## What changed
Add experimental `thread/start.daybreakEnabled` so clients can set the initial preference for persistent threads. Omitted or null values leave it unset; explicit values are rejected for ephemeral threads.
Return the choice in the start response, `thread/started`, and reads before persistence. Stage it with the initial thread metadata and save it when the thread is persisted. Later changes still use `thread/metadata/update`. The preference does not select `turn/start.cyberAccessProgram` or grant access.
## Testing
Add coverage for true, false, and unset values in responses, notifications, reads, and reads after persistence and restart, plus rejection for ephemeral threads. Update existing metadata and access-program tests to exercise threads with an initial preference.
GitOrigin-RevId: 3bff3dc55a18436067bc2a3f156f5abf52d7321b
## Why
Building MCP search entries eagerly cloned tool specs and normalized schemas even for tools that were never selected.
## What changed
Store search specs in `Arc<ToolSpec>` and let MCP search entries share the handler's spec. Materialize and normalize loadable specs only for selected results, preserving existing result formatting and dynamic-tool cache equality behavior.
## Testing
Add coverage for function, freeform, and namespace specs that verifies shared specs produce equivalent results, retain the source while needed, and release it when the search entry is dropped.
GitOrigin-RevId: 4260f2e2527834d8a856b1528654c6951aab8a7d
## Why
Persisting user input received during an active turn currently blocks the next model request. Stores that support background persistence can overlap this checkpoint with inference.
## What changed
- Add `PersistContext::SteeredUserInput` and `allows_background_persistence()` so stores may enqueue these checkpoints, with durability and error reporting enforced by later flush or shutdown operations.
- Use the new context for accepted steered user input and apply the same metadata handling as turn-start persistence.
- Keep tool outputs synchronous, including in mixed input batches, and allow stores to retain synchronous persistence for all contexts.
## Testing
Add gated-store integration tests covering background user-input persistence, synchronous stores, and synchronous tool-output checkpoints. Verify that the next request includes the steered input and waits for persistence when required.
GitOrigin-RevId: c60b7b6c9b483245fd3169306bcf0de248ccdf35
## What changed
- Add spans for one-shot and resumable `exec_command`, `write_stdin`, session creation, and output collection, recording outcomes and output collection stop reasons.
- Correlate calls with conversations, turns, and processes; link stdin interactions to the original exec call and process start requests to executor process IDs. Omit empty turn and call IDs and those longer than 256 bytes.
- Propagate the current tracing span into the spawned one-shot execution task and distinguish timeouts, cancellations, and failures.
GitOrigin-RevId: 722728dc3f5b624e7a4da69fc867c3c672465af0
## Why
Retaining the pseudoconsole's creation pipe handles prevents output readers from seeing EOF while the session remains alive.
## What changed
Drop the creation handles after a successful process spawn and call `ReleasePseudoConsole` when available on Windows 11 24H2 or newer. This lets output close after the last attached client exits while preserving I/O for surviving console descendants. Older Windows versions retain the `ClosePseudoConsole` cleanup path on drop.
## Testing
Add Windows lifecycle tests for output closure after normal exit and termination while retaining the session, plus continued input and output for a surviving console child. These tests skip when `ReleasePseudoConsole` is unavailable.
GitOrigin-RevId: fb1094fb2a570e6fec0cc80d6356f5d7eb1edcbf
## What changed
- Add `NetworkPolicyController` and `NetworkPolicy` APIs for publishing destination policies, checking access, and observing policy changes. Restricted policies permit only `https` and `wss` URLs with exact allowed hosts.
- Add revocable `NetworkPermit` values with cancellation support. Reject stale policy publications, revoke permits when access is removed, and prevent account-bound policy handles from regaining access after invalidation.
- Provide a permit API for SDK transports without destination enforcement that denies access under restricted policies.
- Let `HttpClientFactory` carry a network policy, defaulting to unmanaged access, and include policy identity in factory equality.
## Testing
Add tests for secure host matching, invalidation, stale publication, recovery after policy load failure, account isolation, and SDK permit revocation. Make accepted sockets blocking in redirect test servers to handle macOS socket inheritance, and add a missing read timeout.
