## Why
`TurnComplete` arrives before the active turn is cleared, so submitting a
rollback immediately can race with turn cleanup.
## What changed
Wait for the thread-idle callback with a 10-second timeout before rolling back
in the first-turn model-change and generated-image tests. Fail immediately on
an error event while waiting for `ThreadRolledBack`.
GitOrigin-RevId: c17b35d709b2c74361dd7933506ae192464ea4e8
## Why
Shell snapshot failures were grouped under `capture_failed`, making failure causes and retry attempts indistinguishable in metrics.
## What changed
- Add `purpose` (`execution` or `prewarm`), `attempt`, `shell`, and `sandbox` labels to capture counters and durations.
- Report bounded failure reasons such as `spawn_failed`, `timeout`, and `nonzero_exit` while preserving the original RPC errors.
- Include `failure_reason` on duration metrics as well as counters.
## Testing
Update the bounded retry and single-flight test to assert per-attempt metric labels for execution and prewarm captures, including failure reasons on both counters and durations.
GitOrigin-RevId: 907dc98736c5b8f91006909dacc43278efb43abf
## What changed
- Use `decide_approval` for MCP elicitations, carrying the effective approval policy, reviewer, and synchronous-review requirement into the decision.
- Preserve unsupported form and URL elicitations for user review.
- Use `computer_use_review_required()` for review evidence, session policy, and turn metadata so model policy takes precedence over the legacy flag.
- Derive strict-review notifications from each assessment's review reason.
## Testing
Add coverage for model policy precedence, user and full-access modes, sensitive elicitations, independent code-mode and nested-tool policies, cached score reuse, and user review of unsupported elicitations.
GitOrigin-RevId: d0a9c40572dca7b3dbf876230d2162b72728084d
## Why
Artifact checksums alone do not authenticate the downloaded checksum manifest. V8 downloads need a trusted digest recorded in the repository, and published releases should not have their assets overwritten.
## What changed
- Pin the V8 `150.4.0` release manifest digests and verify manifests before downloading archives or bindings in packaging and `setup-rusty-v8`, preserving CRLF support.
- Refuse to replace published V8 releases, remove unfinished drafts on retry, and use `gh release create` to upload assets before publication.
- Install Windows `sccache` through a pinned `taiki-e/install-action` in the release and canary workflows.
- Document independent manifest verification and digest recording for version updates.
## Testing
Add five packaging tests covering successful downloads, CRLF manifests, tampered manifests, missing pins, and missing pin files. Rejection tests verify that artifacts are not downloaded.
GitOrigin-RevId: 5c771cdcff376388e124faa4826bf81135d84b50
## Why
Concurrent parent compaction can remove evidence between Guardian checkpoint selection and prompt construction. New user instructions or answers received during a review can also invalidate an approval based on earlier authorization.
## What changed
- With `GuardianThreadContext` enabled, use the same parent history snapshot for checkpoint selection and prompt evidence.
- Cancel completed allow decisions if the owning session's user-message revision or root authorization version changed during the review, even without cacheable review evidence.
## Testing
Add regression coverage for evidence preservation during concurrent compaction and aborted approvals after new user instructions or verified answers. Extend reviewer context rollover coverage to exercise `GuardianThreadContext`.
GitOrigin-RevId: 1c2c82197a27c0d3d45b6fe08d200a835d80cc30
## What changed
- Let approval extensions choose between cached approval, synchronous review, and a user prompt for tool and permission requests, while core enforces mandatory Guardian and fresh-review requirements.
- Carry an optional `review_reason` on Guardian assessment events and use it to trigger strict-review notifications, retaining the fallback for older events.
- Require synchronous review when cached evidence has an unusable encrypted parent compaction.
## Testing
Add regression coverage for manual prompts and cached approvals with non-UTF-8 working directories. Update approval contributors in existing tests to use the decision API.
GitOrigin-RevId: a4e66416070bdaa881daa41429c49021629f44c1
## What changed
Advertise the experimental `codex/auth-change` capability for stdio MCP connections with an auth manager. When the server opts in, send `notifications/codex/authChanged` after initialization and on subsequent auth changes, with credential and owner generation counters and no credentials.
Track owner changes separately from credential refreshes so consumers can detect login, logout, or user, workspace, and auth-mode changes even when notifications coalesce. Treat credential changes with incomplete owner identity as owner changes as well.
