## What changed
Allow `skills.read` and `skills.installations` to resolve visible skills by their full display name or the truncated name returned by `skills.list`. Preserve package locator and alias precedence, merged installation locations, and source filtering.
Reject ambiguous names with guidance to use `skills.list` and pass the intended package locator. Hidden and disabled skills remain unavailable through name lookup.
## Testing
Add regression coverage for name resolution, package and alias precedence, truncated UTF-8 names, merged locations, source filters, and ambiguous names.
GitOrigin-RevId: 5a2526d94f259cadb184563807127cb49955106d
## What changed
Update the `openai-docs` sample skill to read `references/codex-self-knowledge.md` first for broad Codex setup or team customization questions, using its guidance to choose and combine configuration options. Keep other product behavior questions on the existing documentation lookup route.
GitOrigin-RevId: 0d307ab128ee8d3952b1527c20d1e659b79820d3
## What changed
Refocus `openai-docs` on Codex and ChatGPT Work behavior and first-time API integrations. Skip API questions about existing integrations, action requests, and tasks fully answered by supplied text or data. Retain model migration guidance when users explicitly invoke `$openai-docs`.
Replace the broad routing workflow with guidance to check available tools and settings, consult documentation for the relevant product surface, and verify recent changes through the changelog and linked client changes or tests.
Update the skill's display metadata and affected skill catalog snapshots to match.
GitOrigin-RevId: 0a0e9abbee9975ebd30917b7477f475096f2c86b
## What changed
Check the effective permission profile directly when applying startup restrictions for models that require automatic review, instead of converting it to a legacy sandbox policy.
Preserve the downgrade to `workspace-write` for profiles with full disk write access and enabled network access, excluding external enforcement and writable paths that cannot be converted to local paths. Share writable-path conversion with the legacy sandbox adapter.
## Testing
Add startup regression coverage for profiles that are downgraded, preserved, or rejected, including read-only carveouts and writable paths that cannot be converted locally. Verify restored permissions, automatic review selection, and workspace settings.
GitOrigin-RevId: 256c949f23d84dfba185a45a01b638ff5f1df52e
## Why
The sidebar chooser used hard-coded keys and hints instead of configured list bindings, limiting navigation and making custom shortcuts inconsistent.
## What changed
- Use configured list actions for chooser navigation, acceptance, and cancellation, including key chords, page movement, and jumps to the first or last choice. Show the configured shortcuts in footer and retry hints.
- Place “New side chat” first and group existing chats into compact rows with a count and optional thread colors. Keep the selected chat visible in short panes.
- Highlight inactive side-chat tabs on hover while preserving the selected tab's styling. Redraw when the hovered tab changes and suppress hover highlighting during pane resizing.
## Testing
Extend interaction tests and snapshots to cover custom acceptance chords, `j`/`k` navigation, paging, and tab hover styles and redraws with either pane focused, including the fallback when terminal colors are unavailable.
GitOrigin-RevId: bad992b3786215dcb5569acfc72af8841fad949d
## Why
Guardian Decisions retained a copied login key after the saved login changed or was removed. Queued comparisons need to respect credential changes, while runtime-bound threads must remain tied to their startup credential source.
## What changed
- Select login credentials from the thread's `ProviderAuthContext`, falling back to the supplied auth manager when no context exists.
- Resolve saved login keys before sending requests and reject queued comparisons if their credential source has changed. Pin runtime-bound credentials to the source selected at startup.
- Revalidate implicit keys before sending, rejecting missing, padded, or FedRAMP keys. Preserve explicit key overrides and the environment-key fallback.
## Testing
Extend credential lookup and queued-request tests to cover reloaded logins, runtime source pinning, rejection of stale queued comparisons, replacement-key authorization, invalid keys, and logout.
GitOrigin-RevId: 1d975613040e08c3825ba6355a166cf0fa812cad
## Why
Async classification could use policy from the manager's startup catalog even when the reviewed thread had a different reviewer policy.
