## Why
Git remote URLs can embed usernames, passwords, or tokens. Codex carries these
URLs through turn metadata and persisted thread metadata, so credentials must be
removed before a remote enters those paths.
## What changed
- Add `SanitizedGitUrl`, which parses Git URL and SCP-style remotes, strips
authentication data, and preserves the conventional `git` SSH user.
- Use sanitized remotes when collecting Git metadata, enriching model requests,
discovering cloud environments, updating thread metadata, and reading legacy
rollouts. Reject or omit malformed remotes instead of retaining their raw
contents.
- Keep API, schema, and TypeScript representations as strings while enforcing
sanitization in Rust.
## Testing
- Cover URL schemes, SCP and IPv6 forms, remote helpers, encoded paths,
malformed values, and legacy deserialization.
- Verify credentials do not appear in model requests, API responses, SQLite, or
rollout files.
GitOrigin-RevId: 6435efc4c45bfbfad4723ce7a0457cb00175f25c
## What changed
- Add the experimental `turn/start.cyberAccessProgram` option with `standard`,
`daybreakBlue`, and `daybreakRed` values.
- Forward the selection as `access_programs.cyber` on Responses, WebSocket,
and remote-compaction requests made with ChatGPT authentication, while
omitting it for API-key and custom-provider requests.
- Preserve the per-turn selection across recovery, compaction, and child-agent
turns without making it a persistent thread setting.
## Testing
- Cover app-server forwarding, authentication boundaries, WebSocket reuse,
turn recovery, compaction, and child-agent inheritance.
GitOrigin-RevId: d2eb468f365b2214c5099bc21741cf30f8bd2eb5
## What changed
- Add an optional `turnTrigger` field to app-server `turn/start` requests and
expose it in the generated protocol schemas.
- Propagate non-empty trigger values to Responses request metadata as the
reserved `turn_trigger` field, while preserving the original value when a
request steers an active turn.
- Classify turns started by queue dispatch, goal continuation, retry recovery,
and realtime handoff.
## Testing
- Cover HTTP and WebSocket metadata forwarding, steering behavior, reserved
metadata handling, and the built-in trigger classifications.
GitOrigin-RevId: c12fe2c522286db21b76081ae6154fbf6bfb3639
## Why
Filesystem policies containing `:tmpdir` need executor-local directory bindings,
including when execution occurs in a remote environment.
## What changed
- Cache temporary directories reported by remote executors and discover the
equivalent directories for local environments.
- Preserve the cached directories across inherited environment selection and
include them in `FileSystemSandboxContext`.
- Add `FileSystemSandboxPolicyContext` and a context accessor so filesystem
policy entries can be resolved with the executor-owned current directory,
workspace roots, and temporary directories.
## Testing
Extend environment-selection tests to cover local, remote, and inherited
temporary-directory policy context.
GitOrigin-RevId: 36335af3465c529f024bf69293af288803dd582d
## What changed
- Add a feature-gated `TurnSettings` operation that can update the model,
reasoning effort, reasoning summary, and service tier for subsequent steps of
a named running turn without changing future thread settings.
- Report whether an update was applied, rejected, or lost its live target.
- Revalidate managed constraints and preserve the turn's admitted approval and
Guardian safety properties before publishing an updated settings snapshot.
## Testing
- Cover sparse updates, step capture and ordering, target replacement, managed
policy changes, model metadata safety, and separation from future settings.
GitOrigin-RevId: ecaaaa95b4fd4ec9d62265bef551582dddb36d78
## What changed
- Add `serviceTierForTurn` to `turn/start` so a newly started turn can override the service tier without changing the thread's saved tier.
- Treat `"default"` as standard speed and omitted or `null` values as inheriting the thread tier.
- Keep `serviceTier` authoritative for subsequent turns when both fields are supplied, and ignore the turn-scoped override when steering an active turn.
## Testing
- Extend the app-server turn-start test to verify both the one-turn `"default"` override and inheritance on the following turn.
GitOrigin-RevId: 4c2c4db21d8d31617a7a6e6df65bf54834e72383
## What changed
- Record collaboration tool analytics for `send_message`, `followup_task`,
`interrupt_agent`, and `list_agents`, including receiver attribution, duration,
failures, and interrupted calls.
- Include these calls in per-turn subagent tool counts while keeping the existing
`subAgentActivity` output unchanged and omitting additional public collaborator
tool items.
