## Why
Filesystem permission paths can use a convention that differs from the host
running Codex. Converting them immediately to native absolute paths can change
the meaning of ambiguous paths such as `/C:/secret` or Windows UNC paths.
## What changed
- Store literal filesystem permission paths as `PathUri` values through the
runtime policy and execution protocol.
- Keep legacy string-based serialization at explicit protocol boundaries and
reject conversions that cannot be represented losslessly.
- Encode native paths as opaque URIs when a normal file URI would imply the
wrong path convention.
## Testing
Added coverage for cross-platform and ambiguous path round trips, UNC path
variants, permission-profile serialization, and deny-policy enforcement.
GitOrigin-RevId: 5247713796d1f2bb4e02f94eb9fc82d4698060f0
## Why
Elevated provisioning can apply ACLs beneath a user-supplied `CODEX_HOME`.
Following a directory junction or another reparse point could apply those ACLs
to a different directory than the one provisioning intended to secure.
## What changed
- Require provisioning paths to be absolute paths on a local Windows disk.
- In provision-only mode, open or create sandbox directories with
`OBJ_DONT_REPARSE` and keep the resulting handle open while applying ACLs
with `SetSecurityInfo`.
- Reject reparse points in both the final directory and its ancestors while
preserving the existing path-based behavior for full setup.
## Testing
Add Windows tests covering plain directory creation and rejection of junctions
at both the leaf and ancestor levels.
GitOrigin-RevId: d165b8b3685c89bc171e4d58c63c739fa9fb2cf9
## What changed
- Query the remote app server for project config layers before starting a thread and show the trust prompt when the project has no existing decision.
- Resolve relative remote working directories and repository-root trust targets, then persist accepted trust through `config/batchWrite` on the remote server.
- Preserve existing trusted and untrusted decisions, including an untrusted repository that contains the requested working directory.
- Exit when the remote trust prompt is declined and ignore repeated key events in the trust selector.
## Testing
- Add coverage for remote trust detection, persistence, thread startup, existing decisions, nested untrusted projects, and rendering a remote Git subdirectory.
GitOrigin-RevId: e5fba2ea23bad1fb28f01df522cadbe05fcbb942
## Why
The per-thread replay buffer limited its event count, but streamed agent-message
deltas could still retain an unbounded amount of text while a thread was
inactive.
## What changed
- Coalesce adjacent deltas for the same thread, turn, and item into chunks of up
to 4 KiB.
- Limit buffered agent-message deltas to 256 KiB, discard a single delta larger
than that limit, and evict the oldest events when either buffer limit is
exceeded.
- Keep pending input and approval state in sync when eviction removes the
corresponding request, including clearing side-thread status indicators.
## Testing
Added coverage for delta coalescing, byte-based eviction, oversized deltas,
replaying only retained text, and side-thread status updates after eviction.
GitOrigin-RevId: 88d85353a124467d467822d2fd9854312b68d547
## What changed
- Resolve MCP server policy directly from the effective user configuration for selected executor-plugin roots.
- Apply server enablement, tool allow/deny lists, and default and per-tool approval modes while preserving stricter plugin-declared restrictions.
- Cover policy merging and opaque selected-root IDs in the executor-plugin MCP integration tests.
GitOrigin-RevId: dce3021969ba71e642de52312449cab6277515c3
## What changed
- Add spans for environment resolution, readiness waits, and environment info,
including fields for the selected environment and resolution state.
- Propagate the active span and tracing subscriber into spawned resolution,
startup, and shell-snapshot tasks.
- Verify that blocking snapshots retain the expected nested environment spans.
GitOrigin-RevId: 3c47e9ec1ebf45dbe1250b9ff76e2983d2a8df2a
## Why
In-process app-server filesystem requests use typed protocol requests and do
not need JSON-RPC parameters.
## What changed
Pass remote filesystem parameters to `request_fs_path` as closures and
evaluate them only when the session uses a remote request handle.
