## What changed
- Use V2 discovery inventories for plugin MCP contributions when supplied, including empty or failed inventories; retain legacy discovery when no V2 snapshot is supplied.
- Merge plugins by canonical identity, using cloud metadata and enablement for remote plugins and attaching executor installations only when versions match. Preserve configured executor-local plugins and executor enablement when cloud data is unavailable.
- Keep installation order stable across refreshes and run merged MCP declarations on the first retained executor installation while preserving attribution for the others.
- Carry local and remote identities through selected-plugin snapshots, skill attribution, and active-plugin telemetry. Track disabled plugin IDs alongside disabled roots.
- Preserve a complete cloud catalog when a partial refresh arrives, and cap tool-description plugin attribution at 1,024 bytes while retaining all plugin associations.
## Testing
Add coverage for catalog parsing and reconciliation, enablement and discovery-mode selection, installation refresh ordering, executor-specific MCP normalization, selected-plugin snapshots, and bounded UTF-8 attribution text.
GitOrigin-RevId: a8ad352de6a2b8dc4bfd1ff6a5c62ee8ed1d1664
## Why
Turn recovery and retries after a server overload can leave consecutive reasoning effort updates in history when settings change without an intervening message. Requests should use the latest update in each consecutive run.
## What changed
Coalesce adjacent `configuration_update` items when building Responses requests with reasoning effort overrides enabled, retaining the latest update. Preserve saved history and updates separated by other input items.
## Testing
Extend integration coverage for recovery with unchanged or changed effort, retries after a server overload, and WebSocket continuation and replay after coalescing. Verify that requests retain the latest adjacent update while saved history keeps all updates.
GitOrigin-RevId: bcf97db4c93dac5f466bd276176ac9d238329ecd
## Why
MCP tool hooks need to invoke model-hidden tools even when a subagent's cached server has not started. Their timeout must also cover server startup.
## What changed
- Let cached servers with allowed model-hidden tools remain dormant until called.
- Wait for the selected server when executing an MCP hook, leaving unrelated cached servers dormant, and apply the hook timeout to the entire operation.
- Capture tool namespace attribution after startup and retain it only while catalog revisions remain unchanged.
- Validate the server, environment, and tool filter before starting a server or capturing attribution.
## Testing
Extend integration coverage for cached subagent hooks under both startup readiness modes, startup timeouts without context injection, and namespace attribution for hook and token-budget context while keeping tools hidden from the model. Verify that a direct call starts a cached server whose tools are hidden from model exposure.
GitOrigin-RevId: 7a54b69aa2515722aeb925e03e1667bf63aa67ca
## What changed
- Add `PreModelRequest` and `PostModelRequest` hooks around model request attempts, including retries. Pass model, session, turn, and optional subagent context; report completion, failure, or cancellation with errors and token usage when available.
- Treat hook output as diagnostic data without allowing it to veto requests or alter model context. Wait for synchronous post-request hooks before dispatching tools, while asynchronous hooks allow streaming tool dispatch to continue.
- Apply memory-consolidation hook filtering and expose the new events through configuration, protocol schemas, generated clients, and the hooks browser.
## Testing
Add integration coverage for failures and retries, ignored control directives, cancellation, synchronous and asynchronous tool ordering, interrupted-turn resume and token accounting, and memory-consolidation filtering. Update hook schema fixtures and hooks browser snapshots.
GitOrigin-RevId: 6ed7b39fc8bb94cf467e350d07d97fcc729c21ce
## Why
A worker can finish after its parent has returned a final answer. Agent messages without `trigger_turn` previously needed an outstanding durable sleep to wake an idle session.
## What changed
Add the disabled-by-default `wake_on_agent_messages` feature to start a new root turn when agent mail arrives through direct delivery or the host mailbox. Reuse the previous turn context for messages without `trigger_turn`. Keep these automatic wakes disabled for interrupted sessions, Plan mode, and child agents.
## Testing
Add coverage for both delivery paths waking a completed root exactly once, child completion waking a parent after its final answer, and the interruption, Plan mode, and child-agent boundaries.
GitOrigin-RevId: f1a4fc7c22be8ca46b2173a85445126cbdd6c4b6
## Why
Rotating header credentials should not discard the model catalog when a stable account ID is available.
## What changed
- Use the account ID from `CodexAuth::Headers` instead of opaque auth headers in the catalog cache identity. Provider settings remain part of the key.
- Retain credential-sensitive keys when the account ID is missing or the provider uses an explicit API key, bearer token, or command auth.
