## What changed
- Reconnect frameless bidirectional WebRTC sideband sockets after unexpected transport loss with capped exponential backoff.
- Preserve pending text or handoff output and bounded transcript state across reconnects.
- Treat `404 Not Found` and `410 Gone` handshake responses as terminal session completion, and preserve HTTP status information from failed WebSocket handshakes.
- Bound Realtime delegation input and transcript fields while retaining the most relevant portion of each.
## Testing
- Add unit coverage for reconnect backoff, terminal status handling, transport error classification, transcript continuity and truncation, and pending outbound messages.
- Add an end-to-end WebRTC conversation test covering an unclean disconnect, reconnect, transcript reconciliation, outbound progress during sustained inbound traffic, and terminal session completion.
GitOrigin-RevId: 544fd7e542c3434d0bb42cfbcc7143604419a037
## Why
SQLite metadata can identify a rollout through a non-canonical path. When that
path resolves to a rollout already found on disk, archive and unarchive
operations could schedule the same source file to be moved twice.
## What changed
- Deduplicate archive and unarchive moves by canonical source path.
- Cover both operations with metadata-backed tests that use equivalent rollout
paths.
GitOrigin-RevId: d190915264214413667fc2c83d360a7e8504d0aa
## What changed
- Add `codex exec-server forward --connect ws://HOST:PORT` to register an
existing WebSocket exec-server as a remote environment.
- Open a separate destination WebSocket for each authenticated Noise relay
stream and forward complete payloads unchanged in both directions.
- Preserve large messages through WebSocket fragmentation and coordinate
disconnects, close acknowledgements, and pending output delivery.
## Testing
- Cover CLI validation, opaque payload forwarding, disconnect handling, and
destination close behavior.
- Verify commands and large file transfers through the complete relay and
forwarding path.
GitOrigin-RevId: 6e2dccff05b9e3571865611f4d432b0e2b4cdbac
## Why
Guardian sampling uses a pool of WebSockets, while the bridge routes each
connection by thread ID. Each socket therefore needs its own identity instead
of reusing the source thread ID across the pool.
## What changed
- Generate a classifier thread ID for every pooled connection and use it for
request, window, and subagent attribution.
- Preserve the originating thread ID in turn metadata alongside the Guardian
classifier request kind.
- Build request metadata after leasing a connection so retries use the identity
of the socket that carries the request.
## Testing
- Cover unique identities across pooled and replacement connections.
- Verify classifier attribution metadata for extension requests and retries.
GitOrigin-RevId: 1c36207125157ff05cab9487a2fa37bf85e5fdd8
## What changed
- Add an optional `connectorId` to `mcpServer/resource/read`.
- Forward the selected connector through `x-codex-turn-metadata` for threaded and threadless resource reads, restricting hosted app resources to that connector.
- Update the generated protocol schemas and app-server documentation.
GitOrigin-RevId: 5cc94d703abbbb6086665910c1c9ed5dc7075210
## What changed
- Add `intersect_effective_permission_profiles` to derive the permissions shared by an authority profile and a requested profile.
- Preserve the more restrictive filesystem access, read denials, protected metadata paths, temporary-directory access, and network policy.
- Canonicalize concrete paths so symlinks cannot expand authority, and fail closed for policy shapes that cannot be intersected safely.
## Testing
Add coverage for workspace intersections, nested carveouts, deny patterns, unsupported policies, temporary-directory restrictions, symlink escapes, and macOS path aliases.
GitOrigin-RevId: a35bdc47e41afad13630f92c032514b300c14a0d
## What changed
- Emit a `codex.guardian_v2.classification` counter for each classification.
- Record classification latency in `codex.guardian_v2.classification.duration_ms`.
- Tag both metrics with `success`, `failure`, or `superseded` outcomes.
## Testing
- Verify metrics for successful classification and fail-closed handling.