GitOrigin-RevId: 623c8733542553d73e2c0e4c4a60d40258bc91c1
## Why
The custom TUI buffer diff emitted `ClearToEnd` for unchanged trailing blank
regions, producing unnecessary terminal output.
## What changed
- Clear a row tail only when its cached contents changed or a wide glyph overlaps
the clear boundary.
- Keep blank cells marked `AlwaysUpdate` in the drawable region so viewport
invalidation still forces them to repaint.
- Preserve Ratatui's native cell diff behavior for the remaining updates.
## Testing
Add coverage for unchanged row tails, forced blank-cell updates, and shrinking
wide graphemes, including half-width katakana with combining marks.
GitOrigin-RevId: a9cac06f5624032a2b8c80a66c651cf3e85ec7fb
## What changed
- Probe the installed desktop app's update endpoint on macOS and Windows and report update-CDN reachability alongside the existing network diagnostics.
- Report newer Windows Store builds and macOS updates that Sparkle has staged for installation in the updates check and human-readable notes.
- Validate Windows update manifests against the production app identity, and use the persisted production appcast configuration when selecting the macOS feed.
## Testing
- Cover Windows version comparison and manifest identity validation.
- Cover macOS appcast selection and staged-bundle discovery.
- Verify the human-readable desktop update note.
GitOrigin-RevId: 1af5aa750144346b4b31f2b27a20371daf40d3c0
## What changed
- Add `x-cluster-name` from `OPENAI_CLUSTER` and
`x-openai-internal-caller` from `DD_SERVICE` to rendezvous WebSocket
handshakes when the environment values are nonempty and valid HTTP header
values.
- Apply the rendezvous headers to both client and remote executor connections
while preserving the existing W3C trace context headers.
GitOrigin-RevId: fead0244ba24fa208990b92d2170a9ae76ff2ceb
## Why
Image generation did not save its result when the extension host did not provide a host-local save root.
## What changed
- Save generated images under the turn environment's `generated_images` directory through its sandboxed filesystem executor when no host save root is configured.
- Limit executor-written images to 32 MiB, reject symlinked output directories and existing destinations, and continue returning the image if persistence fails.
- Include the saved workspace path in the tool output hint while preserving host-managed persistence when a save root is available.
## Testing
- Extend the granted-turn-permissions integration test to verify the image and path hint are written to the turn workspace without creating a host-local artifact.
GitOrigin-RevId: 3d24381a75fe4595641b5250e19fac8ed473b2cd
## What changed
- Stop parsing and exposing the `model` field from skill frontmatter.
- Remove the skill model delegation types and instruction generation.
GitOrigin-RevId: 01198c68c095da5062e8abec417cc3539099d9d5
## What changed
- Add a `desktop.security.enforcement` doctor check for macOS that assesses the app with Gatekeeper and classifies recent Gatekeeper and XProtect events.
- Add the same check on Windows by inspecting recent Microsoft Defender, AppLocker, and Windows App Control events for Codex executables.
- Report blocked or quarantined executions as failures, audit-only or unavailable evidence as warnings, and include actionable remediation while bounding and redacting collected event details.
## Testing
- Add coverage for platform event classification, trusted executable matching, unavailable diagnostics, remediation, and bounded redacted evidence.
GitOrigin-RevId: 792844390cd2cf92d3bc20e6a0973020b4364e51
## What changed
- Skip hyperlink layout for wrapped rows above the scroll offset and stop once
processing reaches the bottom of the viewport.
- Resolve each rendered link destination once while marking its visible cells.
- Add coverage for hyperlinks that span visible wrapped rows after scrolling.
GitOrigin-RevId: c1506d47fa3f1b895966dc2cde7d5b859c201792
## What changed
- Stop treating Vim normal-mode history-up as an alias for editing the latest queued message.
- Continue to edit queued messages through the configured `chat.edit_queued_message` binding.
GitOrigin-RevId: d830e0976a38725e948d420c1a5f374bb13fe945
## Why
Scrolling the transcript pager previously rendered a scratch buffer containing
all rows through the visible viewport, including hidden content above it. This
made rendering work and buffer size grow with the scroll offset.