- Extend the collaboration tool schemas with the new tool variants and the
`interrupted` terminal status.
## Testing
- Add an app-server integration test covering successful and failed calls,
receiver attribution, duration, prompt omission, activity items, and turn
counts.
GitOrigin-RevId: e73eaa05c508261e5fc97e7d08d7881a31e04e22
## What changed
- Add Windows sandbox mode, private-desktop behavior, and legacy Landlock selection to each `EnvironmentConfig`.
- Centralize sandbox context construction on `TurnEnvironment`, preserving environment-owned permissions, paths, and backend settings while applying additional permission grants.
- Use the environment-derived context for project instructions, capability discovery, file uploads, and filesystem-oriented tools.
## Testing
- Verify capability discovery uses the selected environment's permission profile and sandbox backends when they differ from the thread defaults.
GitOrigin-RevId: 7ae2fed90c8ada950f2e8431e571e9b2c793c291
## What changed
- Add a `writeStdin` Guardian action carrying the approval, process, input, and working-directory details.
- Distinguish `command` and `writeStdin` execution approval requests while defaulting missing kinds to `command` for compatibility with older events.
- Render terminal-input review progress, denials, timeouts, and retry actions in the TUI, and record the action separately in analytics.
- Keep terminal-input reviews as child approvals so they do not change the parent command item's lifecycle or reconstructed history.
## Testing
- Cover Guardian serialization, app-server protocol conversion, command history reconstruction, analytics classification, and TUI review flows for terminal input.
GitOrigin-RevId: b083d5e2963bdd23b928644ec03c7eb68ebf2950
## What changed
- Add an `Interrupt` hook event that runs for an active top-level turn before its
interrupted abort event is emitted.
- Flush the turn transcript before invoking the hook and provide the session,
turn, transcript, working directory, model, and permission mode in its input.
- Support command and MCP handlers, including asynchronous commands, with a
one-second default timeout and a three-second maximum.
- Expose the event through hook configuration, managed requirements, app-server
notifications, generated schemas, analytics, and the TUI hook views.
## Testing
- Cover handler discovery, timeout normalization, output parsing, protocol
compatibility, TUI rendering, and interrupt execution ordering.
GitOrigin-RevId: 163fa7c098d94ac2775f6d137f8e916f8ea9b6eb
## Why
Clients need a bounded view of realtime conversations that preserves the order of speech, agent work, and turn lifecycle events without loading the full thread history.
## What changed
- Persist realtime session boundaries, transcript segments, and promoted agent items in paginated thread rollouts.
- Add the experimental `thread/timeline/list` API to page ordinary items, realtime items, and turn boundaries in canonical rollout order. Include `activeRealtimeSessionAtPageStart` so each page can be rendered independently.
- Emit typed `thread/realtime/item/started`, `thread/realtime/item/transcript/delta`, and `thread/realtime/item/completed` notifications around durable realtime items.
- Keep the existing `thread/items/list` response and legacy thread history behavior unchanged.
## Testing
- Cover mixed timeline pagination, realtime-session state at page boundaries, rollout replay, subagent history prefixes, transcript streaming, steering, and promoted agent artifacts.
GitOrigin-RevId: faa2c420192d63e060e8fb32446e3c797422656e
## What changed
- Add the experimental `amazonBedrockAccessKeys` app-server login flow, persist its credentials in the configured auth store, and use them for SigV4-signed Bedrock requests.
- Report `bedrockAccessKeys` as a distinct auth mode and document access-key login alongside AWS profile and environment credential setup.
- Clear the selected Bedrock provider, AWS settings, and Bedrock-specific model on logout while leaving external AWS credentials and `.env` untouched.
- Reject managed access-key login when higher-precedence configuration would prevent its region or profile settings from taking effect.
## Testing
- Cover access-key login, storage, request signing, configuration conflicts, status reporting, and logout cleanup.
GitOrigin-RevId: bbf297887c6503d3651ceb2aad85c4d626e32723
## What changed
- Add `features.network_proxy.credential_broker` and preserve structured network proxy settings when toggling the feature through config APIs.
- Protect broker enablement and provider context variables from project config, while carrying trusted context into filtered shell environments.
- Propagate brokered credentials through shell snapshots and restore real credentials for unsandboxed escalated commands.
- Normalize broker context environment keys case-insensitively on Windows and avoid conflicting remote managed-network enforcement when no proxy launch configuration is available.