GitOrigin-RevId: c79231527bc5e6954cda6581c0b9f43c90335755
## Why
Callers need to tie isolated threads to an explicit lifetime and wait for cleanup even when startup is cancelled or its result is never received.
## What changed
- Add `ThreadManager::start_thread_until` to run an isolated thread until a caller-provided future completes or the thread exits, with a `TaskTracker` covering cleanup and deregistration.
- Retain persistence and session resources across interrupted startup so cleanup can release partially initialized resources or shut down a running session using normal history rules.
- Reject resumed history and startup without explicit session isolation.
## Testing
Add integration tests for cancellation during stalled required MCP initialization, dropping an unconsumed startup result, and owner cancellation that preserves history and parent usability. Also verify that failed duplicate startup leaves the existing thread's writer intact.
GitOrigin-RevId: 47251c1b0c43821ab8f950816c6d341d39cdc823
## What changed
Convert supported expressions inside `$...$` and `\(...\)` to readable Unicode in regular and streaming Markdown. For example, `$\alpha^2 + \beta_{10}$` renders as `α² + β₁₀`. Support a bounded TeX subset including symbols, superscripts, subscripts, square roots, and parenthesized fractions, with verbatim fallback for unsupported expressions.
Exclude code, links, HTML, and display equations from conversion, and avoid interpreting common currency and shell syntax as math. Preserve file citation paths and keep streaming cache boundaries outside display equations.
## Testing
Add snapshots for inline rendering and narrow wrapping, plus regression tests for unsupported input, parser limits, Markdown contexts, file citations, and streaming display boundaries across chunks and widths.
GitOrigin-RevId: 828bf7b48345b05bc6c2fb5cb2798412c3b71dbe
## Why
Remote app servers cannot read image paths on the TUI host. Image attachments need to carry their contents when submitting to a remote workspace.
## What changed
- Prepare local images as data URLs off the event loop for new turns and steers, preserving source pixels for model-specific resizing and enforcing a 32 MiB image transport budget.
- Show preparation progress, preserve queued message order, and recover drafts on preparation failures, cancellation, disconnects, or thread switches. Ignore stale preparation completions.
- Avoid duplicate user messages from server receipts and duplicate image labels in history.
## Testing
Add regression tests for portable image contents, receipt deduplication, draft restoration, responsive input during preparation, and cancellation across thread and connection changes.
GitOrigin-RevId: 6404615eae0b06c141af96b4229501c61f7fcfee
## What changed
Add an `instructions.load` tracing span with `provider = "global"` around loading user instructions from the Codex home directory. Skip recording function arguments and add the `tracing` dependency to `codex-home`.
GitOrigin-RevId: 1b11e4b18f7a0dbee742a092aba580a184dc5fbf
## Why
Configuration requirements did not report which login methods the running app server permits after applying managed policy, forced login settings, and workspace restrictions.
## What changed
- Add `allowedLoginMethods` to `configRequirements/read`, using the running authentication manager's effective policy rather than newly read authentication settings.
- Return requirements when login methods are restricted even without managed requirements, while preserving `requirements: null` for the unrestricted default.
- Update protocol schemas and generated TypeScript and Python types. An empty list permits no login method; older servers may omit the field.
## Testing
Add coverage for managed and forced login restrictions, workspace intersections, policy reporting after requirements files change, invalid login methods, and API-only Amazon Bedrock without ChatGPT requests. Extend tests for conflicting authentication requirements and cloud policy precedence.
GitOrigin-RevId: 56c0767a74143e793aac2ac165d0cbe98a09469b
## What changed
Restrict `run_before_review_deadline_with_cancel` and its re-export to `codex-guardian-reviewer`. Move its timeout, abort, and successful-completion tests from core into the reviewer's deadline module, and remove the standalone `run_before_review_deadline` tests from core.
GitOrigin-RevId: dd9f1ed571a40a4bd66b08c88f3ee2be071f4870
## What changed
Extract tool observation and evidence capture into `observation.rs`, background classification into `classification.rs`, and score tracking and failure handling into `score.rs`. Keep lifecycle hooks in `extension.rs` and pass captured evidence through a `Classification` struct, preserving the existing snapshot and background task boundaries.