Tie the notification watcher to the managed client's lifetime, limit each send to five seconds, and close the connection if a subsequent notification fails.
## Testing
Add tests for credential refreshes versus owner changes, coalesced logout and account switches, capability opt-in, notification payloads, and watcher cleanup.
GitOrigin-RevId: 35a99f5252bd48ca60a71fbdd1f708a8158e812c
Route `gpt-5.6-luna` POST requests through `luna_response` using the shared
classifier state in the guardian compaction and rollback test. This gives
HTTP classifier requests the configured mock score instead of treating them
as guardian review or parent requests.
GitOrigin-RevId: 3841705c7ed1ec564662c33f71e1c78e9b960c68
## What changed
Delete `codex-rs/app-server/README.md` and remove references to it from `AGENTS.md`, while retaining the requirement to update app-server docs and examples when API behavior changes.
GitOrigin-RevId: 664f38c4939a9784b1241225e5101b97ec4ae9e6
Set `SessionTarget::cwd` to `None` in the remote resume permission-override
and CLI fork startup tests to match the struct's required fields.
GitOrigin-RevId: d1e7a2e6b7ae3dda17ef062984917861c12fdeff
## Why
When no healthy pooled WebSocket is available, classification waits for a new connection to open and can stall on its handshake.
## What changed
- Use HTTP streaming when no healthy idle WebSocket is ready, and replenish the pool in the background with a five-minute cooldown after connection timeouts.
- Share concurrency limits and the sampling retry budget across both transports, and bound the wait for HTTP response headers.
- Cancel superseded requests while awaiting response headers and stop SSE polling when the consumer closes.
## Testing
Add coverage for HTTP fallback and recovery after cooldown, shared transport capacity, stalled response headers, and cancellation before headers or during body draining. Update sampler and extension tests to cover fallback after socket expiry, authentication changes, and transient failures.
GitOrigin-RevId: 0b23ccc1bfb2dfdbc8d2791d097706cd4dd44f39
## Why
Session transitions need stack headroom for embedded-server initialization and configuration loading. Running them inside event dispatch risks exhausting the TUI thread's stack.
## What changed
- Queue `/resume` and valid `/cd` requests for processing after event dispatch returns.
- Reject additional `/cd` requests while one is pending, and recheck the source session, working directory, idle state, and remote-environment restrictions before applying it.
## Testing
Add a Unix PTY regression test that exercises `/resume`, worktree conversation forks, `/cd`, and new worktree conversations through the real TUI event loop. Update the directory-change test to verify that dispatch queues the request without immediately changing configuration.
GitOrigin-RevId: 4950921931dfaba9e55e6bb04f98f7ba64b72122
## What changed
- Carry the working directory from `thread/list` and `thread/read` in session selections, and use app-server metadata to resolve resume and fork directories.
- Use the model reported by thread reads and thread-started notifications when restoring session state.
- Remove TUI helpers that read session IDs, working directories, and models directly from rollout files or the state database. Picker selection now requires a thread ID in the selected row.
## Testing
Extend picker coverage to verify that selections preserve the working directory, and add a snapshot asserting that switching to a read thread displays the server-reported model.
GitOrigin-RevId: c9d13e1e56ea2139d3e96344d72ca9ee2de73396
## Why
The TUI's local provider configuration can differ from the active thread's provider, causing `/status` to show misleading provider details.
## What changed
- Use the server-provided model provider ID in `/status` and update it when attaching to a thread.
- Omit the provider row until a thread is configured, and display IDs such as `openai` instead of provider names and base URLs.
- Remove runtime provider URL resolution from TUI startup and the associated widget state.
## Testing
Add regression coverage for provider display before session configuration, thread switching, and server settings updates. Update status snapshots to show server provider IDs while preserving usage-link behavior based on the server's authentication requirement.
GitOrigin-RevId: 87214b4fd971f63835e382557969e4fc3b602745
## Why
Client defaults can override the fork destination's model and reasoning effort or trigger a migration prompt for a stale model.
## What changed
- Omit implicit model and reasoning effort overrides during CLI fork startup, while preserving explicit launch settings.
- Skip the model migration prompt and service tier inference when the fork's model is left for the server to resolve.
- Initialize unspecified reasoning effort from the forked session's response.