## What changed
Share reviewer resolution between synchronous review and async classification, using the thread's catalog and reviewer eligibility rules. Select reviewer metadata from the same catalog snapshot, filter out models unsupported by API authentication, and preserve captured parent metadata when no eligible default reviewer exists.
## Testing
Update the async classification regression test with distinct thread and manager catalog policies, asserting that the thread reviewer's policy appears in classifier instructions.
GitOrigin-RevId: 0b28644d30bda42d2cf1bd8a31de2e8f8d38e1a6
## Why
A delayed file change approval cancellation could interrupt a later turn, even when the original approval was no longer pending.
## What changed
Send `Op::CancelPatchApproval` with the approval ID and requesting turn ID from the app server. Resolve cancellations only for a matching pending approval and interrupt its requesting turn only if it is still active. Route legacy `Op::PatchApproval` abort decisions through the same pending-approval handling.
## Testing
Add a regression test that cancels an approval, then replays that cancellation while a second turn has a pending approval with the same call ID. Verify that the second approval succeeds and its turn remains active.
GitOrigin-RevId: 4c833ccd0f33c2df4e9dfb25e2729ab19b6c879f
Read inline image dimensions with `ImageReader::into_dimensions` instead of
loading the full image into memory. Keep the existing patch-based estimate
and fallback when dimensions cannot be read.
GitOrigin-RevId: fd45eb748ce03134261c867397e1fe46c6023f2d
## Why
Decisions uses a commercial endpoint, so implicitly inherited credentials must exclude FedRAMP API keys.
## What changed
Reject empty, whitespace-padded, and FedRAMP keys selected from cached authentication or `OPENAI_API_KEY`, returning a credentials error without rewriting the key. Explicit `CODEX_GUARDIAN_DECISIONS_API_KEY` overrides retain their existing behavior.
## Testing
Extend the cached-key precedence test to verify that FedRAMP project and service-account keys, including a whitespace-padded key, are rejected even when `OPENAI_API_KEY` provides a fallback.
GitOrigin-RevId: 8904b0e5b30662aaf7eb7535309b01c254bcbb82
## Why
A release can be replaced under the same tag during asset upload. Cleanup by tag could then delete the replacement release.
## What changed
Move GitHub release publication into `.github/scripts/publish-github-release.sh`. Create releases through the API and capture their IDs so an exit trap deletes only the newly created prerelease if asset upload fails. Clear the trap after upload so a metadata update failure preserves the uploaded assets.
Keep existing releases and tags intact, verify tags before creating releases, and continue creating stable releases as drafts until upload completes.
## Testing
Extend the publication test to cover upload failures, retries, metadata update failures, stable drafts, replacement releases, and missing tags. The focused test passes.
GitOrigin-RevId: a310d5b77a66dc6a9cf2d136c280d968f0e7a28f
## Why
Truncating verified answers can obscure the association between questions and responses. Elastic entry caps must preserve that association.
## What changed
Mark verified answer records in root conversation and trusted user answer sections so elastic preparation keeps them intact when they fit. Replace oversized records with the protected incomplete-answer notice and record zero retained evidence bytes.
## Testing
Add a regression test with two questions and opposite answers, checking that both evidence sections omit oversized records whole and preserve complete records when the entry cap allows them.
GitOrigin-RevId: 0fe9e8c0955cb09845a929274e3d52b816119624
## Why
Switching away from a model that requires automatic review should restore the user's requested approval reviewer instead of retaining the model's enforced reviewer.
## What changed
Recompute the reviewer from the requested preference and model requirements when the model changes without an explicit reviewer update, unless the session uses a trusted guardian reviewer. Preserve an explicit automatic-review preference across subsequent model switches.
## Testing
Extend the app-server settings regression test to cover restoring user review after leaving a protected model and retaining an explicit automatic-review choice across repeated model switches.
GitOrigin-RevId: a5672d1ebe94c2fac201ad460b4789d11df03b1a
## Why
A reviewer receiving retained REPL responses after compaction can exhaust its context budget on protected response headers alone when the store contains many small results.