- Document that hosts using header auth must isolate model managers and cache storage by user and catalog-varying request context, since an account ID can represent a shared workspace.
## Testing
Update the auth-rotation test fixture to omit stable account metadata, preserving coverage for catalog invalidation when opaque credentials change.
GitOrigin-RevId: f96a20c5baf76b9235e131140716731da4dbee81
## Why
Contextual fragments and extension-owned world-state sections currently return strings, limiting them to text content.
## What changed
- Return `ContentItem` from fragment bodies and rendering, preserving classification and attribution. Apply text markers only to `InputText`; pass other content through unchanged.
- Allow extension prompt and world-state contributions to carry typed content, and preserve media in context-window hints.
- Hash non-text world-state fragments by their serialized content and role while retaining the existing text hashing behavior.
- Add shared content-to-tool-output conversion that preserves image references, image detail, and audio.
## Testing
Add coverage for typed world-state hashing and preservation of image content and attribution. Expand code-mode output tests to cover input text, output text, file-backed and inline images, and audio.
GitOrigin-RevId: 2ed00d466a3f169b151202f3eef71e667ea64be1
## Why
MCP servers can expose new tools during discovery. Refreshing the catalog after a tool-list notification lets Codex discover and call those tools in the same turn.
## What changed
- Add the disabled-by-default `mcp_tool_list_changed` feature for ordinary MCP servers.
- Track notifications in transport order and refresh catalogs before subsequent discovery or tool binding. Coalesce concurrent refreshes and retry listings invalidated by notifications, including during pagination.
- Retain the previous catalog on refresh failure, apply a retry cooldown, and invalidate affected startup caches. Allow notification refreshes to proceed while admitted calls finish.
## Testing
Add coverage for same-turn discovery and invocation in direct and Code Mode, notifications during startup and pagination, disabled behavior, cache invalidation, and concurrent refreshes with timeout recovery.
GitOrigin-RevId: 9afee8deba00dd9851b5f32625f61f96965aa00c
## Why
Dynamic tool calls should remain independent while waiting for client responses, so one pending call does not block another from reaching the client.
## What changed
Enable parallel execution in `DynamicToolHandler`, allowing code mode programs to issue concurrent dynamic tool calls with `Promise.all`.
## Testing
Add a code mode regression test that waits for two dynamic tool requests before responding, resolves them in reverse order, and verifies that `Promise.all` preserves the expected result order.
GitOrigin-RevId: c93c1fea720f76c772b0e3452ddc8c01fb1a08d8
## Why
A plugin's scripts can change without changing its hook declaration. Declaration-only approval therefore lets changed plugin code run under an existing hook approval.
## What changed
- Fingerprint plugin bundle contents and include the content hash in the approval value returned by `hooks/list`. Persist it as `trusted_content_hash`, keeping `trusted_hash` compatible with older clients.
- Verify contents before each command or MCP hook execution, within the hook's timeout, and require renewed approval when approved contents change.
- Migrate legacy declaration-only approvals to a shared, immutable content baseline per plugin and config home.
- Exclude generated Python bytecode, `.venv`, and `.egg-info` entries from fingerprints. Run app-server hook listing on blocking tasks.
## Testing
Extend integration coverage for plugin upgrades and rollbacks requiring approval, same-turn script changes preventing further hook execution, shared legacy approval baselines, and generated Python artifacts preserving trust.
GitOrigin-RevId: faaf7658210d8adb2534ddd614c72ec993920840
## What changed
Recognize `codex_app.create_thread` deliveries when capturing sender context so Guardian receives the sender's recent user messages and assistant context for delegated tasks.
## Testing
Extend the sender-context integration test to cover `create_thread`, including reviewer-only context and clearing the snapshot on a subsequent delivery without sender provenance.
GitOrigin-RevId: 7a47c3ac5b9c9405e6728010c494529274b7b73d
## Why
Remote credential masking previously supported only Bash commands without login startup or shell snapshots, leaving Zsh commands with unmasked credentials.
## What changed
- Enable masking for Zsh login commands using shell snapshots on Linux and macOS.
- Capture trusted startup profiles per launch, bind the credential broker to the resulting environment, and replace credentials and supported aliases with placeholders before snapshot replay.
- Preserve explicit environment overrides, credential unsets, and launcher-managed proxy settings during replay.
- Warn and fall back to unmasked startup when a snapshot cannot safely replay credentials; stop execution if protected snapshot restoration fails.
## Testing
Extend remote execution tests for inherited and profile-defined credentials, overrides, destination changes, and unsupported-profile fallback. Add a Zsh scenario snapshot showing a credential placeholder in command output.
