## Why
Model catalog description overrides only covered `spawn_agent`, leaving the other multi-agent V2 tools with fixed descriptions.
## What changed
Extend `model_messages.tools.multi_agent` description overrides to `send_message`, `followup_task`, `wait_agent`, `interrupt_agent`, and `list_agents`. Resolve each override by tool name across namespaced, plain, and Code Mode exposure.
Missing or null descriptions retain bundled text; empty strings suppress static text without disabling tools. Preserve `spawn_agent` runtime guidance, tool schemas, and execution behavior. Descriptions follow mid-turn model changes.
## Testing
Expand integration coverage to all six tools, including missing, null, empty, and sparse overrides; plain, namespaced, and Code Mode exposure; unchanged V1 behavior; and mid-turn model changes.
GitOrigin-RevId: a2c47eb8efb28c3eeebcc6482e36c188c38a6dd1
## Why
`CodexThread` retained the full `SessionConfiguredEvent`, including initial replay messages, and cloned it even for callers that only needed thread or session IDs.
## What changed
Store `ThreadStartupMetadata` without replay history and expose it by reference through `startup_metadata()`. Update callers to read IDs from this metadata. When rejoining a running thread, rebuild the startup response using the supplied resume history for `initial_messages`.
## Testing
Extend the resume test to verify that rejoining reuses the loaded thread, preserves startup metadata, and still returns the original replay messages as a prefix.
GitOrigin-RevId: 9d656063088c28f091d29e5862e4b9d894b7642c
## Why
Synchronous Guardian reviewers need to use their selected request-level reasoning effort even when managed requirements enable `reasoning_effort_override` and the parent history contains effort updates.
## What changed
Disable reasoning-effort overrides for synchronous Guardian sessions and use the same decision for request filtering, effort pinning, and update injection. Reviewers omit inherited configuration updates from requests without changing saved history or appending new effort updates.
## Testing
Add regression coverage for both current and legacy Guardian session sources with managed overrides enabled. Verify that the parent retains its pinned effort, reviewer requests follow selected `low` and `high` efforts, and inherited updates remain in saved history.
GitOrigin-RevId: 3a635dbdc613ea72f7a96fc96bb386e4ac7994c3
## Why
Resuming a thread after disabling reasoning effort overrides still sent saved `configuration_update` items until compaction. Disabling the feature should also apply to requests built from existing history.
## What changed
Pass the `ReasoningEffortOverride` feature state into `ModelClient` and filter `configuration_update` items from request input when disabled. Preserve persisted history and other input items while using the request-level reasoning effort.
## Testing
Add regression coverage for resumed threads, compaction, and WebSocket warmup and turn requests. Verify that saved updates remain in history and `agent_message` items remain in request input.
GitOrigin-RevId: aac3257da1ca38a0744807c4f7cb12565bd7fe53
## Why
Code-mode responses show host duration without exposing time spent outside the host, including app-server waiting.
## What changed
- Add `features.code_mode.experimental_show_cell_overhead`, disabled by default, to show handler duration, host duration, and their difference in `exec` and `wait` response headers.
- Reuse the completed handler measurement from tool-call logging, excluding dispatch waiting, and capture it even when logging is disabled.
- Preserve the existing timing format when the option is disabled or host timing is unavailable, and preserve boolean feature toggles when merging nested code-mode configuration.
## Testing
Add coverage for timing headers, zero and missing host measurements, negative rounding differences, content preservation, and configuration merging. Extend app-server tests across gRPC and stdio to verify timing includes post-host elicitation waiting, and add a response snapshot for successful execution and a failed wait.
GitOrigin-RevId: 929b84784d9c6077cf2b5927a90bd2d5f3870078
## Why
Model requests need the selected workspace's routing constraints before sending content. A missing cached route cannot establish that a custom ChatGPT-auth destination is independent of the workspace.
## What changed
- Register the account processor as the workspace routing resolver for Responses HTTP, compaction, and WebSockets, enabling origin selection and routing headers while preserving API paths and rejecting routed HTTP redirects.
- Share concurrent discovery by auth generation, workspace, and backend configuration. Recover from discovery-time `401` responses while allowing token refreshes for the same auth owner.
- Require successful discovery before classifying custom destinations as independent, and require a new thread when a workspace-bound session's bootstrap origin changes.
- Refresh managed requirements using retained session configuration without fetching thread configuration again. Return typed routing errors without account or backend details.
## Testing
Extend coverage for discovery-time token refresh, retained provider definitions under managed requirements, and specific invalid-routing error categories.
GitOrigin-RevId: 090cda70daa91ee8acfbc973699d028111e54125
## What changed
- Accept `windows.sandbox = "mxc"` and preserve the selected backend through environment configuration, command execution, patch writes, and sandbox metadata.
