- GPT-6-Astra is now available in the model picker and Amazon Bedrock catalogs. (#42879, #42619)
- Experimental worktree support lets you create isolated checkouts for new or forked sessions using `--worktree` or `/worktree`, then browse and resume them. (#42652, #43069, #43120, #43286)
- Answer questions inline while Codex continues working, using suggested choices or custom text without losing your main draft. (#42891, #42894, #42897)
- Windows sessions can now share a background Codex server, with daemon lifecycle commands and managed updates. (#42405, #42392)
- Vim editing gains `R` replace mode with undo and dot-repeat, plus more reliable Escape handling in legacy terminals. (#42194, #42584)
- Copying responses preserves formatting in rich-text apps, and `/copy` can copy status output or individual session fields. (#42847, #43055)
## Bug Fixes
- Existing sessions pick up newly installed plugin tools and refresh skills and hooks after external plugin upgrades or rollbacks. (#42284, #42593, #42990)
- MCP connections coordinate OAuth token refreshes and surface login challenges when refresh fails, without automatically replaying rejected tool calls. (#42413, #42552)
- Startup avoids running workspace-controlled helpers before trust is established, and the macOS sandbox blocks terminal input injection. (#42324, #42590)
- Remote resume and fork operations preserve saved permissions; fresh sessions and forks respect server model defaults unless explicitly overridden. (#43330, #43177, #43355)
- Resuming a conversation open in another app now shows a read-only transcript with a retry option while preserving your draft. (#43253)
- Automatic approval reviews better preserve authorization context through compaction and reject approvals invalidated by new user instructions or answers. (#42844, #42852, #43442)
## Documentation
- Updated the bundled OpenAI Docs skill with GPT-6-Astra migration, compatibility, and prompting guidance. (#42931)
## Chores
- The deprecated `codex mcp-server` entry point is no longer available. (#42993)
## Changelog
Full Changelog: https://github.com/openai/codex/compare/rust-v0.153.0...rust-v0.154.0
- #42188 Fix punctuation in npm packaging documentation @copyberry
- #42192 Use native spawning for bare macOS MCP commands @copyberry
- #42194 Add Vim replace mode to the TUI composer @copyberry
- #42196 Add managed worktree creation @copyberry
- #42199 Refactor shared TUI input routing @copyberry
- #42202 Separate TUI preferences from server configuration @copyberry
- #42204 Add macOS voice runtime projection @copyberry
- #42207 Retry TUI reconnects while threads are closing @copyberry
- #42208 Add GNU Linux voice runtime preparation @copyberry
- #42209 Add Windows voice runtime preparation @copyberry
- #42247 Track history notes thread hint outcomes @copyberry
- #42256 Skip Guardian scoring in User approval mode @copyberry
- #42270 Report the exec-server release version in environment info @copyberry
- #42284 Refresh plugin skills after out-of-process version changes @copyberry
- #42288 Fetch rules_rs zlib packages from Ubuntu snapshots @copyberry
- #42290 Expand Guardian history coverage across resume and rollback @copyberry
- #42293 Preserve verified answers across history compaction @copyberry
- #42298 Preserve retained answers across steer rollbacks @copyberry
- #42306 Stabilize the detached exec-server session resume test @copyberry
- #42309 Separate Windows sandbox provisioning from ACL refresh @copyberry
- #42314 Preserve target-native cwd in permission approval requests @copyberry
- #42316 Refactor exec-server startup futures @copyberry
- #42318 Support packaged managed Codex binary paths @copyberry
- #42319 Show live context compaction status in the TUI @copyberry
- #42320 Make the app-server thread unload delay configurable @copyberry
- #42324 Avoid executing PATH helpers before workspace trust @copyberry
- #42325 Render completed assistant messages directly during replay @copyberry
- #42326 Harden Windows control socket rendezvous @copyberry
- #42328 Support durable reasoning configuration updates @copyberry
- #42330 Protect Windows sandbox binaries from inherited write access @copyberry
- #42332 Package prepared runtimes with the voice host @copyberry
- #42334 Add a Windows sandbox provisioning protocol @copyberry
- #42337 Add an authenticated Windows sandbox provisioning client @copyberry
- #42341 Add Windows sandbox service lifecycle scaffolding @copyberry
- #42342 Harden Windows sandbox provisioning file handling @copyberry
- #42344 Prepare managed policy validation for Windows sandbox provisioning @copyberry
- #42348 Add Windows sandbox client authentication @copyberry
- #42351 Enable authenticated Windows sandbox provisioning @copyberry
- #42353 Add experimental Windows sandbox service provisioning @copyberry
- #42354 Add free-form asynchronous user messages @copyberry
- #42356 Initialize questions in buffered replay test messages @copyberry
- #42358 Extend rate limit reads with usage capabilities @copyberry
- #42364 Support graceful daemon shutdown on Windows @copyberry
- #42366 List managed worktrees for a repository @copyberry
- #42369 Keep SQLite history projection moving past invalid records @copyberry
- #42370 Improve MCP server startup error logging @copyberry
- #42372 Add Luna Reserve usage fallback to the TUI @copyberry
- #42373 Add attributed exec process lifecycle telemetry @copyberry
- #42374 Extract PID startup into a dedicated module @copyberry
- #42375 Clean up Windows sandbox resources on app uninstall @copyberry
- #42377 Make app-server realtime sessions always available @copyberry
- #42378 Route rollout reads through the canonical JSON decoder @copyberry
- #42380 Require confirmation for safety-buffered retries @copyberry
- #42381 Support managed app-server lifecycle on Windows @copyberry
- #42383 Update rmcp to 3.2.0 @copyberry
- #42384 Add an RMCP OAuth credential store adapter @copyberry
- #42385 Add experimental context management activation @copyberry
- #42386 Expose loaded thread environments in app-server responses @copyberry
- #42388 Recover deferred environments after provisioning failure @copyberry
- #42391 Authorize `apply_patch` in the executor path context @copyberry
- #42392 Support managed daemon updates on Windows @copyberry
- #42395 Expose the Codex version to commands and turn metadata @copyberry
- #42397 Extract focused TUI logic into submodules @copyberry
- #42399 Preserve restored input after resolved misalignment errors @copyberry
- #42401 Discover TUI collaboration modes from the app server @copyberry
- #42403 Expose the last accepted environment ready report @copyberry
