## Why
Repeated image outputs in different request payloads could fail replay with a call ID reuse error even when their content was unchanged.
## What changed
- Hash canonical JSON for non-text content parts and compare their `content_sha256` values independently of payload location.
- Preserve empty content arrays as empty bodies so they also match across snapshots.
## Testing
Add a regression test verifying that repeated image and empty tool outputs reuse conversation items, while changed image content with the same call and item IDs still fails replay.
GitOrigin-RevId: 07699312675764079f679fd2c12ba6679332d709
## Why
A pending agent-message wake can outlive an interrupt or a switch to Plan mode while model discovery is waiting. It must recheck whether it can start before consuming queued messages.
## What changed
- Revalidate reserved wakes after discovery and build the turn with the configuration selected during admission.
- Mark interrupted wake reservations as stopped so later agent messages cannot restart automatic work, while preserving queued messages for explicit turns.
- Keep finishing turns marked as running until completion is persisted, protecting their rollout writer from capacity eviction.
## Testing
Add regression tests for interrupts and Plan-mode changes during discovery, queued-message preservation, explicit follow-ups with `wake_on_agent_messages` disabled, and completion status and persistence with the feature enabled and disabled.
GitOrigin-RevId: afe1d57063a5ec491e8b16d6c62135caa69c0a3c
## What changed
- Add loaders that select `config_server` when configured and otherwise use the existing ChatGPT bundle source. Fetch custom bundles from `<base_url>/codex/config/bundle` without redirects or request logging.
- Support optional OAuth sessions without interactive login during bundle fetches, recover credentials after a `401`, and scope cached bundles to the endpoint and authorization identity.
- Restrict bootstrap network access to configuration and OAuth endpoints using local administrator rules when available.
- Return generic bundle validation errors so invalid TOML, requirements, and provider settings do not expose configuration contents.
## Testing
Add tests for missing configuration-server sign-in, replacement OAuth credentials, endpoint-specific cache reuse, and validation errors that omit sensitive values while preserving cached bundles.
GitOrigin-RevId: 56590a9e66340540666ca21590bef46c495e0e33
## What changed
- Read optional tool descriptions and parameter schemas for `history`, `notes`, `new_context`, and `get_context_remaining` from the acting model's catalog messages.
- Support catalog namespace descriptions for history and notes, preserving explicit empty and whitespace descriptions.
- Share catalog override handling across native tools and MCP resource helpers. Keep bundled schemas when overrides are invalid, preserve encrypted parameters, and leave tool identity and transport fields unchanged.
## Testing
Add coverage for sparse catalog serialization, schema fallback and encryption preservation, per-step tool definitions, and context tool updates when switching models. Extend outgoing-request tests to verify history and notes overrides while retaining history image attachments.
GitOrigin-RevId: 1adac8b5009f95c91adba491f20a4e2e2dc91475
## Why
Model output alone does not establish that an item entered conversation history. Treating every response item as accepted can include discarded attempts, while relying on a later request misses accepted final output when a turn ends or is interrupted.
## What changed
- Record `HistoryItemAccepted` events and retain Responses item IDs, generating missing IDs consistently across item events.
- Build thread conversation history from request inputs, compaction checkpoints, and explicit acceptance. Keep unaccepted output accessible through its inference call.
- Preserve inference provenance across retries and late response records without overwriting newer request or compaction snapshots.
- Mark turns with errors as failed. Bump trace schemas to version 2 and reject incompatible bundles and event schemas during replay.
## Testing
Add reducer coverage for discarded attempts with identical text, late responses, compaction, inherited context, and legacy bundle rejection. Add CLI integration tests that run `debug trace-reduce` after success, stream failure, and interruption followed by shutdown, including responses without provider item IDs.
GitOrigin-RevId: 8e387a91d9b3f704df82847d630e6f0b08f998b3
## What changed
Add optional `writable_root` and `writable_roots` templates to model-catalog permission messages. Select the template by the number of displayed roots and substitute exactly one `{{ roots }}` placeholder with the existing formatted path list.
Fall back to the bundled sentence for missing, empty, invalid, or oversized templates. Preserve path contents, permission-path limits, and denied-read instructions. Update the permission wording when the selected model changes.