- Treat MXC as enabled in the TUI and report Windows sandbox readiness as `ready`, avoiding legacy setup prompts.
- Keep `allowed_sandbox_implementations` scoped to the legacy elevated and unelevated backends without restricting MXC.
- Default `windows.sandbox_private_desktop` to `false` for MXC while retaining `true` for legacy sandboxes.
## Testing
Add coverage for MXC configuration precedence, legacy requirement handling, sandbox selection, and TUI state. Add a Wine integration test that verifies command and patch routing fails when native MXC is unavailable and reports `windows_mxc` in turn metadata.
GitOrigin-RevId: e2162447d0750f60753864c92a20e02a7f297bca
## Why
Image preparation replaces uploaded images with file references in model history, but user message events still retain the original local paths or inline image URLs. Live and persisted display history should carry the prepared file IDs as well.
## What changed
- Prepare images before emitting user message events, and copy uploaded file IDs into the corresponding user inputs.
- Track original input positions through content expansion so failed image reads, omitted inputs, and duplicate URLs do not misassociate images.
- Preserve text spans, image detail settings, and inputs without a prepared file reference.
## Testing
Add a protocol test for image position mapping and an integration test covering file IDs in model requests, live user message events, and persisted display history, including failed images and duplicate URLs.
GitOrigin-RevId: 55e7ab97925b5db049c5c2403d90349635eee740
## Why
Asynchronous score publication updated the risk score, authorization, and tool-call coverage separately. Approval checks could therefore read inconsistent evidence when deciding whether to reuse a cached score.
## What changed
Keep Guardian's cached score and observation state under one lock, and use consistent snapshots for approval checks. Publish successful scores together with their authorization and classified tool-call index. Preserve timestamp ordering, fail-closed precedence on timestamp ties, and per-call oversized-action tracking.
## Testing
Add regression coverage for rejected delayed results and timestamp ties. Add a gated integration test showing that a delayed score becomes stale after intervening tool calls, while a sufficiently fresh score permits cached approval.
GitOrigin-RevId: 8df6fafd5e0ee59aa0f78f541eac562efce3d4d0
## Why
An explicit `service_tier = "flex"` could be dropped when fast mode was disabled or the model catalog did not advertise Flex, even though Flex is an API request option.
## What changed
- Preserve configured `flex` through core session settings, TUI tier resolution, and request construction regardless of fast-mode or catalog support.
- Omit `service_tier` from Amazon Bedrock requests, including with custom catalogs, because Bedrock only supports the implicit default tier.
## Testing
Add regression coverage for Flex configured at startup or through thread settings, connected thread startup, and TUI turn submission. Update review coverage to expect Flex with fast mode disabled, and verify that both Bedrock providers omit `service_tier`.
GitOrigin-RevId: 98f2761bdd780603839ebfec75cb983a5d55e554
## Why
A delegated task can omit restrictions from the sender's user messages. Guardian needs that context when reviewing actions in the receiving thread.
## What changed
- When thread-owned Guardian context is enabled, capture up to three recent local user messages when a `send_message_to_thread` delivery from `codex_app` or `codex_tui` is accepted.
- Provide a bounded snapshot to synchronous and asynchronous reviewers, with explicit notices for unavailable evidence and a reminder that historical context does not transfer permission. Keep the snapshot out of the worker prompt.
- Retain snapshots with their deliveries across replay, compaction, and rollback, and strip them from forked agent history.
## Testing
Add coverage for reviewer-only visibility, missing sender provenance, context-budget preservation, checkpoint replay and rollback, fork isolation, and input serialization that rejects harness metadata.
GitOrigin-RevId: 3870ba762aa81689713b56d4cb3b98566bffed88
## What changed
Read the static V2 `spawn_agent` description from `model_messages.tools.multi_agent.spawn_agent.description`, independently of the runtime tool namespace. Missing or null values retain the bundled description; an empty string suppresses it.
Preserve generated model guidance, local usage hints, and tool parameters when applying an override. Resolve the description from the active model so it follows mid-turn model changes.
## Testing
Add coverage for sparse and empty catalog values, preservation of generated context and outbound tool schemas, and description updates after mid-turn model changes.
GitOrigin-RevId: 96cfa180f8f374dc868e4fabc337e49380e405da
## Why
Removing the selected working directory can prevent filesystem sandbox helpers from launching, even when the requested absolute paths remain accessible. Permission rules must stay anchored to the selected directory while those operations continue.
## What changed
- Require a policy `cwd` in `FileSystemSandboxContext` and launch filesystem helpers from the filesystem root while preserving the policy directory and workspace roots.
- Carry explicit `policyContext` in filesystem RPCs, preserving legacy wire fields and resolving omitted directories from older clients at executor ingress.