- #42404 Read voice helper frames independently of pipe chunks @copyberry
- #42405 Support the app-server daemon on Windows @copyberry
- #42406 Honor explicit plugin mentions during MCP startup @copyberry
- #42408 Harden embedded composer input handling @copyberry
- #42410 Allow reviewing and continuing misalignment-paused chats @copyberry
- #42413 Enable coordinated MCP OAuth refresh @copyberry
- #42417 Expose managed application network requirements @copyberry
- #42419 Add session resume to the agent command center @copyberry
- #42422 Honor model requirements in Guardian computer-use scoring @copyberry
- #42425 Discover TUI experimental features from the server @copyberry
- #42428 Use the shared composer in the agent command center @copyberry
- #42432 Box the TUI resume picker future @copyberry
- #42445 Include originator in plugin measurement analytics @copyberry
- #42451 Acknowledge pending TUI steers by submission ID @copyberry
- #42453 Discover permission profiles from the app server @copyberry
- #42455 Show live task details in the agent command center @copyberry
- #42458 Expose thread originators through the app-server API @copyberry
- #42529 Register the Guardian thread context feature flag @copyberry
- #42552 Preserve MCP authentication challenges on tool calls @copyberry
- #42577 Preserve target-native paths in command approvals @copyberry
- #42579 Persist verified user answers in Guardian thread context @copyberry
- #42584 Recover Vim escape input in legacy terminals @copyberry
- #42588 Require Guardian review for incompatible compaction checkpoints @copyberry
- #42590 Harden the macOS sandbox against terminal input injection @copyberry
- #42593 Reload user config after local plugin installation @copyberry
- #42596 Record Windows sandbox private desktop usage @copyberry
- #42598 Report MCP tool discovery errors in server status @copyberry
- #42602 Deprecate detached review delivery @copyberry
- #42603 Expose global metrics installation in `codex-otel` @copyberry
- #42606 Support trusted headers for remote exec WebSockets @copyberry
- #42607 Add GPT-6-Astra to the bundled model catalog @copyberry
- #42609 Condense TUI startup warnings @copyberry
- #42619 Add GPT-6-Astra to Amazon Bedrock catalogs @copyberry
- #42623 Bound Noise handshakes by the exec server initialization timeout @copyberry
- #42624 Centralize prompt image detail modes @copyberry
- #42631 Initialize the packaged GStreamer runtime in the voice host @copyberry
- #42634 Add an injectable attachment store to ThreadManager @copyberry
- #42638 Update GPT-6-Astra Fast tier speed description @copyberry
- #42639 Warn when saved model defaults are overridden @copyberry
- #42640 Harden TUI parsing of assistant markup @copyberry
- #42641 Restore the inline TUI after full-screen overlays @copyberry
- #42650 Render assistant file citations as local links @copyberry
- #42652 Add managed worktrees to `codex exec` @copyberry
- #42654 Update the stable exec-server test to Codex 0.153.1 @copyberry
- #42657 Use a generic fallback model name in status tests @copyberry
- #42667 Tailor TUI cyber refusal notices to Daybreak eligibility @copyberry
- #42668 Cancel remote control enrollment on stdio shutdown @copyberry
- #42671 Preserve TUI sessions while starting replacement threads @copyberry
- #42674 Persist server-advertised experimental features from the TUI @copyberry
- #42676 Add WebRTC negotiation to the voice host @copyberry
- #42677 Narrow async user message guidance @copyberry
- #42682 Fix the worktrees experimental feature test fixture @copyberry
- #42716 Allow trusted symlinks beneath CODEX_HOME on macOS @copyberry
- #42718 Gate unified exec TTY support behind a feature flag @copyberry
- #42741 Make the TUI symlink startup test Bazel-compatible @copyberry
- #42744 Honor model-provided Guardian review policies @copyberry
- #42746 Handle pending network reviews after process completion @copyberry
- #42749 Improve automatic thread naming in the TUI @copyberry
- #42752 Preserve response IDs for fast collaborator tool events @copyberry
- #42755 Stabilize the interactive tmux startup safety test @copyberry
- #42758 Propagate response tickets to Guardian reviews @copyberry
- #42762 Retain user instructions in guardian thread context @copyberry
- #42767 Avoid port races in streamable HTTP tests @copyberry
- #42770 Preserve acceptance order in retained thread context @copyberry
- #42773 Avoid holding metadata permit during cold resume config load @copyberry
- #42781 Add direct SigV4 transport to exec-server @copyberry
- #42791 Keep TUI prompt history tied to local settings @copyberry
- #42792 Extract the note input view into its own module @copyberry
- #42798 Add data-use disclosures to the user report dialog @copyberry
- #42801 Keep the Windows sandbox command runner hidden @copyberry
- #42807 Add request-scoped Guardian approval decisions @copyberry
- #42811 Enable staging login issuer overrides in packaged builds @copyberry
- #42814 Support custom report event titles @copyberry
- #42819 Route Guardian approvals independently of async scoring @copyberry
- #42821 Report managed filesystem policy in `codex doctor` @copyberry
- #42823 Expose managed WebMCP policy through the app server @copyberry
- #42824 Refine user input guidance for GPT-6 @copyberry
- #42832 Preserve root authorization context in Guardian reviews @copyberry
- #42833 Preserve SystemRoot for Windows sandbox wrapper setup @copyberry
- #42835 Preserve Windows managed deny reads in the sandbox CLI @copyberry
- #42836 Make GPT-6-Astra user input guidance conditional @copyberry
- #42838 Preserve executor paths in Guardian approval reviews @copyberry
- #42841 Add a native Windows MXC sandbox adapter @copyberry
- #42842 Add Astra sparkle effects to the TUI composer @copyberry
- #42844 Retain user instructions in Guardian context @copyberry
- #42847 Preserve Markdown formatting when copying TUI responses @copyberry
- #42850 Use jemalloc for Linux musl binaries @copyberry
- #42852 Harden Guardian reviews after context compaction @copyberry
- #42854 Persist Daybreak preferences in thread metadata @copyberry
- #42863 Preserve precedence across feature requirement aliases @copyberry
- #42870 Avoid redundant filesystem sandbox path resolution @copyberry
- #42879 List GPT-6-Astra in the model picker @copyberry
- #42883 Add client-side exec-server RPC attempt metrics @copyberry
- #42889 Add TUI building blocks for inline async question editing @copyberry
- #42891 Integrate asynchronous questions into the TUI @copyberry
- #42894 Support selectable answers for asynchronous TUI questions @copyberry
- #42897 Add inline Other answers to async question choices @copyberry