## Testing
Move the fail-closed score-ordering test into `score_tests.rs` and extend it to verify that a failed sample replaces an equally dated score while preserving newer scores.
GitOrigin-RevId: b25b9e828cce78fb2be522d7209346b63403d824
## What changed
- Remove `AgentSpawner` and `AgentSpawnFuture` from the extension API, along with the Guardian wrapper, thread lifecycle context, and app-server injection plumbing.
- Define `InternalSessionSpawnFuture` directly as a boxed future instead of aliasing `AgentSpawnFuture`.
- Raise the workspace `rustls` minimum version to `0.23.45`.
GitOrigin-RevId: b7319dee41bfb869479afeb7555a6f050c4d00a5
## What changed
- Update `rustls` from 0.23.36 to 0.23.45 and `rustls-webpki` from 0.103.13 to 0.103.15.
- Update `aws-lc-rs` from 1.16.2 to 1.18.1 and `aws-lc-sys` from 0.39.0 to 0.45.0, including its new `pkg-config` dependency.
- Refresh the corresponding dependency metadata in `MODULE.bazel.lock`.
GitOrigin-RevId: 7b37b3cea5485c0b5bd11d229b2949aec399afd9
## Why
Session initialization can be cancelled after a persistence writer is installed but before acquisition returns. Cleanup must wait for acquisition to finish so it can discard the writer.
## What changed
Extend `LiveThreadInitGuard` to own in-flight acquisition and finish it before discarding persistence, including when the guard is dropped. Use the guard for thread creation, resume, and inherited model context initialization.
## Testing
Add a regression test that cancels acquisition after writer installation, verifies cleanup waits for handoff, and confirms the writer is removed afterward.
GitOrigin-RevId: 09041fa5cd675d082a86a4cc8a719c572afe11a8
## Why
Matches starting inside a lowercase expansion such as `İ` → `i̇` could receive an incorrect prefix bonus or gap penalty, causing strings that lowercase identically to rank differently.
## What changed
Track the first matched position in the lowercased text directly when calculating scores. Preserve original character indices for highlighting.
## Testing
Add a skill popup regression test and snapshot covering ranking and highlighting for matches beginning at the combining dot in expanded and already-lowercase names.
GitOrigin-RevId: 78a8b79f1defca9f76fde5df945b0b1ff4af25da
## Why
Sandboxes that enforce endpoint access directly need dedicated loopback proxy ports instead of shared SID-attributed ingress.
## What changed
Expose `ManagedProxyRouting` through `NetworkProxyBuilder::managed_proxy_routing`. Selecting `DedicatedListeners` reserves per-proxy loopback listeners on Windows as well as other platforms. Keep `SharedIngress` as the default and include the routing mode in proxy equality.
## Testing
Add regression coverage for distinct loopback endpoints, sandbox port metadata, and HTTP and SOCKS allow/deny policy enforcement. On Windows, verify that dedicated routing requires no restricting SID and omits the shared-ingress proxy-port environment variable.
GitOrigin-RevId: e198891bef1d089f9492d2982505a2d6bb002a74
## Why
Rollout compression failure counters report only that an operation failed,
without identifying the failing stage or I/O error kind.
## What changed
- Add `stage` and `error_kind` labels to failure counters for compression runs,
individual files, materialization for append, and stale temporary file cleanup.
- Record failures at their source, including lock acquisition and task joins,
and avoid counting file compression failures twice.
- Use static stage labels and a fixed set of error categories, keeping error
messages, paths, and rollout contents out of metric tags.
GitOrigin-RevId: ac2bfc7ae4cec4e9f60de9557b03345a3986aa53
## What changed
- Retain the trusted enterprise identity provider in runtime configuration and bind winning MCP registrations during catalog finalization. Require `features.use_xaa` and a configured identity provider for activation, while preserving existing server restrictions.
- Apply plugin `ema_auth` client, issuer, resource, and scope settings to installed and selected plugins. Disable registrations with mismatched endpoints or empty resources without rewriting plugin endpoints.