- Keep permission paths as executor file URIs and validate host compatibility where they are enforced.
- Bind Windows relative denial globs to the policy directory before changing the helper's launch directory, preserving home-relative patterns.
## Testing
Add regression coverage for `apply_patch` after working-directory removal, legacy RPC directory fallbacks, cross-platform permission URI transport, and Windows relative read denials. The patch regression verifies that an allowed file is updated while an explicitly denied file remains unreadable and unchanged.
GitOrigin-RevId: b0f4db722b27cb72ec129fc297c85732afac11f7
## Why
Older Desktop clients can still provide bundled Sites to an independently updated SSH app-server. A cached remote Sites install must take precedence, even when disabled, while a missing remote bundle must preserve the bundled fallback.
## What changed
- Remove persisted bundled-plugin exclusions, Sites migration checks, and the migration wait when loading local plugin configuration.
- Suppress `sites@openai-bundled` during plugin loading when the remote global catalog is active and a cached remote Sites install is available.
- Remove exclusion-based catalog filtering and read/install guards, and simplify `install_plugin` to accept `ConfigLayerStack`.
## Testing
Expand the agent-turn Sites test to cover enabled remote precedence, disabled remote suppression of bundled Sites, and fallback when the remote bundle is missing.
GitOrigin-RevId: e2758596e5493ccee051cdfbf6b4afbe4f98948c
## Why
Code Mode cells that finish without invoking tools omit completeness metadata, leaving a verified empty inventory indistinguishable from an unverified one.
## What changed
- Retain completed, losslessly recorded cells even when they contain no tool calls.
- Always include `executed_tool_calls` when setting `tool_calls_complete`, using `[]` for empty inventories or terminal waits with no new calls.
- Preserve completeness across request retries while revalidating history and rejecting late calls or ambiguous output mappings.
## Testing
Add regression coverage for empty tool discovery, errors, termination, feature gating, retries, and fresh-session requirements for waits. Update protocol assertions to require an explicit empty call list with completeness metadata.
GitOrigin-RevId: 24affe47f46068b6559d04a0103958ae83a00b92
## Why
After a settings update during an active turn, spawned agents could inherit the turn's initial model and reasoning settings. Effort-only overrides could also be validated against the wrong model.
## What changed
Build child configuration from the invoking step's captured model, effective reasoning effort, and reasoning summary in both multi-agent versions. Validate effort-only overrides against that captured model's supported reasoning levels.
## Testing
Add regression coverage for spawning after an active-turn settings update in both multi-agent versions, including effort-only overrides. Update configuration tests to check captured settings and the model's default reasoning effort.
GitOrigin-RevId: 068bdb744149048829cdaa68d254b62e96e6e6af
## Why
File images contributed zero to history and compaction token estimates and were dropped from Guardian context. This undercounted context usage and omitted image evidence from reviews.
## What changed
- Estimate file images using the fixed resized-image cost, or 10,000 patch tokens for `original` detail because file references do not expose dimensions.
- Charge file images against remote compaction and Guardian request budgets.
- Preserve file images from user messages and tool outputs through Guardian selection and delivery, and deduplicate review images by file ID.
- Apply transcript image count and byte limits to both reference types, counting file ID bytes rather than referenced file contents.
## Testing
Add coverage for file-image estimates, selection limits, delivery, and compaction retention. Extend Guardian tests to verify file-image evidence reaches reviews and uploaded original-detail images trigger reviewer-history compaction.
GitOrigin-RevId: ee024204dcbe16e277fea9347c6a4d7fc120e18d
## What changed
Stop emitting a warning when skill descriptions are shortened to fit the skills context budget. Continue warning when skills are omitted from the model-visible list.
Update the app-server warning test to set `skills.max_context_tokens` to `1_000` and expect the omitted-skills warning. Remove assertions and tests for the description-shortening warning.
GitOrigin-RevId: feac10b3d159d73648a786120d477b7fe4e082d7
## Why
MCP requests that need human input, including browser sign-in, must be handled by the root thread. Subagents need guidance to hand these blockers to their parent without prompting the user or automatically accepting requests that require input.
## What changed
- Reject interactive MCP elicitations and tool approval prompts in subagents with guidance to ask the parent and wait before retrying.
- Recognize browser authentication and `codex_requires_user_input` metadata even when the form schema is empty, while preserving automatic permission approvals and review decisions.
- Carry user-interaction eligibility through MCP runtime creation and connection reuse, and guard prompt registration.
- Preserve connector authentication diagnostics alongside handoff guidance, subject to normal tool-output limits.
## Testing
Add unit and integration coverage for blocked subagent prompts, root browser authentication, automatic approval and review, connection reuse, and authentication diagnostic preservation and truncation. Add a request-history snapshot for browser-auth handoff guidance.
