Alex Kira 08ae615122 Enable untrusted context tool outputs by default (#60487) ...

## What changed

Mark `untrusted_as_tool_output` as stable and enable it by default. Untrusted additional context, such as browser information and goal objectives, now reaches the model as `function_call_output` items in the `agent` namespace instead of user messages. Setting `features.untrusted_as_tool_output = false` preserves the message format.

## Testing

Update core, app-server, TUI, and Python SDK test expectations for the default output format. Cover context persistence, deduplication, goal continuation, and explicit opt-out behavior.

GitOrigin-RevId: 30828351e2ed584928f6055b6dcf276d8288c0fb

2026-11-10 01:30:08 +00:00

..

scenarios

Normalize saved chat settings after model catalog refreshes (#59111)

2026-11-03 10:01:36 +00:00

skills_extension

Honor permission grant scopes in executor capability discovery (#60461)

2026-11-09 22:20:07 +00:00

snapshots

Enable untrusted context tool outputs by default (#60487)

2026-11-10 01:30:08 +00:00

step_settings

Test connection events against active environment selections (#59001)

2026-11-02 22:56:19 +00:00

abort_lifecycle.rs

Separate environment requests from runtime selections (#51221)

2026-10-06 01:39:50 +00:00

abort_tasks.rs

Add per-turn prompt cache TTL options (#59480)

2026-11-04 19:58:24 +00:00

actor_access_program_tests.rs

Forward explicit cyber access programs with header authentication (#59743)

2026-11-05 21:21:19 +00:00

additional_context.rs

Enable untrusted context tool outputs by default (#60487)

2026-11-10 01:30:08 +00:00

agent_control_tests.rs

Expose agent tree IDs and environment removal (#60190)

2026-11-08 02:27:59 +00:00

agent_eviction_tests.rs

Add direct replies for thread settings updates (#47937)

2026-09-24 20:59:51 +00:00

agent_execution.rs

Preserve worker permissions across sibling-triggered reloads (#59115)

2026-11-03 10:44:27 +00:00

agent_mailbox.rs

Decouple message lifecycle state from model-visible item IDs (#59785)

2026-11-06 01:50:20 +00:00

agent_message_wake.rs

Make agent-message wakes respect interrupts and Plan mode (#56330)

2026-10-23 02:21:49 +00:00

agent_permission_reload_tests.rs

Stabilize cross-platform tests and directory-change fork permissions (#59369)

2026-11-04 09:51:28 +00:00

agent_websocket.rs

Support asynchronous host service-tier reads and acceptance (#60075)

2026-11-07 06:51:10 +00:00

agents_md_refresh.rs

Separate environment requests from runtime selections (#51221)

2026-10-06 01:39:50 +00:00

agents_md.rs

Warn when project instructions exceed the configured byte budget (#59445)

2026-11-04 16:34:49 +00:00

analytics_runtime_auth.rs

Use runtime authentication for Analytics requests (#60101)

2026-11-07 10:41:36 +00:00

app_tool_exposure_strict_tests.rs

Enforce strict third-party tool deferral in Code Mode Only (#59071)

2026-11-03 06:05:55 +00:00

app_tool_exposure.rs

Enforce strict third-party tool deferral in Code Mode Only (#59071)

2026-11-03 06:05:55 +00:00

apply_patch_cli.rs

Bind capability roots to environment selections (#51493)

2026-10-06 22:39:32 +00:00

apply_patch_serialization.rs

Standardize shell execution on unified exec (#39757)

2026-08-20 17:46:05 +00:00

apply_patch_system_aliases.rs

Protect metadata writes through macOS case aliases (#54273)

2026-10-15 12:01:04 +00:00

approvals.rs

Support catalog headings for saved command-prefix notices (#57599)

2026-10-27 23:53:34 +00:00

audio_duration_store.rs

Use measured durations to budget uploaded audio (#59268)

2026-11-04 00:19:12 +00:00

audio_truncation.rs

…

auth_recovery_policy.rs

Enforce application network policy across app-server requests (#47407)

2026-09-23 00:47:07 +00:00

auto_review.rs

Add web search provider metadata and configuration (#59033)

2026-11-03 01:58:18 +00:00

base_instructions.rs

Add opt-in incremental tools for regular OpenAI Responses (#59832)

2026-11-06 06:07:46 +00:00

bedrock_multi_agent_tests.rs

Enable multi-agent V2 and Ultra reasoning on Amazon Bedrock (#49345)

