Files
codex/codex-rs/ext/extension-api
jif 1e66885a16 Discount an approval's own code-mode wrapper from Guardian score lag (#43527)
## Why

A code-mode `exec` wrapper and its nested tool calls each advance Guardian's score lag. Counting the unscored wrapper against its own nested approval can trigger a synchronous review sooner than needed.

## What changed

Track originating response items and approval tool-call IDs so cached approvals discount their own wrapper when it is newer than the latest score. Preserve wrapper identity across yields and waits, and retain the full lag when provenance is missing or evicted. Other wrappers and scoring failures still count.

Use the current `write_stdin` call's identity for approval freshness, and omit tool-call identity for `execve` intercepts that only retain the launch ID.

## Testing

Add coverage for wrapper-specific discounts, already-scored wrappers, missing and evicted provenance, identity across code-mode resumes, and approval identities for stdin writes and `execve` intercepts.

GitOrigin-RevId: 4002a06d64c4e1e0a13c072303503d6ddfacad09
2026-09-07 17:35:23 +00:00
..