- Preserve enterprise auth policy across catalog rebuilds and rebind registrations when materialized server settings change. Keep registration rejection separate from persistent server-name vetoes so it does not disable replacement hosted apps.
## Testing
Add coverage for activation gates, configuration ownership, plugin endpoint validation, catalog rebuilds, and skipping interactive OAuth during installation of enterprise-managed plugins. Stabilize the sandbox network proxy test by reading request headers before closing the loopback connection.
GitOrigin-RevId: 3374f507d120835b285767cedbbb511fc7b0fba2
## Why
A persistent tmux session can gain remote clients after Codex starts, so successful native copying must not skip terminal forwarding. Terminal sends also lack delivery acknowledgement and cannot replace native copying reliably.
## What changed
- Attempt native copying first, then independently forward through tmux or OSC 52 in tmux and SSH sessions. Preserve existing native clipboard leases when a later copy returns no new lease.
- Target the most recently active client in the current pane's tmux session, checking that client's clipboard capability before sending. Retain OSC 52 fallback when tmux forwarding fails.
- Reject empty selections without touching clipboards and apply the 100,000-byte terminal payload limit to tmux copies.
- Resolve tmux and PowerShell through trusted system locations, adding Nix system profiles and the WSL PowerShell directory to helper discovery.
## Testing
Add regression coverage for native-before-terminal ordering, fallback routing, clipboard lease retention, empty and oversized payloads, tmux client selection, capability checks, and combined backend errors.
GitOrigin-RevId: df4b66fa4368a3cf19b4d07fde6c76ea96a8fef5
## What changed
- Extract helper copying, token-user SID queries, provisioning pipe ownership, and service runtime lifecycle into dedicated modules.
- Simplify command-runner resolution and extract setup configuration loading, payload execution, provisioning request exchange, and response handling into helpers.
- Parameterize installation-record registry access and return the saved installation record from authenticated user registration.
## Testing
Add tests for explicit setup `cwd` selection and effective workspace roots, plus valid and invalid token-user SID queries. Move existing helper-copy and freshness tests alongside the extracted copy implementation.
GitOrigin-RevId: ffb39adae7611baa95e85c89f9a31ef7a779e217
## Why
When terminals deliver pasted text as individual key events, tabs can trigger completion, submission, or queuing instead of preserving indentation in the draft.
## What changed
Capture unmodified `Tab` events during paste bursts before shortcut dispatch, including after short Unicode prefixes. Refresh the burst idle timeout when appending tabs or newlines, and flush expired bursts before handling manual `Tab` shortcuts.
## Testing
Add regression tests for multiline tab preservation, ASCII and Unicode prefixes, idle timeout refresh, completion suppression, and normal submission and queue shortcuts. Add a snapshot for pasted indentation.
GitOrigin-RevId: ba404cfe66c23f37da5a0db7cccfdd3d4c4af331
## Why
Command execution and plugin measurement events lack model and reasoning-effort labels. Attribution needs to reflect the step that invoked the command, even when model settings change before a background process finishes.
## What changed
- Add `model_slug` and `reasoning_effort` to command execution and plugin measurement analytics.
- Capture model context from resolved step settings and carry it through execution, approval, Guardian review, and plugin metrics collection.
- Preserve the first command-start model context when subsequent start notifications arrive.
- Keep the carried context out of serialized protocol items and generated schemas.
## Testing
Extend analytics tests to cover model switches before invocation and during background execution, default reasoning effort, Guardian-denied commands, and repeated start notifications retaining the original model context.
GitOrigin-RevId: af90e1c0d39bab625f2e89786085b61a9b96c0ce
## Why
Running code-mode cells can request Guardian review while the next response is in flight. Clearing the response ID before that response emits `response.created` leaves those reviews without a `parent_response_id`.
## What changed
Keep the latest response ID received in the turn until a later `response.created` replaces it, including across sampling retries.
## Testing
Add regression coverage for reviews before and after a response handoff and for a fresh turn that must not inherit the previous turn's ID. Update retry coverage to expect the last known parent when the retry supplies no response ID.