2026-09-29 19:03:30 +00:00

bedrock_service_tier_tests.rs

Advertise Ultrafast for GPT-6.1 Sol on Amazon Bedrock (#51794)

2026-10-07 18:32:50 +00:00

builtin_model_catalog.rs

Allow catalog URL overrides for the built-in OpenAI provider (#57567)

2026-10-27 21:50:08 +00:00

canonical_plugin_connectors.rs

Honor canonical plugin disables for shared connectors (#45755)

2026-09-15 18:23:08 +00:00

catalog_permission_messages.rs

Support model catalog overrides for plugin guidance (#58894)

2026-11-02 14:06:17 +00:00

cli_stream.rs

Send base instructions as Responses input messages (#51156)

2026-10-05 18:52:51 +00:00

client_websockets_runtime_auth.rs

Revalidate request auth ownership after budget checks (#60436)

2026-11-09 19:50:14 +00:00

client_websockets.rs

Allow asynchronous model request budget checks (#60080)

2026-11-07 07:45:36 +00:00

client.rs

Route response item IDs through a shared generator (#59312)

2026-11-04 04:02:00 +00:00

cloud_config.rs

Require managed configuration from the configured server (#56055)

2026-10-22 02:15:00 +00:00

code_mode_agent_message_tests.rs

Treat code-mode collaboration messages as plaintext (#55633)

2026-10-20 17:15:35 +00:00

code_mode_dynamic_tools_tests.rs

Allow dynamic tool calls to execute in parallel (#54654)

2026-10-16 16:28:53 +00:00

code_mode_elicitation.rs

…

code_mode_host_recovery_tests.rs

Restrict code-mode host replacement to session admission (#57782)

2026-10-28 16:46:41 +00:00

code_mode_model_messages.rs

Wire incremental exec tool updates into Code Mode sessions (#60163)

2026-11-07 19:26:20 +00:00

code_mode.rs

Preserve app invocation context across MCP tool refreshes (#59991)

2026-11-06 21:53:04 +00:00

codex_apps_protocol.rs

Share Apps tool catalogs without retaining unused snapshots (#45440)

2026-09-14 15:06:28 +00:00

codex_delegate.rs

Preserve MCP tool output as content items (#40737)

2026-08-25 23:42:50 +00:00

collaboration_instructions.rs

Support model catalog overrides for plugin guidance (#58894)

2026-11-02 14:06:17 +00:00

command_lifecycle_tests.rs

Add a command-start callback for tool lifecycle extensions (#46539)

2026-09-19 00:46:06 +00:00

compact_program_tests.rs

Enable Cyber access programs for API-key sessions by default (#53717)

2026-10-13 16:57:54 +00:00

compact_remote_trimming.rs

Separate environment requests from runtime selections (#51221)

2026-10-06 01:39:50 +00:00

compact_remote.rs

Use measured durations to budget uploaded audio (#59268)

2026-11-04 00:19:12 +00:00

compact_resume_fork.rs

Remove the long-thread accuracy warning after compaction (#55355)

2026-10-19 19:24:26 +00:00

compact.rs

Handle context length errors consistently across response transports (#60482)

2026-11-10 00:55:34 +00:00

context_annotations.rs

Enable untrusted context tool outputs by default (#60487)

2026-11-10 01:30:08 +00:00

critical_path_runtime.rs

Expand per-turn critical path capture and split inference timing (#59245)

2026-11-03 22:29:33 +00:00

current_time_reminder.rs

Make environment context date and timezone configurable (#52164)

2026-10-08 16:27:10 +00:00

cyber_access_program.rs

Allow per-turn overrides for direct-only tool namespaces (#59481)

2026-11-04 19:58:49 +00:00

cyber_exec_policy.rs

Support catalog headings for saved command-prefix notices (#57599)

2026-10-27 23:53:34 +00:00

daybreak_access.rs

Move the exec-server test fixture into shared test support (#52674)

2026-10-09 18:58:53 +00:00

deprecation_notice.rs

Remove the patched zsh shell execution backend (#52160)

2026-10-08 16:19:09 +00:00

direct_tool_metadata.rs

Track history initialization in Responses turn metadata (#52325)

2026-10-08 23:34:16 +00:00

dynamic_tool_cancellation.rs

Record truncation metrics for accepted Guardian review inputs (#53628)

2026-10-13 10:21:42 +00:00

exec_policy.rs

Add opt-in Unicode canonical matching to exec policy rules (#59535)

