## Why
The transcript supplied to Guardian may omit earlier user instructions, restrictions, or revoked permissions. History retrieval lets the reviewer check relevant authorization before approving actions with side effects.
## What changed
- Add the disabled-by-default `guardian_conversation_history_tools` feature. With Apps enabled, expose `user_message.search_messages` and `user_message.read_messages` through the parent's live Apps connection and conversation identity.
- Recheck the parent's current app and tool policy on each call, rejecting disabled tools and calls requiring approval.
- Add retrieval instructions that distinguish user authorization from assistant context and account for later revocations and incomplete results. Allow overrides through `auto_review.experimental_conversation_history_prompt`.
- Limit history responses to an estimated 4,000 tokens by default, configurable through `auto_review.conversation_history_max_output_tokens`, while preserving stricter parent and reviewer limits.
- Allow explicit extension registries for isolated sessions and prevent those sessions from inheriting the implicit Apps connection.
## Testing
Add scenarios covering history tool exposure, parent connection and identity reuse, custom prompts, output truncation, stricter reviewer budgets, and live permission changes on a reused reviewer. Extend configuration coverage for blank prompt overrides.
GitOrigin-RevId: 055a69b113c8548bd58e7d5618ea026ba6d1ffb1
## Why
After a model change within a turn, tools could still use the turn's original model capabilities, output limits, and telemetry attribution.
## What changed
- Build each step's tool plan from its captured model settings.
- Use those settings for image support and detail, command and MCP output truncation, extension metadata, and tool telemetry.
- Preserve the issuing step's model for delayed command completion events while allowing later `write_stdin` calls to use their own step's output limits.
## Testing
Add regression coverage for model changes within a turn, including tool replanning, Code Mode execution, image handling, MCP tool and resource output limits, extension settings, and delayed command completion.
GitOrigin-RevId: ef991598e89a846889baf770a0c9e12e56886d5d
## What changed
- Resolve `link_id` from tool-call arguments when Apps metadata sets
`requires_explicit_link_id` to `true`.
- Reject the call before approval or execution when the required selector is
missing, empty, or not a string.
- Preserve catalog-provided account metadata for legacy Apps tools and leave
non-Apps MCP tools unchanged.
## Testing
- Add unit coverage for required selectors, malformed values, legacy
fallbacks, and non-Apps tools.
- Add end-to-end coverage for execution, approval prompts, and rejection when
an Apps call omits `link_id`.
GitOrigin-RevId: 667fd04102a3934d53ded020da6d1bf68a1ca3e5
## Why
MCP error-code telemetry special-cased Codex Apps: its reported error
codes were retained, while codes from every other MCP server were
replaced with `unknown`. Error reporting should behave consistently for
every MCP server. The server name already identifies where an error came
from, so telemetry does not need a separate Codex Apps classification.
This follows up on [#28976](https://github.com/openai/codex/pull/28976),
which introduced MCP error-code telemetry.
## What changed
- Add the MCP server name to call, duration, and error metrics.
- Retain bounded, sanitized tool error codes from every MCP server.
- Remove `McpErrorCodeSource` and the Codex Apps ownership lookup from
telemetry collection.
- Use the same metric-tagging path for blocked, rejected, and executed
MCP calls.
## Test plan
- Verify the complete metric tag set includes the sanitized MCP server
name.
- Verify error codes from ordinary MCP servers are retained, bounded,
and sanitized.
- Preserve coverage for request failures, tool-result failures, nested
auth failures, and span attributes.
[Codex Thread
019edc37-5345-7272-92c9-bf5494cf3819](https://codex-thread-link.openai.chatgpt-team.site/thread/019edc37-5345-7272-92c9-bf5494cf3819)
## Summary
- count MCP `CallToolResult.isError` responses as failed calls instead
of successful transport-level calls
- add `codex.mcp.call.error` with bounded `error_type` and trusted
plugin-service `error_code` dimensions
- record the same error classification on MCP tool-call spans while
keeping untrusted server error text out of metric labels
## Scope
- no changes to MCP routing, retries, tool behavior, configuration, or
public APIs
- request failures remain grouped as `mcp_request`; separating
connection, timeout, protocol, and JSON-RPC failures requires preserving
typed errors through the existing flattened error boundary
## Testing
- `just test -p codex-core 'mcp_tool_call::tests::'` (75 passed)
- `just fix -p codex-core`
- `just fmt`
- `just test -p codex-core` (2,676 passed; 80 unrelated environment
failures from missing test binaries, sandbox signals, and read-only
paths)
felixxia-oai