GitOrigin-RevId: af0a08de09edad59e1a7ade7904a42d616b05679
## Why
Idle Apps clients and cached MCP bindings can retain replaced tool definitions. Shared catalog updates can also invalidate prepared calls even when the current definitions match the captured catalog, including after tools are restored while a call awaits approval.
## What changed
- Share immutable tool arrays across equivalent live discovery contexts and reuse storage for equal results. Let unused providers and cached bindings expire.
- Include requested capabilities and initialization results in the sharing scope, and detach servers that disable catalog caching from live sharing.
- Capture catalog snapshots for prepared calls. Accept equivalent shared catalogs regardless of tool-list order, while rejecting changed definitions and calls captured before an explicit refresh on that client.
## Testing
Add regression coverage for shared storage and scope isolation, release of replaced tools and unused bindings, equivalent catalog restoration, explicit refresh invalidation, and an Apps call completing after catalog restoration while awaiting approval.
GitOrigin-RevId: a0516186e4286d0ff13405fafbab6fcf3f1f3773
## Why
MCP tool parsing eagerly cloned structured output schemas and built full call-result envelopes. Cloning tool definitions also copied their output-schema JSON, even before a consumer needed it.
## What changed
- Introduce `ToolOutputSchema` with immutable `Arc` storage so tool definitions share output schemas when cloned.
- Retain MCP structured output schemas and materialize the call-result envelope only when JSON is requested.
- Update code-mode consumers and schema mutation sites to materialize JSON explicitly, reusing uniquely owned storage when possible.
- Move structured content into the MCP envelope without an extra clone, preserving property order.
## Testing
Add tests for JSON preservation, mutation isolation, equality between lazy and materialized schemas, reuse of uniquely owned storage, and equivalent code-mode definitions.
GitOrigin-RevId: e98ba4c2f0efedc99f7cbc7bba206cc63a3bd8f4
Remove entries from the owned snapshot maps when building MCP server status
responses, moving server metadata, tools, resources, and auth statuses into
the response instead of cloning them. Preserve pagination and missing-entry
defaults.
GitOrigin-RevId: 012301f55ddb9c52c7934a638bdd0310f11077fa
## What changed
Move request execution from `LunaSampler` into `SamplingExecution` in
`sampler/execution.rs`, keeping request preparation and active-request tracking
in the sampler. Preserve the existing retry, authentication recovery,
cancellation, streaming, connection reuse, and token accounting behavior.
GitOrigin-RevId: 5e50116459fe9cc196c30c58e42773fc32be3d02
## What changed
Add `ConversationState` and `ConversationCheckpoint` to `codex-guardian-reviewer` and use them in core review sessions to track transcript cursors, completed review counts, and committed snapshots. Keep history and admitted evidence host-owned.
Preserve the separation between live review progress and committed checkpoints so forks inherit the history, cursor, and review count from the last committed snapshot.
## Testing
Add a unit test verifying that forks retain committed history and progress after an uncommitted review, then advance when the next snapshot is committed.
GitOrigin-RevId: 9f92410b11beec6b8f413c4c922fabba65852399
## What changed
Move full/delta transcript selection into the shared `TranscriptMode::select` API and use it when building guardian prompts. Export `TranscriptCursor`, `TranscriptMode`, and `TranscriptSelection` from `codex-guardian-context`.
Preserve full-transcript fallback when the history version changes or the saved cursor exceeds the collected entry count. Select entries before profile retention, preserving their numbering and returning a proposed cursor that counts all collected entries. Hosts remain responsible for committing and invalidating cursors.
## Testing
Add a regression test verifying that sliding-window retention preserves the collected-entry cursor and that an appended entry is selected and numbered correctly in the next delta.
GitOrigin-RevId: a2192c08e23c18302b0105ba47aeb2780eb4a015
## Why
A summary-free parent context reset could reuse a Guardian review session and carry forward rationale from before the reset.
## What changed
Track destructive history replacements with `reset_version` and include it in the Guardian session reuse key. Ordinary input and compaction preserve this version.