GitOrigin-RevId: 83193d6cbc05f3deb0d6d0b9ae80974b353ce900
## Why
Live descendants previously blocked suspension of an unfinished root turn, requiring callers to stop and unload them before recovering the root elsewhere.
## What changed
Allow `suspend_turn_and_shutdown` to suspend the root and initiate shutdown of all sessions sharing its local agent runtime, fencing new starts. Remove `SuspendTurnOutcome::HasLiveDescendants`.
Success confirms that the root has stopped and its history writer is flushed and closed; descendant cleanup completes separately. Callers must finish tree shutdown or fence and terminate the tree's persistence writers before transferring ownership. Interrupted descendants are not automatically recovered.
## Testing
Extend integration coverage to verify child shutdown, recovery under the original root turn ID without restarting children, and separate reporting of child writer failures.
GitOrigin-RevId: 5adc240ae6e34654209154ee9324621a2bd604d5
## What changed
- Upload generated images to the attachment store and expose `fileId` in image-generation items when available, with inline `result` fallback on upload or decoding failure.
- Preserve file references through legacy events, persisted rollouts, thread history, and task output summaries. Keep model-facing image preparation separate.
- Add attachment request tags and mark generated-image uploads with `usage=image_gen`, preserving the thread's ephemeral setting.
- Update public schemas and SDK types to accept either image representation, retain the Python `ImageGenerationThreadItem` alias, and prefer `fileId` when reading records containing both fields.
## Testing
Add coverage for file-backed generation and rollout persistence, legacy history replay, inline and transitional serialization, task output visibility, and Python SDK alias compatibility.
GitOrigin-RevId: f7a2bb5707e2f277348a547a988bc33c8e96d891
## What changed
Negotiate executor support for `credential_masking` and enable built-in credential brokerage in executor-local network proxies. Supported non-login Bash commands on Linux and macOS receive credential placeholders, with real credentials injected by the proxy for matching destinations.
Retain credential mappings across process launches within the same executor session, scoped by environment, conversation, and broker configuration. Keep credentials and destination context on the executor.
Fall back to unmasked execution for unsupported shells or shell startup, and for configured credential providers. Emit warnings when masking is unavailable, preserving shell profiles and snapshots.
## Testing
Add coverage for capability negotiation, fallback behavior, mapping reuse and isolation, proxy credential injection, and keeping executor credentials out of model-visible request history. Test warning, removal, and rejection modes for credentials left unmasked during preparation.
GitOrigin-RevId: f64e916a5de8350fa0d289d3440ec29761accd75
## Why
Local compaction stores generated summaries with the `user` wire role, but those summaries are not user authorization. Guardian transcripts need to preserve that distinction when reviewing compacted history.
## What changed
Classify messages marked with `compaction.summary` as assistant entries in Guardian transcripts, while preserving the attribution of actual user messages.
## Testing
Add transcript collection coverage and regression tests for both line and JSON transcripts that verify generated summaries are attributed to the assistant and original user instructions remain attributed to the user.
GitOrigin-RevId: 66183028ce70a2500d47d3347b110f95471ba868
## Why
On case-insensitive macOS filesystems, paths such as `.GIT/config` refer to protected `.git/config` metadata but can pass case-sensitive write permission checks.
## What changed
Check native filesystem case sensitivity when matching protected metadata paths, including case aliases in workspace roots. Recheck both the target and policy entries with normalized aliases so explicit metadata grants and narrower restrictions retain their precedence. Return errors when filesystem case sensitivity cannot be established.
## Testing
Add macOS coverage for metadata and workspace-root case aliases, explicit grants, narrower restrictions, and missing directories. Strengthen the patch regression test to assert the approval rejection message for both direct `apply_patch` calls and shell interception.
GitOrigin-RevId: 8ae2eb97ce6ec71c51bead130515b9ce6c1cdfab
## What changed
Add an integration test that approves a sandboxed `exec_command` attempt, simulates a sandbox denial, and denies the subsequent unsandboxed retry. Verify that Guardian reviews the retry separately with `require_escalated`, that the denied retry never reaches the executor, and that the tool result includes the denial rationale.
Use a fake executor to exercise the sandbox denial consistently across hosts.
GitOrigin-RevId: cd644255f7a7b7561c9e52a5b6e40f0859b70547
## Why
A failed Guardian inference can retain its input in a reusable session. Tracking transcript progress only after successful reviews can admit the same evidence again on retry.
## What changed
Advance transcript progress when a failed turn has retained its input and the session remains reusable, without counting it as a completed review or changing the committed fork checkpoint. Leave progress unchanged when failure occurs before input admission.