GitOrigin-RevId: 021702f3b26565d6da5708d2b8f1f8881942a441
## What changed
- Give plugin managers for the same cache root a shared semaphore that permits
only one background installed-plugin bundle sync at a time.
- Hold the permit for the lifetime of the spawned sync task and refresh the
installed-plugin cache after a successful local cache change.
## Testing
- Add a test that starts bundle syncs from two plugin managers sharing a Codex
home and verifies that only one request is made.
GitOrigin-RevId: 86c39476c3a9015b9862ab75e8f11f110b0284fc
## What changed
- Add a `NoiseStreamHandler` abstraction that owns payload encoding, decoding,
and connection processing while the virtual stream handles framing,
encryption, and multiplexing.
- Reassemble authenticated payloads as opaque bytes, with the existing
JSON-RPC processor supplied as a handler implementation.
- Have the physical relay send a reset after the current stream instance
closes, including when its processor exits before the writer task.
## Testing
- Verify local JSON-RPC decoding creates the queued request span before queue
admission.
- Verify a processor exit resets the corresponding Noise harness stream.
GitOrigin-RevId: 270befcc8bfbf27e46c84d6a2c6e349cb98ea3f8
## Why
`node_repl` screenshots are nested tool results and do not appear in the parent
conversation history, so Guardian v2 transcript image collection could miss
them.
## What changed
- Allow Guardian v2 to enable bounded, thread-scoped `node_repl` image capture
when transcript images are configured.
- Add retained `node_repl` screenshots to review requests when transcript
sources include tool outputs, while deduplicating images and keeping them out
of the parent turn input.
## Testing
- Add an integration test covering screenshot capture without the synchronous
Guardian transcript feature flags and verifying that screenshots stay out of
the parent request.
GitOrigin-RevId: 5f70c5f2e80389aa8b2a286c3b7f9b1104865486
## What changed
- Pass metrics bound to the active turn's model to approval-review contributors.
- Add counter support to `ExtensionMetrics` while preserving host session attribution.
- Record Guardian v2 tool-call score lag and count stale-score fallbacks with the `score_lag` reason.
## Testing
- Cover counter forwarding and session metadata tags.
- Verify Guardian v2 metric samples for current and stale scores.
GitOrigin-RevId: 0ec34736d29d2e37ed217a27e773b4f6230ae38a
## Why
Repository-scoped imports must not follow redirected Codex paths and write
generated configuration outside the repository.
## What changed
- Reject repository migration scopes when generated configuration paths are
symlinks or, on Windows, reparse points.
- Recheck hook and subagent destinations during import, skipping redirected
directories, files, and dangling links without reporting them as imported.
## Testing
Add service and app-server coverage for redirected generated destinations,
including a repository path replaced with a symlink after detection.
GitOrigin-RevId: 3afb521ead9d76250f0e967eccfdd1dc194f027a
## Why
Guardian sampling WebSockets authenticate when the connection is opened. Reusing
a pooled connection after credentials change can therefore keep using the old
authorization.
## What changed
- Track authentication changes on each pooled sampling connection.
- Discard stale connections after an auth change and reject connections whose
authentication changes while the handshake is in progress.
## Testing
- Verify the sampler reconnects with the refreshed bearer token instead of
reusing its existing connection.
- Verify the installed Guardian extension reconnects after an external auth
refresh.
GitOrigin-RevId: 6d2e7df776fd21c78be0928f71162f5419a8b8f0
## Why
Custom model providers that do not require OpenAI authentication could inherit
ambient authentication headers, including the bearer token and
`ChatGPT-Account-ID`, and send them to the custom provider endpoint.
## What changed
- Resolve providers without `requires_openai_auth` or configured `auth` as
unauthenticated.
- Continue to honor an explicit `experimental_bearer_token` or command-resolved
provider authentication.
- Preserve ambient authentication for OpenAI providers.
## Testing
Added unit and request-level coverage for custom, explicitly authenticated, and
OpenAI provider authentication behavior.