## Testing
Update the review-session reuse test to require a new Guardian thread after a summary-free reset, with no prior review context or previous rationale.
GitOrigin-RevId: bd05c149774839f68b75294751f7619ba7ce0bfe
## What changed
Include `sessionId` and the originating `windowId` alongside `threadId` and optional `itemId` in MCP request metadata. Retain the originating item and window for code-mode cells across waits and compaction, including the window when no matching history item is found.
## Testing
Extend metadata assertions for direct and nested MCP calls. Add a regression test verifying that a code-mode cell retains its original item and window IDs when it resumes after compaction.
GitOrigin-RevId: 5e3cf761f2bed4c16565334c94654496367325fd
## Why
Each `setTimeout` spawned a sleeping thread that remained alive until its delay elapsed, even after `clearTimeout` or cell completion.
## What changed
Replace per-timer threads with Tokio sleep tasks held by `AbortOnDropHandle`, so removing a timeout or dropping the isolate cancels its task. Enter the caller's Tokio runtime on the code mode runtime thread to support scheduling these timers.
## Testing
Add a regression test using virtual time to verify that cleared timers release their tasks, an awaited timer completes, and cell completion cancels remaining timers without emitting their output.
GitOrigin-RevId: 59c7e57ed226cb32633e2d4c25b778cfab2af423
## What changed
- When `CODEX_PROVISIONED_MACOS_CANDIDATE` is `true`, require the provisioned macOS job to succeed and upload its verified packages as release assets. Allow releases to proceed when the job is disabled and skipped.
- Include provisioned archives in `codex-package_SHA256SUMS` and remove per-architecture `SHA256SUMS` files before upload.
- Publish a `codex-provisioned` DotSlash manifest for macOS ARM64 and x86_64 packages, pointing to `bin/codex`.
GitOrigin-RevId: 7e36df484a3b7da6b66180fa31418a6958d1fe77
## What changed
Expose `prepare_windows_sandbox_config` and `PreparedWindowsSandboxConfig`
and use them during config loading. Preserve requirement enforcement and the
separation between the configured mode and the effective sandbox level.
## Testing
Add a unit test covering explicit mode precedence over feature fallback and
ensuring a feature-only fallback leaves the configured mode unset.
GitOrigin-RevId: 98e7f9fbc473b6a841257eca80d9a51950986055
## What changed
- Add a configurable `new_worktree` action, bound to `w`, for local sessions with worktree support enabled.
- Create the worktree from the cached project default branch, preferring remote `HEAD` and falling back to conventional `main` or `master` refs without fetching. Preserve the selected subdirectory and source checkout edits.
- Start and bind a blank session in the new worktree, preserving the selected approval reviewer without sending an initial turn.
- Show creation progress, pause conflicting actions, clean up unclaimed clean worktrees, and report retained checkout paths when session startup fails. Clear pending creation state on reconnect.
## Testing
Add coverage for default-branch selection, source checkout preservation, session ownership and approval settings, cleanup, startup failures, reconnect state, and busy-state rendering. Extend Git environment isolation coverage and test unrelated non-UTF-8 refs.
GitOrigin-RevId: 771ddc12d04dbf0d12e77e9c96c8386cf31e67c5
## Why
Scrolling with `CSI S` can discard history rows in QTermWidget and xterm.js when the viewport grows.
## What changed
Use newlines at the bottom of the history scroll region for `ScrollbackStrategy::Standard`, preserving the composer and restoring the cursor and full-screen scroll region afterward. Fall back to full-screen scrolling when only one history row exists, since `DECSTBM` requires two distinct rows. Skip scrolling when there are no history rows or no rows to scroll.
## Testing
Add regression tests for composer and cursor preservation, scroll-region restoration, emitted newline sequences, single-row scrollback preservation, and no-op growth. Snapshot visible geometry for growth by one, three, and four rows.
GitOrigin-RevId: 1dbfc30bb6997dcc2738ec6b2f42d35c786124de
## Why
Pasting during `Ctrl+R` history search previously went through normal composer paste handling instead of updating the search query.
## What changed
- Append sanitized pasted text to the active query and restart matching from the newest history entry, including for large pastes and image paths.