## Testing
Extend regression coverage for encrypted agent messages across review retries, pending evidence after compaction failures, and fork checkpoints after transcript admission without a completed review.
GitOrigin-RevId: 36239ec9d47f484bcfe68d65e7c8d8ab8660db0d
## What changed
- Verify that freeform `apply_patch` calls and shell-intercepted patches cannot modify `.git/config` through `.GIT/config` when approvals are disabled, while an ordinary workspace file remains writable.
- Add macOS Seatbelt coverage for uppercase protected metadata paths, including absent directories, existing directories with either casing, and case variants of the workspace root. Assert that metadata creation and modification are denied while sibling workspace writes succeed.
The tests skip filesystems that do not support the case-insensitive aliases they exercise.
GitOrigin-RevId: 5cf6b0c36eee348e1ba0db0bc2d3bff072458364
## What changed
Tag `codex.tools.incremental_updates` counters with the qualified tool name alongside the action. Continue excluding initial catalogs and namespace headers, while counting each removed namespace member.
Add `codex.tools.spec_description_bytes` to measure UTF-8 description bytes when an existing tool definition is replaced. Skip definitions without descriptions and use logarithmic histogram boundaries up to 1 MiB.
## Testing
Extend namespace transition tests to check per-tool counts and description sizes. Add scenario assertions for replacement metrics with incremental tool updates and their absence on the non-incremental request path.
GitOrigin-RevId: e20e6d81f21a867b285df1f0da005c2806dd03c6
## Why
With granular sandbox approvals disabled, `write_stdin` rejected input to terminals retaining additional permissions even when those permissions were still granted.
## What changed
Let input reach approval review when the terminal's retained permissions match active grants for its environment. Require identical filesystem grants, including entry order, and an active network grant when retained permissions enable network access. Each input still requires review.
Keep rejecting input when retained authority is no longer covered or the approval policy changes to `Never`.
## Testing
Add regression coverage for user and Guardian review, turn grant expiry, session grants, and switching to `Never`. Cover filesystem restrictions, protected metadata, symlinks, and ordered denials, and verify that rejected input never reaches the terminal.
GitOrigin-RevId: 9abf7da8d03b1526d26ca2a718e36349a255330b
## Why
Environment tool availability and selectors should remain stable as selected environments become ready.
## What changed
- Keep configured environment tools advertised even when no execution environment is ready, and derive `environment_id` selectors from all selected environments.
- Return guidance to wait when an environment is unavailable, while preserving errors for unknown environment IDs. Require a usable primary environment for `write_stdin`.
- Always include `shell` and `login` in the `exec_command` schema and mark `stable_environment_tools` as removed.
## Testing
Update integration tests to expect environment tools with empty or starting environments, and remove explicit feature opt-ins from affected scenarios.
GitOrigin-RevId: 1590c1b5be16a39e4a370663c552b881602545b5
## Why
Advancing the test clock expires the review, but command cancellation and output drainage still run asynchronously. The model can poll before the final timeout failure is available.
## What changed
Hold the initial tool result until the command emits `ExecCommandEnd`, with a bounded wait that also catches unexpected approval requests or turn completion. Only request a poll when the initial result reports a running process, and accept the timeout output from either `exec_command` or `write_stdin`.
Keep the assertions that the model receives the timeout explanation without a user approval prompt or a misleading user-rejection message.
GitOrigin-RevId: 219a1579dce35caf8f0d45b1d92a7343ec1a8935
## Why
Coordinated MCP OAuth refresh must stop retrying a definitively rejected refresh token, including after the runtime is rebuilt.
## What changed
Remove the rejected refresh token while preserving the access token and credential record. Compare stored credentials under the appropriate locks before writing so a replacement login is preserved, and update file entries using their existing keys.
Keep rejection handling alive through caller cancellation and prevent reuse within the runtime even if persistence fails. For ordinary direct-keyring credentials shared across `CODEX_HOME` directories, retire the token only in the current runtime because locking does not span those directories. Report persistence failures without exposing backend diagnostics.
## Testing
Add coverage for reauthentication after runtime rebuild, legacy file keys, cancellation with a concurrent credential replacement, keyring scope, and persistence failures with diagnostic redaction.
GitOrigin-RevId: a6e602ca2e2893ed711d853becc45142d9575fab
## Why
PowerShell safety checks can mistake a literal `start` argument for a URL-launch command, or combine a process launch with a URL from a separate command.