GitOrigin-RevId: 83e146b6e5c1a2a22a34681ad45615f504b3c96c
## What changed
Upload prepared images from messages and tool outputs through the session's `AttachmentStore` before recording history. Use the returned inline bytes or file reference, and fall back to the prepared inline image if upload fails.
Keep history replay on `InlineAttachmentStore` so it does not upload recorded images, and preserve existing file references. Reuse image resizing directly for guardian review comparisons without uploading.
## Testing
Add coverage for upload failure preserving resized inline images. Extend rollout coverage to verify that only new images are uploaded, uploaded bytes have the expected dimensions, and file references and resize notices survive replay.
GitOrigin-RevId: e9966297c3579ef1e52376f0235fe3a7e3ec7ecc
## Why
Per-socket metrics label resends after reconnect as initial requests, obscuring why full input was sent. Client telemetry can preserve that reason across reconnect failures and turn boundaries.
## What changed
- Add `codex.websocket.continuation` to count `response.create` send attempts, including failed sends, with `mode`, `reason`, and `phase` tags.
- Distinguish incremental continuations, fresh requests, restored history, closed connections, and other full-input sends. Track warmup and generation separately.
- Preserve the first continuation reset reason until the next send and identify resumed or forked history.
- Allow session telemetry to use a `MetricsClient` supplied through thread extensions and document the counter's semantics.
## Testing
Add metric assertions for incremental reuse, warmup, changed requests, account switches, reconnects, and resumed or forked history. Add a unit test for preserving reset reasons across repeated resets and turn boundaries.
GitOrigin-RevId: 29324f5e9d5677e0c6068f89b2256a92a5a0d157
## Why
Compaction prompts omitted recorded Code Mode tool calls, leaving them without the nested tool inventory available to normal sampling requests.
## What changed
- Attach pending and retained Code Mode tool metadata to local and remote v2 compaction prompts, including updated result metadata and completeness markers.
- Bound Code Mode metadata separately while preserving captured direct tool records.
- Keep observations omitted from shortened compaction retries available if compaction fails and normal sampling resumes.
## Testing
Add regression coverage for metadata attachment, retry retention, independent budgeting, and binding validation. Extend local and remote compaction tests to check tool inventories with metadata enabled and disabled.
GitOrigin-RevId: 1dc012bd5838797c605d981a8fc1b0378a142227
## Why
Read-only MCP discovery and invocation need a consistent policy across requests, connection reuse, and tool catalogs. Reusing an unrestricted connection or cached catalog can bypass filtered discovery.
## What changed
- Thread `requires_read_only_mcp_tools` through MCP configuration and client setup, leaving it disabled by default.
- When enabled, set `openai/readOnly` to `true` in `tools/list` and `tools/call` request metadata, overriding a caller-supplied `false` while preserving other metadata, pagination, and arguments.
- Include the policy in connection identity and bypass shared Apps and persistent tool catalog caches for read-only connections.
## Testing
Add coverage for metadata propagation in legacy and modern protocol modes, preservation through session recovery, and isolation from unrestricted connections and shared Apps catalogs.
GitOrigin-RevId: f4a3a4021a54e302bffd53f08092b080c056246b
## What changed
- Wait for a request tagged with `x-openai-subagent: guardian` before triggering cancellation, disconnection, or timeout in network approval tests.
- Read the last yielded parent request in the tool cancellation test, with an explicit error if no request was captured.
- Disable WebSockets in the issuing-step permissions test to use its HTTP mock server.
GitOrigin-RevId: 35c021e3931ff4a66ca3970f8e39e1d20257be88
## Why
Server-level tool exposure settings apply to every connector on the apps server. Individual connectors need a way to opt out of deferred discovery without changing exposure for other apps.
## What changed
Add `apps.<connector_id>.omit_tools_from` with support for `code_mode`, `deferred`, and `direct`. Combine connector omissions with server omissions so app settings preserve server restrictions.
For example, `omit_tools_from = ["deferred"]` makes a connector's tools available without tool search, through direct calls or Code Mode as permitted by the active tool mode and remaining restrictions.
Expose the setting in the app-server protocol, JSON schemas, and generated TypeScript and Python types.
## Testing
Add integration coverage for connector-specific exposure and MCP dispatch across tool modes, server restrictions, and direct-only namespaces. Extend config tests to cover populated, absent, and empty omission lists, and add a Code Mode request-history snapshot.
GitOrigin-RevId: cc99ab290c8a878d06d8d7ccf2d1dbd7c46bfa8a
## Why
Orchestrator skill caches were tied to the entire MCP connection set, so runtime updates could discard cached catalogs and contents even when the Apps connection was reused. Plugin changes still need to refresh those resources without requiring a reconnect.