- Ignore empty pastes so they preserve the selected match.
- Display newlines and tabs as `↵` and `⇥` in the footer while matching the original query, and clamp the cursor safely for very large queries.
## Testing
Add regression tests and snapshots covering pasted query acceptance, empty pastes, draft restoration on misses and cancellation, sanitization, large pastes, image paths, separator rendering, and cursor placement.
GitOrigin-RevId: 2ec13fdddcb7503a72a21fc03b2a27ed36313a8a
## What changed
- Replace the inline task composer with a session list: `n` opens a blank session in the selected checkout without sending an initial turn or interrupting running agents.
- Use single-letter action shortcuts and `Enter` to open a session. `Esc` cancels search or rename without closing the list; `Ctrl+C` quits from the list.
- Load destination settings for new sessions while carrying over explicit permission choices. Retain blank sessions and their drafts across navigation until the first turn.
## Testing
Update tests and snapshots for command center navigation, shortcuts, blank draft restoration, destination defaults, permission carryover, and directory trust.
GitOrigin-RevId: bddd04fdbe6ac2f5b7bd70293fd04f673b97ba02
## Why
Model and reasoning effort updates during a turn can leave request metadata and tool hooks reporting the turn's initial settings. Metadata should describe the step that issued the request or tool call.
## What changed
- Share captured execution metadata across Responses, MCP, and extension tool calls, including model, reasoning effort, and automatic review and Node REPL flags.
- Build Responses tool inventory metadata from the issuing step's finalized tool router. Attach the finalized inventory separately for remote compaction.
- Use captured step settings for pre- and post-tool hooks, and captured review settings for permission-request hooks.
## Testing
Add and extend regression tests for model and effort changes during a turn, MCP metadata, pre-tool hook model attribution, captured review flags, and tool inventory matching the issuing request.
GitOrigin-RevId: 9dee46a8b4839de8b434cdad4ed441cc0bb6ff9b
## Why
Desktop uninstall cleanup needs an installation owner even when the user has not signed in or configured the Windows sandbox. Recording ownership only during provisioning leaves those installations unregistered.
## What changed
- Add an authenticated installation registration request and attempt it during Windows desktop stdio initialization, with a five-second timeout before the initialization response.
- Persist ownership independently of provisioning, preserve existing desktop ownership, and prevent another user or home from replacing the registered owner.
- Validate write authority and retain directory handles and guards to protect the registered home against junction conversion through privileged cleanup.
- Preserve existing CLI homes during desktop uninstall while removing their `CodexSandboxUsers` ACL entries. Report ACL revocation errors and avoid propagating unchanged ACLs.
- Grant the owner `WRITE_DAC` on `.sandbox-bin` and allow elevated-helper fallback when older permissions need repair or the service cannot establish an uninstall watcher.
## Testing
Add tests for installation registration without sandbox settings and for preserving a child's null DACL when revoking an absent SID from its parent.
GitOrigin-RevId: fb48923e9d76758d1bf5b50c7305aa60f91629db
## Why
Direct tool-call records need to stay associated with the invocation that produced each output, including when call IDs are reused. Completeness must describe the recorded call inventory, independently of tool success.
## What changed
- Attach direct-call records to outputs before they enter history, and set `tool_calls_complete` when the invocation's arguments are fully recorded.
- Bound pending recordings and retained metadata, release reservations on completion or cancellation, and invalidate pending records when capture is disabled.
- Apply request budgets to direct metadata and strip it from inference and compaction inputs when capture is disabled.
- Remove executed-call metadata from app-server raw response notifications and exclude its size from Guardian history retention budgets.
- Track call IDs that bypass dispatch so their reuse cannot incorrectly establish Code Mode completeness.
## Testing
Add regression coverage for direct-call attribution, malformed calls, metadata budgets, cancellation, configuration changes, compaction, notification filtering, and Guardian context isolation.
GitOrigin-RevId: 2ebd39c7f141d04788736491495109841656b4c0
## Why
Logon SID lookup previously walked token group entries and SID pointers without checking that they fit within the returned buffer.