## What changed
- Add viewport-aware rendering for committed transcript cells and the live tail.
- Forward scrolled rendering through cached and inset renderables while keeping
the full-height fallback for renderables that do not support it.
- Keep hyperlink metadata aligned with scrolled text.
## Testing
Add coverage comparing viewport-aware output with the full-height fallback
across wrapping widths, offsets, insets, styles, hyperlinks, and live tails.
GitOrigin-RevId: 630c30c4a61969a50f2b34701ca1dd87788a4298
## Why
The streaming TUI rerendered the entire mutable Markdown block whenever a
newline-bearing delta arrived. For long fenced code blocks, this repeatedly
parsed and syntax-highlighted the growing fence.
## What changed
- Detect open, top-level, language-tagged code fences and append newly
completed lines directly to the existing render.
- Preserve Syntect parser state across appended lines so multiline syntax and
the active theme remain consistent.
- Fall back to the canonical Markdown renderer for ambiguous fence syntax,
theme changes, incomplete lines, and highlighting limit transitions.
## Testing
Added coverage that compares streamed output with full renders across syntax
styles, Unicode, links, blank lines, fence variants, theme changes, and
highlighting limits. A long-fence test also verifies that the rendered prefix
is retained as new lines arrive.
GitOrigin-RevId: 036db2b7bc93607083b8001f8b4fa3cbb58c713e
## What changed
- Detect installed Codex desktop apps on macOS and Windows and report their version, running state, and redacted log location.
- Inspect bounded log data for the active desktop session and report the latest local app-server handshake outcome without exposing other log fields.
- Add a dedicated Desktop App section to human-readable doctor reports.
## Testing
- Cover local versus remote handshakes, failed handshakes with sensitive fields, bounded log reads, and stopped desktop sessions.
GitOrigin-RevId: ecfb4bd7af3589263624771ec9413b51953280eb
## What changed
Add `server_kind=openai_codex_apps` to the
`codex.mcp.protocol_discovery` counter and its duration metric when protocol
discovery runs for the Codex Apps MCP server. Other MCP servers retain the
existing `mode` and `outcome` tags.
GitOrigin-RevId: aadbdc54642f2c103a9f1bab39308e962c115f75
## Why
Recording a late frame's requested deadline as its emission time can leave the
rate limiter with a stale timestamp, allowing the next frame to be emitted
immediately in a redraw burst.
## What changed
Record the current time when the frame scheduler sends a draw notification so
the 120 FPS limit is measured from the actual emission.
## Testing
Add a paused-time regression test that submits an overdue draw and verifies the
next frame waits for `MIN_FRAME_INTERVAL`.
GitOrigin-RevId: 8c9a5ac0bf858b2ad87838f6d7c67c9470fdfc61
## Why
Release jobs download the `codex-zsh` manifest before packaging or signing its
bundled binaries. Verify that download against a pinned digest so an unexpected
manifest cannot enter release artifacts.
## What changed
- Pin the SHA-256 digest for the `codex-zsh-v0.1.0` manifest.
- Add a portable verification script that uses `sha256sum` or macOS `shasum`.
- Run verification in both the package archive and macOS helper signing flows.
GitOrigin-RevId: a404bb897c8cc0bf3c0ff38e8a6e1cce059d7fab
## What changed
- Add `EnvironmentNetworkPolicy` as a serializable view of portable domain,
Unix-socket, upstream-proxy, and local-binding restrictions without exposing
controller-owned proxy runtime settings.
- Add an optional `network_policy` field to `EnvironmentConfig` and re-export
the policy and related permission types through the core APIs.
- Reject owner-provided network policies during environment preview and
readiness until runtime enforcement is implemented, while preserving the
existing controller policy when the field is absent.
## Testing
- Cover rejection through both environment preview and readiness, including
preservation of the existing environment selection.