- #42900 Establish root turn identity for independent tasks and memory requests @copyberry
- #42903 Preserve TUI question state and integrate history and queue navigation @copyberry
- #42904 Use static instructions for the Default collaboration mode @copyberry
- #42931 Update OpenAI Docs skill guidance for GPT-6 Astra @copyberry
- #42933 Wait for turn analytics before shutting down the Guardian v2 test @copyberry
- #42990 Refresh session hooks after external plugin updates @copyberry
- #42993 Remove the deprecated `codex mcp-server` command @copyberry
- #43000 Preserve the resolved multi-agent version when reverting threads @copyberry
- #43002 Replace Guardian tickets with parent response IDs @copyberry
- #43005 Add Guardian V2 failure reasons and connection timing metrics @copyberry
- #43031 Keep refreshed MCP tool catalogs with their clients @copyberry
- #43039 Refresh live thread tools through `app/installed` @copyberry
- #43043 Avoid filesystem scans when seeding the agents overview @copyberry
- #43055 Allow `/copy` to copy status output and individual fields @copyberry
- #43069 Support managed worktrees for interactive sessions and forks @copyberry
- #43070 Clarify comments in CI setup and the Rust workflow @copyberry
- #43074 Show a retryable error when the apps popup fails to load @copyberry
- #43079 Add opt-in local audio devices to the voice helper @copyberry
- #43083 Supply Bazel-managed CMake and Ninja for the bundled Opus build @copyberry
- #43090 Send processed microphone audio over RTP in voice-host @copyberry
- #43097 Add a helper-backed realtime WebRTC session API @copyberry
- #43099 Add receipt-verified native voice SDK export @copyberry
- #43100 Add bounded incoming Opus RTP handling to the voice host @copyberry
- #43102 Include GIO in voice SDKs and native runtimes @copyberry
- #43104 Move Guardian thread context into `guardianv2` configuration @copyberry
- #43109 Add explicit toolchain inputs for native voice builds @copyberry
- #43110 Record reasoning effort changes in conversation history behind a flag @copyberry
- #43111 Add a Bazel target for native voice dependencies @copyberry
- #43113 Save subagent and memory opt-ins through the app server @copyberry
- #43114 Add Bazel preparation for native voice runtimes @copyberry
- #43117 Link Unix Bazel bindings against the prepared voice runtime @copyberry
- #43120 Add managed worktree creation to TUI session commands @copyberry
- #43121 Require a prepared runtime when assembling voice helper packages @copyberry
- #43125 Add explicit Windows tool selection for native voice builds @copyberry
- #43126 Expose native Windows build tools through Bazel targets @copyberry
- #43144 Add Windows MSVC Bazel targets for native voice libraries @copyberry
- #43147 Gate experimental context by model capability at session startup @copyberry
- #43177 Use server model defaults for fresh TUI startup @copyberry
- #43178 Allow guarded legacy resume with background migration enabled @copyberry
- #43244 Add bounded GStreamer playback components to the voice host @copyberry
- #43248 Connect voice-host RTP audio to speaker playback @copyberry
- #43253 Show read-only conversations when resume encounters an active writer @copyberry
- #43261 Use server defaults when starting TUI background tasks @copyberry
- #43265 Add experimental user verification API contracts @copyberry
- #43279 Include linked worktrees in TUI session discovery @copyberry
- #43281 Move npm package staging into a separate release workflow job @copyberry
- #43282 Make Bazel binary stamping opt-in @copyberry
- #43286 Add a managed worktree browser to the TUI @copyberry
- #43289 Add capability-gated MCP user-verification handling @copyberry
- #43298 Defer managed worktree transitions to fresh TUI loop iterations @copyberry
- #43304 Isolate Bazel build commit metadata from Rust compilation inputs @copyberry
- #43308 Replace Windows app-server shutdown files with socket requests @copyberry
- #43315 Resolve session labels uniquely before acting on them @copyberry
- #43325 Sort JSON schema object keys for consistent Cargo and Bazel output @copyberry
- #43330 Preserve saved permissions when resuming or forking remote tasks @copyberry
- #43340 Enable remote named permission profile selection in the TUI @copyberry
- #43352 Add opt-in MCP user-verification transport @copyberry
- #43355 Let the app server resolve implicit model settings for CLI forks @copyberry
- #43359 Show the server's model provider ID in TUI status @copyberry
- #43360 Use app-server metadata for TUI session restoration @copyberry
- #43376 Defer resume picker and directory changes to a fresh TUI stack @copyberry
- #43408 Avoid WebSocket connection waits in Guardian v2 classification @copyberry
- #43419 Initialize `cwd` in TUI resume and fork test fixtures @copyberry
- #43421 Remove the app-server README and its contributor guidance references @copyberry
- #43423 Remove the app-server docs update requirement from `AGENTS.md` @copyberry
- #43426 Handle Luna HTTP requests in guardian history tests @copyberry
- #43428 Notify opted-in stdio MCP servers of auth changes @copyberry
- #43432 Route approvals through the extension decision API @copyberry
- #43442 Keep Guardian review evidence consistent and reject stale approvals @copyberry
- #43444 Pin V8 release manifests and prevent published release replacement @copyberry
- #43447 Route MCP elicitations through the shared approval decision path @copyberry
- #43454 Add diagnostic labels to shell snapshot capture metrics @copyberry
- #43456 Wait for thread idle before rollback in model-switching tests @copyberry
- #43458 Centralize Guardian context mode and checkpoint policy @copyberry
- #43462 Remove legacy Guardian approval review paths @copyberry
- #43472 Recover missing Guardian root instructions in acceptance order @copyberry
- #43478 Retain inherited Guardian instructions in standalone forks @copyberry
- #43490 Expose shared Guardian reviewer helpers through `guardian_review` @copyberry
- #43491 Include unloaded children in multi-agent v2 environment context @copyberry
- #43494 Limit archive rollout reads to requested threads @copyberry
- #43495 Allow internal sessions to fork from selected history @copyberry
- #43504 Treat zombie processes as inactive in the Unix PID backend @copyberry
- #43513 Expose a stable executor build identity in environment metadata @copyberry
- #43519 Set `recursion_limit` to 256 for app-server, exec, and TUI @copyberry
## What changed
Increase `GUARDIAN_MAX_ACTION_BYTES` from 8,000 to 200,000 bytes to allow larger actions to be reviewed. Keep unified exec stdin approvals capped at 8,000 bytes with a separate `MAX_STDIN_APPROVAL_BYTES` constant.