## What changed
Add a shared `token_groups` helper with a caller-supplied size limit. Validate the group layout, SID bounds, revision, and length before copying SIDs into owned `TokenGroup` values, preserving group order, duplicates, and attributes. Use this helper for logon SID lookup.
## Testing
Add Windows tests for owned SID storage, preserved order and attributes, truncated layouts, malformed and out-of-buffer SIDs, query size limits, and current-token logon SID lookup.
GitOrigin-RevId: f51ff6aa5266b6c73fe07968015e462c888a95e4
## What changed
- Introduce `PreparedNetworkConfig` to separate proxy preparation from applying managed network requirements, preserving preparation before permission fallback in local configuration loading.
- Add helpers to build portable environment policies, retain selected or managed policies even when the proxy is disabled, and validate policies against the final permission profile using the execution resolver.
- Strip listener addresses from environment network configuration and reject unsupported settings, malformed domain patterns, and invalid Unix socket paths.
- Expose supporting managed-feature and permission-profile configuration helpers.
## Testing
Add coverage for policy retention, listener removal, unsupported and malformed policies, and validation against permission profiles. Strengthen configuration tests to compare rebuilt proxy specifications and verify proxy configuration survives permission fallback.
GitOrigin-RevId: 444bf02d8543eaebdbd2ebc14b56d92ce6d2ad2f
## What changed
Expose `prepare_packaged_windows_sandbox_cleanup` to disable sandbox accounts and stop their processes before returning a `PreparedWindowsSandboxCleanup` guard that retains the setup lock. Its `finish` method removes resources and protections; dropping it only releases the lock, leaving accounts disabled and protections intact.
Keep `clean_up_packaged_windows_sandbox` as a wrapper around both phases, and extract the service's existing package cleanup logic into a dedicated module.
GitOrigin-RevId: a32663171bce027f771f738d71b0c46404edbedc
## What changed
- Add explicit MXC backend selection and carry its identity through exec-server process reporting and sandbox violation classification.
- Launch MXC through the Codex executable with the effective permission profile and command environment.
- Reject exec-server MXC requests when native MXC is unavailable or when they request a TTY, an `arg0` override, or managed networking. Reject private desktop isolation during MXC preparation.
- Allow an explicitly empty child environment and avoid exposing request payload values in launcher decode errors.
## Testing
Add coverage for sandbox selection and unsupported-request rejection, plus Windows RPC tests for stdin writes and temporary-directory permissions derived from the command environment. Native MXC tests skip when MXC is unavailable.
GitOrigin-RevId: 3626ff0f9ad7f9b812ce09b68c31ea9a5a9c72b1
## What changed
- Move the setup helper implementation and its existing tests into `codex-windows-sandbox`, with the binary delegating to `setup_helper_main`.
- Expose installation record types and storage operations from the library, preserving the registry key, size limit, and serialization format. Reuse them in the service and remove its direct `serde` dependencies.
- Extract service provisioning from IPC handling into a dedicated module, preserving authentication and machine-policy checks before provisioning and retaining directory handles through helper execution.
GitOrigin-RevId: dd1ea015aff901d5dfe39b395de1971ee0f2d33f
## Why
The latest `openssl-src` 300.x crate still bundles OpenSSL 3.6.3. Build the 3.6.4 security release directly while preserving the existing 3.x ABI.
## What changed
- Build static OpenSSL libraries with the musl compiler for `x86_64` and `aarch64`, verifying the source archive's SHA-256 checksum.
- Set target-specific OpenSSL overrides to bypass vendored builds without affecting host build dependencies.
- Add `perl` and `make` to the musl build prerequisites and reuse completed OpenSSL installations.
GitOrigin-RevId: 4276c7d6cf30c31c8554246cea2f406dfbf7568b
## What changed
Remove the animated stars shown when selecting Astra, along with their input, terminal-focus, and model-selection hooks.
## Testing
Retain draft text and live voice control snapshots in a standalone composer snapshot test, and remove sparkle-specific tests and snapshots.
GitOrigin-RevId: cbe4396e8700cabfb1e0db9fbe8f997b94316c0f