## What changed
Select a contiguous suffix of the newest responses before allocating body budgets, bounding elastic selection by the token-derived cost of provenance headers and separators. Preserve retained response bodies and images for subsequent allocation, and include dropped responses in the omission count. Apply this selection to both text-only and multimodal evidence.
## Testing
Extend the elastic REPL regression test with 10,000 responses in both evidence modes, checking budget admission, contiguous newest-response retention, preserved text and images, and combined storage and selection omission counts.
GitOrigin-RevId: 47c10d2f50e863ce4ba186be888788b8be5299dc
## Why
Prereleases are published before their assets are uploaded. A failed upload can leave an incomplete public release and prevent a rerun from recreating its `prereleased` event.
## What changed
Track newly created prereleases and successful asset uploads in the release workflow. Remove a newly created prerelease if its upload fails, preserving the tag so a rerun can recreate the release. Keep existing releases and releases whose assets finished uploading, even if the metadata update fails.
## Testing
Add a regression test that runs the workflow commands with a stubbed `gh`, covering upload failure cleanup, a successful rerun, preservation of existing prereleases, and metadata update failures after upload.
GitOrigin-RevId: 29411d6d1e649f4e8c67e84a41d9de2c9d31558f
## What changed
Read `final_answer_moderation` metadata and attach `moderation: { moderated: boolean }` to the completed final-answer message only when its item ID matches. Apply this in both normal and plan modes, and reset the pending decision when a new response starts.
Preserve the answer's native item ID and moderation flag through legacy events and history reconstruction. Combine text parts into one legacy event when a moderation decision is present.
Expose nullable moderation data on app-server agent messages and update the JSON schemas, TypeScript types, and Python models.
## Testing
Add an integration test for moderation on completed answers and their legacy events. Extend protocol conversion tests to cover populated moderation data and serialization as `null` when absent.
GitOrigin-RevId: f286b67731a84b3daf5d10b7644f2e31b62f0e53
## Why
Incremental tool declarations were limited to Responses Lite. Regular OpenAI Responses requests sent the full current tool catalog on each request.
## What changed
- Add the disabled-by-default `incremental_tools_legacy` feature for regular OpenAI Responses, independently of the Responses Lite `incremental_tools` flag.
- Support tool declarations and updates in conversation history, including during compaction, while preserving existing history prefixes.
- Keep hosted `web_search` configuration in top-level `tools` rather than `additional_tools`, including in compaction requests.
## Testing
Extend request-history scenarios and snapshots to cover regular Responses catalog updates, model switches, compaction, and MCP tool removal and restoration. Assert that incremental requests preserve input prefixes and keep web search out of history declarations.
GitOrigin-RevId: fa347409e387aa973ce2e41df8505769b7db1ec2
## What changed
- Register an additional Cloud connection on supported macOS and Linux launches when `TuiMultiBackend` is enabled, using the selected ChatGPT account and local network policy.
- Preserve backend settings and identify Cloud in connection controls and status.
- Let Cloud supply the model when a thread opens, skip local skills requests and stale results, and allow resume without a local working-directory override.
- Preserve Git metadata in Cloud thread snapshots and continue history hydration past empty filtered pages within the scan budget.
- Report Cloud connection failures and require reopening Codex to reconnect.
## Testing
Add regression coverage for Cloud model bootstrap, skipped skills requests, resume directory handling, history pagination through filtered pages, and Git metadata preservation.
GitOrigin-RevId: 6717f0f5ad7708c5e9b5796d94711dd1eecc49bb
## Why
Queued inputs previously stored and dispatched without the submitting client's Responses API metadata, losing attribution such as `client_type` when the queued turn started.
## What changed
- Accept `responsesapiClientMetadata` when adding or updating queued submissions and expose it on returned queue items.
- Persist metadata with the input and forward it when starting a selected item or dispatching an idle queue, including after restoration.
- Preserve existing metadata when an update omits it or supplies an empty map; replace it when a non-empty map is supplied.
- Keep stored inputs readable by older queue workers and update generated protocol artifacts.