## Testing
- Cover config layering, editing, project sanitization, Windows environment handling, shell snapshots, escalated execution, and end-to-end GitHub credential brokering in the zsh-fork runtime.
GitOrigin-RevId: 500e51e804e1988022052ccfe00b8fac5e495f4f
## What changed
- Add the under-development `content_item_kinds` feature, disabled by default.
- Strip content item classifications from Responses input when the feature is
disabled while preserving other passthrough metadata.
## Testing
- Add coverage that disables the feature and verifies requests omit content item
kinds without removing the turn ID.
GitOrigin-RevId: f938feb2895d766d979b1666fc7b97fd128fe8a7
## Why
A Multi-Agent V2 child can finish after the parent turn that spawned it, so its
successful completion needs to remain associated with that parent turn in
notifications and history.
## What changed
- Add `completed` to `SubAgentActivityKind` and emit the corresponding started
and completed item events on the spawning parent turn when a child succeeds.
- Persist completed activity as a canonical turn item in both legacy and
paginated history, and expose it through app-server history and schemas.
- Render completed activity as terminal in the TUI without counting it as a
separate tool call or tool-runtime event.
## Testing
- Cover successful completion in legacy and paginated history, late updates to
completed parent turns, TUI rendering, analytics, and rollout tracing.
- Verify that terminal child errors do not emit completed activity.
GitOrigin-RevId: 6c71eb8b10e7327611c6af84f70e294e27d94d02
## What changed
- Recognize `cua_repl` alongside `node_repl` when collecting Guardian review evidence, applying computer-use policy, and capturing transcript images.
- Render `cua_repl.js` results with the compact REPL history and transcript views.
- Preserve failed MCP call status and result content when replaying app-server history.
## Testing
- Cover both REPL server names across Guardian policy, evidence, image capture, history rendering, and failed-call replay tests.
GitOrigin-RevId: 8c13a721f718add403b07e727c1634b59203c51a
## Why
Guardian reviews were reported with the generic `subagent` thread source, making them indistinguishable from other delegated threads in persisted metadata and analytics.
## What changed
- Add the `guardian_review` thread source to the core protocol and app-server schema.
- Assign it to Guardian reviewer sessions and propagate the configured source through turn metadata, rollouts, and analytics.
- Continue treating Guardian reviews like subagents for paginated history and trusted-provenance checks.
## Testing
- Cover protocol round trips, delegate source selection, emitted analytics, request metadata, and persisted rollout metadata.
GitOrigin-RevId: 07480c122715812874c9d3b48bb39fc5c86b2367
## What changed
- Add `ContentItemKind` as an open-ended string classification and carry an
optional list of kinds in `InternalChatMessageMetadataPassthrough`.
- Keep unknown classification values intact during round trips, while treating
a malformed `content_item_kinds` value as absent so the response item can
still be loaded.
## Testing
- Cover round trips for future classification values and deserialization of
malformed metadata.
GitOrigin-RevId: 5398cae5bb294a9f71ddd192e297177fab54a576
## Why
MCP inventory can be cached or collected separately from a thread's live
connections, so tool availability alone does not describe the current runtime
state.
## What changed
- Add a nullable `runtimeStatus` to `mcpServerStatus/list` for thread-scoped
requests, covering not-started, starting, connected, authentication-required,
failed, cancelled, and disabled connections.
- Observe published connection state without starting or reconnecting servers,
and return an unknown status when no thread is supplied or the active
configuration no longer matches the published registration.
- Show connection state and tool counts in the compact `/mcp` view while
retaining the detailed inventory in `/mcp verbose` and compatibility with
servers that omit `runtimeStatus`.
## Testing
- Cover runtime status transitions, deferred and disabled servers, closed
transports, configuration changes, protocol compatibility, and TUI rendering.
GitOrigin-RevId: e3bb6efe652f0fa8b3c97d5c53e4729b3a87cd91
## Why
An active root turn needs to be stopped without marking it complete or aborted
before another runtime can recover the same turn ID.
## What changed
- Add `CodexThread::suspend_turn_and_shutdown` and `SuspendTurnOutcome`.
- Flush history, stop the active regular task, close the history writer, and
shut down the session without recording a terminal turn event.
- Reject suspension when no supported turn is active or the loaded agent
subtree still contains a live descendant.
## Testing
- Verify that suspension preserves unfinished history and allows the turn to be
recovered under its original ID after the descendant guard is cleared.