## Testing
Add coverage for template validation and size limits, singular/plural selection after path truncation, path preservation, sparse serialization, and model switches that append changed permissions once while preserving request history.
GitOrigin-RevId: 4dcfb7ff70b91db3dba3dda684b355b920e07974
## Why
The `Cwd` session filter included sessions from linked worktrees, leaving no way to restrict the picker to the current directory. Project grouping also combined tasks across linked worktrees.
## What changed
- Keep `Cwd` filtering and directory-scoped `resume --last` and `fork --last` lookups limited to the current directory.
- Add an explicit `Repo` picker filter when multiple local worktrees are available, including sessions from corresponding directories across linked worktrees. Cycle between `Cwd`, `Repo`, and `All` in either direction.
- Add `Directory` grouping to the agent command center alongside `Project`, `Status`, and `Model`. Keep this choice in memory without writing a configuration value older clients cannot read.
## Testing
Extend coverage for directory and repository filtering, pagination scope, linked-worktree grouping, directory aliases, grouping persistence, and adjacent selection after task removal. Update picker and command center snapshots.
GitOrigin-RevId: 59603c9c5136db43124102b3277d1d1dab36bb87
## What changed
- Add discovery and listing APIs for environment-owned required hooks, with command and MCP execution routed to the owning environment.
- Use each environment's working directory in hook input, withhold controller transcript paths, and prevent environment hooks from granting permission requests.
- Resolve `command_windows` against the environment's platform and, when hooks are enabled, reject unloadable required hooks before accepting environment configurations at startup or readiness.
## Testing
Add regression coverage for invalid managed hook matchers at startup and readiness, successful readiness after correction, and per-hook working directory and transcript path scoping for `SubagentStop`.
GitOrigin-RevId: 1ac0ab3778ba608c72e5917fcbaebcc1d454887f
## What changed
- Add `environment_hooks` to `EnvironmentConfig` for hooks from an environment's effective managed requirements. Initialize it empty for inferred thread configurations and report the handler count in debug output.
- Move `HookEventsToml`, `MatcherGroup`, and `HookHandlerConfig` into `codex_protocol::hooks`, with re-exports from `codex_config::hook_config`.
- Validate MCP hook input recursively to reject nulls and integers outside the signed 64-bit range without converting through `toml::Value`.
GitOrigin-RevId: 410506c8e2b89c9519c81d86b44ccd760d751693
## What changed
Add a test-only MITM CA constructor and local TLS origin fixtures to exercise AWS SigV4 forwarding:
- Check `aoss` payload hashes and credential replacement for GET and POST requests, while preserving unsigned requests and requests using another access key.
- Verify rejection of unsupported HTTP/1.1 framing and signing headers, and check the forwarded body, payload hash, and signed header presence at an HTTP/2 origin.
- Verify that draining signed request bodies releases buffering capacity before response headers arrive, allowing a ninth request to complete while eight responses remain pending.
GitOrigin-RevId: 4da0a77baace31486e77ad97d9581ec9f51bb34e
## What changed
- Add `masked` after the provider prefix in built-in dummy credentials, followed by at least 22 random alphanumeric characters. Stop copying punctuation from the real credential.
- Check built-in dummy candidates against observed credential owners and discoverable configured-provider aliases, and reject overlaps with existing dummy credentials. Allow configured patterns to match a built-in dummy's format when no credential identity collides.
## Testing
Extend regression coverage for short and opaque credentials, fresh dummy values, known and late credential collisions, alias discovery, header injection, and text restoration. Verify that explicit authorization values remain unchanged even when they resemble masked credentials.
GitOrigin-RevId: 5080176f3ecbcdbb18943eab30136e15a4a3985e
## What changed
Introduce a `BundleSource` interface for authentication, cache identity, bundle fetching, and unauthorized-request recovery. Move ChatGPT plan eligibility and credential recovery into `ChatGptSource`, while keeping validation, caching, and retry orchestration in the shared service.
Support source-specific cache namespaces while preserving the existing ChatGPT cache location. Retain one authentication recovery context across all retries of a bundle fetch.
## Testing
Extend the external authentication test to verify that recovery happens only once per bundle fetch, including when an intervening request failure triggers a retry.