2026-11-05 00:55:46 +00:00

exec.rs

Always use private desktops for legacy Windows sandboxes (#46554)

2026-09-19 01:21:32 +00:00

executor_discovery_v2.rs

Honor permission grant scopes in executor capability discovery (#60461)

2026-11-09 22:20:07 +00:00

extension_sandbox.rs

Store generated image items as attachment references (#54398)

2026-10-15 19:51:22 +00:00

external_auth.rs

Retry gateway credential exports after unauthorized responses (#59816)

2026-11-06 03:51:12 +00:00

fork_thread.rs

Box session metadata and compaction payloads in RolloutItem (#55733)

2026-10-21 02:41:05 +00:00

gateway_auth.rs

Retry gateway credential exports after unauthorized responses (#59816)

2026-11-06 03:51:12 +00:00

gcp.rs

Add GPT-6.1 Terra to model catalogs (#57293)

2026-10-26 22:13:14 +00:00

git_enrichment.rs

Expose and persist turn lineage across the app server (#51415)

2026-10-06 16:56:39 +00:00

guardian_authorization_refresh.rs

Revalidate Guardian denials when parent authorization changes (#59225)

2026-11-03 21:00:31 +00:00

guardian_authorization.rs

Box session metadata and compaction payloads in RolloutItem (#55733)

2026-10-21 02:41:05 +00:00

guardian_cached_score_tests.rs

Use serving assessments for adaptive Guardian review (#58075)

2026-10-29 12:54:39 +00:00

guardian_checkpoint_migration_tests.rs

Separate environment requests from runtime selections (#51221)

2026-10-06 01:39:50 +00:00

guardian_connector_trust.rs

Run environment hooks on their owning executors (#56343)

2026-10-23 04:01:39 +00:00

guardian_context_budget.rs

Share the Guardian context delivery token limit (#58071)

2026-10-29 12:37:59 +00:00

guardian_cyber_access_program_tests.rs

Enforce host-required cyber access programs per thread (#59754)

2026-11-05 22:49:46 +00:00

guardian_environments_tests.rs

Use MCP owner permissions for Guardian reviews and score reuse (#59489)

2026-11-04 20:37:39 +00:00

guardian_heartbeat_authorization.rs

Remove obsolete Guardian thread-context enables from tests (#51184)

2026-10-05 22:17:02 +00:00

guardian_history.rs

Add opt-in elastic budgeting for synchronous Guardian reviews (#59444)

2026-11-04 16:33:22 +00:00

guardian_mcp_elicitation.rs

Measure Guardian approval blocking time per turn (#55591)

2026-10-20 14:43:08 +00:00

guardian_pending_root_delivery.rs

Refresh Guardian reviews when review context changes (#53797)

2026-10-13 23:29:53 +00:00

guardian_persistence_tests.rs

Load persisted sender context for Guardian reviews (#51734)

2026-10-07 15:47:21 +00:00

guardian_retained_context.rs

Allow hosts to restrict a thread's root-only capabilities (#58984)

2026-11-02 21:09:37 +00:00

guardian_retry.rs

Expose lifecycle timestamps on app-server thread items (#57172)

2026-10-26 18:13:00 +00:00

guardian_review_cancellation.rs

Add context to Guardian test setup failures (#59125)

2026-11-03 11:43:00 +00:00

guardian_review.rs

Preserve model metadata origin through runtime resolution (#58361)

2026-10-30 15:11:02 +00:00

guardian_root_handoff.rs

Fix guardian handoff mocks for native history tests (#57468)

2026-10-27 14:28:15 +00:00

guardian_sandbox_retry.rs

Add regression coverage for Guardian sandbox retry approvals (#54265)

2026-10-15 11:24:07 +00:00

guardian_sender_messages_tests.rs

Capture sender context for codex_app.create_thread deliveries (#54590)

2026-10-16 12:37:14 +00:00

guardian_subagent_authorization.rs

Respect model catalog origins when selecting Guardian reviewers (#57770)

2026-10-28 16:00:30 +00:00

guardian_subagent_notification_tests.rs

Add host reporting for terminal agent turn outcomes (#59725)

2026-11-05 19:20:56 +00:00

hooks_cwd_tests.rs

Preserve command cwd in permission and post-tool hooks (#57203)

2026-10-26 19:21:08 +00:00

hooks_executor.rs

Honor permission grant scopes in executor capability discovery (#60461)

2026-11-09 22:20:07 +00:00

hooks_mcp.rs

Start dormant MCP servers for hook calls (#55263)

