## What changed
- Move reviewer configuration overrides, turn request construction, and deadline, cancellation, and completion handling into `codex-guardian-reviewer`.
- Adapt core sessions through `ReviewerRuntime`, keeping context construction, managed constraints, and live network rules in core.
- Make `GuardianReviewSession` crate-private and remove direct reviewer pool initialization and the reviewer dependency from `guardian-v2`.
## Testing
Update the turn-draining test to exercise `wait_for_guardian_review`, checking that prior-turn completion events are ignored and the session remains reusable after draining the current turn.
GitOrigin-RevId: fdf2b335b88b3f405d2370298ee68932808e1186
## Why
Stdio shutdown can hang on open pipes or blocked I/O, and Unix `SIGTERM` needs to run connection cleanup so owned commands terminate and session-end hooks execute.
## What changed
- Handle `SIGTERM` on a dedicated signal thread and close the stdio connection through the existing cleanup path.
- Move blocking stdin and stdout operations to dedicated threads so they do not hold the Tokio runtime open. Cancel message forwarding on `SIGTERM` to release blocked producers.
- When shutdown signal handling is enabled on Unix, start a shared 45-second watchdog on EOF or `SIGTERM`. Preserve the first deadline and exit with status `1` if cleanup or runtime teardown stalls, even when logging is blocked.
## Testing
Add Unix integration coverage for shutdown with open pipes, blocked stdout, blocked stderr, and a stalled filesystem write. Verify command and child-process termination, preserve the EOF deadline when `SIGTERM` follows, and extend session-end hook coverage to `SIGTERM`.
GitOrigin-RevId: 43a80b8277eb50519cdc293eb3b5dc2cad00b3aa
## Why
Session isolation relied on Guardian source attribution. An explicit policy lets callers control inherited capabilities independently of how a session is attributed.
## What changed
- Add `SessionIsolation` with default `Inherit` and opt-in `Isolated` modes, captured at session startup through `ExtensionDataInit`.
- Use the policy to control inherited instructions, extensions, execution rules, and MCP resources. Isolated sessions retain managed execution rules and omit executor-discovered MCP servers.
- Explicitly isolate Guardian reviewers while preserving source-based fallback for older callers and saved reviewers.
## Testing
Extend delegate tests to cover isolation independently of attribution, update execution-policy coverage to supply the explicit policy, and assert that managed reviewers do not inherit the parent's configured MCP tools.
GitOrigin-RevId: f0ab42fa2f0237860ec661e72693ab191216afbf
## Why
MCP tool and connector descriptions were included in required action JSON, consuming review input budget even though they are optional metadata.
## What changed
Move `tool_description` and `connector_description` into an optional, explicitly untrusted `guardian_tool_descriptions` fragment. Limit each description to 400 estimated tokens, escape closing tags, and allow budget enforcement to omit the fragment while retaining the required action JSON. Preserve nested arguments such as `arguments.description` and mention tool descriptions in the budget omission notice.
## Testing
Add regression coverage for oversized descriptions, escaped closing markers, and budget eviction without changing action arguments. Update MCP approval and elicitation tests to verify descriptions appear separately from the action JSON.
GitOrigin-RevId: 30734567c2ebc4b180110276c83d79ddb315ceab
## Why
HTTP 429 responses for exhausted quota, credit balances, and spending or usage limits were reported as retry-limit failures instead of usage-limit errors.
## What changed
Parse the API error's `code` and map `insufficient_quota`, `credit_balance_exhausted`, `organization_spend_limit_exceeded`, `project_spend_limit_exceeded`, and `organization_usage_limit_exceeded` to `CodexErr::QuotaExceeded`. Also recognize `insufficient_quota` in the error's `type` field.
## Testing
Add a regression test covering all recognized quota errors and verifying that `rate_limit_exceeded` and `slow_down` HTTP 429 errors retain their existing retry-limit mapping.
GitOrigin-RevId: b075dba199e08d29563630f5ada846e3e7fd11ff
## Why
Switching accounts could reuse a Responses WebSocket connection and incremental response state belonging to the previous account.
## What changed
Track auth ownership for cached WebSocket sessions and reconnect when it changes, including across turns. Clear incremental response state and `x-codex-turn-state` so the next request sends the full input with fresh routing state. Apply the same connection handling to prewarm requests and build request metadata after checking ownership.
## Testing
Add a regression test for account switches within a turn and between turns. Verify new account credentials on reconnect, full input without `previous_response_id` or stale routing state after the switch, and subsequent connection and incremental response reuse.