## Testing
Extend queue service and app-server tests to cover metadata round trips, preservation and replacement on edits, compatibility with older readers, and forwarding during selected, idle, and restored dispatch.
GitOrigin-RevId: 508043b1d3d0298c9af2be8e05b6999de46596a1
## Why
Sidebar resizing previously required an open side chat, leaving the chooser without the same width controls.
## What changed
- Support keyboard resizing, width presets, and divider dragging for the sidebar chooser, with resize hints that fit narrow sidebars.
- Keep keyboard resize mode active across startup thread assignment and replacement of the chooser by a new side chat, so `Enter` finishes resizing without submitting the parent draft.
- Activate resize bindings only when a split is available, and prevent divider drags from starting while the split is animating.
## Testing
Add regression coverage for chooser resizing, width preservation when switching between the chooser and a chat, startup and side-chat creation transitions, draft preservation, and unavailable resize bindings in narrow terminals.
GitOrigin-RevId: 511cd4bb5894e6f33f0cf5d7472bb3013361ffe0
## Why
Runtime authentication must use the credential selected by the model provider. Explicit API keys and command credentials need independent ownership so cached connections and in-flight work cannot cross credential sources.
## What changed
- Register and reuse runtimes per credential source, supporting explicit provider keys and command credentials without falling back to saved login credentials.
- Track `AuthOwner` by credential manager and owner generation across WebSocket state, compaction, and scoring.
- Preserve cached identity and runtime registration state during credential-source outages or failed storage reloads. Require a successful auth reload before logout revokes credentials.
- Reject requests whose production or staging environment differs from runtime registration, including model catalog requests.
## Testing
Add regression coverage for credential selection and runtime reuse, owner isolation, source outages, failed reloads and logout recovery, and environment mismatches.
GitOrigin-RevId: 7bab55e0ea502593393df10046309fd8502edbd0
## Why
Gateway sign-in needs an alternative for terminals that cannot open a browser.
## What changed
- Add optional `gateway_oauth.device_authorization_url` configuration and a `login_with_device_code` API that presents a verification URL and user code, polls for approval, and persists the resulting credentials.
- Use the configured proxy and network policy, validate verification URLs, and bound OAuth responses. Support cancellation and report denied or expired codes without exposing issuer error details.
## Testing
Add tests for successful authorization and credential persistence, unsafe verification URLs, network-policy denials, denied and expired codes, and cancellation during approval or credential storage.
GitOrigin-RevId: 96398578fb866d34929e85c04eadf468d8cd3255
## Why
Gateway OAuth reads and logins previously used only the current provider, preventing clients from authorizing another configured provider without changing the default.
## What changed
- Add optional `modelProvider` params to `account/gatewayOAuth/read` and `account/gatewayOAuth/login`, preserving current-provider behavior for omitted or null params and selectors.
- Validate explicit providers against current managed policy without changing the default or any thread's provider.
- Retain readiness state across providers and send `account/gatewayOAuth/changed` notifications for every configured provider sharing the changed credential.
- Update protocol schemas, TypeScript types, Python models, and documentation.
## Testing
Add coverage for non-default provider login, retained readiness when alternating providers, notifications for shared credentials without starting login, and legacy TypeScript request compatibility.
GitOrigin-RevId: cfd472c322b821fe36b8c133a8de774f4ba48534
## Why
The TUI's cached active turn can be stale when a cloud message is submitted. A lost reply also leaves delivery uncertain, so automatically resending the draft risks submitting it twice.
## What changed
- Let the cloud server choose whether an Enter submission starts or steers a turn, and apply its receipt to the matching client message ID.
- Keep Tab-queued input waiting until the admitted turn finishes, including before its start notification arrives.
- Restore rejected submissions to the composer. Hold duplicate or unconfirmed submissions out of automatic delivery until history confirms them.
- Reconcile saved drafts and pending steers by client message ID when resuming sessions, and preserve submissions belonging to other turns during interruption recovery.
- Classify cloud preflight failures as invalid parameters so rejected queued input can be restored safely.