GitOrigin-RevId: 1f9b019d07c51474ec2d991d263bc15cdd4f89ad
## What changed
- Add an extension API for spawning host-owned internal sessions and a
`ThreadReadyInput` lifecycle callback that runs after thread registration.
- Add Guardian reviewer session scaffolding that records the parent thread and
effective model, plus the under-development `guardian_ext` feature flag.
- Start internal sessions with fresh history while preserving parent lineage,
shared session controls, and internal-thread visibility rules.
- Scope internal-session prompt cache keys to their source and parent thread,
and expose `guardian` as an internal session source.
## Testing
- Cover internal-session spawning, parent metadata, history isolation, prompt
cache keys, and extension spawner argument forwarding.
GitOrigin-RevId: 682dae80397d62bb36247796b447042e760ca364
## Why
App-server logs can be persisted or included in submitted diagnostics, so credentials used by model providers, authentication refreshes, and attestation requests must not appear in diagnostic output.
## What changed
- Add `RedactedString`, which preserves serialization and string access while replacing debug output with `<redacted>`.
- Use it for model-provider bearer tokens, header and query values, authentication command arguments, and attestation tokens.
- Avoid logging JSON-RPC error payloads and parser or authentication errors that may echo credentials; retain safe context such as error codes and categories.
## Testing
- Add an app-server regression test that exercises provider credentials, refreshed authentication tokens, and attestation tokens, then verifies none appear in persisted SQLite or submitted diagnostic logs.
GitOrigin-RevId: 8c50408adf94d93847658b1320682cf3b637d2cc
## Why
`EnvironmentConfig.network_policy` could describe attachment-owned traffic
restrictions, but core rejected every configured policy because execution did
not enforce it.
## What changed
- Resolve each remote environment's network policy for the selected command
and apply it to the execution-scoped proxy.
- Compose owner rules with controller constraints and saved network decisions
while preserving inherited domain and Unix-socket denials.
- Keep strict allowlists non-expandable, allow reviewable policies to use
network approvals, and reject sandbox escalation that would bypass an owner
policy.
- Reject policies for local execution, disabled managed enforcement, or a
disabled controller proxy.
## Testing
Added coverage for policy composition, scoped remote proxy behavior, approval
and denial flows, offline execution, and unsupported environment authority.
GitOrigin-RevId: d9331f616df24de6cd13ed68196f0ff7b0ca4dd9
## Why
Clients that create and negotiate realtime calls themselves need Codex to join
those calls without creating another call or overwriting the client-owned
session configuration.
## What changed
- Add the `existingCall` transport to `thread/realtime/start`, accepting a
client-provided `callId` and optional `realtimeSessionId`.
- Attach Codex over the call's sideband WebSocket without SDP negotiation or a
session update, and reconnect that sideband while preserving transcript
state.
- Default existing calls to realtime v1, support v1 and v3, and reject v2 or
options that would reconfigure the client-owned session.
- Encode call IDs as a single URL path segment for v3 sideband connections.
## Testing
Add protocol, app-server, core, reconnection, authentication-header, and URL
encoding coverage for existing-call attachments.
GitOrigin-RevId: 2046b70566f98efa55381bb1e461ea3cc68256c5
## What changed
- Add `FileSystemSandboxPolicy::has_writable_roots_with_cwd` to detect an
effective writable root without constructing its read-only carveouts.
- Use the helper when classifying permission profiles and selecting patch
rejection reasons.
## Testing
- Verify the presence check matches the existing materialized-root result
across read-only, unrestricted, external, writable, denied, and unresolved
special-path policies.
GitOrigin-RevId: 17ee490aa3180e05732133203f68544d9de5268b
## What changed
- Add `WINDIR` to the Windows core environment variable allowlist.
- Extend the Windows core-inheritance test to verify that a case-variant
`WinDir` entry is retained.
GitOrigin-RevId: 0305d8fa882ba2705a7ce7661098cedac1339c43
## Why
External tool events may need to enter thread history without a preceding function call and therefore do not have a `call_id`.
## What changed
- Allow `function_call_output` items to omit `call_id` and carry optional `name` and `namespace` fields.
- Preserve named standalone outputs during history normalization and agent forks while retaining existing pairing behavior for outputs with a `call_id`.
- Accept, persist, and forward these outputs through `thread/inject_items`, and update the app-server schemas and documentation.
## Testing
- Cover paired and standalone JSON round trips, history normalization, agent forks, and injected thread history.