## Testing
Add a startup regression test that changes server defaults after bootstrap and verifies that `thread/fork` proceeds without a migration prompt, model or reasoning effort overrides, an inferred service tier, or a `config/read` request.
GitOrigin-RevId: 858f0fe3c72b90bdcaf31b400144d37af5bc6ed7
## Why
Device-authenticated verification needs an app response outside automated approval and review. Previously, MCP user-verification requests were always cancelled.
## What changed
- Add typed `openai/userVerification` elicitations carrying a title, description, and challenge through core and app-server.
- Route verification to one connection enabled by trusted host activation. Restrict responses to that owner, exclude requests from replay, and cancel on disconnect or authentication changes, including account switches away and back.
- Return proofs in `content`, discard response metadata, and cancel malformed acceptances. Suppress verification response logging and analytics, and send only a generic verification notice to realtime.
- Keep the mode experimental and exclude it from stable schema exports. Capability advertisement remains disabled, and the TUI cancels verification requests.
## Testing
Add coverage for owner isolation, disconnect and authentication races, proof response handling, automated-review bypass, inactive-host cancellation, stable schema filtering, and realtime payload exclusion. Update the MCP integration test to verify that an activated request holds the tool until the client responds.
GitOrigin-RevId: c8c7b6691a3f7756682bbcca9def1df0d1feb906
## Why
The permissions picker displayed profiles from the connected app server but disabled selection of remote custom profiles.
## What changed
- Enable named profile selection through `thread/settings/update` and track pending selections until server confirmation.
- Use pending or confirmed server permissions for subsequent turns, preserve profiles across forks and prompt edits, and reconcile pending selections on reconnect.
- Block conflicting permission changes and forks while selection is pending. Preserve input when selection fails and report unsupported app servers.
- Reject working directory changes while a remote named profile is active.
## Testing
Add regression coverage for profile selection, turn permissions, pending-selection guards, prompt-edit profile preservation, reconnect reconciliation, and profile inheritance in forks and side conversations.
GitOrigin-RevId: 76e9bb7b4d631b1066974da013d9915a89dc54a7
## Why
Local permission settings could overwrite a remote task's saved server settings when resuming or forking, including its named permission profile.
## What changed
- Omit permission overrides from remote resume requests and remote fork requests that inherit saved settings.
- Reject explicit permission overrides when resuming or forking remote tasks, including overrides from session flags and selected configuration profiles.
- Refresh restored runtime permission and approval overrides after a remote resume so settings from the previous task do not persist.
- Carry the selected fork permission mode through retries after unarchiving.
## Testing
Add regression coverage for restoring saved server permission profiles, approval policies, and approval reviewers across resume and fork; rejecting explicit remote resume overrides; and clearing stale restored runtime overrides.
GitOrigin-RevId: 465c0444df380553e50ddbeeceff9dc64e5bf9c1
## Why
JSON schema exports should be identical across Cargo and Bazel builds.
## What changed
Recursively sort object keys before writing app-server protocol JSON schemas,
while preserving array order.
GitOrigin-RevId: 740c846062f7bae18790e9cf4f30734289ae3056
## Why
Selecting the first matching session name can target the wrong conversation when labels are duplicated. Session commands also need to accept preview text when no explicit name is set.
## What changed
- Share app-server label lookup across resume, fork, archive, unarchive, delete, and queue commands, matching the trimmed name or fallback preview.
- Reject distinct matching sessions across collections and source filters, and require a UUID when pagination prevents verifying uniqueness.
- Revalidate listed candidates with `thread/read`, skip unusable local rollouts, and retain compatibility with older servers that cannot read unloaded threads.
- Show ambiguous resume errors in the TUI without replacing the current conversation.
- Disable implicit local daemon reuse with `--oss`.
## Testing
Add regression coverage for name and preview lookup, provider filtering, duplicate labels across pages and collections, stale rollouts, older-server compatibility, queue ambiguity, and preserving the current conversation after an ambiguous resume.
GitOrigin-RevId: e2766276a16140fb674c9640f7050c11ac0d0f6f
## What changed
Route managed Windows app-server shutdown through `/daemon/shutdown` on the local control socket. Require the server's PID and acknowledge it before triggering shutdown through the existing drain logic. Enable the endpoint only for managed Windows launches via `CODEX_DAEMON_SHUTDOWN_SOCKET`.