## Testing
Add regression coverage for cloud receipt outcomes, queued-input ordering, rejected drafts, lost replies, interruption recovery, and session resume with identical message text but distinct client IDs.
GitOrigin-RevId: ec4eb581e450488434bc4614ec59273d73ffd0a1
## Why
Cached gateway command credentials need to be refreshed when the gateway rejects them with a `401`.
## What changed
Clear the cached `credential_export` token after an inference HTTP `401` or a WebSocket upgrade rejected with `401`, then rerun the command for one retry. Preserve subsequent primary authentication recovery if the retry is also unauthorized, and document the behavior.
## Testing
Add integration coverage for using a new exported token, reporting an invalid export, recovering primary authentication after the gateway retry, and stopping after a second unauthorized WebSocket upgrade.
GitOrigin-RevId: 3397476dbfd3bec1bd44f90657c4f9e17bb7df67
## What changed
Add `-z pack-relative-relocs` to the Cargo and Bazel release linker flags for
`x86_64-unknown-linux-musl`, alongside the existing safe identical code folding.
GitOrigin-RevId: 1398ea6775e6b8ec81e624def6c23e8053363544
## What changed
Add an optional `thread_id` to `HostedFileUploadContext` and include it as `codex_thread_id` in file creation requests when provided. Keep MCP app uploads without this field while retaining the thread ID in tool-call metadata.
## Testing
Extend upload tests to check inclusion and omission of `codex_thread_id`, and assert that MCP app calls retain `_meta.threadId` without adding it to file uploads.
GitOrigin-RevId: cff15b35e5130e56973f944b3b849807550d298b
## What changed
Add a default `ModelRequestContributor::budget_exhausted` hook and fail generation with `SessionBudgetExceeded` when any contributor reports an exhausted budget for the thread.
Check budgets before HTTP requests and before WebSocket connection setup, then check again after the connection is established. WebSocket warmup remains available when the budget is exhausted.
## Testing
Add coverage for budget changes during a tool call, verifying that exhaustion prevents the next model request while an available budget allows completion. Extend WebSocket coverage to verify that exhausted generation opens no connection and warmup still permits connection reuse once the budget becomes available.
GitOrigin-RevId: 97ce02dc7f9bd54830e4b73c4f0334a30367eebf
## Why
Item reads with an update boundary previously rejected forked thread histories and only supported an exclusive lower bound on update ordinals.
## What changed
- Add `before_updated_at_ordinal` as an exclusive upper bound, mutually exclusive with `after_updated_at_ordinal`.
- Allow update-filtered and update-ordered item reads across parent and child segments, applying segment bounds and preserving cursor pagination in both directions.
- Require an update boundary for update-order sorting and reject either boundary when using an item anchor or item-ID filtering.
## Testing
Extend thread-store tests to cover upper-bound filtering, descending cursor pagination, forward and backward paging across forked lineages, mutually exclusive boundaries, and ordinals outside SQLite's integer range.
GitOrigin-RevId: 63f7e18fb24a89a41ff8e570cf65963622519a25
## What changed
Move proxy configuration and routing selection into `prepare_managed_network`. Keep native Windows launches direct by stripping managed proxy variables before credential brokering, and select dedicated listeners only for Windows MXC launches.
Consolidate managed network context filtering in `SandboxManager` and simplify proxy preparation for Linux and MXC while preserving the macOS Seatbelt context.
## Testing
Add Windows regression coverage for native launches with both disabled and enabled proxy configurations, verifying that managed proxy variables are removed while caller environment values and API credentials are preserved.
GitOrigin-RevId: 29fe1fb02afb574b4108032b7e8028d19d8270b4
## Why
Incoming delegated messages were rendered as plain text, leaving Markdown formatting visible and links without hyperlink metadata.
## What changed
Use a dedicated history cell to render the message body as Markdown while keeping the source task attribution literal. Preserve hyperlinks and wrapping, and apply the appropriate list spacing for scrollback and the redrawable transcript.
Use the same rendering for live messages, resumed history, and transcript projection.
