## Why
Code-mode callbacks can outlive their initial request and run in separate tasks,
so their trace context must be preserved explicitly.
## What changed
- Preserve the execution context for code-mode callbacks and add spans for
nested tool invocations in the runtime and dispatch broker.
- Propagate each tool invocation span as the parent of its streamed gRPC
callback, falling back to the outer execution context when needed.
- Add a `codex.exec_server.process` span for each process lifetime, including
its process ID and completion result, without retaining the request span.
GitOrigin-RevId: a6059e34d895416f5517e51dad6ca0078355adca
## What changed
- Verify image-generation extensions rebind permissions on every turn, preserving session grants while expiring turn-only grants.
- Cover executor skill reference reads under current filesystem permissions, including paginated reads, permission changes, and edits between pages.
- Verify oversized live executor skill prompts emit a warning without replacing previously injected prompt content.
GitOrigin-RevId: 1fc8eef409fa65db4bb1ab6a00408fe72c9e938f
## Why
Composer drafts include attachments, mention targets, and deferred paste payloads in addition to visible text. Vim undo needs to restore that complete state as a single edit.
## What changed
- Add bounded, draft-level Vim undo history, with `u` as the configurable default binding in normal mode.
- Group complete Vim commands and insert sessions into undo steps, including direct composer changes such as pastes and attachments.
- Preserve undo, repeat, and search state when a reverse-history preview is canceled, and start fresh history when another prompt is accepted.
## Testing
- Cover grouped edits, custom bindings, history and search interactions, attachments, and large paste payloads.
GitOrigin-RevId: 12ecdb3c34a2d66f5d856aa2f82dc15bd91b230b
## What changed
- Retain bounded, process-local records for failed Guardian reviews, including the reviewed action, decision, status, model, instructions, and reviewer history.
- Add recent records from the reported thread and its descendants to log-enabled report uploads as `auto-review-failures.jsonl`.
- Preserve the action and decision while omitting oversized reviewer context, and exclude successful, ephemeral, and capture-disabled reviews.
## Testing
- Cover denied and invalid decisions, cleaned-up ephemeral reviewers, descendant-thread selection, record count and byte limits, and oversized-context fallback.
GitOrigin-RevId: 5f12f7605041c3c84e826e6bac1cf06b1518ab24
## Why
Audio models cannot reliably encode tool-generated clips shorter than 25 ms.
## What changed
- Measure the available audio frames in base64-encoded PCM and IEEE float WAV outputs.
- Replace clips under 25 ms with explanatory text while preserving surrounding Code Mode output.
- Leave clips at or above the threshold and unrecognized audio formats unchanged.
## Testing
- Cover the duration boundary across multiple sample rates and all supported `audio()` input forms.
- Verify bounded and truncated WAV chunks, output after `yield_control()`, and end-to-end mixed text and audio output.
GitOrigin-RevId: 342b4bdbc65db4238580f9cdc372763c2576eca5
## Why
Sandbox diagnostics could report `read-only` when a configured writable root did not yet exist, because policy labeling used filesystem-aware runtime root resolution.
## What changed
- Derive diagnostic policy labels from configured writable roots without inspecting the filesystem. Runtime sandbox authorization continues to use filesystem-aware resolution.
- Capture sandbox labels once per turn and reuse them for response metadata and tool-result metrics.
## Testing
Add coverage for missing project roots, denied roots, and deny rules on project subpaths.
GitOrigin-RevId: ccbdb8c32a1f44bfa63ae4d2ae1f9cc408e66b9c
## What changed
- Raise the Guardian message transcript budget from 10,000 to 20,000 tokens.
- Raise the per-message entry limit from 2,000 to 5,000 tokens.
GitOrigin-RevId: 93a92e3d806fd3bf005e6c27964babd7ed2f948e
## Why
Permission grants can belong to an executor whose path convention differs from
the local host, such as a Windows remote environment. Matching those grants
against a host-native working directory can reject valid permissions.