Watch running-turn changes whenever shutdown is requested so socket-triggered shutdown can finish draining. Keep the updater's file-based shutdown mechanism and retain forced termination as the manager's timeout fallback.
## Testing
Add a transport test covering rejection of unmanaged shutdown requests and mismatched PIDs, plus acknowledgment before emitting the shutdown event.
GitOrigin-RevId: 3e95dc1914f61e8a131f9b6fd56b6c63688d1744
## Why
Stamped Rust binaries consume workspace status files containing build user,
host, and timestamp values. These unrelated values prevent remote cache reuse
when building the same commit across developers and CI workers.
## What changed
Generate a compiler environment file containing only `STABLE_GIT_COMMIT` through
a small stamped template action. Use it for `codex`, `codex-tui`, and
`codex-voice-host`, with Rust binary stamping disabled so their build metadata
input changes only when the embedded commit changes.
Rename the crate macro option from `stamped_binaries` to
`binaries_with_build_commit` and add `bazel_lib` for template expansion.
GitOrigin-RevId: 21d0f2e3df97670a4c2cdbc3d1972cd14cc5b439
## Why
Managed worktree transitions run through the event handler into the large synchronous `ChatWidget` constructor. Split this work so each stage runs on a fresh event-loop stack.
## What changed
- Queue worktree setup, checkout completion and configuration loading, session transition, and widget attachment as separate stages with boxed futures.
- Recheck the source session before transitioning and report retained checkout cleanup instructions when the transition cannot proceed.
- Keep the old configuration paired with the old widget until attachment, and protect input during the handoff.
## Testing
Update worktree lifecycle and submission tests to drain the deferred stages explicitly and assert that checkout creation starts before completion.
GitOrigin-RevId: 0435f56d08bf3a6392d35b5c1cfdcc0f1fe02753
## What changed
- Handle `openai/userVerification` requests through `openai/elicitation/create` when the client advertises `userVerification` support.
- Validate request fields, size limits, and base64url encoding. Require a correctly shaped, bounded proof for acceptance; cancel invalid acceptance responses and discard proof material on decline or cancellation.
- Handle request and service cancellation, including cancellation received before request dispatch. Bound early-cancellation storage and cancel new verifications when capacity is exceeded.
- Keep verification inactive in Codex: cancel requests without prompting until the typed app-server and UI path is available.
## Testing
Add tests for request and proof validation, malformed modes, cancellation races and capacity limits, timeout-pause cleanup, and independent concurrent requests. Add integration coverage showing that verification does not prompt or prevent tool and turn completion before activation.
GitOrigin-RevId: 6313c1be40fae0b33cc3ce0f8fe025b4124ed2ef
## What changed
Add a searchable “Browse worktrees” option to `/worktree` for local repositories with worktrees enabled. List checkouts from the repository's configured pool, show owner metadata, and let users resume an owner thread or copy a worktree's working directory.
Load worktrees asynchronously and discard results after the loading popup is dismissed or the request context changes. Ignore actions from stale requests and offer copying when owner metadata is missing or invalid.
## Testing
Add popup snapshots and tests for search, resume and copy actions, stale results, and disabled local worktree operations. Extend lifecycle coverage to verify discovery from repository subdirectories and handling of missing or invalid owner metadata.
GitOrigin-RevId: 2b7e694a133278da640b6bb275fd5c1202b271c7
## Why
Binaries that do not consume build identity should not have their cached compilations invalidated by Git revisions or build timestamps.
## What changed
Add `stamped_binaries` to `codex_rust_crate`, defaulting to an empty list. Only listed binaries enable stamping and receive `STABLE_GIT_COMMIT`. Opt in `codex`, `codex-tui`, and `codex-voice-host`.
GitOrigin-RevId: 9bcac29f98f20129c988f696ce5b98057be7a158
## What changed
- Stage npm tarballs in a job with `contents: read` permissions and upload them as the `npm-packages` artifact.
- Require staging to succeed before the `release` job runs, and download the staged tarballs there. Remove its dependency installation, packaging steps, and `actions: read` permission.
- Reuse native artifacts from `--artifacts-dir` when every target directory is nonempty, skipping workflow lookup and download. Retain workflow-based downloads as a fallback.