## Testing
Extend replay coverage to check matching live and replayed output, transcript rendering, hyperlink destinations, and shared source text across wrapped rows. Add a snapshot covering list spacing in scrollback and the redrawable transcript.
GitOrigin-RevId: e9864c7721fa1afa2d3662ab9f57122ab696a51e
## What changed
Allow `model_providers.<id>.gateway_oauth.credential_export` to supply a gateway access token instead of browser OAuth. Run the configured command on first use, cache its token in memory, and deliver it through the configured header or cookie. Export failures surface directly, and command-backed providers do not require an OAuth session.
Require mutually exclusive OAuth and exporter settings, same-origin model catalog access, and rejection of HTTP redirects for command-backed gateway credentials. Share the bounded, timeout-controlled command runner with AWS credential export.
## Testing
Add tests for inference and model listing without OAuth, token caching and recovery after invalid output, preservation of primary authentication, and rejection of mixed OAuth/exporter configuration.
GitOrigin-RevId: e3dbfd8823b1992045f1c1efd56ec98ee17e07a5
## Why
A message's model-visible item ID may be unknown until the recipient records it. Message lifecycle observers need to capture publication state before that point.
## What changed
Remove `message_id` from `MessageLifecycleInput` and give each publication's `ExtensionData` a fresh UUID key. Stop assigning an item ID when publishing messages for lifecycle observers.
## Testing
Update the agent mailbox test to store a contributor-specific token in `ExtensionData` at publication and retrieve it at consumption, verifying that publication state survives queued delivery and recipient eviction.
GitOrigin-RevId: e254f94994d0976e61cb46ee23297f3248b9a389
## What changed
- When side retention is enabled, let the sidebar chooser create additional side chats from the main chat or reopen existing ones.
- Add numbered, clickable tabs and keyboard navigation in the chooser. Keep the selected tab visible when space is limited.
- Preserve drafts, transcript history, and the sidebar layout when switching between sibling side chats.
- Make `/side` with a prompt request a new side chat, while `/side` without arguments reopens the selected side chat. Preserve existing reuse behavior when side retention is disabled.
## Testing
Extend TUI tests and snapshots to cover creating sibling side chats, switching through the chooser and tabs, retaining drafts and history, and restoring image attachments after failed creation.
GitOrigin-RevId: 4166010c253c40a409390f7020b69478c04cf98c
## Why
Some hosts assign a worker per connection. Idle connection eviction can prevent a quiet session from reaching the worker holding its lease, while retaining a connection after the last session closes unnecessarily keeps that worker allocated.
## What changed
- Disable the HTTP connection pool idle timeout for gRPC code-mode connections.
- Cache URL-based clients weakly and let live sessions own the shared client, releasing their ownership on closure or failure even while the provider remains alive.
- Acquire clients for deferred RPCs only when needed and return the session error if the client has already been released.
## Testing
Add regression tests that verify connection reuse and stored state after 120 seconds of inactivity, and connection closure after the last shared session fails while the provider and session handles remain alive.
GitOrigin-RevId: bd1ff00c4003c03ed173c23dd2ed373ed354ab65
## What changed
Enable `--addrsig` and `--icf=safe` for `x86_64-unknown-linux-musl` release packages in Cargo and Bazel.
Opt Cargo release builds into these flags with `CODEX_MUSL_RELEASE_LINK_FLAGS=1`, selecting `lld` and preserving existing `RUSTFLAGS`. Apply the corresponding flags in Bazel's release package transition for the x86-64 musl platform.
GitOrigin-RevId: ade3c619dad2f03fd93a6fec35477607caec8b31
## What changed
- Add an “Add custom provider” entry to the provider picker and an “Edit configuration” action for editable providers.
- Provide forms for custom gateway names, base URLs, and API key environment variable names, plus supported Bedrock and GCP settings.
- Validate required fields, suggest environment variable names from the provider catalog, and preserve drafts when validation or saving fails.
- Save configuration through the connected app server, write only changed fields, and refresh the provider list after saving. For uncertain creation results, ask users to check the list before adding the provider again.