GitOrigin-RevId: a3258163a7dc93777c7c3023116fe204819bdbb0
## What changed
- Add `otel.tool_result.max_bytes`, defaulting to 2048 bytes, to control the
text included in `codex.tool_result` logs independently of model-visible
output limits.
- Apply truncation centrally when emitting telemetry, preserve UTF-8
boundaries, and report whether the logged output was truncated.
- Record typed tool names and namespaces, agent names, and process-local result
sequence numbers while keeping tool arguments and output out of trace events.
## Testing
- Cover configuration propagation, UTF-8-safe truncation, raw tool-output
logging, and log/trace event routing and fields.
GitOrigin-RevId: 89ca76e55f1a09b729e7770ce01f2e4d98f9a22d
## What changed
- Use `exec_command` and `write_stdin` as the shell tool surface.
- Treat legacy `default`, `local`, and `shell_command` model metadata as `unified_exec`.
- Remove obsolete shell-selection configuration and runtime paths while preserving the feature and policy gates for zsh fork execution.
GitOrigin-RevId: d743cbe598630d73052f1fecad680c4cde17977d
## What changed
- Remove the legacy `shell_command` handler and runtime, leaving `exec_command`
and `write_stdin` as the shell execution tools.
- Treat legacy `shell_command` model metadata as `unified_exec`, and normalize
legacy user opt-outs so they do not disable command execution. Managed feature
requirements and `shell_tool` can still disable it.
- Preserve shell approvals, sandboxing, zsh-fork support, and output truncation
through the unified execution path.
## Testing
- Cover legacy configuration and model-metadata compatibility.
- Exercise unified shell execution, approvals, truncation, and `apply_patch`
serialization across the app-server and core test suites.
GitOrigin-RevId: 5c2fd6164fc3519cdae4944cb9db276b8467311c
## What changed
- Add `rejection_instructions` and `timeout_instructions` to catalog-provided auto-review messages.
- Use the acting model's instructions for denied and timed-out reviews across tool approvals, shell escalation, and MCP elicitation responses.
- Fall back to the existing instructions only when a catalog value is absent, while preserving explicit empty-string overrides.
## Testing
- Cover catalog overrides, legacy fallbacks, empty values, and separation between acting-model and reviewer-model messages.
GitOrigin-RevId: c5b2c2dbdaefd45d1d658651dd1abaeb6d8c93da
## What changed
- Add `max_tool_call_lag`, `reuse_parent_compaction`, and transcript
`include_images` to the Guardian model configuration.
- Inherit these settings from model defaults while preserving explicit local
overrides.
- Enable image capture for Node REPL review evidence when transcript images are
included.
## Testing
- Cover inheritance and local override precedence for the new settings.
- Verify that enabling transcript images initializes review-evidence capture.
GitOrigin-RevId: 7c1965c2ec00a78a0436fa916b630be0004dbb51
## Why
Resolving attacker-mutable path components while preparing a Seatbelt profile can let a writable root be rebound to a different location before the sandbox is applied. File roots also need to remain confined to the file itself rather than granting access to descendants after replacement.
## What changed
- Preserve mutable components of writable-root paths until Seatbelt binds them, while still normalizing trusted top-level aliases such as `/tmp`.
- Use literal grants for existing file and device roots, and subpath grants for directories and missing roots.
- Exclude both logical and resolved forms of protected subpaths so symlinked metadata directories remain read-only.
## Testing
Add coverage for ancestor rebinding, file-root symlink and directory replacement, missing directory roots, top-level aliases, and symlinked metadata carveouts.
GitOrigin-RevId: 63c00e44dd30766e873b8acdad09d6657657fad9
## What changed
- Remove `untrusted` from the CLI, configuration schema, and MCP tool interface. Explicit `approval_policy = "untrusted"` settings now fail with an actionable error.
- Remove the known-safe command allowlist. Projects marked untrusted now request approval for every command unless an explicit exec policy rule allows it.
- Keep command parsing conservative by treating in-place `sed` forms as mutating and ignoring unrecognized commands when recording memory usage.
## Testing
- Cover rejection of the retired configuration value and approval requests for commands in untrusted projects.
GitOrigin-RevId: d6bf425edddfffbb325eee6acf383434af5fd33b
## What changed
- Add environment-provided MCP restrictions for configured and plugin-provided servers.
- Disable attachment-scoped servers while their environment configuration is pending, failed, or unselected, while preserving selected-plugin access and the controller-owned Apps server.