GitOrigin-RevId: 80ad4cf4d4a45632daa7a823e6cf568eb0e8bb80
## Why
The app directory is a discovery catalog and can include apps that are not
callable in the active thread. Using it for `$` suggestions can therefore
offer mentions that cannot be used.
## What changed
- Load mention candidates from `app/installed`, enrich callable apps through
bounded `app/read` batches, and retain compatibility with app servers that
do not support `app/installed`.
- Keep the mention catalog separate from the `/apps` directory cache and scope
results to the current thread, workspace, and account.
- Refresh mentions after app notifications, enablement changes, configuration
updates, and apps MCP readiness, while immediately removing disabled apps.
## Testing
Add coverage for batching and fallback behavior, stale scoped results,
notification refreshes, enablement changes, MCP startup races, and filtering
non-callable apps from mentions.
GitOrigin-RevId: 4d9e20794aed30cc97120170792fb555b86fe1e7
## Why
Creating the telemetry shutdown thread during shutdown can fail under resource
pressure, including when the native thread guard page cannot be allocated.
## What changed
- Start and verify a dedicated shutdown worker when `OtelProvider` is created.
- Send the provider to the prepared worker for bounded shutdown, while preserving
timeout behavior and avoiding a potentially blocking destructor if worker
preparation failed.
- Rename the fallible provider constructor to `try_new`.
## Testing
Add Unix regression coverage that injects guard-page allocation failures, plus
coverage for worker preparation failure, successful shutdown, and timeouts.
GitOrigin-RevId: 3656298078a800a7fa392437c2ee4a68753092e3
## Why
The app server sends sub-agent activity in both item-started and item-completed
notifications, causing the TUI to add the same activity to history twice.
## What changed
Render live sub-agent activity when the item completes instead of also rendering
it when the item starts. Preserve the existing replay behavior.
## Testing
Add a regression test that sends matching started and completed notifications
and verifies that the activity produces one history cell.
GitOrigin-RevId: 76a66f3657fe297f37067ed672ab9642997b4499
## What changed
Gate plugin hook resolution in `hooks/list` on both the hooks and plugins
feature flags. When hooks are disabled, return the default empty plugin hook
outcome without loading plugin hook sources or warnings.
GitOrigin-RevId: 166070576effaba248b790c4f2a47e6e9a7b1112
## Why
MCP requests can contain sensitive headers and tool-call bodies. Following a
cross-origin redirect could disclose them to another server.
## What changed
- Follow redirects only when every hop remains on the configured server's
origin, and require HTTPS for redirects on non-loopback hostnames.
- Preserve standard redirect method and body handling while sharing the
original timeout and enforcing a 10-hop limit.
- Avoid replaying plaintext proxy credentials across redirects, while leaving
OAuth requests that stop at redirects unchanged.
## Testing
Add coverage for same-origin and cross-origin redirects, redirect methods,
headers and bodies, proxy credentials, timeouts, hop limits, and legacy MCP
tool calls.
GitOrigin-RevId: 3e267911a1665ad8c2fc63825099a758770f4d68
## What changed
- Register `in_app_chat` and `in_app_dictation` as stable, default-enabled feature gates for desktop apps.
- Allow requirements to disable either capability and expose both keys in the generated configuration schema.
## Testing
- Add configuration tests that verify enterprise requirements can disable each gate.
GitOrigin-RevId: 5bba35d710fb0b6924aa55df98b2e013fa288f6d
## What changed
- Add `cli_auth_credentials_store` and `chatgpt_base_url` as exact managed requirements loaded from local requirements configuration.
- Apply these requirements to runtime and bootstrap authentication configuration, overriding user-configured values.
- Expose the managed values through `configRequirements/read` and reject attempts to change them through config write APIs.
- Ignore these local-only authentication requirements in cloud-managed requirement layers.
## Testing
- Cover requirement loading and composition, runtime and bootstrap overrides, app-server responses, and read-only config writes.
GitOrigin-RevId: 8ea9c096386072036ca5441f3d48af8707988a65
## Why
Unified exec could drop network approval registration when a selected environment used a Windows working directory on a non-Windows host because the trigger path could not be converted to a host absolute path.