GitOrigin-RevId: 83b0636c0afec8b21b5d837a9937db32fb448237
## Why
Pre-turn compaction runs before incoming input is recorded, so failures could leave an accepted prompt out of conversation history. Reporting the error before prompt hooks finish also lets clients steer follow-up input into a turn still preserving its prompt.
## What changed
Record input and run prompt hooks on every pre-turn compaction failure. Defer local and remote compaction error events to `run_turn`, after prompt preservation completes, while retaining the remote error prefix.
## Testing
Extend the remote compaction output-validation test to trigger automatic compaction and assert that the prompt is emitted before the error, saved exactly once, and followed by no additional model request. Retain the assertion that usage is recorded for invalid compaction output.
GitOrigin-RevId: ab7ccb259836c084173e0e81dbbd4c610e95a6c8
## Why
Transient rate limits can end automatic approval reviews prematurely, and review failures currently report high risk even when no assessment completed.
## What changed
- Retry rate limits and recoverable exhausted-stream errors, while excluding non-transient HTTP failures.
- Preserve server retry delays after stream retries are exhausted and honor them within the review deadline. Scope retry advice to the current turn so reused sessions cannot apply stale delays.
- Keep failed reviews denied, but leave risk and authorization unset and explain that the review could not complete without declaring the action unsafe.
## Testing
Add an integration test covering rate-limit recovery through approval and tool execution, asserting that the action executes exactly once after approval. Update failure assertions to check absent assessment fields and the review-failure explanation.
GitOrigin-RevId: 1163cfde35c6b8eb23b6f24f1f24461b86ded838
## Why
Reused call IDs, ambiguous exec/wait associations, and missing history can make tool-call completeness claims unreliable. Truncating one cell's recorded calls should also preserve completeness for unrelated cells.
## What changed
- Track observed call and runtime cell IDs with bounded memory, including call IDs from initial history, and withhold completeness when evidence is missing or ambiguous.
- Validate exec/wait input-output associations and keep invalidated completeness from returning on retries. Withhold wait completeness after resume or fork, where runtime cell IDs can be reused.
- Keep truncation markers and omission counts local to each output, clearing completeness across the affected cell while preserving unrelated cells within the metadata budget.
- Refresh recording enablement from runtime configuration without changing execution features, and preserve the live recorder during legacy configuration reloads.
## Testing
Add regression coverage for reused IDs, compaction, resumed waits, mismatched wrappers, runtime recording changes, and metadata budgeting that preserves unrelated complete calls.
GitOrigin-RevId: 0bc85964bee079879620ec0664eea530a13b61fb
## What changed
- Add `Ctrl+E` to archive the selected task and its child agents, and `Delete` to permanently delete their history. Both actions require confirmation, with Cancel selected by default.
- Expose `agents.archive` and `agents.delete` in keymap configuration and the shortcut picker. Default bindings yield to existing custom bindings and chords.
- Show progress while requests run, keeping rendering responsive and blocking task switching. Refresh overview state afterward and keep the dashboard open when the current task is removed.
- Report failures and preserve the current attachment and draft when a rejected operation leaves the task loaded.
## Testing
Add coverage for confirmation and cancellation, active and background task removal, child-agent attachments, stale refresh invalidation, failure recovery, and draft preservation. Add progress input-isolation tests, shortcut conflict tests, and snapshots for confirmation, errors, progress, and keymap rendering.
GitOrigin-RevId: b327bb8834699d0058f9ffb903ace525ae270500
## What changed
- Add `Ctrl+W` to hide the selected task without stopping it. Hidden tasks stay hidden through activity and metadata refreshes until explicitly resumed or the TUI restarts.
- Expose `agents.hide` in keymap configuration and the shortcut picker, and let the default binding yield to existing custom shortcuts.
- Wrap overview footer hints while keeping shortcuts and their labels together when they fit.
## Testing
Add coverage for hiding filtered tasks across statuses, visibility through activity and refreshes, explicit resume, existing keybinding compatibility, and custom chord footer rendering at narrow widths.
GitOrigin-RevId: 980726e1095b8d5bad8901be919decdde8c0f925
## What changed
Make turn event delivery depend on when each consumer attaches:
- Handles returned by `thread.turn(...)` receive events from when the request is sent, including events received before the response arrives.
- Other handles and explicit low-level registrations receive only events from when they join. Remove replay of completed items, token usage, and terminal events; use `thread.read(include_turns=True)` for earlier history.