GitOrigin-RevId: d89a79604338bc660a3edb2af0068cfa9b694fa2
## What changed
- Add a Tree-sitter-based lowerer that converts a conservative subset of literal PowerShell commands into argument vectors.
- Reject dynamic expressions, parse recovery, unsupported value conversions, directives, and source outside recognized command nodes instead of guessing their meaning.
- Keep the lowerer alongside the existing production parser for later adoption.
## Testing
- Add fixture-driven coverage for supported literal commands and unsupported or ambiguous syntax, including a dedicated `#requires` rejection test.
GitOrigin-RevId: a6e7acc264ca40df264db4b271e38ae7d89e1ec4
## What changed
- Reject a symbolic link used as the memory root.
- Recursively remove symbolic links before preparing or seeding the memory workspace.
- Remove and reject symbolic links created during consolidation, including when the worker fails, so they cannot affect files outside the workspace.
## Testing
Add Unix startup tests covering pre-existing extension links and links created by both successful and failed consolidation workers.
GitOrigin-RevId: f96e03812773f7beaa16455dd77370ee47d8a71f
## What changed
- Export `read_sensitive_file_to_string` from `codex-exec-server`.
- Require the opened path to be a regular disk file and avoid following its
final symlink component on Unix or reparse point on Windows.
- Read valid UTF-8 file contents asynchronously and return I/O errors for
unsupported inputs.
## Testing
Add tests covering regular files, directories, and symlinks.
GitOrigin-RevId: 68809e94c0d3719e5685c064f9610a0455ffd8d7
## Why
Compaction can remove the tool-call events that associate an MCP app widget with
the tool, account, and URI needed to authorize later resource reads.
## What changed
- Store a bounded MCP resource-origin checkpoint with each compacted rollout.
- Restore the checkpoint when resuming a session so existing widgets remain
readable after compaction and restart.
- Discard saved origins when rollback rewrites history across the compaction
boundary, and reject oversized or invalid checkpoints during restoration.
## Testing
- Extend the app-server MCP resource-origin test to compact a paginated thread,
continue the conversation, and read the original widgets before and after a
restart.
- Verify rollback clears provenance that no longer matches retained history.
GitOrigin-RevId: 7f91c6202fe8d9be21c78dda42fa205937c44263
## Why
App widgets need to read resources using the app and account context of the
tool call that produced them, including after a thread is restored.
## What changed
- Add an optional `originCallId` to `mcpServer/resource/read` requests and
return it on successful scoped reads.
- Track bounded provenance for successful app tool calls in thread history and
use the current tool binding, account link, and app policy when reading the
associated widget resource.
- Reject missing, mismatched, failed, or ambiguous origins, while keeping
app-only tools available for widget reads without exposing them to the model.
## Testing
Add app-server coverage for scoped widget reads across both history modes,
ephemeral and persistent threads, server restarts, app-only visibility, and
invalid origin cases.
GitOrigin-RevId: 11eaefc066b2a3b639599e4cbdef680233d150a2
## What changed
- Exclude descendant-authored `MESSAGE` progress updates from the history retained after remote compaction v2.
- Continue retaining descendant-authored tasks while omitting progress updates and final answers from subsequent requests.
## Testing
- Extend the remote compaction follow-up test to cover descendant progress updates and descendant-authored tasks.
GitOrigin-RevId: 3e3e60bb108d27e99e2a4c222eed4b9d02fd3829
## What changed
Start sampling for automatic idle `UserInput` requests without adding an empty
message to the input queue. Continue queuing automatic response-item input.
GitOrigin-RevId: 5d304aed9e7e165380b29b5b59d9245e97b40659
## Why
Repository manifests and user-configured sources must not be able to claim names reserved for managed or remote marketplaces.
## What changed
- Reject reserved marketplace names from unmanaged sources during discovery, installation, configuration projection, and configured marketplace upgrades, even when source restrictions are disabled.