GitOrigin-RevId: 89c6a5039afbac12968fb6f35a39c8db723c4c62
## Why
Directory-scoped session lookup misses conversations in linked worktrees of the same repository. Managed worktree creation also runs synchronous Git work on the TUI event loop.
## What changed
- With `worktrees` enabled for local sessions, include corresponding directories across linked checkouts in resume and fork pickers and `--last` lookup. Group them together in the agents overview and show checkout paths for picker entries from another worktree.
- Validate shared Git metadata and backlinks, preserve relative working directories and logical path aliases, and reject directory symlink escapes. Keep the expanded directory filter stable across pagination until the listing restarts.
- Fall back to the originally requested directory when an older daemon rejects an array-valued `cwd` filter.
- Create managed worktrees on a blocking worker, check transition blockers before allocation, and revalidate the source session before switching. Report retained checkout paths and cleanup instructions if the transition cannot complete.
- Start the in-session picker server in a separate task to avoid exhausting the TUI event future's stack.
## Testing
Add coverage for linked-checkout discovery, feature gating, picker selection and rendering, project grouping, pagination stability, and legacy daemon fallback. Extend worktree lifecycle tests to cover running-agent blockers and recovery after the source session changes during creation.
GitOrigin-RevId: 4a8a36c0dba3d32d72600f2edf8258a29fb4cb07
## What changed
Add `userVerification/status`, `userVerification/enroll`, `userVerification/delete`, and `userVerification/verify` behind the `experimentalApi` capability. Define request, response, proof, and typed error contracts, export their schemas, and document the API.
All four methods currently return `unavailable` with reason `providerUnavailable`; native verification operations are not implemented by this change.
## Testing
Add tests for experimental opt-in, typed provider unavailability, readiness serialization, and rejection of mismatched error reasons and native diagnostic payloads.
GitOrigin-RevId: a858ab41523c5acec7dbf3cfa7fcab693ac44a8c
## Why
Background tasks launched from the agents overview could use client model settings instead of the server defaults for the destination directory.
## What changed
- Read `config/read` for the task's destination before starting the thread, preserving explicit launch settings and applying managed new-thread defaults.
- Use the server's model provider for embedded sessions when no model or provider override is set. When the server clears the model and fast mode is enabled, resolve the fallback model from the server catalog.
- Restore the prompt and show an error if settings cannot be loaded. Keep the existing fallback for older servers that do not support `config/read`.
## Testing
Add request-level tests for local and remote destinations, model and provider selection, explicit and managed defaults, fast-mode fallback, and prompt recovery after a configuration read failure.
GitOrigin-RevId: 50c84fba964463303442dd849e1280bcd5b4f467
## Why
Resuming a conversation that is open in another app fails with an active-writer error. Allow users to inspect its transcript and retry after closing it in the other app.
## What changed
- Fall back to a read-only history snapshot on active-writer conflicts during startup and session selection.
- Replace the composer with an explanatory notice, `R` to retry, exit shortcuts, and the configured transcript shortcut.
- Block input and freeze active command and MCP animations while viewing the snapshot. Preserve initial prompts and existing drafts for a successful retry.
- Keep the subscription when retrying the same thread and preserve read-only state across thread switches and reconnects.
## Testing
Add regression tests for conflict detection, history viewing, draft preservation, same-thread retry without unsubscribing, exit shortcuts, and notice and frozen-tool rendering.
GitOrigin-RevId: fa864cc73143cad9139c22e33b7958569eec20cf
## Why
The voice host drained incoming RTP packets without playing them. Route received audio through decoding and speaker output while preserving speaker suppression boundaries.
## What changed
- Add a GStreamer pipeline with RTP jitter buffering, Opus decoding, conversion, and resampling into the native speaker sink.
- Rebuild playout when the speaker is re-enabled, reject packets received before the new pipeline started, and discard queued audio and echo references on speaker transitions while preserving capture history.
- Limit each receive pass to 64 packets so incoming media cannot indefinitely delay audio controls.
- Prevent retired sink failures from failing a new speaker generation, and retain the last coherent playback delay estimate during callback contention.
## Testing
Add tests for real Opus playback and stale packet rejection, combined microphone mute and speaker suppression, retired sink failures, delay contention, and echo-reference reset without losing capture history.