- Retain unread events for active subscribers and pending starts, release unused turn state, and close the returned subscription when an async start is cancelled.
Preserve the existing low-level subscription when repeated `turn_start(...)` calls return the same turn.
## Testing
Update coverage for late joins, request-time buffering, completion or transport failure before a start returns, async cancellation cleanup, and repeated low-level starts. Adjust external-message integration tests to allow handles to collect different items while receiving the same final response.
GitOrigin-RevId: 3b7f1268df1193dee88385006ae9510101086c24
## What changed
Add the default-off `api_key_model_discovery` feature and expose it through app-server experimental feature enablement, respecting user configuration overrides.
When enabled, fetch OpenAI API-key model metadata from the Codex backend, honoring explicit provider base URLs. Treat remote catalogs containing visible models as authoritative. When disabled at startup, skip discovery requests and cached catalogs and retain bundled models.
## Testing
Add coverage for feature enablement and user overrides, cached catalogs across sessions, provider routing, and API-key `model/list` results. Extend coverage for remote instructions and auth-specific cache isolation.
GitOrigin-RevId: 4b189c37c615a7f808cb6ff5f0858a9a55f36ebc
## Why
Pressing `Esc` in the agents overview task list dismissed the overview or
exited Codex when no primary thread existed, instead of returning to the draft.
## What changed
Make list cancellation return focus to the composer, including while
reconnecting, preserving the draft and cursor position.
## Testing
Add regression coverage for returning from the list to the composer with Vim
mode enabled or disabled, both online and reconnecting. Verify draft and cursor
preservation, resumed text entry, and the absence of app events.
GitOrigin-RevId: 8920677c42b0c9ff5023979e198f069abcfcf54b
## Why
Status-only discovery could retain an `OAuth` status based on stored credentials even after the connection attempt failed authentication. This discovery path has no event channel to report the failure.
## What changed
Update the snapshot to report `NotLoggedIn` for servers previously marked `OAuth` whose connection attempts failed authentication. Preserve other authentication statuses and OAuth statuses for failures unrelated to authentication.
## Testing
Add a regression test covering OAuth authentication failure, successful OAuth startup, an unrelated provider error, and a bearer-token authentication failure.
GitOrigin-RevId: 9df68fb1f818e40acab0c71bb4fda118f03a7611
## What changed
Replace duplicated footer wrapping in the MCP elicitation and request-user-input overlays with `wrap_hint_rows`. Preserve whole-hint grouping, display-width and separator accounting, oversized hints, and the single empty row for empty input.
## Testing
Add unit tests for Unicode display widths, whole-hint wrapping, oversized hints at zero width, and empty input.
GitOrigin-RevId: 4d8ead0acbfa3bf9241baedb86d2476566d26ebc
## What changed
Replace full additional permission profiles with network-only metadata in Guardian reviewed actions, and remove the `program` field from `execve` analytics. Preserve absent and empty permission requests and the optional `network.enabled` value.
## Testing
Add serialization tests for enabled and disabled network permissions, absent and empty permission requests, and an unset network permission value.
GitOrigin-RevId: 9904e5f5bd6723d0c09fb423b4818cb8bf12d397
## Why
Attachment mutations must coordinate with thread deletion so queued requests cannot use metadata belonging to a deleted thread.
## What changed
- Add typed `ThreadStore` operations for idempotent attachment creation, paginated listing, and removal, with capability detection and unsupported defaults.
- Implement attachment operations for SQLite-backed `LocalThreadStore`, including unloaded threads, and preserve invalid-request and missing-thread errors.
- Coordinate attachment mutations with lifecycle locks and move SQLite cleanup into thread-store deletion. Remove state rows only after rollout deletion, preserving retries after cleanup failures.
- Give the in-memory store ownership of its associated SQLite cleanup and remove duplicate cleanup from the app-server.
## Testing
Add coverage for attachment pagination and idempotency, unsupported stores, error categories, lifecycle exclusion, mutations queued behind single and batch deletion, cleanup failure retries, and in-memory state cleanup. Extend the app-server descendant deletion test to verify SQLite rows are removed.
GitOrigin-RevId: f0157538c7c5c2ee1362ce40eac157101c5d4505
## Why
Forked threads reported `startup`, causing startup hooks to run again even when their context was inherited from the parent. Resuming with supplied history also reported `startup` instead of `resume`.