2026-10-19 11:40:15 +00:00

hooks_plugin_policy_refresh.rs

Apply session plugin overrides during MCP config refresh (#57974)

2026-10-29 03:14:13 +00:00

hooks.rs

Apply PreToolUse hooks before direct Guardian review policy checks (#58368)

2026-10-30 15:28:20 +00:00

host_turn_admission.rs

Render host-owned V2 subagent rosters in environment context (#59531)

2026-11-05 00:39:39 +00:00

image_rollout.rs

Preserve pending agent messages across compaction (#59404)

2026-11-04 13:03:01 +00:00

injected_models_cache.rs

Preserve model catalogs when starting child agents (#60049)

2026-11-07 03:16:52 +00:00

interrupt_hooks.rs

Add hooks for interrupted turns (#40511)

2026-08-25 01:27:18 +00:00

items.rs

Preserve model catalogs when starting child agents (#60049)

2026-11-07 03:16:52 +00:00

json_result.rs

Accept environment requests at thread and turn settings boundaries (#51422)

2026-10-06 17:11:07 +00:00

live_cli.rs

…

managed_threads_tests.rs

Add local diagnostic ZIP exports to the app server (#55940)

2026-10-21 16:43:30 +00:00

mcp_auth_elicitation.rs

Allow hosts to restrict a thread's root-only capabilities (#58984)

2026-11-02 21:09:37 +00:00

mcp_auth_refresh.rs

Use runtime authentication for OpenAI MCP and app requests (#59749)

2026-11-05 22:03:29 +00:00

mcp_ema_config.rs

Restrict enterprise MCP auth and fail closed on config refresh (#49260)

2026-09-29 13:08:37 +00:00

mcp_executor_context_tests.rs

Apply session plugin overrides during MCP config refresh (#57974)

2026-10-29 03:14:13 +00:00

mcp_extension_protocol.rs

Add scoped host metadata hooks for MCP tool requests (#58395)

2026-10-30 17:32:09 +00:00

mcp_network_policy_compat_tests.rs

Derive MCP network policy and preserve saved denials (#60046)

2026-11-07 03:06:33 +00:00

mcp_oauth_refresh_tests.rs

Retire rejected MCP OAuth refresh tokens (#54079)

2026-10-14 20:00:52 +00:00

mcp_optional_startup_grace.rs

Restrict enterprise MCP auth and fail closed on config refresh (#49260)

2026-09-29 13:08:37 +00:00

mcp_refresh_cleanup.rs

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00

mcp_sandbox_tests.rs

Separate MCP sandbox policy from launcher metadata (#53709)

2026-10-13 16:23:44 +00:00

mcp_startup_refresh_http_proxy.rs

Add hook configuration to environment attachments (#56302)

2026-10-23 00:02:29 +00:00

mcp_storage_telemetry_tests.rs

Box session metadata and compaction payloads in RolloutItem (#55733)

2026-10-21 02:41:05 +00:00

mcp_subagent_elicitation.rs

Allow hosts to restrict a thread's root-only capabilities (#58984)

2026-11-02 21:09:37 +00:00

mcp_tool_cache.rs

Add opt-in lazy startup for cached stdio MCP servers (#60039)

2026-11-07 02:28:44 +00:00

mcp_tool_exposure.rs

Allow per-turn overrides for direct-only tool namespaces (#59481)

2026-11-04 19:58:49 +00:00

mcp_turn_metadata.rs

Support direct Guardian review of recorded MCP calls (#59735)

2026-11-05 20:55:46 +00:00

mcp_user_verification.rs

Separate environment requests from runtime selections (#51221)

2026-10-06 01:39:50 +00:00

mod.rs

Use runtime authentication for Analytics requests (#60101)

2026-11-07 10:41:36 +00:00

model_overrides.rs

…

model_provider_requirements_tests.rs

Remove the patched zsh shell execution backend (#52160)

2026-10-08 16:19:09 +00:00

model_request.rs

Preserve display instructions in answer moderation (#60172)

2026-11-07 21:31:08 +00:00

model_runtime_selectors.rs

Preserve project agent opt-ins across enabled legacy feature flags (#59496)

2026-11-04 21:23:11 +00:00

model_switching.rs

Enable uploaded audio with durable rejection recovery (#59234)

2026-11-03 21:24:16 +00:00

model_visible_layout.rs

Add an option to omit descriptions from skill catalogs (#57500)