GitOrigin-RevId: f5009f72dc4479f96d4ed1da9232f250988444a5
## Why
The sequential token fixture rewrites shared files when resolving credentials. Concurrent credential resolution needs a fixture that can return the same token independently for each caller.
## What changed
Add `ProviderAuthCommandFixture::fixed_token`, which reads a token file using `cat` on Unix or `cmd.exe` on Windows without modifying it. Use it in the Vertex command-auth and guardian-request tests.
GitOrigin-RevId: 5bf5134f113b546a643a47012281fb960e885b15
Update both `call_tool` invocations in `dropping_tool_call_cancels_remote_request` to pass `|_| Ok(None)`, matching the metadata callback API while continuing to omit metadata.
GitOrigin-RevId: 9d0f3e3108fe81972ce4fd4cca13f4b7febcc616
## Why
Python release jobs installed build tools without a shared lockfile and allowed isolated builds to resolve additional dependencies. Release retries can also build older source revisions, so their tool pins need to come from the running workflow revision.
## What changed
- Add a shared setup action with pinned `uv` and locked `sdk` and `runtime` dependency groups. Apply a seven-day dependency age cutoff, with a two-day exception for `certifi` CA trust updates.
- Use the action for Python SDK and runtime packaging across Linux, macOS, and Windows. Build with `uv build --offline --no-build-isolation` using the prepared environments.
- In the standalone Python build workflows, check out the release tools from `github.workflow_sha` separately from the requested source revision.
GitOrigin-RevId: a9c0344930e5b9870ce9f7754a1fee1a9219305c
## Why
Existing release consumers verify v2 signature bundles, so the Cosign upgrade must preserve that format.
## What changed
- Upgrade `sigstore/cosign-installer` to `v4.1.2` and explicitly install Cosign `v3.1.4`.
- Provide a pinned Sigstore trusted root for offline installer verification.
- Check the installed Cosign version before signing and disable the new bundle format and signing configuration.
GitOrigin-RevId: c54578c904ed890d013d79169164e662b57d3ee5
## What changed
Select an originator-specific models manager before resolving thread model metadata. Supported originators send their own `originator` header and use separate in-memory catalogs and disk caches, so each thread receives the corresponding model instructions and tools.
Reuse managers for repeated originators and share the API-key model discovery setting across them. Unsupported originators retain the default manager and catalog.
## Testing
Add coverage for originator headers, concurrent catalog isolation, cache reuse across restarts, shared discovery policy, and the instructions and tools sent in actual turns.
GitOrigin-RevId: ae4aa51c8df2813a72fc8aed8978fd630e467069
## Why
Consecutive user prompts in the rich transcript have extra blank spacing that breaks up their shared background.
## What changed
- Join adjacent visible user prompts into one background block, skipping hidden entries when determining adjacency.
- Keep prompts separated when intervening content becomes visible through detailed mode or search, and restore grouping when it is hidden again.
- Preserve selectable source offsets and joined spacing when text is rewrapped, and reuse cached layouts when checking adjacency.
## Testing
Add regression tests for prompt grouping, layout cache reuse, source offsets across rewrapping, detailed reasoning, and search-driven visibility. Update transcript snapshots to reflect the tighter spacing.
GitOrigin-RevId: faca8001244b0ac883d9d670864c8f7856ac2bad
## What changed
Add an optional `NetworkPolicyMetadataProvider` to the MCP runtime. Advertise `codex/network-policy-meta` only to trusted ChatGPT origins when a provider is available, and attach policy metadata only when the sending session also advertises support.
Strip caller-supplied policy metadata and derive restrictions from the call's captured permission profile and server environment. Resolve metadata against each session's capabilities, including after recovery, while retaining one policy snapshot per call. Fail the call before sending if policy resolution fails. Existing runtime callers leave the provider unset.
## Testing
Add tests for capability negotiation, trusted-origin restrictions, forged metadata removal, both tool dispatch paths, and policy snapshot reuse. Add HTTP session-recovery coverage for changing capabilities and policy-resolution failures while preserving caller metadata and read-only restrictions.
GitOrigin-RevId: 4b978f986abc0475fc67659be98fc01a2d6ce7cd
## Why
The network proxy previously required AWS signing requests to have an empty body or use `UNSIGNED-PAYLOAD`, preventing signing of nonempty payloads.