- Recognize managed marketplaces only at their expected paths. Preserve the required macOS and Windows path equivalences without allowing symlink aliases to inherit managed provenance.
## Testing
- Cover reserved-name rejection for plugin list and install RPCs, configured upgrades, unrestricted policy, and remote marketplace names.
- Cover symlink spoofing and Windows managed-path normalization.
GitOrigin-RevId: a610bdc382857f306dd3e244f0992de2ec279673
## Why
Collaboration guidance can change without changing the active mode or model, such as after a model catalog refresh. Tracking only the mode and model leaves the earlier guidance in retained history.
## What changed
- Include a hash of the rendered collaboration instructions in the world-state snapshot so changed guidance is appended to retained history once.
- Emit one empty collaboration fragment when guidance is removed, preventing stale instructions from remaining active without repeatedly clearing them.
- Refresh legacy snapshots that lack an instruction hash once on resume.
## Testing
Cover same-mode catalog updates, clearing missing or explicitly empty guidance, retained-history behavior, and cold resume from legacy snapshots.
GitOrigin-RevId: 69f690adeccd1fb9794a6b15647e6efae3fec4f6
## Why
Tree-sitter can represent brace expansions, globs, and escaped text as plain
words even though the shell changes them at runtime. Treating their source text
as literal argv could let a command match a safe-command check or allow rule
that does not match what will actually execute.
## What changed
- Reject unquoted Bash and Zsh words containing expansion, glob, or escape
syntax from literal command parsing, including heredoc command prefixes.
- Reject double-quoted escape sequences that the shell removes or interprets,
while continuing to accept quoted metacharacters that remain literal.
- Require approval for affected commands under `UnlessTrusted`, even when a
policy contains an allow rule for the unexpanded source text.
## Testing
Add parser and approval scenarios covering brace expansion, globs, escapes,
Zsh-specific syntax, heredocs, and quoted literals.
GitOrigin-RevId: 31f2c6062680c42ac65362e3f3eebfaaf4eb71da
## What changed
- Add the experimental `autoApprovalReview/strictReviewRequired` app-server notification with the review's `threadId`, `turnId`, and `startedAtMs`.
- Emit it when Guardian v2 leaves an approval review in progress because the action risk is elevated or its score is stale.
- Export the notification through the Rust, TypeScript, and JSON schema surfaces and route it to the associated thread.
## Testing
- Cover strict-review reason tracking for elevated and stale risk scores.
- Verify that high-risk approval routing emits one notification whose identifiers and timestamp match the review-started event.
GitOrigin-RevId: e65352894520bfb756c75b2c95e2e149f9767bb2
## What changed
- Pin `openai-codex` to the `0.147.0` CLI runtime and regenerate its protocol models and lockfile.
- Allow stable Python SDK release tags and require their versions to match the pinned runtime.
- Expose the regenerated API additions, including thread sections, environment connection notifications, audio inputs, and the `section_id` thread-list filter.
## Testing
- Update release staging, generated-contract, notification, and public-signature coverage for the new runtime.
GitOrigin-RevId: 8b99ef6781e01c34d9d697c8c44247fb4e4fe3ab
## Why
The TUI startup future is large enough to inflate the CLI dispatcher's stack
frame.
## What changed
- Heap-pin the TUI startup future before awaiting it.
- Add a regression test that keeps the `run_interactive_tui` future below 64
KiB.
GitOrigin-RevId: 1f977928117537a5188c4d801517fb4a42e39e15
## Why
Cold resumes and forks could lose the thread's active permission profile and
fall back to the current configured default.
## What changed
- Restore the latest persisted approval policy, approvals reviewer, and active
permission-profile ID when resuming or forking a thread.
- Re-resolve persisted profile IDs through current configuration and
requirements. Missing or invalid profiles fall back to the configured
default, while threads without a persisted profile continue to use current
configuration.
- Keep explicit permission and approval overrides ahead of persisted settings.