- Apply the resolved policy to runtime startup, model tool exposure, telemetry, OAuth flows, and skill dependency installation.
## Testing
- Cover policy filtering for configured and plugin servers, environment state transitions, Apps ownership, and managed OAuth rejection.
GitOrigin-RevId: 7ca5d4dda14068e758497f88835d5cba685e159e
## What changed
- Recognize `edu_plus` and `edu_pro` as distinct education workspace plans across authentication, backend rate-limit mapping, and app-server account schemas.
- Include both plans in cloud configuration eligibility and use the education usage-limit behavior.
- Display the plans as `Edu Plus` and `Edu Pro` in the TUI status view.
## Testing
- Cover parsing, workspace classification, account and rate-limit responses, cloud configuration eligibility, usage-limit messages, and TUI display names for the new variants.
GitOrigin-RevId: bf8add780ae03a3c6d10c4f4afa0da262c37928e
## What changed
- Add an optional `delivery` field to agent message events and app-server
`agentMessage` items, with `"async"` identifying a user-visible message sent
without ending the current turn.
- Preserve the marker through legacy event conversion, thread history
materialization, replay, and generated JSON and TypeScript schemas.
- Require delivery of async agent message completion notifications on the
in-process app-server transport.
## Testing
- Cover preservation of async delivery metadata in thread history.
- Cover delivery-required classification for async agent messages.
GitOrigin-RevId: f92ba25de1293ee271404badfdf0d117d6530329
## What changed
- Stop writing Guardian v2 security risk scores to rollout history.
- Treat resumed and forked threads as having no previous Guardian score, so their
first tool approval is classified and reviewed normally.
- Remove the now-unused `codex-history` dependency from the Guardian v2
extension.
## Testing
- Update app-server coverage for new, resumed, and forked threads to wait for
classification completion and verify the expected approval reviews.
GitOrigin-RevId: 74d9caa903a1ff9d38e577b4697b5f8970f11ebb
## What changed
- Add `NODE_REPL_AUTH_TOKEN` to the environment variables that model-reachable child processes cannot inherit.
- Remove the variable case-insensitively after shell environment policy overrides and from explicitly configured child command environments.
- Extend the environment scrubber tests to cover inherited and configured forms of the token.
GitOrigin-RevId: 716c65e0a9e222f705c226b7c86545251d3ea580
## What changed
- Add `intersect_effective_permission_profiles` to derive the permissions shared by an authority profile and a requested profile.
- Preserve the more restrictive filesystem access, read denials, protected metadata paths, temporary-directory access, and network policy.
- Canonicalize concrete paths so symlinks cannot expand authority, and fail closed for policy shapes that cannot be intersected safely.
## Testing
Add coverage for workspace intersections, nested carveouts, deny patterns, unsupported policies, temporary-directory restrictions, symlink escapes, and macOS path aliases.
GitOrigin-RevId: a35bdc47e41afad13630f92c032514b300c14a0d
## Why
Compaction can remove the tool-call events that associate an MCP app widget with
the tool, account, and URI needed to authorize later resource reads.
## What changed
- Store a bounded MCP resource-origin checkpoint with each compacted rollout.
- Restore the checkpoint when resuming a session so existing widgets remain
readable after compaction and restart.
- Discard saved origins when rollback rewrites history across the compaction
boundary, and reject oversized or invalid checkpoints during restoration.
## Testing
- Extend the app-server MCP resource-origin test to compact a paginated thread,
continue the conversation, and read the original widgets before and after a
restart.
- Verify rollback clears provenance that no longer matches retained history.
GitOrigin-RevId: 7f91c6202fe8d9be21c78dda42fa205937c44263
## What changed
- Add the optional `active_permission_profile` field to `TurnContextItem` to record the built-in or named profile that produced the effective permission profile.
- Populate the field when serializing a turn context while preserving compatibility with records where it is absent.
## Testing
- Add coverage verifying that turn-context serialization stores the active permission profile.
GitOrigin-RevId: d69142ab1b26595ab406235f89818ef41370e963
## Why
Filesystem permission paths can use a convention that differs from the host
running Codex. Converting them immediately to native absolute paths can change
the meaning of ambiguous paths such as `/C:/secret` or Windows UNC paths.
## What changed
- Store literal filesystem permission paths as `PathUri` values through the
runtime policy and execution protocol.