## What changed
- Buffer and hash request bodies before signing, then forward the original bytes.
- Add `max_body_bytes` with an 8 MiB default and a 16 MiB maximum, plus a 30-second body read timeout.
- Limit concurrent buffering to eight requests with a five-second capacity wait. Retain reservations while forwarded body data remains alive.
- Reject trailers and mismatched content lengths for buffered payloads while preserving streaming for explicitly unsigned payloads.
## Testing
Add coverage for payload hashing and forwarding, body limits and timeouts, fragmented body collection, and buffer reservation lifetimes. Extend signing tests for S3 path and query canonicalization, header replacement, and secret exclusion from trace logs.
GitOrigin-RevId: 48c18442fa90ae3efb1a4a99a168d07e1be2c496
## Why
Aborting a refresh task is asynchronous, so yielding once before checking `is_finished()` does not guarantee cancellation has completed.
## What changed
Return the refresh task's `JoinHandle` from `cloud_config_bundle_loader_for_service` and retain its `AbortHandle` in the loader lifetime. Update `each_loader_owns_refresh_until_its_last_clone_is_dropped` to await each task and assert cancellation after dropping its last loader clone, while still checking that the replacement loader's task remains active.
GitOrigin-RevId: 2eb65211aefc21f9195ff766d8793f4b8f5a74c4
## What changed
- Regenerate protocol models with `datamodel-code-generator==0.64.0`, targeting Python 3.10.
- Preserve discriminator field titles without introducing extra `RootModel` wrappers for literal values or inline unions.
- Keep nullable project and section IDs optional for compatibility with older SDKs, and remove redundant required-nullable field patches.
## Testing
Extend schema annotation coverage to assert that `ReasoningSummary.model_validate("none").root` remains the string `"none"`.
GitOrigin-RevId: 386d07d7e2e368b07d4602b49be6e81a887685fe
## Why
A requirements denial on a custom `codex_apps` registration could block the trusted hosted Apps replacement. Requirements filtering also lost whether a server had been explicitly disabled, which must remain effective across runtime overlays.
## What changed
- Track explicit disables separately from requirements denials, retaining the requirement source across catalog rebuilds and server materialization.
- Allow trusted host-owned Apps to bypass a previous registration's requirements denial while preserving explicit disables and blocking later custom replacements.
- Preserve combined explicit and requirements disables during repeated filtering, and reject those servers when preparing standalone MCP login HTTP clients.
## Testing
Extend regression coverage for hosted Apps replacements, later custom replacements, cloud catalog refreshes, repeated requirements filtering, and standalone login rejection.
GitOrigin-RevId: 736a13c40fbf7436b4d0682f70c335f33f45962f
## What changed
- Support `model_provider = "gcp"` with a Vertex AI endpoint derived from `GOOGLE_CLOUD_PROJECT` and `GOOGLE_CLOUD_LOCATION`, defaulting to the `global` location.
- Obtain credentials through `gcloud auth application-default print-access-token` by default, and allow `base_url`, `auth`, and `http_headers` overrides under `model_providers.gcp`.
- Use a static model catalog tailored to Vertex AI, preserve function tools, namespaces, and client-side tool search, and support remote compaction V2. Disable unsupported reasoning summaries, Responses Lite, custom tools, web search, and image generation.
- Expose a `gcp` account type through the app-server protocol and generated clients without resolving credentials during account reads or requiring OpenAI authentication.
## Testing
Add coverage for endpoint resolution, configuration overrides, model catalog filtering, authenticated requests, unsupported request fields, missing credentials, account reporting across provider changes, and automatic remote compaction.
GitOrigin-RevId: 97a3158269e6dbc2605e2cf576998e09817ea12a
## Why
The URL parser treats backslashes as HTTP(S) path separators, while Git/libcurl does not. This difference can make a marketplace URL appear to match an allowed host pattern while Git connects to a different host.
## What changed
Reject HTTP(S) URLs containing literal backslashes in userinfo when checking marketplace host patterns. Continue allowing encoded backslashes in userinfo and backslashes in paths or query strings.
## Testing
Expand regression coverage to verify that denied URLs never invoke the cloner, create the marketplace install directory, or write configuration. Extend host-pattern tests to cover accepted HTTP(S) URL variants.