## Testing
Added coverage for legacy and paginated histories, settings updates, explicit
overrides, removed or changed profiles, requirement fallbacks, and forks.
GitOrigin-RevId: 2289af2f3206bf131a6ffe0e8447e8d402e76c47
## What changed
Update `pypa/gh-action-pypi-publish` from v1.13.0 to v1.14.2 for the Python runtime and SDK publishing jobs.
GitOrigin-RevId: 239d2787aec47fd53111e05c29efdd680c0c7c67
## What changed
- Add a shared helper for recovering the latest persisted approvals reviewer from turn context and thread settings history.
- Use the helper when resuming and forking threads while continuing to honor explicit request overrides.
- Fall back to an older persisted reviewer when the latest turn context omits the field.
## Testing
- Add unit coverage for settings snapshot precedence, turn context precedence, and fallback to an older reviewer.
GitOrigin-RevId: dfc0332b0f1410a4c9a550236eb32624f5133baa
## What changed
- Add the optional `active_permission_profile` field to `TurnContextItem` to record the built-in or named profile that produced the effective permission profile.
- Populate the field when serializing a turn context while preserving compatibility with records where it is absent.
## Testing
- Add coverage verifying that turn-context serialization stores the active permission profile.
GitOrigin-RevId: d69142ab1b26595ab406235f89818ef41370e963
## What changed
- Fetch recommendations from the Codex-specific `/ps/plugins/suggested/codex` endpoint and parse its compact response shape.
- Fetch the selected plugin's details before presenting an install request, using them to verify availability and populate connector metadata.
- Skip install elicitation when the selected recommendation is no longer available, and return a retryable response when its metadata cannot be verified.
## Testing
- Cover the new recommendation route and response shape.
- Cover metadata hydration for available plugins and rejection of unavailable plugins.
GitOrigin-RevId: 2b0e2d70572aae2b7cd8e458b42e9dd14be3dbaf
## What changed
- Add `tui.keymap.global.open_agents`, defaulting to `alt-a`, to open the shared agents overview.
- Add an `agents` keymap context for search, new task, rename, stop, and grouping actions.
- Expose the new actions in the keymap picker and render dashboard hints from the resolved bindings.
- Preserve existing custom `alt-a` bindings by disabling the new default when it would conflict.
## Testing
- Cover remapping, reserved keys, conflicts, and compatibility with existing bindings.
- Verify that configured dashboard shortcuts act on the selected filtered task.
GitOrigin-RevId: 98c48a332e06cb96dbf0e59647ce7959d45b9988
## Why
App-server response diagnostics can include access tokens returned by the ChatGPT auth refresh flow.
## What changed
- Log successfully parsed server responses instead of raw JSON-RPC response payloads.
- Redact `access_token` from the `Debug` representation of `ChatgptAuthTokensRefreshResponse`.
- Avoid formatting callback send errors that can retain the original response payload.
GitOrigin-RevId: fd47485b38ed89527b25937c759b3273581f6ae6
## Why
Plugin and marketplace names can flow into generated install commands, so the
plugin creator must reject names outside the supported identifier syntax before
using them or changing files.
## What changed
- Centralize validation for plugin names, including dotted names, and marketplace
names.
- Apply validation when reading marketplaces, validating manifests, updating
cachebusters, and scaffolding plugins.
- Validate existing marketplace state before scaffold writes so invalid or
duplicate entries leave plugin and marketplace files unchanged.
## Testing
Add regression tests for accepted identifiers, unsafe and malformed names,
dotted plugin names, and failure paths that must not modify files.
GitOrigin-RevId: 9db68c2313a1539c5ab44d777966e33b460ceb71
## Why
Dangerous-command inspection has a bounded wrapper depth. Returning no match
after that limit could let a nested dangerous payload escape policy detection.
## What changed
- Classify commands beyond the wrapper-depth limit as dangerous.
- Cover the boundary and overflow cases in the command-safety unit tests.