2026-10-27 16:16:17 +00:00

models_cache_auth.rs

Preserve model catalogs when starting child agents (#60049)

2026-11-07 03:16:52 +00:00

models_cache_ttl.rs

Preserve model catalogs when starting child agents (#60049)

2026-11-07 03:16:52 +00:00

models_etag_responses.rs

Accept environment requests at thread and turn settings boundaries (#51422)

2026-10-06 17:11:07 +00:00

multi_agent_mode.rs

Adapt multi-agent mode guidance for hosted tools (#60011)

2026-11-06 23:50:54 +00:00

multi_agent_restore_tests.rs

Reuse unchanged history snapshots when resuming threads (#49600)

2026-09-30 11:59:13 +00:00

multi_agent_resume.rs

Record initialization analytics for resumed subagents (#51206)

2026-10-06 00:16:18 +00:00

multi_agent_tool_descriptions.rs

Support model-specific descriptions for agent message board tools (#47670)

2026-09-23 21:34:11 +00:00

multi_exec_server_sandbox.rs

Move the exec-server test fixture into shared test support (#52674)

2026-10-09 18:58:53 +00:00

network_approval_completion.rs

Test command completion before network denial grace expires (#59974)

2026-11-06 20:36:32 +00:00

network_approval.rs

Stabilize cross-platform tests and directory-change fork permissions (#59369)

2026-11-04 09:51:28 +00:00

openai_file_mcp.rs

Support optional thread IDs in hosted file uploads (#59795)

2026-11-06 02:42:02 +00:00

otel.rs

Add an option to disable successful SSE delta logs (#58034)

2026-10-29 10:34:17 +00:00

output_token_replay.rs

Add opt-in output token replay for OpenAI requests (#52742)

2026-10-10 01:25:00 +00:00

override_updates.rs

Accept environment requests at thread and turn settings boundaries (#51422)

2026-10-06 17:11:07 +00:00

pending_input_persistence.rs

Add a thread-store builder with host cleanup support (#58954)

2026-11-02 19:25:02 +00:00

pending_input.rs

Add audio file references with explicit runtime rejection (#58430)

2026-10-30 20:53:25 +00:00

permissions_messages.rs

Allow model catalogs to customize approval instruction headings (#57581)

2026-10-27 22:26:12 +00:00

personality.rs

Accept environment requests at thread and turn settings boundaries (#51422)

2026-10-06 17:11:07 +00:00

plugins.rs

Preserve filesystem authority when loading skills (#59279)

2026-11-04 01:13:54 +00:00

prompt_cache_key.rs

Allow callers to control prompt cache keys independently of session IDs (#55587)

2026-10-20 14:14:59 +00:00

prompt_caching.rs

Enable deferred tool world state by default (#58410)

2026-10-30 18:33:14 +00:00

prompt_debug_tests.rs

Allow volatile World State sections to refresh after compaction (#58956)

2026-11-02 19:38:59 +00:00

quota_exceeded.rs

Fix retry classification for throttling and quota errors (#45602)

2026-09-15 04:20:38 +00:00

realtime_attachment.rs

Support cancellation and deadlines for realtime attachments (#60443)

2026-11-09 20:24:40 +00:00

realtime_conversation.rs

Detach realtime sideband observers without ending the session (#57817)

2026-10-28 20:10:15 +00:00

realtime_initial_items.rs

Forward client voice session IDs in realtime requests (#53784)

2026-10-13 22:21:31 +00:00

realtime_misalignment.rs

Forward client voice session IDs in realtime requests (#53784)

2026-10-13 22:21:31 +00:00

realtime_sideband_endpoint.rs

Forward client voice session IDs in realtime requests (#53784)

2026-10-13 22:21:31 +00:00

realtime_system_proxy.rs

Forward client voice session IDs in realtime requests (#53784)

2026-10-13 22:21:31 +00:00

reasoning_effort_override.rs

Add per-turn prompt cache TTL options (#59480)

2026-11-04 19:58:24 +00:00

remote_env_capability_roots_tests.rs

Respect filesystem permissions when discovering repository skills (#59280)

2026-11-04 01:15:38 +00:00

remote_env_failure_tests.rs

Retry transient environment startup failures on the next turn (#57866)

2026-10-29 00:42:21 +00:00

remote_env_required_skills_tests.rs

Add an option to omit descriptions from skill catalogs (#57500)

2026-10-27 16:16:17 +00:00

remote_env_spawn_tests.rs

Accept environment requests at thread and turn settings boundaries (#51422)