## What changed
- Add `fork` as a `SessionStart` source and expose it in the hook input schema.
- Report `fork` for histories with a fork parent and `resume` for supplied histories without one.
- Continue dispatching `SubagentStart` for spawned subagents with either fresh or forked context.
## Testing
Add regression coverage for fork hook matching without duplicate startup context, resume hooks with supplied history, and `SubagentStart` context injection for fresh and forked subagents.
GitOrigin-RevId: 5ac1ae4ab8adcbbbceb8cb0ffb9b32b6402c585b
## Why
RMCP's standard input request union excludes custom methods, so tool continuations need explicit handling for OpenAI form elicitation and native user verification.
## What changed
- Route MCP `2026-07-28` tool inputs through the existing client service, preserving capability checks and verification response validation.
- Support `openai/elicitation/create` form and `openai/userVerification` inputs alongside standard MCP inputs, and return responses with the server's opaque `requestState`.
- Bound continuation rounds, back off for state-only responses, and reject unsupported or malformed inputs.
- Give concurrent verification prompts distinct cancellation ownership and release pending prompts and timeout pauses when the connection closes.
- Prevent session recovery from restarting a tool after submitting a verification proof while preserving authentication challenges.
## Testing
Add HTTP continuation tests covering mixed input types, proof validation, request metadata preservation, invalid requests, round limits, authentication challenges, session expiry after proof submission, and independent prompt cancellation. Add duplex transport tests for pending-input cleanup on cancellation and transport closure.
GitOrigin-RevId: b7db6d47fa0969b6a938220dfe3610e5ba5188b2
## What changed
Allow `Right` to open the selected task from the task list or an empty, focused composer. Preserve editor keybindings and guard against pending input, active popups, and offline state. Keep metadata editing unaffected and show the shortcut in navigation hints.
## Testing
Add regression tests for opening the current or highlighted task, preserving cursor movement and renaming, and preventing navigation while offline. Update snapshots to cover the new hints.
GitOrigin-RevId: 9fc01b62ad0829b964509ae6286a041fc4936b9d
## Why
Remote-control connections and queued operations must not carry over to a different signed-in user or account. Token refreshes for the same identity should preserve the live relay connection.
## What changed
- Scope relay state and authentication recovery to a login lifetime. Retire the session on logout or identity changes and leave remote control disabled until enabled again.
- Reject stale incoming messages and queued RPCs, and cancel pending remote-control operations when their authentication owner changes.
- Start replacement sessions with fresh client, replay, and enrollment state, and prevent retired sessions from publishing status into their replacements.
- Serialize enrollment and preference persistence across sessions, retaining write permits through caller cancellation and draining admitted writes on shutdown.
## Testing
Add regression coverage for same-owner refreshes, user and account changes, stale pairing and client-revocation work, unauthorized enrollment recovery after logging in again, and persistence during cancellation.
GitOrigin-RevId: 5e6ecd23588aab1e2e6168a21f575fb24bbb341c
## Why
`/archive` exits the TUI even when connected to a local daemon or remote app server, interrupting access to other tasks.
## What changed
- Keep the TUI running after a successful archive on local daemon and remote connections, and reopen the agent command center.
- Shut down side conversations before archiving, then clear the archived thread's local state, transcript, and unsent draft.
- Preserve exit-on-archive behavior for the embedded app server and remove the exit promise from `/archive` help and confirmation text.
## Testing
Add coverage for local daemon and remote connections, including side-thread cleanup, archive requests, cleared session state, and the resulting command center snapshot. Retain coverage for embedded archive success and failure.
GitOrigin-RevId: 36c61ec76a13a3fc1b5d6725e3b8f42a97fe6793
## What changed
- Add host-recorded `tool_result_metadata` snapshots with size limits, redacted debug output, and protection against deserialization from untrusted input. MCP capture remains disabled.
- Preserve accepted metadata across retries and delayed Code Mode results. Shed raw metadata before source evidence, calls, or completion markers when the request budget is exceeded.
- Send raw metadata only to allowed OpenAI and ChatGPT HTTPS endpoints, filtering by the resolved destination for HTTP and WebSocket requests.
- Encode source parse failures as an array entry with type `parse_failed` and an empty ID.
## Testing
Add coverage for metadata bounds and redaction, retained-call updates, budget shedding, disabled MCP capture, and HTTP/WebSocket destination filtering.