## What changed
- Normalize, materialize, and compare additional filesystem permissions using
the selected executor's URI-based sandbox context.
- Apply the same context-aware preapproval flow to `exec_command`,
`apply_patch`, and extension tools.
- Fail closed when symbolic temporary-directory or project-root permissions
cannot be resolved from executor metadata, while accepting opaque working
directory URIs when requested paths use the executor's convention.
## Testing
- Added coverage for reusing a Windows permission grant from a non-Windows
host, resolving symbolic temporary-directory grants, and normalizing paths
with an opaque Windows working directory.
GitOrigin-RevId: aee54350a25430a0443f8319e2bb0bbdc4f44282
## What changed
- Exercise Rust source discovery through a mocked `git ls-files` call, including files outside `codex-rs`, paths containing spaces, and stale entries that no longer exist.
- Assert that the formatter invokes `rustfmt` from `codex-rs` with the repository configuration in both format and check modes.
- Keep the multiline argument-comment lint fixture stable under formatting and update affected Rust test files to the expected style.
GitOrigin-RevId: 0cfffde1bb91bf620d2118bed1efc68466c0cca6
## Why
Realtime history should be recorded consistently for every Core host, including
when no app-server event listener is attached.
## What changed
- Move transcript segmentation, session boundaries, and backing-agent artifact
promotion into Core for paginated threads.
- Persist canonical realtime items through the thread store in event order and
emit dedicated history lifecycle events for hosts to present.
- Translate those Core events into the existing app-server realtime item
notifications without app-server persisting the items a second time.
## Testing
- Cover Core-only persistence across repeated sessions, ephemeral sessions,
accepted and rejected steering, typed input ordering, and artifact promotion.
- Verify app-server notifications correspond to the persisted timeline.
GitOrigin-RevId: 7cbef14129d77f6d6d7099b733be91f5279c55f5
## What changed
- Add an in-process `sideband_base_url` override to `ConversationStartTransport::ExistingCall`, while keeping app-server requests on the configured or default endpoint.
- Prefer the per-call endpoint when attaching and reconnecting a sideband, falling back to `experimental_realtime_ws_base_url` when no override is supplied.
- Preserve runtime authentication headers on the selected endpoint without adding bearer authorization.
## Testing
- Cover configured and per-call endpoint selection, authentication headers, call-specific handshake paths, and reconnect behavior.
GitOrigin-RevId: 16c439fe0a9ff8bcdda4ec615bb9983e30935052
## What changed
- Add `auto_review.node_repl_policy` to model messages for `node_repl` and `cua_repl` reviews.
- Use the reviewer model's configured policy, falling back to the bundled policy when the field is absent and skipping injection when it is explicitly empty.
- Include the effective policy in Guardian session reuse checks and reject unsafe parent-model fallback transitions that would change it.
## Testing
- Cover catalog, bundled, and explicitly empty policies across Node and CUA review paths.
- Verify that policy changes invalidate cached reviewer sessions and incompatible fallback transitions.
GitOrigin-RevId: 51c0bdfed9b464091b6eb47d91ca5a0990d7a315
## What changed
- Add the `codex-config-schema` workspace and Bazel crate for the
`codex-write-config-schema` binary.
- Preserve `codex-rs/core/config.schema.json` as the default output location.
- Update `just write-config-schema` to run the new crate and remove the schema
generator's `clap` dependency and binary target from `codex-core`.
GitOrigin-RevId: 7447f97d6e44d1077b16d2d850f8a8add9117ea6
## Why
Resumed threads need to continue per-turn and per-thread token totals without scanning arbitrarily far beyond the latest compaction checkpoint.
## What changed
- Add durable `TokenUsageRecord` rollout items with response, turn, thread, session, and root-turn attribution.
- Restore accumulated usage on resume and snapshot the latest record plus the compaction response ID in compaction checkpoints.