## What changed
Key orchestrator skill caches by the Apps server connection and an explicit invalidation generation. Preserve cached resources while that identity stays unchanged, and invalidate them on MCP runtime refresh requests or configuration refreshes. Replacing the connection also changes the cache identity.
## Testing
Extend the production-turn integration test to verify cache reuse across ordinary turns and approval-policy changes, refreshed skill contents after plugin invalidation without reconnecting, and fresh resource requests after a forced reconnect.
GitOrigin-RevId: 43ce059972369c4c735742e8224b60a692244b02
## Why
The cleanup-hook allowlist for `browser@openai-curated-remote` accepted only `Stop` and `SubagentStop`, leaving its cleanup hook unavailable when a turn was interrupted.
## What changed
Allow `Interrupt` to invoke `browser.turn_ended` through `codex_apps`, retaining the registered browser connector and empty-input requirements.
## Testing
Extend hook metadata tests to cover interrupts, rejecting mismatched connectors and manifest-provided arguments. Extend executor integration coverage to interrupt an active turn and verify that browser app and computer-use cleanup calls use their separate MCP routes.
GitOrigin-RevId: 355801f9ca3086bae80d1e623d0be7e1772a39e1
## What changed
- Add `ResolvedModelMessages` to resolve catalog text and bundled defaults while preserving explicit empty overrides and their source.
- Move base-instruction rendering, Guardian prompt composition, multi-agent role rendering, and `update_plan` guidance filtering into `codex-prompts`; migrate consumers to the shared APIs.
- Separate permission-profile resolution from prompt composition, and annotate Guardian policy and classifier instructions with content kinds.
## Testing
Add and update coverage for missing versus empty templates, literal overrides, multi-agent role composition, Guardian policy substitution and truncation, and preservation of permission path spellings and order.
GitOrigin-RevId: 52335bb7acec0f432d5c57acb2accd5f0276056e
## What changed
Add an optional `protocol_mode` to `McpServerContribution::HostedApps` and apply it when registering the server. Preserve the hosted Apps default when no override is provided.
## Testing
Add an integration test that selects MCP `2026-07-28` with the global feature disabled and completes a native user verification flow, including resuming the tool call with the verification response. Extend capability tests to confirm that the override preserves hosted Apps user verification without granting it to ordinary extension registrations.
GitOrigin-RevId: e8662c45f964c00b0bb4503bbcfd8432d7e2fa70
## Why
Executor skill discovery enabled every discovered skill, with no provider option for callers to disable selected skills.
## What changed
Add `ExecutorSkillProvider::with_disabled_skill_paths` to accept `SKILL.md` paths grouped by environment ID. Mark matching catalog entries disabled in both discovery routes so they are omitted from model context. Skills remain enabled by default, and paths configured for another environment have no effect.
## Testing
Extend catalog tests to cover default enablement, matching paths, and environment isolation across both discovery routes. Add a model-context snapshot test confirming that an active skill appears while a disabled skill is omitted.
GitOrigin-RevId: 7426eb94566db2bcf7e49a5dee28673ab743ad25
## What changed
Capture result metadata for host-owned app calls when analytics and executed tool call metadata recording are enabled. Respect both `analytics.enabled = false` and host-disabled analytics, using the prepared call's ownership to determine eligibility.
Disable incremental WebSocket request reuse when raw result metadata or its call binding changes, so late results attached to an already-sent output are included in the next request. Continue allowing reuse when only other metadata changes or result metadata is filtered out for the endpoint.
## Testing
Extend coverage for direct and code-mode calls, analytics settings and host overrides, runtime recording changes, and prepared call ownership. Add metadata comparison and WebSocket reuse tests, and verify that raw response item notifications continue to omit result metadata.
GitOrigin-RevId: 411843fbff3749ee96fd6f0ebc591362942a4555
## What changed
Add `codex_history::CompactionCheckpoint` to keep a checkpoint and its recorded producer model hash together, with shared checks for usability and reviewer compatibility.
Replace `ConversationHistorySnapshot::latest_compaction_model_hash()` with `latest_compaction()` and use the shared abstraction in Guardian context selection, review sessions, and parent compaction reuse. Preserve selection of the latest checkpoint even when unusable, and leave missing producer metadata unknown.
## Testing
Add coverage showing that the latest checkpoint retains its own provenance even with missing or empty encrypted content, and that compatibility requires matching producer and reviewer hashes. Adapt existing history, migration, and parent compaction tests to the new API.
GitOrigin-RevId: 98e794644edf979c98fcc8294baa48ff82ea0ed0
## Why
With `NonfatalClockReadErrors` enabled, a clock failure after a successful read could be suppressed if an earlier failure had already been reported in the same turn and context window. This left the model without a fresh notice that the clock was unavailable again.