2026-10-06 17:11:07 +00:00

remote_env.rs

Normalize turn context permissions to a required profile (#59963)

2026-11-06 19:29:06 +00:00

remote_models.rs

Preserve model catalogs when starting child agents (#60049)

2026-11-07 03:16:52 +00:00

request_compression.rs

…

request_permissions_tool.rs

Accept environment requests at thread and turn settings boundaries (#51422)

2026-10-06 17:11:07 +00:00

request_permissions.rs

Allow dangerous-command review when sandbox approvals are disabled (#59120)

2026-11-03 11:14:59 +00:00

request_plugin_install_runtime_auth.rs

Extend runtime auth to account, plugin, and file requests (#59564)

2026-11-05 03:49:13 +00:00

request_plugin_install.rs

Extend runtime auth to account, plugin, and file requests (#59564)

2026-11-05 03:49:13 +00:00

request_user_input_async.rs

Carry targeted moderation decisions on final-answer messages (#59842)

2026-11-06 07:43:44 +00:00

request_user_input.rs

Account for token usage from incomplete responses (#53670)

2026-10-13 13:36:24 +00:00

required_access_program_tests.rs

Enforce host-required cyber access programs per thread (#59754)

2026-11-05 22:49:46 +00:00

responses_api_proxy_headers.rs

Accept environment requests at thread and turn settings boundaries (#51422)

2026-10-06 17:11:07 +00:00

responses_lite.rs

Enable incremental tools by default for Responses Lite (#55368)

2026-10-19 20:01:37 +00:00

responses_system_proxy.rs

Expose system proxy support as an experimental setting (#58157)

2026-10-29 19:16:28 +00:00

resume_warning.rs

Normalize turn context permissions to a required profile (#59963)

2026-11-06 19:29:06 +00:00

resume.rs

Support store-owned preparation when resuming threads (#54059)

2026-10-14 18:02:25 +00:00

retry_after.rs

Keep HTTP fallback active for the rest of the session (#58989)

2026-11-02 21:37:17 +00:00

review.rs

Add opt-in output token replay for OpenAI requests (#52742)

2026-10-10 01:25:00 +00:00

rmcp_client.rs

Derive MCP network policy and preserve saved denials (#60046)

2026-11-07 03:06:33 +00:00

rollout_budget.rs

Clarify test failures and annotate a backend registration invariant (#59131)

2026-11-03 12:08:52 +00:00

rollout_compression.rs

Add a thread-store builder with host cleanup support (#58954)

2026-11-02 19:25:02 +00:00

rollout_list_find.rs

…

runtime_auth_denials.rs

Stop retrying terminal runtime authentication denials (#60096)

2026-11-07 09:48:46 +00:00

runtime_auth.rs

Honor managed runtime authentication modes and expand coverage (#60014)

2026-11-07 00:18:36 +00:00

safety_buffering.rs

…

safety_check_downgrade.rs

Accept environment requests at thread and turn settings boundaries (#51422)

2026-10-06 17:11:07 +00:00

scenarios_agent_eviction_tests.rs

Add configured thread environment inheritance for subagents (#55375)

2026-10-19 20:30:44 +00:00

scenarios_agent_message_board_http.rs

Route message-board notifications through agent mailboxes (#59139)

2026-11-03 12:33:26 +00:00

scenarios_agent_message_board_remote.rs

Expose message board permissions and structured denials (#52568)

2026-10-09 13:15:39 +00:00

scenarios_agent_message_board.rs

Extract agent message board hosting into a dedicated crate (#59473)

2026-11-04 19:10:59 +00:00

scenarios_audio_file_tests.rs

Use measured durations to budget uploaded audio (#59268)

2026-11-04 00:19:12 +00:00

scenarios_budget_context.rs

Render host-owned V2 subagent rosters in environment context (#59531)

2026-11-05 00:39:39 +00:00

scenarios_catalog_approval_instructions_tests.rs

Allow model catalogs to customize approval instruction headings (#57581)

2026-10-27 22:26:12 +00:00

scenarios_code_mode_settled_helpers_tests.rs

Add promise settlement streaming helpers to code mode (#51126)

2026-10-05 16:58:29 +00:00

scenarios_command_sessions_tests.rs

Expose retained command sessions in incremental world state (#59633)

2026-11-05 11:14:26 +00:00

scenarios_compaction_tests.rs

Preserve pending agent messages across compaction (#59404)