- Preserve root-turn lineage in persisted turn context, while ensuring forked child threads start with their own usage totals.
## Testing
- Cover usage accumulation across multiple responses and resumed turns.
- Cover local and remote compaction checkpoints, invalid remote compaction output, rollout reconstruction, and fork isolation.
GitOrigin-RevId: ef9e0c4a9102a08a2c382be4cdac68c84353c90a
## What changed
- Add context-aware normalization, materialization, and intersection helpers for additional filesystem permissions.
- Resolve project roots, home-relative deny globs, temporary directories, and filesystem roots from the executor's `FileSystemSandboxPolicyContext` while preserving URI path conventions and symlinked paths.
- Keep deny constraints when intersecting grants across POSIX, Windows, and UNC paths, and reject incompatible path conventions when executor context is available.
## Testing
- Cover cross-convention validation, empty temporary-directory contexts, home-relative deny globs, and rooted deny globs for POSIX, Windows, and UNC paths.
GitOrigin-RevId: 14fd866a17a0ac4a595aa4f0e2fb82bfae1a8838
## Why
Paginated threads can accumulate wake turns with no user-message boundary. The
reverse context scan could not use those turns as a bounded replay cutoff, even
when a compaction and its resume state provided everything needed to reconstruct
the latest model context.
## What changed
Treat a full world-state snapshot that survives the latest compaction as a
durable baseline when it is paired with a compatible turn context. This lets the
scan stop at empty wake turns while still scanning further back for patches,
snapshots before compaction, or missing and mismatched turn contexts.
## Testing
Add coverage for repeated empty wake turns and verify that bounded replay
matches full rollout reconstruction across successive compaction windows.
GitOrigin-RevId: ae90c5f939c660ea539fbfc11128cc7259efaa9c
## What changed
- Build Guardian review transcripts with `codex-guardian-context` while preserving Guardian-specific filtering and transcript budgets.
- Apply per-entry truncation during collection, including the larger limit for Node REPL output.
- Retain standalone function and custom tool outputs even when their matching calls are unavailable.
## Testing
- Update Guardian transcript tests to cover shared entry types, Node REPL truncation limits, standalone tool outputs, and recent-tool retention.
GitOrigin-RevId: ec73e80c09fe63c3cf100684cb15574d5d6c2c95
## What changed
- Initialize Guardian reviewer subthreads with empty extension data.
- Remove the special registration that exposed inherited read-only `history`
tools in the Guardian tool plan.
GitOrigin-RevId: 7700f033faab125d59d11bc2d82955c67689e3c3
## Why
User messages with images larger than the Guardian history budget were skipped
entirely, removing any accompanying instructions from retained review context.
## What changed
- Retain the text and message metadata from oversized user messages while omitting
their images.
- Keep the existing behavior for other oversized history items.
## Testing
- Cover text and metadata retention, content ordering, and the integration path
with an image larger than the 4 MiB history budget.
GitOrigin-RevId: 91d99609a8d096b87d0f2b1d149f577a00dce699
## What changed
Match recorded user-input tool calls against both the current conversation and
retained review history when collecting Guardian review evidence. This keeps
answers available when their original tool call exists in either history.
GitOrigin-RevId: e511e2d252d31fa8658c34db19f0151699e9a34a
## What changed
- Make `Session::spawn` return a `BoxFuture` while preserving lazy session
initialization.
- Prevent the startup wrapper from being inlined so callers do not expose its
concrete future.
- Await the returned future directly at session creation call sites.
GitOrigin-RevId: 5432745aae1c934b16202716a8d49a8553de2018
## Why
Compaction removes the original `request_user_input` tool call from model-visible history, causing its trusted user answer to be omitted from subsequent Guardian reviews.
## What changed
Match recorded user answers against retained review history so they remain available through compaction and review-history eviction. Explicit rollback still removes the associated answer.