- Keep legacy string-based serialization at explicit protocol boundaries and
reject conversions that cannot be represented losslessly.
- Encode native paths as opaque URIs when a normal file URI would imply the
wrong path convention.
## Testing
Added coverage for cross-platform and ambiguous path round trips, UNC path
variants, permission-profile serialization, and deny-policy enforcement.
GitOrigin-RevId: 5247713796d1f2bb4e02f94eb9fc82d4698060f0
## What changed
- Add `EnvironmentNetworkPolicy` as a serializable view of portable domain,
Unix-socket, upstream-proxy, and local-binding restrictions without exposing
controller-owned proxy runtime settings.
- Add an optional `network_policy` field to `EnvironmentConfig` and re-export
the policy and related permission types through the core APIs.
- Reject owner-provided network policies during environment preview and
readiness until runtime enforcement is implemented, while preserving the
existing controller policy when the field is absent.
## Testing
- Cover rejection through both environment preview and readiness, including
preservation of the existing environment selection.
GitOrigin-RevId: 80ad4cf4d4a45632daa7a823e6cf568eb0e8bb80
## What changed
- Define MCP server identities, matchers, requirements, and per-plugin MCP requirements in the new `codex_protocol::mcp_policy` module.
- Keep requirement validation and matching against `McpServerConfig` in `codex-config`.
- Re-export the moved types from `codex-config` to preserve existing consumers.
GitOrigin-RevId: ad8a107e3085191241a5766f061dd004103e21e6
## What changed
- Add optional `guardian_v2` model-message defaults for classifier instructions,
review thresholds, reasoning effort, transcript selection and limits, and
action and compaction token limits.
- Apply those defaults when Guardian v2 samples a tool call, while preserving
explicit `[features.guardianv2]` settings over catalog values.
- Preserve the new catalog configuration when applying model overrides.
## Testing
- Cover model-catalog serialization and model override behavior.
- Verify that sampling uses catalog defaults while retaining local overrides.
GitOrigin-RevId: 4ae9ec235c647acbca05a20b7c4b87a4e1331161
## What changed
- Add an optional restrictive execution policy to `EnvironmentConfig` and merge it over the active command policy for shell execution and approval decisions.
- Reject environment policies that contain allow rules, so environment configuration can only tighten command access.
- Include the environment policy fingerprint in cached approval keys so policy changes require fresh session approvals.
## Testing
- Cover restrictions overriding saved prefix approvals, policy changes invalidating session approvals, and environment overlays remaining effective when model-specific prefix filtering is active.
GitOrigin-RevId: e94f877549ed5e0f577b8cb52f3c1872c58f029d
## Why
`CODEX_EXEC_SERVER_NOISE_AUTH_TOKEN` is an execution-server credential and
must not be exposed to model-reachable commands or command hooks, including
when shell environment policy explicitly sets a case variant of the name.
## What changed
- Add `CODEX_EXEC_SERVER_NOISE_AUTH_TOKEN` to the shared list of
non-inheritable environment variables.
- Keep the environment variable constant in `codex-protocol` so the exec
server and environment scrubber use the same definition.
- Verify case-insensitive removal after policy overrides for shell commands
and command hooks.
GitOrigin-RevId: 759b224b6a7fb4f56f7b1a6d94ffbb0b188c658f
## What changed
- Carry `ShellEnvironmentPolicy` in each resolved `EnvironmentConfig` and use
the selected turn environment's policy for shell commands, user shell tasks,
and unified exec.
- Infer the policy from the thread configuration when an environment does not
provide its own resolved configuration.
- Redact the policy from `EnvironmentConfig` debug output because it can contain
explicit environment variable values.
## Testing
- Verify shell handlers and unified exec filter inherited variables according
to the selected environment while preserving its explicit overrides.
GitOrigin-RevId: 9f6a52aa4af60e5f17251a0e1b11e1926b779055
## What changed
- Read optional workload identity context from `OPENAI_WORKLOAD_IDENTITY_CONTEXT` and forward it unchanged as the `workload_identity_context` token exchange field.
- Treat the context as sensitive by redacting it from session configuration debug output and removing it from model-reachable child environments.
- Include the context in workload identity session fingerprints so sessions with different values cannot share an exchange.
## Testing
- Cover request forwarding, debug redaction, session compatibility, and child-environment scrubbing.
GitOrigin-RevId: fb50700478cf54d9d604944a4ed3e77acc928a0f