## What changed
Clear `last_clock_failure` after a successful clock read so a subsequent outage produces a new notice while consecutive failures remain deduplicated.
## Testing
Add a regression test that scripts two failures, a successful read, and another failure within one turn. It verifies that the consecutive failures share one notice, recovery delivers a time reminder, and the later failure adds a new notice.
GitOrigin-RevId: f2a9c4d7b63f2e8408a47b1803b0bc4577f23f32
## Why
An omitted controller socket policy was treated as an explicit denial, preventing execution environments from supplying their own Unix socket grants.
## What changed
- Preserve omission of `dangerously_allow_all_unix_sockets` separately from `false`, and retain explicitly empty `unix_sockets` maps.
- Defer to attachment socket permissions when the controller supplies neither setting. Continue enforcing explicit restrictions, socket denials, and managed requirements.
- Resolve omitted values to `false` for ordinary execution and remote configuration, preserving the default for commands without attachment grants.
- Add debug logging for effective environment and remote execution network policies.
## Testing
Add regression coverage for omitted, explicit, finite, empty, and managed socket policies through remote launch configuration, including live policy replacement and serialization round trips. Adjust remote environment tests to tolerate child-completion ordering and box large cold-resume test futures to reduce Windows stack usage.
GitOrigin-RevId: 98a88d01cbb91aea1faaa03b3c414ef3be7af398
## Why
Reusing a Guardian reviewer could trigger a model catalog refresh during the previous-model compaction check, even when the model was unchanged and no compaction compatibility change required compaction.
## What changed
Return early from the previous-model compaction check for Guardian sessions when the model slug is unchanged and the compaction compatibility hashes do not require compaction.
## Testing
Add a regression test with an expired model catalog cache that verifies two approvals reuse the same Guardian reviewer, both reviews and the parent turn complete, and no additional model catalog request occurs.
GitOrigin-RevId: cc1cdc5f89c6f9ec03f1bedfb78cad9780825733
## Why
Probing Windows network paths can send ambient credentials, even during metadata checks. Entries in `project_doc_fallback_filenames` must be validated before filesystem probes.
## What changed
Ignore entries containing path syntax according to the executor's OS, rather than the host's. Reject `.` and `..`, slashes, and NUL characters on all executors; also reject backslashes and colons on Windows. Log a warning for rejected entries and continue considering valid filenames.
## Testing
Add tests that verify invalid entries never reach metadata probes under POSIX and Windows path conventions, preserve backslashes and colons in POSIX filenames, and confirm valid fallback instructions still load alongside invalid entries.
GitOrigin-RevId: 4369e9b97ae6a3560d09e79efd8c85adac3d1d90
## Why
Executor profile roots can use path conventions that are not native to the current host. Converting them to host paths during configuration or turn reconstruction can reject or drop those roots, while case-insensitive comparison can hide Windows path spelling changes.
## What changed
- Store profile roots as URI-backed `ProfileWorkspaceRoot` values throughout permission snapshots and thread settings, preserving spelling in equality and deduplication.
- Keep effective workspace roots as `PathUri` values for permission materialization and status summaries. Convert Windows sandbox root hints to native paths only at native Windows sandbox boundaries, rejecting incompatible roots.
- Omit the legacy rollout `workspace_roots` field when profile roots cannot be represented as host paths, retaining the compiled permission profile.
## Testing
Add regression coverage for Windows and UNC root spelling changes, settings restoration and turn recording with foreign roots, executor-root status display, and backend-specific Windows root conversion.
GitOrigin-RevId: 903c068fd74959bdd10e7cb1141aa42b953a59a4
## Why
Clock provider failures can abort a turn while preparing time context or running clock tools. Allow turns to continue with an explicit indication that the current time is unavailable.
## What changed
- Add `features.nonfatal_clock_read_errors`, disabled by default, to report clock failures to the model without failing the turn.
- Emit a generic `failed to read current time` notice for context reads and tool errors, without exposing provider error details. Deduplicate context notices per turn and compaction window, and remove inherited notices from forked subagent context.
- Omit unavailable environment dates and explicitly clear previously visible dates with `<current_date status="unavailable" />`.
- Return external sleep clock failures to the model when the feature is enabled, preserving sleep item completion notifications.
## Testing
Add coverage for continued inference after clock failures, notice deduplication across compaction, subagent notice filtering, environment date removal and recovery, and sleep failures during initial and polling reads.
GitOrigin-RevId: a39c3723c06a6f786d8ad59d667e8b9f626c973e
## Why
Daemon recovery reloads threads but leaves interrupted work unfinished. Resume eligible work automatically from the saved conversation, even without a connected client.
## What changed
- Attempt one new continuation turn immediately after restoration, including in Plan mode. Mark the old turn interrupted and supply recovery context without creating a user message or granting new authorization.