## Testing
Update aggregate payload rejection coverage for the new limit and exercise MCP elicitation reviews with tool descriptions exceeding the previous 8,000-byte limit.
GitOrigin-RevId: fd4b97980803a7a687449043931e6f1e57e260d3
(cherry picked from commit 3d3df0a0ca)
## Why
Executor compatibility checks need a build identity that distinguishes commits
and compiler targets independently of the package release version.
## What changed
- Add optional `providerId` to exec-server environment metadata, cached at startup
and returned by initialization and `environment/info`.
- Derive the ID as SHA-256 of `git:<lowercase commit>:<target>`. It identifies a
standard build configuration, not exact executable bytes, and is omitted when
the commit stamp or target is unavailable or invalid.
- Embed the compiler target in `BuildInfo`, preserve compatibility with historical
metadata without a target, and stamp Cargo release builds with `STABLE_GIT_COMMIT`.
- Group Bazel build-script argument files under one `--arg-file` flag to reduce
Windows command-line length while preserving file order.
## Testing
Add deterministic build-ID vectors across targets, commit normalization and invalid
input coverage, and historical metadata compatibility tests. Extend exec-server
coverage for metadata caching and ensure runtime environment overrides cannot
replace the executor's build identity.
GitOrigin-RevId: 125a18c23de7ad006571940ba305836376c983f4
## Why
Unreaped zombies still pass `kill(pid, 0)` and retain their start time, so exited app-server and updater processes can appear active.
## What changed
Read process state alongside start time with `ps` and treat zombies as inactive. When the start time matches the PID record, attempt to reap the process with nonblocking `waitpid`.
## Testing
Add a Unix regression test verifying that an exited, unreaped updater is reported inactive and reaped.
GitOrigin-RevId: 55f1cd26dbb31b5835bea76591023817f1bc10b5
## What changed
Add `ThreadManager::fork_internal_session` to start an internal session from caller-selected committed history without reading an in-flight parent turn or appending an interruption marker. Preserve parent authentication and budget sharing, and propagate fork lineage. Keep `spawn_internal_session` starting with fresh history.
## Testing
Add a regression test verifying that the fork contains only the selected history, retains its parent association and authentication manager, and stays outside the public thread registry.
GitOrigin-RevId: df4260ed3adfa0abe7a07c2b6d8b8c6ef6ba3d16
## Why
Archiving threads reads metadata from every active rollout, including unrelated compressed files.
## What changed
Add `RolloutReferenceIndex::scan_unarchived_threads` and use it when archiving. Filter canonical filenames by the requested thread IDs before reading contents, while retaining metadata-based ownership checks.
## Testing
Add tests covering reverted rollouts, requested descendants, compressed rollouts, exclusion of archived and unrelated files, and candidate ownership checks.
GitOrigin-RevId: a64f7fa25e5493ed20312f1d8216422752272bae
## Why
After a cold resume and compaction, the subagent roster omitted children whose threads had not been loaded.
## What changed
Build the multi-agent v2 roster from registered direct children and render their full agent paths. Prioritize loaded children, sort alphabetically within each group, and cap the rendered roster at eight agents and 1,024 bytes. Preserve the existing behavior for other multi-agent versions.
## Testing
Extend the cold-resume integration test to check that post-compaction context includes unloaded children, excludes grandchildren, and lists a loaded child before an alphabetically earlier unloaded sibling.
GitOrigin-RevId: 745c1622133b9c01e61f4702e4b2ef6255417f39
## What changed
Add a public `codex_core::guardian_review` module exposing `GuardianAssessment`, the assessment parser and output schema, and the review session configuration builder for reuse by the Guardian extension.
Extract assessment handling and reviewer configuration into dedicated modules, preserving the existing parsing defaults, policy prompt, and read-only reviewer settings.
## Testing
Move the existing embedded-JSON, bare allow/deny, and output-schema tests alongside the assessment implementation.
GitOrigin-RevId: cb2aba3ccdb597e2876015e718e923d4f8f36802
## Why
A standalone root forked from a worker needs its inherited user instructions for Guardian review, including after compaction. Parent input counters belong to a different thread, and omitted parent answers may have restricted an inherited authorization.
## What changed
- Adopt inherited user instructions into thread-owned retained context for standalone roots, recovering surviving checkpoint messages when needed.
- Keep inherited instructions before local evidence without sharing local acceptance counters, and preserve that distinction during reconciliation and rollback.
- Mark parent verified answers as incomplete and treat recovered checkpoint instructions as incomplete excerpts.
## Testing
Add coverage for standalone forks from copied history and truncated checkpoints, retention through compaction and resume, inherited/local ordering collisions, and rollback scope.
GitOrigin-RevId: bf716e224a1d29d6c528ef0dd7cdb118a413a08c
## Why
Incomplete retained checkpoints can omit root user instructions that still survive in live history. Queued input can also reach model history after a later-accepted answer, so recording order cannot reliably order grants and restrictions for subagent authorization reviews.
## What changed
- Reconcile retained evidence with surviving local user messages using source identity and persisted acceptance order, including answers present only in the checkpoint.
- Preserve checkpoint gaps and mark evidence incomplete when recovered instructions lack an order or conflict with an existing order.
- Restore the input-order counter from surviving local metadata so new instructions sort after recovered evidence, even without a retained checkpoint.
## Testing
Add unit coverage for source matching, acceptance ordering, persistent gaps, conflicting orders, and counter restoration. Extend subagent authorization tests to cover checkpoint resume, queued approvals, missing sources, and a subsequent revocation.
GitOrigin-RevId: 8bfbfd2c797d725796187e5cecf7f3f11a5f3380
## What changed
- Remove the `fast_decision` and `full_review` extension hooks and `ApprovalAssessment`, leaving `ApprovalReviewContributor::decide` as the approval decision interface.
- Remove the duplicate Guardian V2 fast-approval implementation and `StrictReviewReason` state.
- Require an explicit `GuardianReviewReason` for synchronous reviews.