GitOrigin-RevId: b1a396323ad0623167cdd9e20ff9453f0d01bbf7
## What changed
- Add `disabled_plugin_ids` to thread startup options, settings overrides, snapshots, and persisted turn contexts. Omitted overrides preserve the current list; an empty list clears it.
- Restore the selection on resume and capture it before truncating history for a fork. Prefer the owning thread's latest settings snapshot, falling back only to the latest turn context so stale history cannot resurrect an older selection.
- Freeze the selection at turn admission and retain compatibility with histories that lack the new fields.
## Testing
Add coverage for owned settings, explicit clears, latest-turn fallback, and legacy snapshots. Extend settings tests to cover plugin selection during runtime restoration and compaction, and verify initial turn persistence without extra settings checkpoints in both history modes.
GitOrigin-RevId: 75ffbff5763cd93cc5ac69d73b08b237f59bc009
## What changed
- Mark `realtime_conversation` as experimental, keeping it disabled by default, and label it “Voice conversations” in `/experimental`.
- Add an announcement directing users to enable the feature, restart Codex, and run `/voice`.
- Hide server-discovered voice entries and the announcement when the client lacks native voice runtime support.
## Testing
Add tests and snapshots for voice discovery and announcement visibility with and without runtime support, and update the experimental features popup snapshot.
GitOrigin-RevId: 709655f3733cb88191eb78b40ac1f67e27c9816e
## What changed
Add `StateRuntime::list_thread_attachments` with page sizes from 1 to 100 and stable keyset ordering by `created_at` and `id`. Return a continuation cursor when more attachments remain, and reject malformed cursors or cursors belonging to another thread.
## Testing
Add coverage for thread-scoped pagination, cursor validation, and attachment persistence across reopening the database and archiving/unarchiving a thread. Verify listings reflect attachment removal and cascading deletion when a thread is deleted.
GitOrigin-RevId: e07433e1a675669082cc58f86b0dc4535d365ba3
## Why
Unanswered questions from the previous prompt remain visible after a new follow-up. Clear them when the user moves on to new work.
## What changed
- Clear pending questions when a model prompt is submitted or queued, and when a review starts. Clear again on queued prompt delivery to remove questions that arrived while waiting.
- Retain seen question IDs so replay cannot restore cleared questions.
- Track question answers separately from prompts through queues, retries, thread restoration, and reconnects so delivering an answer preserves other pending questions.
- Preserve questions for local commands and rejected submissions.
## Testing
Add regression tests for immediate and queued follow-ups, replay suppression, slash prompts, reviews, rejected input, and answer preservation across delivery and recovery. Add a snapshot of the composer after questions are cleared.
GitOrigin-RevId: 76353c6ee098c1505678ac43b1dc6391ea9fa738
## Why
The elevated Windows sandbox requires effective `:root` read access and cannot safely enforce policies that deny reads at the filesystem root.
## What changed
- Validate root read access before elevated setup, service provisioning, and setup refresh, rejecting root-denying globs before expansion.
- Reject filesystem-root deny-read ACL targets after canonicalization and check the opened handle before applying an ACL, so aliases cannot bypass the root guard.
- Read and update deny ACLs through the same handle, and allow an existing deny ACE to be recognized when write access to the ACL is unavailable.
## Testing
Add regression coverage for default root denial, root-denying globs, allowed root reads with narrower deny rules, handle-based root detection, and reading existing deny ACEs without `WRITE_DAC`.
GitOrigin-RevId: b904e7cdbc09ee0147e1818c898b0382b5820c1b
## What changed
Add nullable `promptHash` to the upload response, populated from the uploaded `prompt_hash` tag. It identifies the whitespace-normalized SHA-256 of the session base instructions, excludes later developer messages, and is `null` when the reported rollout has no prompt metadata.
Update the protocol schemas, precomputed exports, and generated TypeScript and Python types.
GitOrigin-RevId: 6fa70fbe7a06604ac1cd0ea363eb4f192083dad9
## Why
Automatic goal continuations can repeatedly return empty final answers without
making progress. Stop this loop by marking the goal as `blocked` after three
consecutive empty turns with no other activity.
## What changed
- Observe completed turn items through a new `on_item_completed` lifecycle hook.
- Track empty final answers only for automatically admitted goal turns, resetting
the streak on activity, user turns, or goal changes.
- Preserve normal turn completion and streamed message deltas when blocking a goal.
## Testing
Add accounting coverage for the three-turn threshold and streak resets, plus
app-server tests for empty continuations and recovery through final-answer text,
commentary, or tool activity.