GitOrigin-RevId: c91c94a2ba2347ac98af4e7fd1dc331ae766cc45
## What changed
- Add a `GstAudioSink` subclass backed by a bounded mono `F32LE` playback writer, with partial writes, cancellation on speaker epoch changes, and delay accounting for queued samples and pending device output.
- Recreate the CPAL output stream and discard buffered audio when speaker controls change the epoch, preventing stale audio from surviving suppression.
- Add GStreamer dependencies, adjust Windows Bazel native-tool selection, and allow the helper handshake time to load startup-linked libraries.
- Separate installed-client tests from protocol lifecycle tests and supply native startup libraries in test packages.
## Testing
Add unit coverage for partial writes, sample accounting, suppression cancellation, stale writers, device delay, invalid samples, and stalled consumption.
GitOrigin-RevId: c48c48d2fee00659cf6f8a4039a6745385cb77cd
## Why
Enabling background rollout migration disabled the TUI's cached legacy resume shortcut, even when the rollout maintenance lock could prevent migration during resume.
## What changed
Allow embedded sessions to use the shortcut regardless of migration feature settings when they acquire the maintenance lock and revalidate that the thread still uses legacy history. Hold the lock through `thread/resume` so the response can safely include turns. Remove the session's cached startup migration setting.
## Testing
Update the regression test to cover all four combinations of startup and workspace migration settings, checking lock acquisition before metadata revalidation, a two-request resume, and nonempty history.
GitOrigin-RevId: cf525a6edb813050469dff39b83e5e61214485a1
## Why
Fresh startup could use saved client model and reasoning settings that differ from the app server's effective configuration. A cleared server model could also leave startup using a stale client model from bootstrap.
## What changed
- Reuse the new-session defaults reader at startup to load `model` and `model_reasoning_effort` through `config/read` before `thread/start`, using the appropriate embedded or remote working directory.
- Preserve explicit CLI and selected-profile settings, then apply managed new-thread defaults with the existing precedence rules.
- When the server has no configured model, select the startup model from its model catalog, falling back to the bootstrap default if the catalog is empty.
- Fall back to local defaults when older servers do not support `config/read`; stop startup before thread creation on other read failures.
## Testing
Add request-level tests for defaults and override precedence, working-directory selection, cleared-model fallback, request ordering, unsupported servers, and read failures.
GitOrigin-RevId: e094ba5d5501fdb34c393a0117b34dd93d8d4f2b
## Why
Experimental context activation previously checked the provider and account eligibility without checking model support. Child sessions also inherited token-budget activation from their parent, even when starting fresh with a different model.
## What changed
- Add `ModelInfo.supports_experimental_context`, defaulting to `false`, and enable it for the bundled `gpt-6-astra` model. Require this capability when activating experimental context.
- Snapshot configured token-budget preferences before startup activation. Restore them for fresh child sessions before applying their starting model's defaults, while history forks retain their parent's activation.
- Pass unresolved token-budget preferences to child sessions so they can use their own model's prompts.
## Testing
Extend coverage for unsupported models, model-switch guidance under explicit and experimental activation, and child configuration from both active and inactive parents. Verify that omitted capability metadata defaults to `false`.
GitOrigin-RevId: 02df9e171682267232fa923d5ea3f7af36527808
## What changed
- Add explicit x64 and ARM64 targets for native builds, runtime preparation, and linking using the existing voice recipes. Each target requires native Windows execution of the matching architecture.
- Declare compiler, SDK, Python, and CMake inputs; require an explicitly supplied Cygwin/pkgconf tool tree and a fixed `SystemRoot`. Validate installed tool selections against the manifest and declared files.
- Pair Windows DLLs with SDK import libraries, preserve plugin and receipt runfiles, and omit Unix runtime-search flags. Use Python for portable payload copying.
- Correct the MSVC ARM64 tool directory casing to `HostArm64` and document provisioning and build commands.
The generic Rust-consumer aliases remain separate; native Windows Bazel execution and consumer validation are still needed to establish complete Windows voice support.
## Testing
Add eight unit tests covering tool selection, path anchoring, invalid inputs, and DLL/import-library copying, plus x64 and ARM64 link smoke targets that reference `gst_version`.
GitOrigin-RevId: fb2b4998e9ffb5b64ca830ebf4bb4633fc959eb9
## Why
The MSVC runtime and Windows SDK repositories discard their tool binaries during setup, leaving native build tools unavailable to Bazel consumers.