- Require an idle thread, matching permissions, and the same single local environment configured by the thread. Skip completed, aborted, or superseded work and snapshots without environment identity.
- Add `continue_turn_if_idle` with an atomic previous-turn check so newer tasks or standalone settings changes invalidate pending continuation.
- Preserve the output schema, service tier, and root turn ID, and emit a “Resuming interrupted work” warning when continuation starts.
## Testing
Add daemon restart coverage for continuation without a client, Plan mode, permission and environment mismatches, and legacy snapshots. Add core coverage for preserved continuation metadata, absence of user-message events, rejection of superseded continuations, and exclusion of remote execution from recovery snapshots.
GitOrigin-RevId: 2b290b75d9399fc58258bcda2e85c74e9b5b3b09
## What changed
- Add an optional `WorkspaceRoutingResolver` to `AuthManager` and pass session configuration into routing lookups. Callers without a resolver retain existing routing behavior.
- Apply resolved backend origins and account routing overrides to eligible ChatGPT Responses HTTP requests and WebSocket handshakes. Preserve endpoint paths, validate routing values, and reject HTTP redirects for routed requests, including `NO_CONSTRAINT` routes.
- Key cached WebSocket connections by destination, routing header, and auth revision. Rebuild request setup after credential refreshes and reject account changes during setup or routing discovery.
- Serialize routing lookups per session and retain whether the session has previously been routed.
## Testing
Add tests for path preservation, provider exclusions, concurrent routing lookups, unavailable resolvers, workspace mismatches, redirect rejection, and credential refresh or account changes during request setup.
GitOrigin-RevId: 2b6609019e84a315745c94858955f3f16426fe7f
## What changed
- Accept and ignore `features.personality` in user configuration, profiles, and managed requirements.
- Remove feature gating from `personality = "none"`, which strips the literal `# Personality` section when preparing model catalog instructions. Preserve explicit base instructions and existing thread instructions.
- Document deprecated personality fields in configuration, app-server schemas, and the Python SDK: `friendly` and `pragmatic` no longer select a style, and `supportsPersonality` is always `false`.
## Testing
Add regression coverage for ignored legacy flag values and managed requirements, personality opt-out behavior with the flag absent or set to either value, role overrides, and preservation of explicit base instructions, including empty strings.
GitOrigin-RevId: 4e12c66b42bfc59d6f151a5b3c28fadc6654ae99
## Why
Managed daemon recovery snapshots previously saved only loaded thread IDs, without identifying active turns or preserving their turn-specific options.
## What changed
- Capture regular, uncanceled turns after their input is recorded, saving the turn ID, output schema, service tier, and cyber access program alongside persisted thread IDs.
- Store interruption metadata atomically in the existing candidate array format so older servers can still read thread candidates.
- Begin snapshotting once admitted operations drain, while turns may still be running. Run snapshot collection and thread listener attachment independently of the event loop to keep forced shutdown responsive.
## Testing
Add coverage for running, completed, canceled, and compacting turns; recovery readiness for automatic and user turns; admitted resumes during shutdown; forced shutdown with a blocked rollout writer and child listener attachment; and legacy candidate-array compatibility.
GitOrigin-RevId: ed46342c3a5c71b09c48fa9acece2f15ae748e2f
## What changed
Reject `request_plugin_install` calls from non-root agents with an error returned to the model before parsing arguments or prompting for installation. Apply the restriction to both legacy install requests and recommended plugin requests.
## Testing
Add unit and integration tests for both request formats, verifying that subagent calls return the root-only error and emit no installation elicitation request.
GitOrigin-RevId: f23bbc6dd34d69366b81e4033bd554bba1fb816a
## Why
Clients need widget presentation details to render MCP Apps without waiting for the full MCP catalog, including when replaying saved history.
## What changed
- Add `mcpToolCall.mcpAppUi` with the invoked descriptor's `resourceUri` and `preferredModelDisplayMode`, and carry it through tool-call events and saved history.
- Support `fullscreen` and default to `inline` when the display preference is missing or unsupported.
- Keep existing resource URI fields for compatibility. Leave `mcpAppUi` null for older history and tools that declare widgets only in result metadata, where clients still use catalog discovery.
- Update protocol schemas, TypeScript and Python types, and app-server documentation.
## Testing
Add parameterized integration coverage for fullscreen, missing and unsupported preferences, legacy URI metadata, and result-only widgets, verifying consistent tool events and preservation across session resume.
GitOrigin-RevId: 2a9bed804dcea8c2b4903b8406fa6710681f7f5e
## What changed
- Accept `fileId` alongside the existing `url` form for app-server image inputs, and forward file references to the Responses API as `file_id`. Update generated schemas and client types.
- Preserve file references, image detail hints, and mixed inline/file image ordering through user-message events, thread history, and rollout migration. Retain file images when truncating tool output.