## Testing
Extend the Guardian history integration test to verify trusted user answers survive compaction and eviction but not rollback.
GitOrigin-RevId: 00681ee8df51cf36421b6fdc5446565dff3776fe
## Why
Context compaction can replace original conversation items that Guardian still needs to review approval-sensitive actions.
## What changed
- Retain a bounded, chronological review history independently of the model's compacted history.
- Keep separate limits for user messages and other transcript items so tool traffic cannot evict user instructions.
- Use the retained evidence for synchronous and asynchronous Guardian transcripts, while resetting it after rollback or history reconstruction.
## Testing
- Cover retention through compaction and eviction, reset behavior after rollback, independent size limits, and asynchronous transcript construction.
GitOrigin-RevId: c5851e992820504fc18de8cfec7f6f9f1b69f316
## What changed
- Define the shared 16 MiB thread stack budget in `codex-async-utils`.
- Use it for both the async main/runtime threads and the dedicated approval-review thread.
GitOrigin-RevId: c825669e1545bcfaeaaaa07066dc63874f46630f
## What changed
- Add model metadata flags for enabling token budgeting and its history-notes extension.
- Apply those activation defaults once at thread startup when the user has not explicitly configured token budgeting, while respecting managed feature requirements.
- Continue resolving model-owned prompts for the active model so model switches can use their own token-budget guidance.
## Testing
- Update the token-budget integration test to verify that model metadata activates the feature without manual configuration.
GitOrigin-RevId: 73a32623eaeabb9243e240c43da7a5e7e93e9a19
## What changed
- Default `tools.update_plan.enabled` to `false`; users can explicitly enable it to expose `update_plan`.
- Remove bundled `update_plan` guidance from model, collaboration-mode, multi-agent, compaction, prewarm, and goal-continuation prompts when the tool is disabled.
- Preserve custom base instructions, model catalog instructions, collaboration policies, and user goal text even when they mention planning or `update_plan`.
## Testing
- Cover default and explicitly enabled tool registration, prompt consistency across request paths, and preservation of custom instructions.
GitOrigin-RevId: a53964e6e72f98e2557dd3090fdb7caccb956527
## What changed
- Set `history_ingest_requested` to `true` in Responses turn metadata when the
history-notes token-budget extension is enabled.
- Reserve the metadata key so caller-provided metadata cannot override the
core-owned value, and omit it when the extension is disabled.
GitOrigin-RevId: e750bcb729292c407e1d443857cdb584a88aac97
## What changed
- Allow MCP server names to contain `:`, `@`, `/`, and `.`, enabling names such as `npm:@modelcontextprotocol/server-sequential.thinking`.
- Preserve these names across `mcp add`, `get`, `list`, and `remove`, runtime tool namespaces, and OAuth credential lookup.
- Quote non-bare server names in generated `config.toml` recovery hints and keep similarly escaped OAuth credential names isolated.
## Testing
- Add CLI and runtime round-trip coverage for npm-style names.
- Add snapshot coverage for quoted recovery hints and a regression test for OAuth credential-name collisions.
GitOrigin-RevId: 97e9353cdbc544db4eb2377ddbfa1d2d539b1e04
## Why
Environment-backed stdio MCP servers have no host-local working-directory
fallback, so their test fixtures must provide a workspace explicitly.
## What changed
- Set the fixture workspace as `cwd` for environment-backed MCP servers across
the core integration tests.
- Reuse the same test environment when configuring MCP servers and building
fixtures that need an explicit working directory.
GitOrigin-RevId: e38f2029e01fc1377cdc34d01a392ad310419766
## Why
Compaction and host-injected context can rewrite the model-visible conversation
without changing what the user authorized. Treating those updates as authorization
changes prevents Guardian from reusing an otherwise valid review.
## What changed
- Track a host-owned user-message revision separately from the conversation history
generation.
- Advance the revision for genuine user messages and history resets, while preserving
it across compaction and internal context injection.
