing
Extend PTY tests to cover mouse-report bursts with a split DA1 reply, clean shell input after exit, and queued input cleanup during panic unwinding.
GitOrigin-RevId: 304859b654fb2b2c8882e6cac4cb6522fe05475c
## What changed
- Replace Rust `1.99.1` pins with `1.95.0` across Cargo, Bazel, CI, release workflows, and Windows setup, and update the Bazel lockfile.
- Adjust Rust APIs, borrowing, and lint-related code for the pinned toolchain, and box MCP tool dispatch to bound compiler async-layout query depth.
- Update the halfwidth sound mark snapshot and allow optional symbol hash suffixes in the code mode host package smoke test.
GitOrigin-RevId: 75460c3d0465dc601811e619bce373a4f7ff2912
## What changed
- Return the selected workspace's display name as `workspaceName` in ChatGPT account responses, caching it alongside workspace routing and updating generated schemas and bindings.
- Display a `ChatGPT workspace` row with the name and account ID, falling back to the ID when the name is unavailable or invalid. Refresh workspace details with account identity updates and hide the row for providers that do not use ChatGPT authentication.
## Testing
Update account-response tests to cover workspace names and null values, add workspace details to the status snapshot, and verify that switching to a custom API-key provider hides the workspace row.
GitOrigin-RevId: 4b30ab8a39e1fa7ad1ba7367c5295544be8f6001
## What changed
- Show selectable safer follow-ups alongside safety-block explanations, with an option to enable Daybreak when disabled.
- Submit the selected rewrite in a verified fork before the blocked turn, preserving the original chat's draft and current model settings. Mark the new turn with `safety_recourse_follow_up`.
- Filter suggestions that could invoke commands, skills, apps, or plugins, and suppress recourse for unsupported servers and non-primary threads.
## Testing
Extend coverage for fork history, draft preservation, model selection, turn metadata, suggestion filtering, and the Daybreak picker.
GitOrigin-RevId: 49052df6301b6bfbba07262d40b007dcf97bb7c9
## What changed
- Handle `TurnModerationMetadata` for the active turn, showing a temporary block notice while an explanation is pending.
- Validate safety recourse metadata and render topic-specific explanations with safer ways to continue for biological and cybersecurity policy blocks. Apply the explanation only when the terminal policy error matches its domain; otherwise retain the existing error handling.
- Queue input while recourse is pending and preserve prepared images when queued messages are submitted.
## Testing
Add an integration test covering biological and cybersecurity blocks, the loading notice, and fallback for a mismatched policy error, plus a snapshot of the cybersecurity explanation. Extend queued-image coverage to verify submission succeeds after the original image file is removed.
GitOrigin-RevId: dd9ca57cf3b2d842e3deb8aff5d7c3c73a92e14d
## Why
Contention on the writer coordination lock can block writer cleanup indefinitely, preventing idle threads from unloading.
## What changed
Retry coordination lock acquisition every 50 ms and return `io::ErrorKind::TimedOut` after 30 seconds of contention. This lets cleanup release writer ownership and idle unloading finish even while another process holds coordination.
## Testing
Extend writer lock coverage to check the timeout error. Update the idle unload regression test to verify that the thread closes while coordination remains locked and can resume with its persisted turn after the lock is released.
GitOrigin-RevId: 513117fdaf3890283e7acdd149ce9abb66075b63
## Why
The process-local mutex cannot coordinate session name appends and removals from multiple Codex processes sharing the same home directory.
## What changed
- Guard index mutations with a persistent `session_index.jsonl.lock` file, retaining the lock until the blocking worker finishes even if its caller is cancelled.
- Return a timeout error after 30 seconds of lock contention without modifying the index.
- Rewrite removals through a unique temporary file while preserving index permissions, and skip removal when the index is absent.
## Testing
Update regression tests to check lock retention after cancellation, timeout without writing, successful writes after contention clears, and removal with a missing home directory. Retain coverage for cancelled queued updates preserving the next write.
GitOrigin-RevId: 5231c9ff85c6b34de5ee92931d119b6f46bd583b
## Why
`codex migrate-nfs-db` reported a successful migration when the database directory existed but contained no databases.
## What changed
Count databases that were migrated or already use DELETE journal mode. If none are found, print `No databases found.` instead of the migration success message.
## Testing
Extend the CLI integration test to cover an empty directory, a failure on a corrupt logs database after an earlier conversion, and a successful rerun that recognizes the converted database as already in DELETE mode.
GitOrigin-RevId: 16b109645925164f3af5d35a909417872cfa004f
Zack Brunson