GitOrigin-RevId: cfdd29d6e83fb1718b505abaae85d37257317953
## Why
V8's Abseil and protobuf's shared Abseil can be built for different C++ runtimes. Give V8's copy a distinct inline namespace so both can link into one binary without interposing incompatible functions.
## What changed
- Move pinned V8 dependency imports and BUILD overlays into `third_party/v8`, and inject those repositories into V8 through a module-extension bridge with no fallback downloads.
- Build V8's Abseil with a V8-specific inline namespace while preserving protobuf's shared Abseil namespace.
- Apply V8's C++ runtime settings in the Abseil, Highway, and simdutf overlays, and remove the shared `rules_cc` patch.
- Document source dependency ownership and the version, checksum, and overlay review procedure for V8 upgrades.
GitOrigin-RevId: 2b8e3deed285559f8dd3324647cb4b81089f2f56
## Why
Resuming a thread with unchanged settings appended another `ThreadSettingsApplied` event to its rollout.
## What changed
Compare the effective settings with the latest persisted settings for the same thread before writing a checkpoint. Persist settings when they differ or no matching checkpoint exists, even if no turn follows the resume.
## Testing
Add a regression test that restarts the app server, resumes a materialized thread without overrides, and verifies that its persisted settings events remain unchanged.
GitOrigin-RevId: c545791ed3bb4020fa3da6d233607a9ba73e5c8d
## What changed
Update `astral-sh/setup-uv` to `v10.3.2` and pin `uv` to `0.13.5` across the affected build, test, and release workflows. Refresh the checksum used for DotSlash publishing.
Install `uv` in the Python SDK wheel test from a hash-pinned requirements file, requiring a binary distribution and hash verification.
GitOrigin-RevId: 05295f6468f4897ca08672ccf9dc4e9b7d717fa8
## What changed
Move inline crate tests into `lib_tests.rs` and nest related test suites under each crate's `tests` module. Update imports, subprocess test filters, logging targets, and snapshot names to match the new module paths.
Keep test helpers accessible where needed and preserve the schema writer's exact test name used by release tooling.
GitOrigin-RevId: de55eaae66dce4941abb33dd0b2f170093daa8f9
Add `yield_control()` after phase 2 in
`code_mode_can_yield_and_resume_with_wait` so the intermediate output is
returned explicitly. Increase both `wait` calls' `yield_time_ms` from 1,000
to 10,000 to allow more time for each phase to produce its output.
GitOrigin-RevId: 3626a64ae0269c22ad634ec2e3fd5e27942f649f
## Why
Prompt telemetry can include full user text. Emitting it before hook acceptance logs prompts that `UserPromptSubmit` hooks subsequently block.
## What changed
Move prompt telemetry from input submission to hook acceptance, including queued and steered input. Preserve telemetry for accepted Guardian review prompts that are converted to response items during finalization.
## Testing
Extend hook regression tests to assert that blocked prompts are absent from telemetry and rollouts, while accepted queued prompts are logged exactly once. Extend Guardian review coverage to assert exactly one prompt event across inspection steps.
GitOrigin-RevId: aa71f98de2356dd08f62ff492e897ab3a43b54c9
Timestamp synthetic frames in `real_encoder_produces_twenty_millisecond_opus_packets`
from a single start time using each block's sample offset and input rate. This
keeps the test audio contiguous even when the test thread is descheduled.
GitOrigin-RevId: e66440fcc3b3c965a7b1b22b61246c2a622a9cc9
## Why
Resuming a paginated thread rechecks stored history after loading configuration. Unchanged model context can be reused instead of loading it again.
## What changed
Retain the prepared model context across configuration loading and reuse it when the thread ID, rollout path, and history revision still match. Add `ThreadStore::is_model_context_current` to validate revisions, with a fresh read when validation fails or is unavailable.
## Testing
Add coverage for revision invalidation after history is appended or removed. Extend resume tests to cover paginated history, concurrent metadata and lifecycle changes, workspace-root changes, and preservation of saved user messages in model requests.
GitOrigin-RevId: bad2ca0caddb63523264ac530ffb801db3961f2b
## What changed
Move the Bazel installation, repository cache configuration, and Windows MSVC environment setup directly into `prepare-bazel-ci`, and remove the `setup-bazel-ci` action. Wire the repository cache output and restore step to the inlined configuration step.