- Use message content-kind metadata to distinguish host context from user input,
conservatively treating unknown or incomplete metadata as user authorization.
## Testing
Added coverage that cached Guardian authorization survives compaction and internal
context, but is invalidated by user input and rollback.
GitOrigin-RevId: c7960fa182d1686042c23764d2abc58acbc4b882
## What changed
- Cover the default, explicitly enabled, and explicitly disabled states of
`tools.update_plan.enabled`.
- Verify prompt tool lists remain consistent across requests, including when
custom base and developer instructions are configured.
- Explicitly enable `update_plan` in existing fixtures that depend on the tool.
GitOrigin-RevId: 3be279cb5195dfc5892c2c8ff6a1461fac879309
## What changed
- Add draft-local forward and backward literal search with `/` and `?`, plus
wrapped repeat navigation with `n` and `N`.
- Support search motions after delete, change, and yank operators, while keeping
queries separate from the draft and skipping atomic elements and partial
grapheme matches.
- Render and edit the query in the composer footer, highlight matches, and add
configurable `tui.keymap.vim_search` bindings to the keymap picker and schema.
## Testing
- Cover navigation, wrapping, operator composition, repeat behavior, Unicode
graphemes, atomic elements, query editing, paste handling, and rendering.
GitOrigin-RevId: 087b080ff8fd74e48456c6b899c07ea5eed38e0c
## Why
Resuming a thread without an explicit `cwd` should restore that thread's latest
retained setting. Forked history can contain settings copied from another
thread, while compaction can move the latest setting outside the replay window.
## What changed
- Record the owning thread ID on new settings snapshots and only use snapshots
owned by the resumed thread when restoring `cwd`. Older snapshots without an
owner remain readable but do not override the startup `cwd`.
- Checkpoint the current settings after compaction and serialize checkpoints
with settings updates so the retained history contains an accepted, current
snapshot.
- Cover resume behavior across compaction, forks, reverts, legacy histories,
and concurrent settings updates.
GitOrigin-RevId: 1efc9cf55472d6b88c465c4efe44672a232dbf64
## Why
Automatic goal continuations should remain attributable to the turn that created the goal. External input, hook context, or goal edits can make that attribution ambiguous and must not leave stale lineage metadata behind.
## What changed
- Carry the trusted root and previous parent turn through successive automatic goal continuations.
- Invalidate stored lineage when external context reaches an active turn or when a goal is edited or cleared.
- Preserve lineage for async hook results only when they belong to the receiving turn.
## Testing
- Cover goal continuations across intervening user turns and external objective edits.
- Cover active, buffered, and externally injected hook or response context.
GitOrigin-RevId: 22ccc07961cd0ed8f4b17912b7efa416b342bf50
## Why
The `core` and `tui` Bazel targets treated nearly their entire crate trees as
compile-time data, mixing embedded runtime resources with source files and test
fixtures.
## What changed
- Move embedded resources for `core` and `tui` into dedicated `assets/`
directories and update their `include_str!` paths.
- Restrict Bazel compile data to explicit asset and frame directories.
- Move test-only prompts into `tests/fixtures`, resolve the core prompt through
`find_resource!`, and reuse the integration-test file glob when assembling
Bazel test data.
GitOrigin-RevId: eee9b0e41df77ea2604215a7f7333a6fe8317bfa
## What changed
- Defer legacy sandbox policy projection until a working-directory change may require rebinding project-root writes.
- Keep client name and version updates from resolving filesystem paths or altering the existing permission snapshot.
## Testing
- Add regression coverage for updating client metadata with a managed, restricted filesystem policy that includes both a writable path and a nested denied path.
GitOrigin-RevId: d84dbcd09b9d1961a11b2889d79479e30eb54149
## What changed
- Add model message metadata for built-in tool descriptions.
- Use the active step model's catalog description for `send_user_message_async`, including after a mid-turn model change.