## What changed
Classify independently parsed literal PowerShell commands separately so commands such as `Write-Output start 'https://example.com'` do not trigger URL-launch checks. Retain conservative checks for pipelines, script state, executable strings, and shell or terminal wrappers, while continuing to detect actual URL launches and destructive commands.
## Testing
Add policy regression coverage for literal arguments, separate commands, URL launches, wrappers, and destructive commands, plus a Windows integration test covering execution and policy rejection.
GitOrigin-RevId: 2878aa86bc36b44c60230cc1de3430922b28b81a
## Why
Thread stores need a way to reuse history and writer state loaded while preparing a resume, rather than loading them again during session startup.
## What changed
- Add an opaque, single-use `ThreadStoreResumePreparation` and an optional preparation in `StartThreadOptions`.
- Pass preparation through session startup to `ThreadStore::resume_thread_with_preparation`, which defaults to an unsupported-operation error.
- Reject preparation for ephemeral threads or threads without resumed history. Continue using `resume_thread` when no preparation is supplied.
## Testing
Add a regression test verifying that supplied preparation selects the prepared store path and propagates its unsupported-operation error instead of falling back to ordinary resume.
GitOrigin-RevId: 26537d9b83443bd56341d6afc713f32b999dc67c
## Why
A remote primary environment could supply its working directory and workspace roots to host plugins and MCP processes, breaking relative MCP executable resolution and applying the wrong workspace permissions.
## What changed
- Build host configuration from the local environment, falling back to the session's host working directory and runtime workspace roots when no local environment is selected. Preserve explicitly empty local roots.
- Use the same host configuration for MCP startup and refresh, and refresh MCP state when runtime workspace roots change.
- Keep repository skill discovery paired with the primary executor's working directory and filesystem.
- Box skill warmup and turn context construction futures to reduce enclosing future sizes.
## Testing
Extend the MCP integration test to cover a remote primary with populated, empty, or absent local roots; relative executable resolution before and after refresh; workspace-root revocation; and remote repository skill discovery.
GitOrigin-RevId: 21a73c90507b55fd94261e7bf348695ff8466a24
## Why
Compaction could record partial output before the response completed, leaving failed summaries in conversation history and persisted rollouts.
## What changed
Buffer compaction output until `response.completed` so failed or incomplete attempts leave no partial output in history. Record successful output before the response completion notification, preserving its compaction metadata.
## Testing
Add regression coverage for preserving messages, tool results, and token usage after a disconnected compaction stream, including after restart. Verify incomplete compaction output is excluded from subsequent requests and successful output remains observable and persisted.
GitOrigin-RevId: 8651200b2aae616000c55c1ed63283f3e2c1b8d5
## Why
Standalone thread settings updates cleared the running turn's continuation lineage, preventing recovery after a daemon restart.
## What changed
Preserve continuation lineage while a task is registered. Continue invalidating pending continuations for idle, reserved, and finishing turns, and record started-turn lineage atomically with task registration.
## Testing
Extend settings invalidation coverage to idle, reserved, and finishing turns. Exercise an in-flight reasoning effort update before compaction, then verify cold resume preserves the turn's frozen settings and allows continuation. Wait for thread idle before testing idle continuation.
GitOrigin-RevId: d7c316af6a4c871790bb57f0af9892bb30871ac8
## Why
Incremental-tool windows recorded base instructions only at setup, so a catalog refresh for the same model could leave active instructions stale. Instruction changes need to reach the model without rewriting the existing history prefix.
## What changed
- Track model identity and instruction content independently, appending a `model_instructions` developer message when either changes. Explicitly mark replacement or removal of base instructions, and avoid repeating unchanged updates.
- Start new windows after compaction with the latest model instructions while preserving custom base instructions.
- Preserve the recorded window base during local compaction retries, including empty instructions, and rebuild current model instructions when reconstructing child context.
## Testing
Add integration tests and request snapshots for catalog refreshes, instruction removal, model switches, compaction, restart, and forks. Extend regression coverage for legacy snapshots and local compaction retries.
GitOrigin-RevId: eeca69067b4d9cd91c817732d79b4d5c1faa18b9
## Why
Message roles and content classifications do not identify who supplied each context part. Source attribution needs to survive prompt assembly and history truncation, including messages that combine text from different producers.
## What changed
- Add per-part `ContentItemMetadata` for user input, developer instructions, `AGENTS.md`, skills, harness context, command hooks, and tool context with optional callable namespaces.
- Carry attribution alongside content and classifications through contextual fragments, extension prompts, hook output, and agent messages. Keep tool-provided context-window hints separate from harness text.
- Preserve the source of retained text slices during compaction and attribute generated truncation notices to the harness. Default missing historical attribution to unknown.