## Testing
Add editor tests for validation, draft recovery, Vim input, and patches that preserve unchanged authentication settings. Add an integration test covering the edit action and custom provider creation while preserving the default provider, with snapshots of the new UI.
GitOrigin-RevId: 8eb32ed30ed27ab671f08f565af48705f2b9f193
## What changed
- Add `accepted_at_unix_ms` and `accepted_seq` to conversation items, recording the first local `HistoryItemAccepted` event in trace order. Inherited context alone does not count as local acceptance.
- Add `started_code_cell_id` to model-requested `exec` tool calls when a matching code cell exists in the same thread and, when known, turn. Resolve links after replay so deferred cell starts can be matched.
- Default the new optional fields to absent when deserializing older traces and omit them from serialized output when unset.
## Testing
Extend reducer tests to cover duplicate acceptance events with out-of-order clock readings, inherited items without local acceptance, and `exec` calls with and without matching code cells.
GitOrigin-RevId: dfb594630f77d7c899398aa181c88a681587b1df
## Why
Clients need to list models for a configured provider other than the app-server's startup default.
## What changed
Add an optional `modelProvider` parameter to `model/list` and expose it in the generated schemas and client types. Explicit selections use provider definitions loaded at startup and respect current managed provider requirements. Unknown providers return a structured `modelProviderNotConfigured` error.
Use a temporary catalog when selecting another provider, preserving the default catalog and its disk cache while retaining runtime authentication. Requests without a selector keep the existing provider and caching behavior.
## Testing
Add coverage for provider selection, preservation of the default catalog and disk cache, unknown-provider errors, managed requirement enforcement, and runtime authentication for temporary catalogs.
GitOrigin-RevId: 6092df9f6141810c6ac215a8e1fb601f77e54747
## What changed
Update Seatbelt tests to call `create_seatbelt_command_args` directly with explicit filesystem and network policies, and remove the unused legacy-policy wrapper.
Reuse `FileSystemSandboxPolicy::read_only()` in read-only policy conversion and test setup instead of constructing equivalent policies inline or through legacy conversion.
GitOrigin-RevId: 2e2b3342425a3477986f41135caa18003b697fe4
## What changed
Remove `FileSystemSandboxContext::from_legacy_sandbox_policy` and migrate its test callers to `from_permission_profile`. Construct read-only, disabled, and externally enforced sandbox contexts directly with `PermissionProfile`.
GitOrigin-RevId: e330b89d060061eda106232eab554be5ccd06149
## What changed
- Expose an optional `AgentServiceTier` provider so host-owned children, including detached children, inherit the root's committed tier during spawn preparation, startup prewarm, and each inference step.
- Reject per-turn tier overrides for children using the shared provider. Root updates apply to subsequent requests without changing requests already in flight.
- Preserve independent configured tiers and role overrides when no provider is installed, including across eviction and reload. Spawned children inherit the parent's thread preference rather than its per-turn override.
- Publish the latest committed root tier only after successful runtime registration, preventing failed duplicate starts from changing shared settings.
## Testing
Add coverage for detached-child WebSocket prewarm and between-step tier changes, shared-child override rejection, independent-tier inheritance and reload, and settings updates before registration.
GitOrigin-RevId: f0f3676813a1c59bd77baf95121e2d13e0163a8e
## Why
WebSocket telemetry reparses text frames to extract event kinds that the transport already decodes.
## What changed
Pass decoded event kinds to telemetry and report receive failures separately. Keep JSON parsing for timing metrics and as a fallback when stream event decoding fails. Remove the `tokio-tungstenite` dependency from `codex-otel` and restrict it to tests in `codex-core`.
Limit wrapped error parsing to error events or failed stream decoding, preserving HTTP error forwarding when unrelated stream fields are malformed.
## Testing
Update runtime summary coverage to include receive failures and extend the WebSocket error forwarding test with a malformed stream field.