## Testing
Migrate Guardian reviewer tests to the production `decide_approval` path and cached-score tests to the registry's decision interface.
GitOrigin-RevId: 1f9092c0ff5bb1eed0c63fa557fb3807e2e71564
## What changed
Resolve `GuardianContextMode` once at session construction and share it across history retention, replay, evidence capture, compaction, and review consumers.
Extract synchronous reviewer context policy and consolidate Guardian V2 parent checkpoint selection so sampling and fast approval use the same eligibility checks. Preserve legacy checkpoint omission and strict compatibility requirements for thread-owned context.
## Testing
Adapt existing review and history tests to the explicit context mode. Move checkpoint tests alongside the extracted selector, retaining coverage for latest-item identity, unusable checkpoints, and complete-item size limits.
GitOrigin-RevId: c73fb6fea556921acfffe758a5f709d7494019dd
## Why
`TurnComplete` arrives before the active turn is cleared, so submitting a
rollback immediately can race with turn cleanup.
## What changed
Wait for the thread-idle callback with a 10-second timeout before rolling back
in the first-turn model-change and generated-image tests. Fail immediately on
an error event while waiting for `ThreadRolledBack`.
GitOrigin-RevId: c17b35d709b2c74361dd7933506ae192464ea4e8
## Why
Shell snapshot failures were grouped under `capture_failed`, making failure causes and retry attempts indistinguishable in metrics.
## What changed
- Add `purpose` (`execution` or `prewarm`), `attempt`, `shell`, and `sandbox` labels to capture counters and durations.
- Report bounded failure reasons such as `spawn_failed`, `timeout`, and `nonzero_exit` while preserving the original RPC errors.
- Include `failure_reason` on duration metrics as well as counters.
## Testing
Update the bounded retry and single-flight test to assert per-attempt metric labels for execution and prewarm captures, including failure reasons on both counters and durations.
GitOrigin-RevId: 907dc98736c5b8f91006909dacc43278efb43abf
## What changed
- Use `decide_approval` for MCP elicitations, carrying the effective approval policy, reviewer, and synchronous-review requirement into the decision.
- Preserve unsupported form and URL elicitations for user review.
- Use `computer_use_review_required()` for review evidence, session policy, and turn metadata so model policy takes precedence over the legacy flag.
- Derive strict-review notifications from each assessment's review reason.
## Testing
Add coverage for model policy precedence, user and full-access modes, sensitive elicitations, independent code-mode and nested-tool policies, cached score reuse, and user review of unsupported elicitations.
GitOrigin-RevId: d0a9c40572dca7b3dbf876230d2162b72728084d
## Why
Artifact checksums alone do not authenticate the downloaded checksum manifest. V8 downloads need a trusted digest recorded in the repository, and published releases should not have their assets overwritten.
## What changed
- Pin the V8 `150.4.0` release manifest digests and verify manifests before downloading archives or bindings in packaging and `setup-rusty-v8`, preserving CRLF support.
- Refuse to replace published V8 releases, remove unfinished drafts on retry, and use `gh release create` to upload assets before publication.
- Install Windows `sccache` through a pinned `taiki-e/install-action` in the release and canary workflows.
- Document independent manifest verification and digest recording for version updates.
## Testing
Add five packaging tests covering successful downloads, CRLF manifests, tampered manifests, missing pins, and missing pin files. Rejection tests verify that artifacts are not downloaded.
GitOrigin-RevId: 5c771cdcff376388e124faa4826bf81135d84b50
## Why
Concurrent parent compaction can remove evidence between Guardian checkpoint selection and prompt construction. New user instructions or answers received during a review can also invalidate an approval based on earlier authorization.
## What changed
- With `GuardianThreadContext` enabled, use the same parent history snapshot for checkpoint selection and prompt evidence.
- Cancel completed allow decisions if the owning session's user-message revision or root authorization version changed during the review, even without cacheable review evidence.
## Testing
Add regression coverage for evidence preservation during concurrent compaction and aborted approvals after new user instructions or verified answers. Extend reviewer context rollover coverage to exercise `GuardianThreadContext`.
GitOrigin-RevId: 1c2c82197a27c0d3d45b6fe08d200a835d80cc30
## What changed
- Let approval extensions choose between cached approval, synchronous review, and a user prompt for tool and permission requests, while core enforces mandatory Guardian and fresh-review requirements.
- Carry an optional `review_reason` on Guardian assessment events and use it to trigger strict-review notifications, retaining the fallback for older events.
- Require synchronous review when cached evidence has an unusable encrypted parent compaction.
## Testing
Add regression coverage for manual prompts and cached approvals with non-UTF-8 working directories. Update approval contributors in existing tests to use the decision API.
GitOrigin-RevId: a4e66416070bdaa881daa41429c49021629f44c1
## What changed
Advertise the experimental `codex/auth-change` capability for stdio MCP connections with an auth manager. When the server opts in, send `notifications/codex/authChanged` after initialization and on subsequent auth changes, with credential and owner generation counters and no credentials.
Track owner changes separately from credential refreshes so consumers can detect login, logout, or user, workspace, and auth-mode changes even when notifications coalesce. Treat credential changes with incomplete owner identity as owner changes as well.
Tie the notification watcher to the managed client's lifetime, limit each send to five seconds, and close the connection if a subsequent notification fails.
## Testing
Add tests for credential refreshes versus owner changes, coalesced logout and account switches, capability opt-in, notification payloads, and watcher cleanup.
GitOrigin-RevId: 35a99f5252bd48ca60a71fbdd1f708a8158e812c
Route `gpt-5.6-luna` POST requests through `luna_response` using the shared
classifier state in the guardian compaction and rollback test. This gives
HTTP classifier requests the configured mock score instead of treating them
as guardian review or parent requests.
GitOrigin-RevId: 3841705c7ed1ec564662c33f71e1c78e9b960c68
## What changed
Delete `codex-rs/app-server/README.md` and remove references to it from `AGENTS.md`, while retaining the requirement to update app-server docs and examples when API behavior changes.
GitOrigin-RevId: 664f38c4939a9784b1241225e5101b97ec4ae9e6
Set `SessionTarget::cwd` to `None` in the remote resume permission-override
and CLI fork startup tests to match the struct's required fields.