- Attribute host MCP calls using cached tool namespaces only when catalog revisions remain stable, without starting servers or refreshing catalogs for attribution.
- Send the new metadata to Responses Lite and strip it from requests to endpoints that do not support it.
## Testing
Extend compaction tests to cover mixed sources, missing or extra metadata entries, and discarded media. Update Responses Lite request assertions to verify endpoint-specific attribution handling.
GitOrigin-RevId: b0ebc929b7c60f3ec49d1affbf897312d63edcc8
## What changed
- Launch background compaction at eligible pre-turn, mid-turn, and post-turn checkpoints when `AsyncCompaction` is enabled, capturing the current world state and client routing state.
- Adopt ready results at compaction checkpoints while preserving newer messages, tool outputs, and world-state updates. Continue normally if an optional result is rejected.
- Run one foreground compaction if an adopted result still exceeds the context limit.
- Prevent cancelled turns from launching new background work while preserving already-running work for later reuse.
## Testing
Add unit and scenario coverage for stale history and account changes, cancellation, pending-result reuse and fallback, retained tool outputs, compaction event pairing, and token usage accounting. Add a context snapshot covering a collaboration-mode change while compaction runs.
GitOrigin-RevId: 04ac028d9fe2e3ea64aacaaeb351c3c776cf3940
## Why
Assistant messages delivered during a pending Guardian review can change its evidence. Previously, these context changes aborted the review instead of triggering a fresh assessment.
## What changed
Treat changes to local or root review context as stale authorization so Guardian retries with updated evidence. Cancellation and history resets still abort the review.
## Testing
Extend local and worker delivery tests to cover refreshed allow and deny decisions, verify that the new review includes the delivered message, and ensure commands execute exactly once after approval and never on stale approval or denial.
GitOrigin-RevId: 019205bee6d3f4e8cf6b9268f72bbc5db6b3899e
## What changed
Add optional `voiceSessionId` to realtime start parameters and forward it as the `voice-session-id` header for WebSocket, WebRTC, and existing-call transports. Keep this client-generated voice session identifier distinct from `realtimeSessionId`, which uses `x-session-id`.
## Testing
Extend serialization tests and add coverage for distinct session ID headers, WebRTC request forwarding, and existing-call handshake forwarding.
GitOrigin-RevId: cb558dbb9d438f2d34e281199a7e81fe5d33b879
## What changed
- Return qualified skill names such as `team:deploy` and parsed `dependencies` and `policy` instead of a separate namespace and raw metadata file. Share `agents/openai.yaml` parsing and validation between skill loaders and executor discovery.
- Include each standalone skill's search-root ID and path in `discoveryRoot`, while accepting responses from older executors that omit it.
- Add plugin `displayName`, falling back to the manifest name or installation directory.
- Materialize inline MCP declarations in `mcpConfig` with the manifest as their source path, and report incomplete discovery when declared MCP or Apps configuration files have no returned contents.
## Testing
Add coverage for JSON round trips, omitted `discoveryRoot`, optional and invalid skill metadata, qualified names, display-name fallbacks, and inline MCP configuration. Verify standalone search roots survive cached discovery and sandboxed RPC responses.
GitOrigin-RevId: 4124972444ad7c2fb8c6418acbf9a589d797fad2
## What changed
When the remote global catalog is active, let a cached `visualize@openai-curated-remote` install supersede `visualize@openai-bundled`, matching the existing Sites behavior. A disabled remote install also suppresses the bundled plugin; a missing remote bundle preserves the bundled fallback.
## Testing
Extend the agent-turn compatibility tests to cover Visualize with enabled, disabled, and missing remote bundles, asserting which skills appear in the developer prompt.
GitOrigin-RevId: 7d0cc564189249e597d5bd29b5800353d89a9060
## What changed
- Add the disabled-by-default `executor_capability_discovery_v2` feature to acquire `capabilities/discoverV2` inventories from supporting remote executors using each selected environment's working directory and sandbox.
- Share snapshots with MCP and world-state contributors and skill providers without activating discovered plugins or publishing discovered skills to the model.
- Cache inventories by environment instance, executor session, working directory, and sandbox. Coalesce concurrent requests, refresh the cache at turn start, retry transient failures, and refresh MCP projections after recovery.
- Resolve the system skills root in the executor and pass it explicitly to capability location discovery.
## Testing
Add coverage for feature gating, unsupported executors, inert inventories, cache reuse and eviction, turn refreshes, failure recovery, executor replacement, and system skill locations.