- Fall back to the built-in description when catalog metadata is absent, while preserving an explicitly empty description.
## Testing
- Cover catalog serialization, fallback and empty-value behavior, and model changes within a turn.
GitOrigin-RevId: 72b953214ab9708931065321debf12133f8d2d40
## What changed
- Add an optional `proactive` multi-agent mode message to model metadata.
- Use the catalog's proactive message for `Ultra` reasoning when no general mode hint is configured. A missing value falls back to the built-in proactive instructions, while an empty value suppresses the mode message.
- Keep explicit mode behavior for other reasoning efforts and refresh the applicable catalog message when the model changes.
## Testing
- Cover proactive overrides, built-in fallback, empty-value suppression, mode-hint precedence, non-`Ultra` behavior, and model switches.
GitOrigin-RevId: da0a9ebd9b58cf04ef13a703c210e5da2eed0884
## What changed
- Admit the curated remote Browser plugin's `Stop` and `SubagentStop` hooks when its listed `browser.turn_ended` tool matches the expected connector and is enabled by app policy.
- Carry trusted app routing metadata and the MCP environment through hook registration and execution.
- Register hooks from multiple executor environments, while deduplicating cleanup calls that share an event, MCP environment, server, and tool.
## Testing
- Cover Browser and Computer Use cleanup through separate MCP routes, including user- and managed-policy disablement.
- Verify routing metadata, environment selection, multi-environment registration, and target deduplication.
GitOrigin-RevId: 66de088fd201b9ed0db8b97c23d33de88135120d
## Why
Code mode wall time should measure the host operation itself, without including
client-side response delays or idle time between requests.
## What changed
- Measure each execute, wait, and terminate request in the code mode host.
- Carry the duration through the stdio and gRPC protocols and use it for
model-visible wall time.
- Emit a structured `codex.code_mode.host_timing` event correlated with the
conversation, turn, tool call, and cell.
## Testing
- Cover successful and failed execution timing, delayed response reads,
repeated waits, termination, and missing cells across stdio and gRPC.
- Verify timing survives protocol serialization and is reflected in app-server
model output and structured telemetry.
GitOrigin-RevId: d24af30c3fc5820521b4beba1f9970714dad6482
## What changed
- Advertise `openai/elicitation` form support when the client declares an
object-valued `form` capability, without deriving it from the legacy
`openai/form` capability.
- Handle `openai/elicitation/create` requests in `form` mode and forward their
metadata and opaque schema through app-server as `openaiForm`, preserving
`x-openai-*` annotations.
- Keep legacy form handling independent and have the TUI automatically decline
the new form requests it cannot render.
## Testing
- Add an app-server round-trip test for capability negotiation, request
forwarding, and accepted responses.
- Extend MCP capability filtering coverage for `openai/elicitation.form`.
GitOrigin-RevId: 88f39257bffafe4ee98a9c910e38507843cd7eeb
## Why
Executor-scoped cleanup hooks need to observe an interrupted turn as well as a
normally completed one.
## What changed
- Allow bundled executor plugins to register the allowlisted `Interrupt` hook
alongside `Stop`, while preserving multiple allowed hook entries from the
selected executor environment.
- Run interrupt hooks with the interrupted turn's last step discovery and turn
metadata. Turns without a step context do not reuse discovery from an earlier
turn.
- Keep executor-scoped interrupt hooks asynchronous and omit public hook
lifecycle events for them, matching executor `Stop` hook behavior.
## Testing
Added coverage for hook filtering and registration, interrupt execution and
metadata propagation, environment selection, and turns without a step context.
GitOrigin-RevId: f0c536b3382a37cf3bf693c4573d21f6f66ace4e
## What changed
- Store the most recently captured execution `StepContext` in the active turn state.
- Keep speculative model-fallback captures from replacing that context, and update it only when the fallback is selected for remote compaction.