GitOrigin-RevId: d1e7a2e6b7ae3dda17ef062984917861c12fdeff
## Why
When no healthy pooled WebSocket is available, classification waits for a new connection to open and can stall on its handshake.
## What changed
- Use HTTP streaming when no healthy idle WebSocket is ready, and replenish the pool in the background with a five-minute cooldown after connection timeouts.
- Share concurrency limits and the sampling retry budget across both transports, and bound the wait for HTTP response headers.
- Cancel superseded requests while awaiting response headers and stop SSE polling when the consumer closes.
## Testing
Add coverage for HTTP fallback and recovery after cooldown, shared transport capacity, stalled response headers, and cancellation before headers or during body draining. Update sampler and extension tests to cover fallback after socket expiry, authentication changes, and transient failures.
GitOrigin-RevId: 0b23ccc1bfb2dfdbc8d2791d097706cd4dd44f39
## Why
Session transitions need stack headroom for embedded-server initialization and configuration loading. Running them inside event dispatch risks exhausting the TUI thread's stack.
## What changed
- Queue `/resume` and valid `/cd` requests for processing after event dispatch returns.
- Reject additional `/cd` requests while one is pending, and recheck the source session, working directory, idle state, and remote-environment restrictions before applying it.
## Testing
Add a Unix PTY regression test that exercises `/resume`, worktree conversation forks, `/cd`, and new worktree conversations through the real TUI event loop. Update the directory-change test to verify that dispatch queues the request without immediately changing configuration.
GitOrigin-RevId: 4950921931dfaba9e55e6bb04f98f7ba64b72122
## What changed
- Carry the working directory from `thread/list` and `thread/read` in session selections, and use app-server metadata to resolve resume and fork directories.
- Use the model reported by thread reads and thread-started notifications when restoring session state.
- Remove TUI helpers that read session IDs, working directories, and models directly from rollout files or the state database. Picker selection now requires a thread ID in the selected row.
## Testing
Extend picker coverage to verify that selections preserve the working directory, and add a snapshot asserting that switching to a read thread displays the server-reported model.
GitOrigin-RevId: c9d13e1e56ea2139d3e96344d72ca9ee2de73396
## Why
The TUI's local provider configuration can differ from the active thread's provider, causing `/status` to show misleading provider details.
## What changed
- Use the server-provided model provider ID in `/status` and update it when attaching to a thread.
- Omit the provider row until a thread is configured, and display IDs such as `openai` instead of provider names and base URLs.
- Remove runtime provider URL resolution from TUI startup and the associated widget state.
## Testing
Add regression coverage for provider display before session configuration, thread switching, and server settings updates. Update status snapshots to show server provider IDs while preserving usage-link behavior based on the server's authentication requirement.
GitOrigin-RevId: 87214b4fd971f63835e382557969e4fc3b602745
## Why
Client defaults can override the fork destination's model and reasoning effort or trigger a migration prompt for a stale model.
## What changed
- Omit implicit model and reasoning effort overrides during CLI fork startup, while preserving explicit launch settings.
- Skip the model migration prompt and service tier inference when the fork's model is left for the server to resolve.
- Initialize unspecified reasoning effort from the forked session's response.
## Testing
Add a startup regression test that changes server defaults after bootstrap and verifies that `thread/fork` proceeds without a migration prompt, model or reasoning effort overrides, an inferred service tier, or a `config/read` request.
GitOrigin-RevId: 858f0fe3c72b90bdcaf31b400144d37af5bc6ed7
## Why
Device-authenticated verification needs an app response outside automated approval and review. Previously, MCP user-verification requests were always cancelled.
## What changed
- Add typed `openai/userVerification` elicitations carrying a title, description, and challenge through core and app-server.
- Route verification to one connection enabled by trusted host activation. Restrict responses to that owner, exclude requests from replay, and cancel on disconnect or authentication changes, including account switches away and back.
- Return proofs in `content`, discard response metadata, and cancel malformed acceptances. Suppress verification response logging and analytics, and send only a generic verification notice to realtime.
- Keep the mode experimental and exclude it from stable schema exports. Capability advertisement remains disabled, and the TUI cancels verification requests.
## Testing
Add coverage for owner isolation, disconnect and authentication races, proof response handling, automated-review bypass, inactive-host cancellation, stable schema filtering, and realtime payload exclusion. Update the MCP integration test to verify that an activated request holds the tool until the client responds.
GitOrigin-RevId: c8c7b6691a3f7756682bbcca9def1df0d1feb906
## Why
The permissions picker displayed profiles from the connected app server but disabled selection of remote custom profiles.
## What changed
- Enable named profile selection through `thread/settings/update` and track pending selections until server confirmation.
- Use pending or confirmed server permissions for subsequent turns, preserve profiles across forks and prompt edits, and reconcile pending selections on reconnect.
- Block conflicting permission changes and forks while selection is pending. Preserve input when selection fails and report unsupported app servers.
- Reject working directory changes while a remote named profile is active.
## Testing
Add regression coverage for profile selection, turn permissions, pending-selection guards, prompt-edit profile preservation, reconnect reconciliation, and profile inheritance in forks and side conversations.
GitOrigin-RevId: 76e9bb7b4d631b1066974da013d9915a89dc54a7
## Why
Local permission settings could overwrite a remote task's saved server settings when resuming or forking, including its named permission profile.
## What changed
- Omit permission overrides from remote resume requests and remote fork requests that inherit saved settings.
- Reject explicit permission overrides when resuming or forking remote tasks, including overrides from session flags and selected configuration profiles.
- Refresh restored runtime permission and approval overrides after a remote resume so settings from the previous task do not persist.
- Carry the selected fork permission mode through retries after unarchiving.
## Testing
Add regression coverage for restoring saved server permission profiles, approval policies, and approval reviewers across resume and fork; rejecting explicit remote resume overrides; and clearing stale restored runtime overrides.
GitOrigin-RevId: 465c0444df380553e50ddbeeceff9dc64e5bf9c1
## Why
JSON schema exports should be identical across Cargo and Bazel builds.
## What changed
Recursively sort object keys before writing app-server protocol JSON schemas,
while preserving array order.
GitOrigin-RevId: 740c846062f7bae18790e9cf4f30734289ae3056
## Why
Selecting the first matching session name can target the wrong conversation when labels are duplicated. Session commands also need to accept preview text when no explicit name is set.
## What changed
- Share app-server label lookup across resume, fork, archive, unarchive, delete, and queue commands, matching the trimmed name or fallback preview.