- Verify that exec policy rejects a deeply `env`-wrapped forced `rm` before it
can delete a sentinel file when approvals are disabled.
GitOrigin-RevId: a6cdbbb7bdc6274a62745f668189fabaaf46745f
## Why
Some managed filesystem permission profiles cannot be represented by the
legacy app-server sandbox policy without changing which paths are accessible.
## What changed
- Require legacy sandbox conversion to preserve the filesystem policy's
semantics, and reject unsupported profiles with an actionable error.
- Keep queued follow-up messages and safety-buffered retries intact when
permissions are rejected, resuming queued input only after a compatible
profile is selected.
- Cover compatible profiles, lossy restrictions and write roots, turn-start
handling, and safety-buffered retries with regression tests.
GitOrigin-RevId: 345cc2a839206b2b1997e8981feb59f91b6975cc
## What changed
- Remove `experimental_thread_config_endpoint` from the configuration model and schema.
- Stop app-server and the in-process client from constructing a remote thread config loader from local configuration.
- Keep the thread config loader supplied at app-server startup fixed for the lifetime of the config manager.
GitOrigin-RevId: e7907fee2d631e7ecf89ec6bac8f22bc2c221350
## What changed
- Add `codex agents` to open the shared agents overview without creating a new session.
- Start the local background app server automatically on Unix, or connect to a server supplied with `--remote`.
- Reject invocation-specific session overrides that cannot apply to shared sessions.
- When the overview is opened from an embedded session, offer to start the background server without moving or interrupting the current session.
## Testing
- Cover command-line parsing and rejection of incompatible overrides.
- Snapshot the embedded-session background-server prompt.
GitOrigin-RevId: 60845dfebc48d820dc4ff090626d30452127f062
## What changed
- Mirror execution, permission, and patch approval requests into active realtime conversations with a prompt to review them in the app.
- Mirror user-input and elicitation requests with a prompt to respond in the app.
- Include the serialized request event so the realtime handoff retains the request details.
GitOrigin-RevId: 56fefa70b9ecaaad2fcf83592f20e8b4514a004a
## What changed
- Let users start tasks, open root sessions, rename tasks, and stop active work directly from the agents overview.
- Show details for the selected task on wide terminals and limit the overview to root sessions while still reflecting background activity.
- Preserve draft input and pending server requests when switching sessions so running roots and their subagents can continue in the background.
- Apply the selected project's working directory when dispatching from project grouping, including remote workspaces.
## Testing
- Expand overview rendering and interaction coverage for root filtering, dispatch, search, selection, renaming, and responsive input.
- Cover switching away from roots with running subagents and retaining background server requests.
GitOrigin-RevId: b7b0d33b7ecc077498efb756a0ad2fd425158b17
## What changed
- Pass `--cap-drop ALL` in both bubblewrap launch modes.
- Verify in the inner sandbox stage that the effective and permitted Linux
capability sets are empty, and abort before executing the command otherwise.
- Cover the generated bubblewrap arguments, capability state of sandboxed
commands, and rejection of a capability-bearing inner-stage process.
GitOrigin-RevId: 9dbd651d306d92327e36c9b3f308619db7d80a67
## What changed
- Allow `gpt-5.6-sol`, `gpt-5.6-terra`, and `gpt-5.6-luna` context-window overrides up to 872,000 tokens.
- Build the corresponding Amazon Bedrock entries from each bundled model's metadata while preserving Bedrock-specific identifiers, availability, tool, reasoning, and service-tier settings.
## Testing
- Cover long-context override clamping for bundled and Amazon Bedrock GPT-5.6 models.
- Verify the normalized Amazon Bedrock catalog metadata and context limits.
GitOrigin-RevId: 9f530dee501222a4d280bb31bbcdc2dacbe35d7d
## What changed
- Upgrade `rmcp` from 3.0.0 to 3.1.2.