2026-11-04 13:03:01 +00:00

scenarios_content_filter.rs

Add recovery guidance to content-filter retries (#49119)

2026-09-29 01:14:41 +00:00

scenarios_context_management_tools.rs

Apply model catalog overrides to history, notes, and context tools (#56313)

2026-10-23 00:46:28 +00:00

scenarios_credential_masking.rs

Mark built-in dummy credentials and strengthen collision checks (#56297)

2026-10-22 23:48:20 +00:00

scenarios_dynamic_tools.rs

Allow replacing dynamic tools between model steps (#57553)

2026-10-27 19:50:41 +00:00

scenarios_exec_tools.rs

Allow model overrides for incremental Code Mode tool messages (#60188)

2026-11-08 01:13:32 +00:00

scenarios_frozen_cloud_skills.rs

Respect turn filesystem permissions during executor skill discovery (#59291)

2026-11-04 02:00:01 +00:00

scenarios_guardian_agent_messages_tests.rs

Restrict Guardian native multi-agent history to the OpenAI provider (#59737)

2026-11-05 20:57:03 +00:00

scenarios_guardian_conversation_history_tests.rs

Restrict enterprise MCP auth and fail closed on config refresh (#49260)

2026-09-29 13:08:37 +00:00

scenarios_guardian_direct_mcp.rs

Support direct Guardian review of recorded MCP calls (#59735)

2026-11-05 20:55:46 +00:00

scenarios_guardian_direct_review.rs

Support direct Guardian review of recorded MCP calls (#59735)

2026-11-05 20:55:46 +00:00

scenarios_guardian_extra_policy.rs

Add an optional JSON transcript format for Guardian (#51465)

2026-10-06 19:30:57 +00:00

scenarios_guardian_handoff.rs

Preserve native multi-agent calls in Guardian review history (#57448)

2026-10-27 13:02:57 +00:00

scenarios_guardian_heartbeat.rs

Enable instant interrupts by default (#51812)

2026-10-07 19:42:35 +00:00

scenarios_guardian_orchestrator_connector.rs

Use conversations for all Guardian v2 async classification (#56556)

2026-10-23 18:48:10 +00:00

scenarios_guardian_reconsideration.rs

Resample Guardian denials with the original request (#59659)

2026-11-05 13:38:12 +00:00

scenarios_guardian_sender_context.rs

Preserve Guardian sender context for cloud deliveries with orbit IDs (#58946)

2026-11-02 18:43:57 +00:00

scenarios_incremental_tools_resume.rs

Test exec catalog preservation across session and compaction changes (#60173)

2026-11-07 21:44:47 +00:00

scenarios_incremental_tools.rs

Allow model overrides for incremental Code Mode tool messages (#60188)

2026-11-08 01:13:32 +00:00

scenarios_indirect_namespace_prefixes.rs

Support model-specific function description prefixes (#51930)

2026-10-08 03:20:54 +00:00

scenarios_injected_agent_mail.rs

Preserve pending agent messages across compaction (#59404)

2026-11-04 13:03:01 +00:00

scenarios_mailbox_preemption_tests.rs

Drain WebSocket responses on mailbox preemption (#55969)

2026-10-21 19:29:08 +00:00

scenarios_managed_human_approval_tests.rs

Add managed command checkpoints requiring fresh human approval (#58045)

2026-10-29 11:23:51 +00:00

scenarios_mcp_ema.rs

Require managed configuration from the configured server (#56055)

2026-10-22 02:15:00 +00:00

scenarios_mcp_resource_messages.rs

Expose deferred MCP servers in resource listings (#60423)

2026-11-09 17:58:16 +00:00

scenarios_mcp_sharing.rs

Use runtime authentication for OpenAI MCP and app requests (#59749)

2026-11-05 22:03:29 +00:00

scenarios_model_instructions.rs

Scope model catalogs and caches by thread originator (#56284)

2026-10-22 22:44:48 +00:00

scenarios_mxc.rs

Add an opt-in preference for the local MXC sandbox (#47375)

2026-09-22 21:57:52 +00:00

scenarios_partial_answers.rs

Preserve parent history by default in full agent forks (#55548)

2026-10-20 11:56:17 +00:00

scenarios_preparation.rs

Add audio file references with explicit runtime rejection (#58430)

2026-10-30 20:53:25 +00:00

scenarios_provider_capabilities.rs

Add capability overrides for custom model providers (#50459)

2026-10-02 23:26:27 +00:00

scenarios_reserved_spawn.rs

Add shared service-tier support for host-owned agents (#59770)