## What changed
- Keep network approval trigger working directories as `PathUri` values and render them with their inferred native path syntax for Guardian requests.
- Fall back to the selected turn environment only when a trigger path can be converted to a host absolute path.
- Reject selected environment working directories larger than 8 KiB at the thread-manager validation boundary.
## Testing
- Cover managed-network approval registration for a foreign Windows working directory.
- Verify that oversized working directories are rejected as invalid `thread/start` requests.
GitOrigin-RevId: 646fbf12115a35a7e5cb04b511464797bee6647b
## Why
Resumed and forked threads need their persisted Guardian risk state available when routing later approval requests.
## What changed
- Initialize a session's `SecurityRiskScore` from the latest score in its rollout history when no score was supplied explicitly.
- Preserve the inherited score when resuming or forking a thread so low-risk actions can skip redundant Guardian reviews.
## Testing
- Add app-server coverage for inheriting the latest Guardian score when resuming and forking threads.
GitOrigin-RevId: 95a6c803f8dae75516d1da9d66a722379a0a7ef2
## Why
Config reads arriving while a long-running shared read was active waited for that
request to finish, even though they could safely run concurrently.
## What changed
- Admit newly queued shared reads into the active batch until an exclusive write
is queued, preserving the write as a fairness barrier.
- Treat `hooks/list` and `configRequirements/read` as shared config reads.
- Cover concurrent reads, read/write ordering, and config reads completing
alongside a `skills/list` request.
GitOrigin-RevId: 8194301c2ba60be0fc71b8915923af9accc745dc
## What changed
- Add end-to-end app-server tests for MCP tool approvals with Guardian V2 and automatic review enabled.
- Verify that sampling receives the thread context, uses a thread-scoped prompt cache key, and persists the resulting action risk score.
- Cover both routing outcomes: low-risk actions skip later Guardian reviews, while high-risk actions continue through full review.
GitOrigin-RevId: 78ba2b0560caf701ad333785c4dda4f7d2be4f2c
## Why
Durable thread queues can be updated through another SQLite connection, but loaded idle threads need to notice those updates before they can dispatch the new messages.
## What changed
- Track a durable revision for each thread queue, including backfilling existing queues and updating revisions on inserts, updates, and deletes.
- Poll SQLite's data version and query revisions to find changed queues for loaded threads.
- Wake idle threads with pending external messages, discover queued work when threads are loaded or resumed, and retry each thread independently so one blocked queue does not stall others.
## Testing
- Cover cross-runtime queue writes, edits, independent dispatch, wake retries, and resumed threads.
- Cover migration backfills and revision tracking for queue updates and deletes.
GitOrigin-RevId: 906d902bbf6a760be206a1b2c08fd71427b63c46
## Why
Building a resume-picker preview for a legacy session should not require loading its full thread history.
## What changed
- Read up to six preview lines by scanning at most 1 MiB from the end of a local legacy rollout.
- Fall back to the existing history hydration path when the local file is unavailable, the bounded scan is incomplete, or the tail contains a rollback.
- Keep the initial `thread/read` request turn-free while loading the preview.
## Testing
Added coverage for compaction, rollbacks, oversized records, exhausted scan budgets, and app-server request parameters.
GitOrigin-RevId: a8950f03d8b56323f268fd3355c6a38a16cb9833
## Why
Direct access to shimmer primitives can bypass the reduced-motion handling
introduced in https://github.com/openai/codex/pull/20564.
## What changed
- Make `shimmer` a private child of `motion` and restrict `shimmer_spans` to
its parent module, so Rust visibility enforces the animation boundary.
- Remove the source-scanning regression test that previously checked this
boundary with regular expressions.
GitOrigin-RevId: 1f4cccacaa907992c636cd1e9cd2829b7653f811
## What changed
- Reuse shared directory fixtures and local and remote app-server instances across the resume cwd case matrix.
- Seed the runtime working-directory override directly so each case focuses on resume behavior without starting and replacing an extra thread.