## What changed
Patch `windows_support` to retain native MSVC tools and support files, plus the selected SDK's versioned tools, for `x64` and `arm64`. Expose them through opt-in `msvc_tools_x64`, `msvc_tools_arm64`, `winsdk_tools_x64`, and `winsdk_tools_arm64` directory targets.
Exclude the retained tool trees from the existing `sysroot_files`, `headers`, and `libs` targets.
GitOrigin-RevId: df7db08fecfb5e389252332842b8d7361d166891
## Why
Windows libffi builds invoke tools by name, and Cygwin provides a different `link.exe` from MSVC. Inherited search paths can select unintended tools or SDK inputs.
## What changed
Add optional `--windows-build-inputs <json>` to `third_party/voice/build_native.py` to select installed tools and SDK directories for Windows MSVC targets. Validate the target, tool paths, architecture-specific assembler, SDK directories, and agreement with CLI tool arguments.
Build the search path from the selection with MSVC ahead of Cygwin, reject shadowed tools, replace inherited `INCLUDE` and `LIB`, and remove `LIBPATH`. Retain the selection in build receipts. Builds without the option continue using the normal Visual Studio environment.
## Testing
Add tests for linker precedence and subprocess selection, invalid or mismatched inputs, shadowed SDK tools, environment replacement, and receipt recording.
GitOrigin-RevId: c80a6d9eb29556157ba1316d62c9b5083f4038b9
## Why
The helper's native bindings require shared libraries before entering `main`, including for lifecycle calls. Helper-only packages cannot satisfy that requirement.
## What changed
Make `--runtime` mandatory in `third_party/voice/assemble_package.py` and require the `runtime` argument in `assemble()`. Always validate and include the prepared runtime, and update the voice host documentation to describe the requirement.
## Testing
Update assembly tests to supply prepared runtimes and verify that package manifests include runtime library hashes and `runtime.json` alongside the helper.
GitOrigin-RevId: ab5abf80ae935b4ace833fa59b74f670ba62c632
## What changed
- Add `/worktree` to start a fresh conversation or fork the current conversation into a new managed checkout.
- Offer current-checkout and new-worktree choices for `/new` and `/fork`, preserving optional conversation names. Enable these choices for local Git repositories when the `worktrees` feature is enabled.
- Load destination configuration, bind the checkout to the replacement thread, and inherit conversation history only when forking.
- Reject creation from explicitly untrusted sources and require an idle primary session without queued input. Refuse forks when developer instructions differ, with guidance for removing the unused checkout.
## Testing
Add picker snapshots and tests for command availability, named selections, fresh versus forked history, destination configuration, worktree ownership, and feature and trust checks.
GitOrigin-RevId: d6c83e00217660aacf2a6d92acad50b506607e0b
## What changed
- Export `native_sdk` from the same inspected build as `native_runtime`.
- Configure GLib and GStreamer Rust build scripts to use the declared `pkg-config` executable and SDK, preserving upstream version checks while directing linking to prepared libraries.
- Add `native_link` to expose canonical libraries, development aliases, transitive dependencies, plugins, and the runtime manifest through `CcInfo` and runfiles. Replace GStreamer SDK absolute rpaths with relative Bazel runpaths.
## Testing
Extend the macOS archive preparation test to cover absent and empty SDK output directories, verify SDK file hashes, and check that SDK and runtime manifests share the same source commit and target.
GitOrigin-RevId: 3fc33af06225c69e4c293437f1985290f228dc0a
## What changed
Add the manual `//third_party/voice:native_runtime` target for macOS and GNU Linux. It consumes the native prefix archive, validates the completed build receipt against the target and source manifest, inspects libraries, and prepares verified copies using the existing platform policies.
Record the build commit through Bazel workspace status and include it in runtime receipts. Reject invalid or ambiguous commit metadata and escaping library aliases. Keep macOS preparation local and allow the system `libc++.1.dylib` dependency.
## Testing
Add tests for receipt validation, inspection ordering and failures, invalid commit metadata, and escaping archive links. Add a macOS integration test for preparing real libraries from a sandbox-linked archive with native aliases and either an absent or empty output directory.
GitOrigin-RevId: 23717ab33d1d3da5fb0042c1cc8e8efcd333c386
## What changed
Route the TUI's subagent and memory enable prompts through server config writes for new threads, leaving the current thread unchanged. Report success, configuration overrides, or failures after the write completes, and clarify the scope in the prompts.