- Reject distinct matching sessions across collections and source filters, and require a UUID when pagination prevents verifying uniqueness.
- Revalidate listed candidates with `thread/read`, skip unusable local rollouts, and retain compatibility with older servers that cannot read unloaded threads.
- Show ambiguous resume errors in the TUI without replacing the current conversation.
- Disable implicit local daemon reuse with `--oss`.
## Testing
Add regression coverage for name and preview lookup, provider filtering, duplicate labels across pages and collections, stale rollouts, older-server compatibility, queue ambiguity, and preserving the current conversation after an ambiguous resume.
GitOrigin-RevId: e2766276a16140fb674c9640f7050c11ac0d0f6f
## What changed
Route managed Windows app-server shutdown through `/daemon/shutdown` on the local control socket. Require the server's PID and acknowledge it before triggering shutdown through the existing drain logic. Enable the endpoint only for managed Windows launches via `CODEX_DAEMON_SHUTDOWN_SOCKET`.
Watch running-turn changes whenever shutdown is requested so socket-triggered shutdown can finish draining. Keep the updater's file-based shutdown mechanism and retain forced termination as the manager's timeout fallback.
## Testing
Add a transport test covering rejection of unmanaged shutdown requests and mismatched PIDs, plus acknowledgment before emitting the shutdown event.
GitOrigin-RevId: 3e95dc1914f61e8a131f9b6fd56b6c63688d1744
## Why
Stamped Rust binaries consume workspace status files containing build user,
host, and timestamp values. These unrelated values prevent remote cache reuse
when building the same commit across developers and CI workers.
## What changed
Generate a compiler environment file containing only `STABLE_GIT_COMMIT` through
a small stamped template action. Use it for `codex`, `codex-tui`, and
`codex-voice-host`, with Rust binary stamping disabled so their build metadata
input changes only when the embedded commit changes.
Rename the crate macro option from `stamped_binaries` to
`binaries_with_build_commit` and add `bazel_lib` for template expansion.
GitOrigin-RevId: 21d0f2e3df97670a4c2cdbc3d1972cd14cc5b439
## Why
Managed worktree transitions run through the event handler into the large synchronous `ChatWidget` constructor. Split this work so each stage runs on a fresh event-loop stack.
## What changed
- Queue worktree setup, checkout completion and configuration loading, session transition, and widget attachment as separate stages with boxed futures.
- Recheck the source session before transitioning and report retained checkout cleanup instructions when the transition cannot proceed.
- Keep the old configuration paired with the old widget until attachment, and protect input during the handoff.
## Testing
Update worktree lifecycle and submission tests to drain the deferred stages explicitly and assert that checkout creation starts before completion.
GitOrigin-RevId: 0435f56d08bf3a6392d35b5c1cfdcc0f1fe02753
## What changed
- Handle `openai/userVerification` requests through `openai/elicitation/create` when the client advertises `userVerification` support.
- Validate request fields, size limits, and base64url encoding. Require a correctly shaped, bounded proof for acceptance; cancel invalid acceptance responses and discard proof material on decline or cancellation.
- Handle request and service cancellation, including cancellation received before request dispatch. Bound early-cancellation storage and cancel new verifications when capacity is exceeded.
- Keep verification inactive in Codex: cancel requests without prompting until the typed app-server and UI path is available.
## Testing
Add tests for request and proof validation, malformed modes, cancellation races and capacity limits, timeout-pause cleanup, and independent concurrent requests. Add integration coverage showing that verification does not prompt or prevent tool and turn completion before activation.
GitOrigin-RevId: 6313c1be40fae0b33cc3ce0f8fe025b4124ed2ef
## What changed
Add a searchable “Browse worktrees” option to `/worktree` for local repositories with worktrees enabled. List checkouts from the repository's configured pool, show owner metadata, and let users resume an owner thread or copy a worktree's working directory.
Load worktrees asynchronously and discard results after the loading popup is dismissed or the request context changes. Ignore actions from stale requests and offer copying when owner metadata is missing or invalid.
## Testing
Add popup snapshots and tests for search, resume and copy actions, stale results, and disabled local worktree operations. Extend lifecycle coverage to verify discovery from repository subdirectories and handling of missing or invalid owner metadata.
GitOrigin-RevId: 2b7e694a133278da640b6bb275fd5c1202b271c7
## Why
Binaries that do not consume build identity should not have their cached compilations invalidated by Git revisions or build timestamps.
## What changed
Add `stamped_binaries` to `codex_rust_crate`, defaulting to an empty list. Only listed binaries enable stamping and receive `STABLE_GIT_COMMIT`. Opt in `codex`, `codex-tui`, and `codex-voice-host`.
GitOrigin-RevId: 9bcac29f98f20129c988f696ce5b98057be7a158
## What changed
- Stage npm tarballs in a job with `contents: read` permissions and upload them as the `npm-packages` artifact.
- Require staging to succeed before the `release` job runs, and download the staged tarballs there. Remove its dependency installation, packaging steps, and `actions: read` permission.
- Reuse native artifacts from `--artifacts-dir` when every target directory is nonempty, skipping workflow lookup and download. Retain workflow-based downloads as a fallback.
GitOrigin-RevId: 89c6a5039afbac12968fb6f35a39c8db723c4c62
## Why
Directory-scoped session lookup misses conversations in linked worktrees of the same repository. Managed worktree creation also runs synchronous Git work on the TUI event loop.
## What changed
- With `worktrees` enabled for local sessions, include corresponding directories across linked checkouts in resume and fork pickers and `--last` lookup. Group them together in the agents overview and show checkout paths for picker entries from another worktree.
- Validate shared Git metadata and backlinks, preserve relative working directories and logical path aliases, and reject directory symlink escapes. Keep the expanded directory filter stable across pagination until the listing restarts.
- Fall back to the originally requested directory when an older daemon rejects an array-valued `cwd` filter.
- Create managed worktrees on a blocking worker, check transition blockers before allocation, and revalidate the source session before switching. Report retained checkout paths and cleanup instructions if the transition cannot complete.
- Start the in-session picker server in a separate task to avoid exhausting the TUI event future's stack.
## Testing
Add coverage for linked-checkout discovery, feature gating, picker selection and rendering, project grouping, pagination stability, and legacy daemon fallback. Extend worktree lifecycle tests to cover running-agent blockers and recovery after the source session changes during creation.