GitOrigin-RevId: e1f9d200fd6d30ec124a2354bdbc01f3082ddde3
## What changed
- Remove startup prefetching of remote catalogs, featured plugins, and recommendations while retaining installed-plugin refreshes and bundle downloads.
- Fetch featured plugin IDs on demand, concurrently with marketplace fetching when listing the remote global catalog, and reuse the cached results.
- Retire `plugin_discovery_prefetch` as an ignored compatibility flag and remove forced background catalog refreshes.
## Testing
Update app-server tests to verify that startup downloads installed bundles without discovery requests and that two `plugin/list` calls share one featured-plugin fetch.
GitOrigin-RevId: aa10474f3429102d624c83472e81ec85e3b470ae
## Why
Starting a side chat waits for fork and setup requests. Keep the workspace responsive during those requests and let users return to an existing side chat through the sidebar chooser.
## What changed
- Add a clickable `Side chat` tab and `+` chooser, plus the configurable `focus_sidebar_tabs` action bound to `leader t` by default.
- Create workspace side chats in the background, showing loading and failure states with `Enter` to retry and `Esc` to go back. Preserve opening prompts and avoid taking focus when the user has moved away.
- Retain inherited permission profiles and defer startup notifications until the side chat is registered on its owning backend.
- Quiet the parent composer while the chooser has focus and prevent completion popups or repeated activation keys from consuming chooser input.
## Testing
Extend tests and snapshots for loading and failure states, returning to an existing chat, draft preservation, inherited permissions, focus transitions, and deferred MCP startup notifications.
GitOrigin-RevId: 244bcd3f170819e2260f21dc1041cf8899fe048c
## What changed
- Advance the pinned `tokio-tungstenite` and `tungstenite` fork revisions and update the Cargo and Bazel lockfiles.
- Use `OAuthCredentialsStore::File` in the gateway credential test to avoid spending the model discovery deadline on keyring-backed decryption.
GitOrigin-RevId: 2862850215abce478136137b9b68a37f3caaeed4
## What changed
- Expose `RequiredCyberAccessPrograms` so hosts can require an explicit allowed program on a thread. Snapshot the requirement before extension callbacks; hosts must reapply it on cold resume.
- Validate resolved `access_programs` before HTTP and WebSocket model requests, rejecting omitted or disallowed programs. Explicit `Standard` remains distinct from omission. Reject memory summarization and realtime requests when a requirement is present.
- Keep required programs scoped to the parent thread by preventing Guardian reviewers from inheriting its program, including Guardian v2 reviews.
## Testing
Add HTTP and WebSocket coverage for allowed programs, omission, disallowed programs, unsupported providers, and connection reuse. Extend Guardian tests to verify parent-only program scope and that removing the public attachment does not erase the startup snapshot.
GitOrigin-RevId: 9306a9af0e03e7a1728dfeb610cd7ec7517367fd
## What changed
- Configure Bazel to apply `opusic_sys_install_headers.patch` to `opusic-sys` with `-p1`.
- Run the cloud-managed MCP OAuth test with `--no-browser` and keep stdin open until the child exits so EOF cannot race the HTTP callback.
- Serialize the cancelled-refresh test with other auth environment tests and temporarily clear the access-token environment variable.
GitOrigin-RevId: ad76b72ae98320bd0e3ff3231e1ed874332ce38c
## Why
Registry `401` responses during harness key validation previously produced generic relay resets, causing recovery to retry rejected executor credentials instead of surfacing the authentication failure.
## What changed
- Send an authenticated Noise handshake rejection for registry `401` responses without opening an application transport.
- Propagate the rejection as `EnvironmentRegistryAuth` and preserve it in the terminal connection state so recovery stops with a specific authentication error.
- Preserve registry HTTP status codes so `403` responses for stale harness grants and transient service failures can continue through recovery.
## Testing
Add tests that reject tampered authentication rejections and exercise session recovery: `401` stops after one rejected recovery attempt, while `403`, `502`, and `503` retry with fresh harness grants and reconnect successfully.
GitOrigin-RevId: 9a55412e583146c094948618c7c9aeb4fb4b953e
iceweasel-oai