- Pass file references through image preparation without resolving them, while keeping resize-notice numbering correct. Omit them from unsupported TUI display and Guardian image context.
- Reject image-edit requests whose recent-image window includes a file reference, preventing selection of an older inline image instead.
## Testing
Add coverage for serialization, request and rollout preservation, mixed-image history ordering, incomplete ordering metadata, tool-output truncation, and rejection of unsupported image-edit selections.
GitOrigin-RevId: 6ca20a8577155cc934b720803c3b7b3bffdf972a
## Why
A checkpoint produced by a previous model may be incompatible with the selected Guardian reviewer. Legacy review must retain user restrictions and verified answers across compaction and restart until a compatible checkpoint is available.
## What changed
- Expose retained user evidence independently of whether Guardian reviews the legacy transcript or parent context.
- Resolve the selected reviewer's compaction compatibility hash during resume and remote compaction. Preserve the legacy transcript when checkpoint compatibility is unknown or mismatched.
- Activate parent-context review immediately after compatible compaction and invalidate pending reviews bound to the previous evidence policy. Ordinary compaction preserves pending reviews.
- Keep strict compatibility checks for previously migrated checkpoints whose complete legacy transcript is no longer available.
## Testing
Add coverage for mismatched checkpoint hashes, retained evidence during legacy review, and pending-review cancellation on migration. Add a request-history scenario covering a model switch, incompatible automatic compaction, restart, and compatible manual compaction with preserved user restrictions and verified answers.
GitOrigin-RevId: b52bfd7c21ce7ebed482174c8d7c327e50b1ada8
## Why
Older compaction checkpoints can lack a producer model hash. Enabling thread-owned Guardian context must accommodate those checkpoints without losing user instructions or verified answers.
## What changed
- Select review policy from each history snapshot independently of the session's evidence capture policy.
- Keep legacy review for checkpoints with missing or empty producer hashes when the transcript preserves the evidence. Preserve strict compatibility checks when review depends on retained-only evidence.
- Continue capturing retained instructions and answers during migration, while supplying legacy reviews with runtime answers and subagent reviews with root authorization evidence.
- Record producer model hashes on new compactions regardless of context mode.
## Testing
Add coverage for checkpoint migration across compaction and resume in both history storage modes, snapshot policy stability, retained-evidence preservation, and authorization revalidation for owning sessions and subagents.
GitOrigin-RevId: ec72b4a51d40729173e24ac1b53b7d516ddaa825
## Why
Disabling a connector's canonical plugin could leave its tools available when another enabled plugin contributed the same connector.
## What changed
Retain `canonical_app_id` in the remote installed-plugin cache and use ownership metadata for the current account when building connector snapshots. A disabled canonical owner now excludes its connector even when another plugin contributes it or the owner's bundle is absent from the host. Match owners by plugin name and marketplace, and ignore ownership metadata when the cache no longer matches the current authentication.
Build these snapshots through `PluginsManager` when the plugins feature is enabled; otherwise use an empty snapshot.
## Testing
Add manager coverage for combined local and canonical exclusions, marketplace matching, and authentication changes. Add an integration test showing that disabling a noncanonical contributor preserves shared calendar tools, disabling the canonical owner hides them, and clearing the exclusion restores them.
GitOrigin-RevId: ee2981d1277825fefb671dd7d1078cd7ea5c0ea5
## What changed
- Replace dedicated Guardian endpoints with `/responses`, sending `x-codex-guardian: reviewer` or `x-codex-guardian: classifier` for eligible Codex backend requests over HTTP and WebSocket.
- Add model-scoped thread headers, recheck backend authentication on each request attempt, and reconnect WebSockets when the applicable headers change.
- Retain `features.guardianv2.free_guardian` for configuration compatibility while removing its routing gate; the backend now controls Guardian billing.
## Testing
Update tests for reviewer and classifier headers, model and authentication scoping, HTTP fallback, WebSocket reuse, and parent-response metadata across retries.
GitOrigin-RevId: 1c2b3c458ab77fb40aae4ee6784f6d827c60e76c
## What changed
- Record `auth_or_link` for Codex app calls with trusted connector authentication failure metadata, capturing it before result callbacks or model-facing rewrites. Propagate the classification to MCP tool-call and app-usage analytics.
- Record `approval` when a dispatched approval request is denied, times out, or aborts, covering both MCP elicitation and legacy user-input approvals.
## Testing
Add unit and turn-level coverage for authentication failures, metadata removal by callbacks, successful and rejected approvals, and closed approval response channels. Verify event counts, classification, and exclusion of sensitive test values and authentication URLs from analytics payloads.
GitOrigin-RevId: 493df2a2923f346a0f644f1f26ab8b6b9b8888e0