- Run the test on a four-thread Tokio runtime and shut down each shared server after all cases complete.
GitOrigin-RevId: 4bc4978abc546882f26bcb5e3591ff9673758b4a
## Why
Pet tests reuse the same blank WebP spritesheet fixture, so encoding a new image
for every temporary path does unnecessary repeated work.
## What changed
Encode the test spritesheet once with `LazyLock`, then write the cached WebP bytes
to each requested fixture path.
GitOrigin-RevId: 26d75bb1bac448717ca63aeb82eb4e500c86fad8
## Why
The 1,000-character human-like typing test waited on the wall clock after
every keypress, making the test unnecessarily slow.
## What changed
Advance an injected timestamp by the recommended paste flush delay and flush
the paste-burst detector explicitly after each character. This preserves the
coverage that slow typing appears directly without creating a paste
placeholder, without sleeping between keypresses.
GitOrigin-RevId: 0c1beb40283f7d73a381cd221725ab4227c8e233
## What changed
Construct the oversized unified diff fixture directly instead of generating it
from two large input strings. Keep the fixture just above
`MAX_HIGHLIGHT_LINES` so the test continues to verify that syntax highlighting
is skipped for large updates.
GitOrigin-RevId: 8f8853e03a50ff9f53e77b2ba0956cf85ee17c07
## Why
MCP tool results can contain multi-megabyte image, audio, or resource bodies,
even though TUI history renders only summaries for those content types.
## What changed
- Project completed MCP results into width-independent display data, dropping
media and resource bodies that history does not render.
- Preserve text output, JSON fallbacks, error state, Node REPL rendering, and
the fully decoded image-output marker.
- Add tests covering width-dependent rendering, image validation, and Node REPL
text fields on non-text and unknown content blocks.
GitOrigin-RevId: 2cfddf0864093e6837a4431e541f7a9cab544a68
## Why
Keeping overflowing separators with the following word can add whitespace-only
rows and make composer wrapping differ from the queued-input preview.
## What changed
- Hang breakable whitespace from the preceding visual row at soft word breaks
while preserving the underlying editable text.
- Keep indentation, trailing whitespace, mandatory breaks, and nonbreaking spaces
visible and editable according to their existing semantics.
- Align cursor placement, scrolling, vertical navigation, masked rendering, and
styled overlays with the visible wrapped content, including after resizes.
## Testing
Add focused wrapping, rendering, cursor, editing, scrolling, navigation, Unicode
separator, long whitespace-run, and resize coverage.
GitOrigin-RevId: 7fbdb0a4bf33cfee20c4c19dca5aee74df4f892c
## Why
Windows named pipe servers can impersonate connected clients. IDE context
connections only require the server to identify the client, so they should not
grant broader impersonation rights.
## What changed
Open Windows IDE context pipes with `SECURITY_SQOS_PRESENT` and
`SECURITY_IDENTIFICATION`, limiting the server's impersonation token to the
identification level.
## Testing
Add a Windows regression test that connects to a named pipe, asks the server to
impersonate the client, and verifies that the resulting token has the
`SecurityIdentification` level.
GitOrigin-RevId: 51ef080f3367857987e03b0113a476040ea40e56
## Why
Headers configured for an MCP resource can contain credentials and must not be
forwarded to a different origin during OAuth discovery, registration, or token
exchange.
## What changed
- Apply configured resource headers only to OAuth requests on the MCP resource
origin, while allowing OAuth-generated headers to take precedence.
- Follow credentialed OAuth redirects only when each destination remains on the
resource origin. Preserve redirect method semantics, the overall timeout, the
response size limit, and a maximum of 10 redirects.
- Use the Codex MCP user agent for requests to authorization-server origins.
## Testing
Add coverage for cross-origin header isolation, same-origin dynamic client
registration redirects, OAuth header precedence, token refresh, timeout
accounting, and response size limits.
GitOrigin-RevId: 609d06e2b065e4aa9ca5382b4ae60455f9e26db9