GitOrigin-RevId: 4b9d2cb2e306b0adc316972429cc35000115b88b
## Why
Hosted Codex Apps shared the `mcp_2026_07_28` protocol setting with other MCP servers, preventing independent protocol selection.
## What changed
- Add `features.codex_apps_mcp_2026_07_28`, disabled by default, for the host-owned HTTP `codex_apps` server. Enabling it attempts 2026-07-28 discovery with Legacy fallback.
- Keep other servers, including third-party registrations with Apps-like names or URLs and local stdio servers, governed by `mcp_2026_07_28`.
- Support the new flag through `experimentalFeature/enablement/set` and refresh protocol settings in existing sessions. Track protocol mode per server when deciding whether to reuse connections.
## Testing
Add coverage for independent feature and protocol selection, hosted event-stream protocol selection, standalone Legacy defaults and discovery fallback, and runtime enablement refreshing an existing app-server thread.
GitOrigin-RevId: 640e8e251f0c45e5f4829cc2b73c3082cf42f715
## Why
Saved threads need to resume after a managed daemon restart so active goals can continue without waiting for a client to reconnect.
## What changed
- Consume the recovery snapshot at startup and restore threads in the background through the shared cold-resume path.
- Trigger idle lifecycle work without attaching a client subscription, and leave already-loaded threads untouched.
- Continue recovery after individual thread failures and abort background recovery during shutdown.
## Testing
Extend the daemon restart integration test to verify goal continuation before client reconnection, restored conversation history and tools, idle-thread restoration, and recovery snapshot consumption. Include malformed snapshots and an invalid thread ID.
GitOrigin-RevId: 90e7b8f74ddc0ae327bacde1b2108b9749c65f2a
## Why
Remote-control requests could bypass a server's `Retry-After` deadline through pairing, auth changes, or reconnects. Proactive token refresh could also continue using a valid token despite an explicit server delay.
## What changed
- Share retry deadlines across enrollment, token refresh, pairing, pairing status, and WebSocket handshakes, preserving them across enrollment replacement and disable/enable transitions.
- Honor `Retry-After` on HTTP `429` and `503` pairing and handshake responses, including incomplete pairing response bodies.
- Add up to 30 seconds of jitter once per response without shortening the server's deadline, including for `Retry-After: 0`.
- Defer new requests while retaining valid tokens, and prevent auth changes from shortening the server delay while keeping shutdown responsive.
## Testing
Add regression coverage for shared deadlines, concurrent pairing and handshake failures, auth recovery, disable/enable transitions, retries after expiry, prompt shutdown, and jitter bounds.
GitOrigin-RevId: 69a5a46559031709a4558190c3142eb65e2ae634
## What changed
- Add a tag-release workflow gated by `CODEX_PROVISIONED_MACOS_CANDIDATE` for Apple Silicon and Intel macOS candidate artifacts.
- Package the CLI in `CodexCLI.app` with an embedded provisioning profile and a relocatable `bin/codex` launcher. Validate independently supplied profile, certificate, and team expectations before signing.
- Sign and notarize candidates, then verify signatures, entitlements, architecture, stapling, and Gatekeeper acceptance on macOS. Retain verified artifacts after package smoke tests pass.
- Filter code-mode smoke-test requests to `/v1/responses` so analytics requests are excluded from response parsing.
## Testing
Add tests for profile validation, launcher relocation and symlink handling, standard and provisioned signing flows, and rejection of signing, notarization, identity, and entitlement failures. The candidate workflow runs package smoke tests, including sandboxed code mode.
GitOrigin-RevId: f214f6a23dd10df62cd72a2c63c20cb0864fbc9c
## What changed
- Atomically save successfully persisted, loaded root thread IDs to `app-server-daemon/loaded-threads.json` during graceful managed shutdown, excluding ephemeral threads and threads pending unload.
- Clear stale recovery state at startup and around daemon lifecycle operations, including explicit stops and fresh starts.
- Probe support for `--managed-daemon` before launching managed app servers, and clear recovery state best-effort when launching older binaries.
- Keep forced shutdown responsive while saving the snapshot and log snapshot failures without preventing shutdown.
## Testing
Add coverage for snapshots after active turns finish, forced shutdown without a snapshot, excluded threads, snapshot write failures, and recovery-state cleanup for stops, fresh starts, and legacy launches.