GitOrigin-RevId: 1bdca28fa7f17622b27e2713ab3dcc0c13426889
## What changed
Use `conversation` when neither a local `async_classifier_mode` override nor a model default specifies a mode. Keep `snapshot` available as an explicit override and update the configuration documentation and schema to describe the new fallback.
## Testing
Expand configuration tests to cover all local override and model default combinations. Update app-server approval tests to exercise conversation mode without an explicit override, and explicitly select snapshot mode in tests that depend on it.
GitOrigin-RevId: a62479a3f6454bf28d589373a236d8b0ab5023b9
## What changed
- Default `features.api_key_cyber_access_programs` to `true` and allow `codex exec` to select Daybreak with an OpenAI API key. Select the advertised standard program when `daybreak=false`, while respecting explicit feature opt-outs.
- Resolve API-key eligibility for TUI background turns from the target thread's feature settings, including project opt-outs. Omit access-program overrides when the server cannot report those settings.
- Preserve automatic server treatment for unlisted models and missing or empty Cyber program metadata in exec and TUI. Continue rejecting Daybreak when a nonempty program list does not offer it.
## Testing
Update regression coverage for API-key Daybreak selection, the off override, explicit opt-outs, resumed sessions, target-thread settings, and missing model metadata.
GitOrigin-RevId: f3cf7bd95a2754d4b4281bc70b18c7da4b177552
## Why
MCP servers must forward sandbox policy unchanged to `codex sandbox --sandbox-state-json`, while interpreting launcher information to find the Codex CLI. Keep those contracts separate so consumers can preserve unknown policy fields.
## What changed
- Accept the experimental `codex/sandbox-state` capability alongside the deprecated `codex/sandbox-state-meta` capability, and send identical policy values under both `_meta` keys.
- Move `codexExecutable` out of the policy into `codex/sandbox-launcher`, supplied only when a verified CLI path is available for a local stdio server.
- Replace stale sandbox metadata while retaining unrelated entries, and remove stale launcher metadata when no launcher is available.
- Document the metadata contract and how servers should forward policy and retain authority for long-lived subprocesses.
## Testing
Update unit and integration coverage for policy serialization, identical state aliases, launcher availability across execution environments, and stale metadata replacement.
GitOrigin-RevId: e544c06e6e023953b1fc8069b7b1affa065262d1
## Why
Canceled classifier requests need bounded cleanup that preserves received token usage and returns only safe WebSocket connections to the pool.
## What changed
- Own classifier response streams and connection leases together, interrupting dropped responses with a one-second cleanup deadline.
- Require a matching interruption acknowledgement and response completion before reusing a canceled response's socket. Retire sockets on rejection, invalid acknowledgements, or timeout while preserving any received completion and token usage.
- Skip requests canceled before dispatch and return their unused sockets to the pool.
- Distinguish cancellation from ordinary steering, which continues draining without requiring an interruption acknowledgement.
## Testing
Add regression coverage for cancellation, acknowledgement ordering and failures, cleanup timeouts, socket reuse, and token accounting under backpressure. Extend steering tests to cover rejected and missing acknowledgements.
GitOrigin-RevId: c4e7aac49d36cea2c2d0e9f2ba5f6147f67471dd
## Why
Encrypted compaction payloads can include sampled-token replay caches that increase their size roughly threefold. Budgeting them as ordinary text can reject checkpoints that fit the model context budget.
## What changed
Use a shared estimate of one token per twelve ciphertext bytes, rounded up, for encrypted `Compaction` and `ContextCompaction` items in history and Guardian context budgeting. Guardian continues to count framing and metadata separately.
Check parent compactions against the configured token budget and a separate hard wire-size limit. Preserve the complete encrypted checkpoint when it fits. The token estimate remains a heuristic and can underestimate legacy checkpoints without replay caches.
## Testing
Add coverage for token-estimate rounding, parent compaction token and wire-size limits, and reviewer continuation with a cached compaction preserved intact.
GitOrigin-RevId: cc18ca29802491865167eef992830efcf93d97da
## Why
Prediction forks need to retain their parent's context even when it exceeds the automatic compaction threshold. Compaction or context resets can otherwise replace the history used for the prediction.
## What changed
- Apply a thread-local `AutoCompactionDisabled` policy to experimental prediction forks without changing model or skill budgets.
- Skip automatic compaction before, during, and after turns, including context-limit recovery, and suppress new token-budget reminders.
- Reject `new_context` requests for these threads and report context-limit failures without compacting their history.