GitOrigin-RevId: 4a8a36c0dba3d32d72600f2edf8258a29fb4cb07
## What changed
Add `userVerification/status`, `userVerification/enroll`, `userVerification/delete`, and `userVerification/verify` behind the `experimentalApi` capability. Define request, response, proof, and typed error contracts, export their schemas, and document the API.
All four methods currently return `unavailable` with reason `providerUnavailable`; native verification operations are not implemented by this change.
## Testing
Add tests for experimental opt-in, typed provider unavailability, readiness serialization, and rejection of mismatched error reasons and native diagnostic payloads.
GitOrigin-RevId: a858ab41523c5acec7dbf3cfa7fcab693ac44a8c
## Why
Background tasks launched from the agents overview could use client model settings instead of the server defaults for the destination directory.
## What changed
- Read `config/read` for the task's destination before starting the thread, preserving explicit launch settings and applying managed new-thread defaults.
- Use the server's model provider for embedded sessions when no model or provider override is set. When the server clears the model and fast mode is enabled, resolve the fallback model from the server catalog.
- Restore the prompt and show an error if settings cannot be loaded. Keep the existing fallback for older servers that do not support `config/read`.
## Testing
Add request-level tests for local and remote destinations, model and provider selection, explicit and managed defaults, fast-mode fallback, and prompt recovery after a configuration read failure.
GitOrigin-RevId: 50c84fba964463303442dd849e1280bcd5b4f467
## Why
Resuming a conversation that is open in another app fails with an active-writer error. Allow users to inspect its transcript and retry after closing it in the other app.
## What changed
- Fall back to a read-only history snapshot on active-writer conflicts during startup and session selection.
- Replace the composer with an explanatory notice, `R` to retry, exit shortcuts, and the configured transcript shortcut.
- Block input and freeze active command and MCP animations while viewing the snapshot. Preserve initial prompts and existing drafts for a successful retry.
- Keep the subscription when retrying the same thread and preserve read-only state across thread switches and reconnects.
## Testing
Add regression tests for conflict detection, history viewing, draft preservation, same-thread retry without unsubscribing, exit shortcuts, and notice and frozen-tool rendering.
GitOrigin-RevId: fa864cc73143cad9139c22e33b7958569eec20cf
## Why
The voice host drained incoming RTP packets without playing them. Route received audio through decoding and speaker output while preserving speaker suppression boundaries.
## What changed
- Add a GStreamer pipeline with RTP jitter buffering, Opus decoding, conversion, and resampling into the native speaker sink.
- Rebuild playout when the speaker is re-enabled, reject packets received before the new pipeline started, and discard queued audio and echo references on speaker transitions while preserving capture history.
- Limit each receive pass to 64 packets so incoming media cannot indefinitely delay audio controls.
- Prevent retired sink failures from failing a new speaker generation, and retain the last coherent playback delay estimate during callback contention.
## Testing
Add tests for real Opus playback and stale packet rejection, combined microphone mute and speaker suppression, retired sink failures, delay contention, and echo-reference reset without losing capture history.
GitOrigin-RevId: c91c94a2ba2347ac98af4e7fd1dc331ae766cc45
## What changed
- Add a `GstAudioSink` subclass backed by a bounded mono `F32LE` playback writer, with partial writes, cancellation on speaker epoch changes, and delay accounting for queued samples and pending device output.
- Recreate the CPAL output stream and discard buffered audio when speaker controls change the epoch, preventing stale audio from surviving suppression.
- Add GStreamer dependencies, adjust Windows Bazel native-tool selection, and allow the helper handshake time to load startup-linked libraries.
- Separate installed-client tests from protocol lifecycle tests and supply native startup libraries in test packages.
## Testing
Add unit coverage for partial writes, sample accounting, suppression cancellation, stale writers, device delay, invalid samples, and stalled consumption.
GitOrigin-RevId: c48c48d2fee00659cf6f8a4039a6745385cb77cd
## Why
Enabling background rollout migration disabled the TUI's cached legacy resume shortcut, even when the rollout maintenance lock could prevent migration during resume.
## What changed
Allow embedded sessions to use the shortcut regardless of migration feature settings when they acquire the maintenance lock and revalidate that the thread still uses legacy history. Hold the lock through `thread/resume` so the response can safely include turns. Remove the session's cached startup migration setting.
## Testing
Update the regression test to cover all four combinations of startup and workspace migration settings, checking lock acquisition before metadata revalidation, a two-request resume, and nonempty history.
GitOrigin-RevId: cf525a6edb813050469dff39b83e5e61214485a1
## Why
Fresh startup could use saved client model and reasoning settings that differ from the app server's effective configuration. A cleared server model could also leave startup using a stale client model from bootstrap.
## What changed
- Reuse the new-session defaults reader at startup to load `model` and `model_reasoning_effort` through `config/read` before `thread/start`, using the appropriate embedded or remote working directory.
- Preserve explicit CLI and selected-profile settings, then apply managed new-thread defaults with the existing precedence rules.
- When the server has no configured model, select the startup model from its model catalog, falling back to the bootstrap default if the catalog is empty.
- Fall back to local defaults when older servers do not support `config/read`; stop startup before thread creation on other read failures.
## Testing
Add request-level tests for defaults and override precedence, working-directory selection, cleared-model fallback, request ordering, unsupported servers, and read failures.
GitOrigin-RevId: e094ba5d5501fdb34c393a0117b34dd93d8d4f2b
## Why
Experimental context activation previously checked the provider and account eligibility without checking model support. Child sessions also inherited token-budget activation from their parent, even when starting fresh with a different model.
## What changed
- Add `ModelInfo.supports_experimental_context`, defaulting to `false`, and enable it for the bundled `gpt-6-astra` model. Require this capability when activating experimental context.
- Snapshot configured token-budget preferences before startup activation. Restore them for fresh child sessions before applying their starting model's defaults, while history forks retain their parent's activation.
- Pass unresolved token-budget preferences to child sessions so they can use their own model's prompts.
## Testing
Extend coverage for unsupported models, model-switch guidance under explicit and experimental activation, and child configuration from both active and inactive parents. Verify that omitted capability metadata defaults to `false`.
GitOrigin-RevId: 02df9e171682267232fa923d5ea3f7af36527808
Celia Chen