GitOrigin-RevId: 422dc32b85355510f7e4c57b7540597b47d9f0b2
## What changed
Populate `turn_trigger` in request metadata with `guardian_review` for guardian reviews, `guardian_classifier` for classifier requests, and `memory_consolidation` for both detached memory requests and consolidation agent turns.
## Testing
Extend request metadata assertions to cover each trigger across guardian reviews, classifier requests, and both memory startup phases.
GitOrigin-RevId: 2dc3c173ede6563b942b8099ad9901c32967b969
Run `hook_drains_output_and_times_out_while_stdin_is_blocked` with
`cmd.exe /D /C` on Windows and `/bin/sh -c` elsewhere to keep user shell
startup files out of the test.
GitOrigin-RevId: 296e65cf76b74543e91c9ed9024ba2442e7e33af
## Why
Async classifications need to account for the complete request, including parent compaction checkpoints and images, before sending it to the classifier.
## What changed
- Resolve the input allowance from the classifier's model metadata, independently of parent-model context-window overrides.
- Reject requests whose estimated input exceeds that allowance minus a 256-token reserve. Record `input_too_large` and defer to synchronous review without sending the oversized request or dropping evidence to make it fit.
## Testing
Add integration coverage for checkpoint and image budgets, verifying that oversized inputs defer to synchronous review and inputs that fit retain their evidence. Update Guardian context-budget tests to exercise V2 remote compaction.
GitOrigin-RevId: 765060e08d2d5f3028ef5207508d256d4bf8d856
## Why
`update_goal` only accepted `complete` and `blocked`, preventing the agent from pausing a goal in response to an explicit user request.
## What changed
- Accept `paused` and account for final goal progress when pausing, with budget limits taking precedence.
- Update tool instructions and goal prompts to allow pauses only at the user's explicit request, report the returned status, and stop goal work. A later resume revokes the pause request.
## Testing
Extend coverage for pause accounting, budget-limit precedence, rejection of resume and system-limit statuses, and preservation of a tool-paused goal when resuming a thread.
GitOrigin-RevId: c3c15a51f848ce6eb65854d51b1a1bc75bb456a7
## Why
MXC volume-root grants are nonrecursive, and filesystem deny globs were rejected before launch.
## What changed
- Expand volume-root grants to include existing immediate children, preserving read-only carveouts and denies. Children created directly under a volume root after policy construction are not granted access.
- Normalize filesystem object aliases before and after expansion so generated grants preserve tighter access restrictions.
- Skip unavailable volumes and uninspectable generated children.
- Resolve deny globs into concrete file and directory paths using the Windows sandbox resolver.
## Testing
Add regression tests for read-only children and aliases, normalized root access, uninspectable children, and deny glob expansion alongside explicit denies.
GitOrigin-RevId: 3242e9a30d16581d6fe5b7b6e39e0e0f71ca6ef4
## Why
Writing hook input before draining output can deadlock when pipe buffers fill. Stdin writes also ran outside the hook timeout, allowing hooks that never read input to hang indefinitely.
## What changed
Write stdin concurrently with draining stdout and stderr, and apply the configured timeout to both input delivery and command completion. Preserve handling of broken pipes and distinct stdin and wait errors.
## Testing
Add a regression test that sends a large input to a hook that fills stdout and stderr without reading stdin. Verify that output drains and the hook reports its configured two-second timeout.
GitOrigin-RevId: 48cf33a2acfebbc5122a4522660d7a6b3fb1e9b0
## Why
With network access enabled, WSL interop can launch Windows processes outside the Linux filesystem sandbox, including using `wsl.exe` to reenter the distribution as root.
## What changed
- Mask WSL interop sockets in bubblewrap when filesystem write access is restricted, and hide inherited procfs when running without a fresh proc mount.
- Deny `AF_VSOCK` sockets and `io_uring` under restricted filesystem policies even when ordinary network access is allowed, closing the VM socket route to host services.
- Reject legacy Landlock configurations that combine restricted filesystem access with unrestricted networking when the WSL interop directory exists.
## Testing
Add unit coverage for mount masking and legacy policy rejection, plus WSL integration tests for Windows process launch, bind aliases, direct `/init` invocation, root reentry, and `--no-proc` isolation. WSL tests skip when host prerequisites are unavailable.
GitOrigin-RevId: 1e8b97ac43675807ee541ca614534d9b1febf410
## Why
Initial history replay and rollback before the first turn could clear the reasoning-effort baseline established by startup prewarm, preventing the first request from preserving that baseline when the selected effort changes.