## Testing
Add regression tests for legacy and paginated prediction forks across compaction thresholds, unchanged parent compaction and skill/tool inputs, context-limit failures, and rejected context resets. Add a request-history snapshot verifying inherited context and reminders survive without compaction or additional reminders after a tool call.
GitOrigin-RevId: 7df374287f4142f776981bb6c22e5caa564d74a5
## Why
A transient Apps MCP startup failure can remove cached tools that the model has already discovered, preventing a later Code Mode invocation from using them.
## What changed
Keep cached Apps tools in the model's tool catalog while startup recovery runs. Let invocation readiness start or join a shared retry before acquiring the tool execution lock, while tool discovery remains nonblocking. Keep recovery running if a waiting invocation is cancelled.
## Testing
Extend connection-manager tests to cover cached tool bindings and shared recovery. Add a Code Mode regression test that discovers a cached Calendar tool, invokes it after startup fails, and verifies that it succeeds after recovery while unrelated tools remain able to execute.
GitOrigin-RevId: e888501a1050884a50a473e71b893cf6672fe256
## Why
Terminal `response.incomplete` errors discard reported token usage. Counting that usage as a new context baseline can also double-count input and trigger unnecessary compaction on the next turn.
## What changed
- Carry the response ID and valid reported usage with incomplete-response errors.
- Record usage for sampling and foreground compaction in cumulative totals, rollout records, budgets, and token-usage contributors without replacing the context baseline. Preserve the original terminal error, including when accounting exhausts the budget or cancellation races the error.
- Charge incomplete background compaction requests to the rollout budget without publishing foreground token usage.
- Ignore missing or malformed usage rather than estimating it.
## Testing
Extend coverage for SSE and WebSocket incomplete responses, rollout usage records, compaction accounting, deferred token-count events, and token-usage contributors. Add regressions for unnecessary compaction on the next turn and background compaction publishing foreground usage.
GitOrigin-RevId: bf1ee6df3912052ab7c19e1c6af8ad3dc4b07675
## Why
Cancellation after initial input admission could leave a child registered even though the spawn caller had not received its result.
## What changed
Resolve the child's status and configuration before committing reservations and releasing provisional ownership. This keeps cancellation cleanup active through the final awaits and lets the spawn result return without yielding after commitment. Cancellation after the result returns does not retract the accepted child.
## Testing
Add a regression test that cancels spawn during the final status lookup after input admission and verifies that the child is unregistered, terminated, and unloaded, and that shutdown completes. Extend the provisional-child cancellation test to cover both native V1 and V2 callers.
GitOrigin-RevId: 028b873ad4c1fac2c4b5d1dc823b4561ff19e6bf
## Why
Non-parallel tool calls can acquire their lock in either order, making the shared board scenario's `last_message_id` snapshot nondeterministic.
## What changed
Send each `collaboration.post` call in a separate mocked response to order the writes before snapshotting. Update the `board_connections` snapshot and expected request count from 15 to 17 to reflect the additional responses.
GitOrigin-RevId: a290a01f5071a2081d4d0b1531b1b31bfbb8a6e6
## What changed
Emit `codex.guardian.review.truncation` counts and `codex.guardian.review.truncation.bytes` histograms after successful input finalization. Aggregate observations across reduction stages by component and disposition (`truncated` or `omitted`), recording original, retained, and omitted byte totals. Exclude feasibility checks and failed retries from loss telemetry.
Keep blocking command-hook cancellation fixtures in the local environment and use double quotes for the Python command.
## Testing
Add metric-export tests covering aggregation across multiple reductions, separate truncation and omission totals, no loss metrics for rejected inputs, and no duplicate reporting on repeated finalization.
GitOrigin-RevId: 69182fc7afe230be69dd2469caedb5ae4494947b
## Why
Remote process exit can arrive before the final output, and inherited pipes can keep the output stream open after exit. Removing the session at exit can lose output that should remain available to `write_stdin` polls.
## What changed
- Retain remote sessions with open or unread output after exit, including early exits and cancelled initial collection.
- Collect pending output when `write_stdin` races with exit, skipping stdin writes once remote exit is known.
- After initial collection finishes and the process exits, allow a five-second grace period before a final background read. Respect active polling deadlines and keep later polls available while that read recovers retained output.
- Let explicit termination stop output collection even when the process has already exited, and install the exit watcher before cancellable cleanup.
## Testing
Extend remote process event tests to cover output arriving after the initial yield, polling during a delayed final read, active polls exceeding the background grace period, resumable cancellation, and termination before the initial yield.
GitOrigin-RevId: b1671fad8b61a2cdecf7cf9fdf92e57c028c7af8
Anthony Tafoya