- Preserve the retained context when a turn completes or is interrupted.
## Testing
- Add coverage for completed and interrupted turns, successful primary compaction, fallback compaction, and interruption while a fallback is running.
GitOrigin-RevId: c7dee36ec8e88ba2f4fb4a9c0322e5c86a0caf0e
## What changed
- Treat a surviving full world-state snapshot as a context baseline when a fork removes the associated user message.
- Restore the previous turn settings and reference context from that baseline, without treating the segment as a user turn for rollback.
- Ignore partial snapshots and full snapshots superseded by compaction.
## Testing
- Cover resumed rollout reconstruction with removed task messages, partial snapshots, and compaction.
- Verify nested agents inherit developer instructions and environment context exactly once across history modes and compacted histories.
GitOrigin-RevId: 9f9f6992d7ea8cff9ac82a7fcdf0c8fb764db81c
## What changed
- Add a positive `output_token_limit` setting to each entry under an MCP server's `tools` configuration.
- Apply the most restrictive limit when plugin and user policies overlap, while keeping approval policy independent.
- Carry the effective MCP output budget in conversation history so tool output, post-tool hook responses, and resumed sessions use the same truncation limit.
## Testing
- Cover configuration parsing, serialization, schema validation, and plugin policy merging.
- Cover MCP output below and above the configured limit, post-tool hook responses, and session resume.
GitOrigin-RevId: d0beb4fca9ba6055d9e1d31c137373b465d50d61
## What changed
- Add the disabled-by-default `omit_app_server_notification_media` feature.
- When enabled, remove inline image and audio content from `item/started`,
`item/completed`, and `rawResponseItem/completed` notifications, including
tool output and image-generation results.
- Keep the media in model input; the filter only changes app-server
notifications.
## Testing
- Verify that image content is absent from all three notification types while
the model request still receives it.
GitOrigin-RevId: 9a4434d18a3dac6d67c2e0c3723ff4595a9b3797
## What changed
- Re-run the HTTP headers helper after a same-origin `POST` receives a `401` or `403`, and retry the request once when the effective headers changed.
- Share refreshes across concurrent rejected requests, retain the previous headers when refresh fails, and keep the retry within the original timeout.
- Allow helpers to supply `Authorization` while preserving explicit OAuth or bearer credentials, OAuth insufficient-scope challenges, and redirect safety checks.
## Testing
- Cover rotating helper headers for MCP tool calls and same-origin OAuth token refreshes.
- Cover concurrent rejections, failed and unchanged refreshes, retry limits, timeouts, and redirects.
GitOrigin-RevId: c662edefdb1cd2876d9d02545a72d5bd6739864f
## Why
Managed configuration can disable resumable unified execution while leaving shell tools enabled. This should not remove command execution entirely or grant access to retained processes.
## What changed
- Keep `exec_command` available in completion-only mode when `unified_exec` is disabled.
- Remove `tty`, `yield_time_ms`, `session_id`, and `write_stdin` from that mode, and add a `timeout_ms` argument.
- Terminate one-shot commands on timeout or turn cancellation, reporting timed-out commands with exit code 124.
## Testing
Added integration coverage for tool availability, timeout cleanup, and interruption cleanup under managed configuration.
GitOrigin-RevId: a382d34f922fdc4ba52889272c6db985abd42e47
## What changed
- Generate a UUIDv7 turn ID for each Guardian classification and preserve it across retries.
- Record the owning turn as `parent_turn_id` and propagate its trusted `root_turn_id` when known, including through the tool lifecycle extension API.
- Omit ambiguous or unknown root lineage and keep classification identities distinct when reusing Guardian sessions and WebSocket connections.
## Testing
- Cover classification metadata across retries, connection reuse, concurrent samples, auth refresh, and consecutive owning turns.
GitOrigin-RevId: 78757f2ad031844e4b545802f634c678a9ee2298
Adam Perry @ OpenAI