Update the Windows PATH script documentation and remove the deleted action from V8 canary path matching.
GitOrigin-RevId: 2472372478e1618cd03e98a1536f862f47352659
Resolve `codex-windows-sandbox-setup` with `codex_utils_cargo_bin::cargo_bin` so the manifest test supports both Cargo binary paths and Bazel runfiles.
GitOrigin-RevId: 23e62800cdd5994eb18fa47fcc1479f4ce10c42e
## Why
Profiles without a v1 memory workspace have no legacy context to preserve or consolidate before using v2.
## What changed
- Select v2 when memories are enabled and the `memories` directory is absent. Preserve explicit `memories.version` settings, the `memories.dual_write = false` opt-out, and the v1 default for existing workspaces or filesystem check errors.
- Report `v2_ready` immediately for profiles without a v1 workspace. Keep the consolidation count and valid-summary requirements for profiles with a v1 workspace.
- Make resetting an absent memory workspace a no-op so it does not create an unused v1 directory.
## Testing
Extend coverage for default and explicit version selection, opt-outs, version-specific memory reads, fresh-profile readiness and reset behavior, and running only the v2 pipeline for fresh profiles.
GitOrigin-RevId: a8fb0844962ae9266ffbe88af97e8dc4a99ac15f
## Why
A concurrent fork can retain locks from a previous cleanup pass until exec,
causing the next pass to skip cleanup and fail the test's assertions.
## What changed
Wait for and explicitly release both staging locks before each cleanup pass in
`cleanup_reclaims_unpublished_and_aged_legacy_clones`. Run the existing age
scenarios in a loop and report the age when legacy directory assertions fail.
GitOrigin-RevId: 115d887e6b74159f22a2f675237e3b3356ab0308
## Why
Allow workloads to make AWS requests with placeholder credentials while keeping real AWS credentials in the trusted proxy process.
## What changed
- Add an `aws_sigv4` hook action with a placeholder access key ID, region, service, HTTPS port, and credential sources from proxy environment variables or files.
- Re-sign matching requests after network and hook authorization and header transformations, using the configured credentials and optional session token.
- Support empty payloads and explicitly unsigned payloads, including streaming unsigned S3 uploads. Reject selected requests with incompatible credential scopes, presigned URLs, unsupported streaming signatures, or ambiguous framing through the hook denial path.
- Mark generated credential headers as sensitive and suppress signing SDK trace events that could expose credentials.
## Testing
Add tests for the published AWS IAM signature vector, unsigned S3 uploads with a session token, and rejection of invalid transport, credential scopes, signing inputs, and unsupported bodies.
GitOrigin-RevId: ab4fbbc00ba40a5bb309add521fea6ee2ff6e79e
## What changed
Promote `reasoning_effort_override` to stable and enable it by default, allowing supported models to receive reasoning effort changes through configuration updates in conversation history.
Update request-history snapshots to include the configuration updates, and remove explicit feature enablement from the reasoning effort override test builder so the suite exercises the default.
GitOrigin-RevId: 6ce16d7f985c33f008e5230fc9bae09cdaf141d5
## Why
Managed network policies need to require approval for selected hosts even when an exact or wildcard allow rule matches them.
## What changed
- Add `experimental_network.review_domains` to managed requirements and route matching hosts through the existing network approval flow. Explicit denials retain precedence, and approved connections still undergo DNS and local-address checks.
- Preserve review patterns across environment policy attachments and remote proxy configuration. Reject execution on an exec-server that lacks the `networkProxyReviewDomains` capability when review patterns are present.
- Expose `reviewDomains` through the app-server requirements API and generated schemas, and show `review_domains` in debug configuration output.
- Update approval reasons to say that network access requires approval rather than assuming the host is absent from the allowlist.
## Testing
Extend coverage for review precedence over exact and wildcard allows, explicit denials, DNS checks after local and remote approvals, approval hooks, policy merging, remote configuration round trips, and requirements API serialization.
GitOrigin-RevId: 4a861061a0ed80b3537d3b72f2caecb0db2a4f0b
## Why
Enterprise MCP token exchange and sign-in failures can collapse into generic errors, hiding useful diagnostics such as an OAuth `invalid_scope` rejection or a cancelled sign-in.