- Use `rmcp`'s native JSON-RPC decoding and remove the local compatibility layer for multi-round-trip tool results.
- Preserve response metadata on `input_required` SSE results.
- Support OAuth protected-resource metadata discovery and include the discovered resource audience when refreshing tokens.
## Testing
- Add coverage for metadata preservation on modern SSE `input_required` responses.
- Add an OAuth startup scenario that discovers protected-resource metadata and verifies the refresh-token resource audience.
GitOrigin-RevId: 689f009b4a33552b640304111b74585b4009eeb8
## What changed
- Pass the screen size already available to TUI draw and history-tail paths into history insertion.
- Use the terminal's cached screen size for direct history insertion calls instead of querying the backend again.
- Extend the terminal size-query regression test to cover history insertion.
GitOrigin-RevId: 44c7a0f0bc5bc365d8d0c72d7e26587ed17a4821
## What changed
- Start inbound exec-server request spans when messages enter the connection queue and carry them through dispatch and response handling.
- Record request outcomes for client-handled network policy callbacks, including errors and disconnections.
- Add the `exec_server_request_queue_duration_seconds` histogram, labeled by bounded route name, while excluding synchronous route setup time.
## Testing
- Cover span lifetime and trace-parent propagation across server and client queues.
- Verify queue-duration telemetry and outcome recording for completed, rejected, and cancelled requests.
GitOrigin-RevId: ed67fe5305048bdf283a26ec874337d549e3324f
## What changed
- Add `/agents` to open a full-screen dashboard of loaded root sessions from the shared app server, with subagent status reflected in each root session.
- Support search, navigation, and grouping sessions by project or status.
- Refresh the dashboard when relevant thread notifications arrive, while preserving its selection and view preferences.
- Show a clear message when the dashboard is unavailable with the embedded app server.
## Testing
- Add coverage for dashboard rendering, status grouping, persisted view state, and restoring the conversation viewport after closing the dashboard.
- Cover `/agents` command discovery and dispatch from parent-owned threads.
GitOrigin-RevId: 6651f4c47358116e1809da3ac8844a5842026a95
## What changed
- Add `codex queue --thread <THREAD> --message <TEXT>` to submit a text message through the `thread/queue/add` app-server API.
- Resolve active sessions by UUID or exact name across interactive, exec, and custom sources, and reject ambiguous names.
- Support local and explicit remote app servers while reporting incompatible servers and configuration overrides instead of silently changing the target.
- Reject empty messages and image attachments.
## Testing
- Add CLI coverage for remote submission, validation, unsupported servers, and local-daemon routing.
- Add session lookup and queue tests for stale, non-interactive, custom, and duplicate session names.
GitOrigin-RevId: 44c233f752b63a85c85b92fa6da303336e4ddeca
## Why
Community expertise is most useful when shared through detailed issue reports, reproduction steps, logs, analysis, and design discussion. Reviewing external code changes requires broader architectural and roadmap context and can divert maintainers from higher-priority work.
## What changed
- State that external code contributions and pull requests are not accepted.
- Replace invited-contributor workflow and CLA guidance with instructions for reporting bugs and requesting features through the issue tracker.
- Remove the pull request template and align the ChatGPT crate guidance with the repository-wide policy.
- Direct vulnerability reports to the security policy.
GitOrigin-RevId: 736c0cb181e07cc751bc46f4fefc53c6964e3dab
## What changed
- Use `/subagents` consistently for the subagent picker and status UI, removing the `/agent` alias.
- Rejoin already-loaded subagent threads without overriding their existing settings.
- Route notifications and approval requests only to the active thread or its known subagents, discard unrelated startup events, and avoid replaying resolved approvals.
## Testing
- Add coverage for filtering buffered startup events, dropping resolved approvals, preserving owned subagent approvals, and resuming threads without setting overrides.
GitOrigin-RevId: b4e597f7cd4756faccf31d8b964e7a172f5ab0eb
Peter Bakkum