## What changed
Preserve the reasoning-effort pin during history reconstruction. Clear it on rollback only after startup prewarm has been consumed. With reasoning-effort overrides enabled, a prewarmed `medium` baseline remains on the request while a subsequent `high` selection is sent as a `configuration_update`.
## Testing
Add regression coverage for prewarm completing before initial replay on resume and fork. Expand WebSocket tests to cover resumed and forked threads with overrides enabled and disabled, plus rollback before the first turn.
GitOrigin-RevId: 2e2d0e8a06b24f01b717458ca0576d63107c7697
## What changed
Probe the default Windows system config namespace at session start and record `codex.windows_system_config.namespace_squatting_probe` once per process when metrics are available.
When `config.toml` or `requirements.toml` exists, check the containing directories for expected ownership and broad standard-user mutation allow ACEs, including permissions inherited by child files. Report coarse results for missing files, expected directories, unexpected types or owners, mutation permissions, and check errors.
The probe is observational: it does not change configuration loading or enforce a trust decision.
GitOrigin-RevId: e1c79dca5548e16e83c7b84b44ab0de4e2643d0d
## Why
Loaded threads, including idle threads whose rollout files are still deferred, need to survive a managed daemon restart. Shutdown must also remain forceable when rollout I/O is blocked.
## What changed
- Add a hidden `--managed-daemon` option for app-server Unix socket transports. After active turns and admitted requests drain, save loaded persistent root threads before exiting.
- Skip ephemeral threads, non-root agent threads, and threads pending unload. Log persistence failures and continue saving other threads.
- Apply shutdown admission checks to thread and turn settings updates, thread deletion, and archiving.
- Keep force signals and daemon shutdown requests responsive during persistence. Return `AppServerExit::Forced` so executables can exit without waiting for runtime teardown.
## Testing
Add integration coverage for resuming active and idle threads after restart, forcing shutdown during active work, and forcing shutdown with a blocked rollout writer. Extend shutdown rejection coverage to deletion and settings updates.
GitOrigin-RevId: 4344e97d39f9f80c5d84c41c17300fd6aa99b4cc
## Why
Review evidence can fit its own limits while exceeding the reviewer context window once history, tools, output format, and reminders are included. Tool continuations can also push an existing review over budget.
## What changed
- Select evidence after tools and turn context are resolved, reserving request overhead and a 256-token margin. Omit optional evidence while preserving required sections, and reject required evidence that cannot fit.
- Keep incoming evidence pending until budget selection succeeds so cancellation and compaction cannot record unselected input in reusable history.
- Check the assembled prompt before sampling, including retries and tool continuations. Retry budget failures with summary compaction once per model step, and retire reviewers whose budgets remain exhausted. Avoid history-resetting token-budget compaction for this recovery.
- Record section costs after budget selection.
## Testing
Add unit and integration coverage for required-evidence rejection, optional-evidence omission, reminder overhead, cancellation safety, incoming-review and tool-continuation compaction, and reviewer retirement after ineffective compaction.
GitOrigin-RevId: 2f7ef191b3f46032d295ad363eb7debf9d7a9684
## Why
Failed environments were omitted from environment context, and `wait_for_environment` returned a generic failure or treated an already-failed environment as unselected. The model needs the failure reason to explain problems such as an empty repository.
## What changed
- Preserve the selected environment and error when startup or configuration fails.
- Include failed status and XML-escaped error details in environment context, and return the reason from `wait_for_environment` for failures detected before or during a wait.
- Limit error details to 256 bytes per environment and 512 bytes total in context, preserving UTF-8 boundaries. Limit wait failure details to 256 bytes.
## Testing
Add coverage for failures before a turn and while waiting, verifying that the model receives the reason and the turn completes. Add unit tests for XML escaping, incremental context updates, clearing errors on recovery, and UTF-8-safe truncation.
GitOrigin-RevId: 093ab9b447c7b3243fbb53b665180db95479f2a7
## Why
Recovering a suspended turn can append a duplicate reasoning effort update when history already ends with a matching trusted update but the runtime has not established its effort pin.
## What changed
Reuse a matching harness-authored `ConfigurationUpdate` at the end of history even when the runtime effort pin is unset.
## Testing
Add a regression test that suspends and recovers a turn without WebSocket prewarming, then verifies the recovered request contains exactly one effort update and retains `high` reasoning effort.
GitOrigin-RevId: 2e49073eb5e8d4fae39a8dc1d9d2b07f77802adb