## What changed
Introduce `EmaErrorDetail` to carry static operation messages and sanitized SDK diagnostics through token-source errors and enterprise login completion. Exchange failures can report the stage, HTTP status, and allowlisted OAuth error code, such as `IdentityProvider: HTTP 400: invalid_scope`, without retaining arbitrary provider text or raw error chains.
Preserve specific discovery, credential storage, cancellation, and account/configuration mismatch errors instead of replacing them with generic failure messages.
## Testing
Extend tests to cover `invalid_scope` diagnostics, specific sign-in completion errors, and exclusion of credentials from diagnostics even when an outer error context contains sensitive text.
GitOrigin-RevId: e9280a5db3565ea91da0810bab528da5ee088d64
Initialize `client_secret` and `token_endpoint_auth_method` to `None` in
`ema_auth_statuses_do_not_wait_for_account_refresh` to match
`McpServerIdpOAuthConfig`.
GitOrigin-RevId: 0c800b4f60d2468d7c2cb0b8d83bbdb4b3998574
## Why
An explicit `final_answer` with empty or whitespace-only text could allow queued agent mail to restart the turn instead of leaving it queued for the next turn.
## What changed
Treat explicit `final_answer` messages as terminal regardless of visible text in both completed-item handling and turn-item finalization. Untagged messages still require visible text to defer mailbox delivery; `commentary` and `partial_answer` messages do not defer it.
## Testing
Extend regression coverage for empty and whitespace-only final answers, delivery of queued agent mail on the next turn, and message board notifications arriving before or after an empty final answer.
GitOrigin-RevId: 466f1a9c613e07d67ce45458858ba32d5d23f11d
## Why
Dropping a local tool-call future did not notify the MCP server that the request was cancelled, leaving remote work running.
## What changed
- Send a cancellation notification for the request when its response future is dropped, covering both ordinary tool calls and tool-input rounds.
- Preserve write order for stdio and in-process transports so cancellation cannot arrive before its tool request, without waiting for tool responses.
## Testing
Add regression tests for cancellation on drop, request-before-cancellation ordering under reversed send polling and exhausted task budgets, and continued use of the shared connection after cancellation.
GitOrigin-RevId: fab02d546fd82c601756117d9ecbf1017c28ac11
## Why
EMA MCP auth status checks acquired an account grant lease, making status inspection wait for account refresh coordination or an existing lease.
## What changed
Add `AuthManager::account_oauth_grant()` to inspect an owner-checked grant without acquiring the refresh lock. Use it for EMA status checks and share a single lazy read across servers, including missing grants and read errors. Keep refresh exclusion for token exchanges through `lease_account_oauth_grant()`.
## Testing
Add regression coverage for status checks across two EMA servers while an account lease is held. Extend account refresh tests to verify inspection completes with a lease held and refresh queued, and returns no grant after logout.
GitOrigin-RevId: 921214dd552eb216c713596f2737460053a07d08
## What changed
Add the disabled-by-default `guardian_recorded_items` feature to forward recorded reviewer items and interruptions through the parent's raw-event subscription, preserving reviewer thread and turn IDs without modifying the parent's history or completing its turn.
Emit reviewer items as `rawResponseItem/completed` notifications and interruptions as interrupted `turn/completed` notifications. Mark opted-in reviewer requests with `guardian_recorded_items` metadata.
## Testing
Extend Guardian integration tests to cover reviewer identity, recorded-item metadata replay, concurrent reviewer interruptions, independent parent completion, and behavior without the feature enabled.
GitOrigin-RevId: beb4dbf6c6f2a800a2fbf3cfd11ae174a1382386
## What changed
- Add `InitialBackendSessions` to carry the initial session and additional sessions into the TUI event loop. Existing launches continue to supply a single session.
- Shut down all supplied sessions on startup errors, cancellation, and early exits.
- Register the under-development `tui_multi_backend` feature flag, disabled by default, and expose it in the configuration schema.
## Testing
Add a regression test that fails bootstrap and verifies that both initial backends receive shutdown requests. Update multi-source event polling coverage to use the new initialization path.
GitOrigin-RevId: e5db439552de97594e6f13360b90be71256ab2f0
cassirer-openai