Write both `features.memories` and the legacy `features.memory_tool` key for compatibility with older app servers.
## Testing
Extend tests to cover writes to the selected server config, preservation of current settings, legacy memory key updates, and managed configuration overrides. Update prompt snapshots and verify that confirmation emits the new save event.
GitOrigin-RevId: ec331db675b38102851899a4aa878d6fe8e9606e
## What changed
Add `//third_party/voice:native_prefix` to run the existing native build recipe with Bazel-declared archives and toolchain inputs on matching macOS and Linux GNU 2.28 targets for x64 and ARM64. The manual target exports `prefix.tar` and a `built.json` receipt through the `receipt` output group.
Keep macOS actions local to access Apple tools, use Apple's linker for libffi partial links, and preserve compiler runtime flags through libtool on Linux. Surface upstream build failure logs in the Bazel action output.
Document the build's host utility requirements and the distinction between the raw prefix and a relocatable SDK or runtime package.
GitOrigin-RevId: b4917943f621dec07bb994392619e8a42e496b8b
## What changed
Add the disabled-by-default `reasoning_effort_override` feature for OpenAI models with `use_responses_lite` enabled. Append a trusted `configuration_update` after accepted input when no effort is established in surviving history or the resolved effort changes. Preserve the existing history prefix and continue sending the request-level reasoning effort.
Share effort normalization through `ModelInfo::resolve_reasoning_effort` so requests and history updates resolve `ultra` consistently and translate `persistent` to `disabled`. Exclude other custom effort values from history updates, and compare only against harness-authored configuration items.
## Testing
Add integration coverage for effort transitions, deduplication, history prefix and cache-key preservation, alias normalization, and feature/provider/model gating. Add unit coverage for model-specific `ultra` resolution, fallbacks, and `persistent` translation.
GitOrigin-RevId: c3fe7050058076454d8ea20054a618bca9d48c7c
## Why
Native voice builds ignore ambient compiler flags, but need a way to accept declared compiler, linker, and archive-tool inputs.
## What changed
- Add repeated `--c-flag`, `--cxx-flag`, and `--link-flag` options plus optional `--ar` and `--ranlib` paths for Unix builds. Record flags and pass them through CMake, Meson, and libffi, including Objective-C flags on macOS.
- Preserve literal libffi compiler arguments with response files. Reject flags containing whitespace, libffi paths requiring shell quoting, and Unix toolchain overrides on Windows.
- Add a pinned Bazel `pkg-config` tool built with LLVM archive tools and native macOS configure checks. Register the pinned Make toolchain and patch its bootstrap to pass preprocessor flags and enable cross-compilation configuration.
## Testing
Extend native-build tests to verify compiler and linker flags, explicit archive tools, Meson and Objective-C inputs, literal definitions through shell and recursive Make expansion, and rejection of unsupported overrides.
GitOrigin-RevId: e5ea541ec76abfa170f6b0411b0f14cd698c07e7
## What changed
Replace `features.guardian_thread_context` with `features.guardianv2.thread_context` and update the configuration schema. The setting controls thread-owned context for synchronous and asynchronous Guardian, defaults to `false`, and remains independent of `features.guardianv2.enabled`.
## Testing
Update configuration tests to cover the nested setting, profile overrides, and enabling thread context while Guardian v2 is disabled. Migrate Guardian approval, history, and async scorer tests to the new configuration key.
GitOrigin-RevId: 54a91555eb68001e0adedc8a07bdbc5ea2273f9b
## Why
The Rust GStreamer bindings link GLib's GIO library even when none of the selected plugins imports it. Following only plugin dependencies can omit a library the bindings need.
## What changed
- Export `gio-2.0` pkg-config metadata in the voice SDK.
- Require GIO as a runtime dependency root on Linux, macOS, and Windows, including its transitive dependencies under the existing import checks.
- Reject runtime packages that omit the required GIO library.
## Testing
Extend fixtures to cover GIO inclusion and missing-library rejection across platforms, loading GIO and its transitive dependency after moving a Linux runtime, and resolving `gio-2.0` through pkg-config after moving an SDK.
GitOrigin-RevId: d12e45d387d56c54d94d788cf07d82bb22c2b4a3