2026-11-06 00:24:27 +00:00

scenarios_retained_tool_outputs.rs

Close input admission while a turn finishes recording (#53452)

2026-10-12 18:54:22 +00:00

scenarios_shared_instructions.rs

Add host-inherited thread instructions and execution policies (#58406)

2026-10-30 18:20:57 +00:00

scenarios_skill_catalog_dedup.rs

Respect filesystem permissions when discovering repository skills (#59280)

2026-11-04 01:15:38 +00:00

scenarios_strict_3p_cache.rs

Enforce strict third-party tool deferral in Code Mode Only (#59071)

2026-11-03 06:05:55 +00:00

scenarios_tools_namespace_budget.rs

Separate environment requests from runtime selections (#51221)

2026-10-06 01:39:50 +00:00

scenarios_turn_input_agent_message.rs

Accept agent follow-ups through native turn input delivery (#58829)

2026-11-02 07:27:49 +00:00

scenarios_web_search.rs

Clarify test failures and annotate a backend registration invariant (#59131)

2026-11-03 12:08:52 +00:00

scenarios_world_state_prefix_tests.rs

Support window prefixes for extension world-state sections (#57276)

2026-10-26 21:46:26 +00:00

scenarios.rs

Enable untrusted context tool outputs by default (#60487)

2026-11-10 01:30:08 +00:00

search_tool.rs

Enable deferred tool world state by default (#58410)

2026-10-30 18:33:14 +00:00

settings_commits.rs

Restore thread-owned permissions on cold resume (#53150)

2026-10-11 15:48:35 +00:00

settings_constraints.rs

Use permission profiles for protected-model startup downgrades (#59933)

2026-11-06 16:00:54 +00:00

shell_snapshot.rs

Add hook configuration to environment attachments (#56302)

2026-10-23 00:02:29 +00:00

skills_extension.rs

Honor permission grant scopes in executor capability discovery (#60461)

2026-11-09 22:20:07 +00:00

skills.rs

Enforce current filesystem permissions when reading repository skills (#59278)

2026-11-04 01:12:49 +00:00

spawn_agent_description.rs

Add web search provider metadata and configuration (#59033)

2026-11-03 01:58:18 +00:00

spawn_settings_tests.rs

Test spawn settings reporting after child removal (#47258)

2026-09-22 11:10:29 +00:00

sqlite_state.rs

Scope local history discovery to the current ChatGPT account (#58918)

2026-11-02 16:00:20 +00:00

startup_cancellation.rs

Prepare skill catalogs before building step tools (#55357)

2026-10-19 19:33:11 +00:00

step_settings_compaction.rs

Remove obsolete fields from persisted turn context (#51492)

2026-10-06 22:39:06 +00:00

step_settings_snapshots.rs

Remove retired model entries while preserving migration prompts (#44250)

2026-09-09 17:56:33 +00:00

step_settings.rs

Allow model catalogs to customize approval instruction headings (#57581)

2026-10-27 22:26:12 +00:00

stream_error_allows_next_turn.rs

Add a credential file override for GCP provider authentication (#57188)

2026-10-26 18:33:05 +00:00

stream_no_completed.rs

Add a credential file override for GCP provider authentication (#57188)

2026-10-26 18:33:05 +00:00

subagent_dynamic_tools.rs

Separate environment requests from runtime selections (#51221)

2026-10-06 01:39:50 +00:00

subagent_notifications.rs

Add a thread-store builder with host cleanup support (#58954)

2026-11-02 19:25:02 +00:00

subagent_service_tier.rs

Add shared service-tier support for host-owned agents (#59770)

2026-11-06 00:24:27 +00:00

token_budget.rs

Enable deferred tool world state by default (#58410)

2026-10-30 18:33:14 +00:00

token_usage_rollout.rs

Route rollout reads through the canonical JSON decoder (#42378)

2026-09-02 22:45:19 +00:00

tool_harness.rs

Accept environment requests at thread and turn settings boundaries (#51422)

2026-10-06 17:11:07 +00:00

tool_lifecycle.rs

Include root turn IDs in host-owned Apps tool calls (#51421)

2026-10-06 17:10:43 +00:00

tool_observation_tests.rs

Expose tool dispatch and timing observations to extensions (#47662)

2026-09-23 20:49:48 +00:00

tool_parallelism.rs

Add host-reserved V2 child creation APIs (#57586)

2026-10-27 23:02:27 +00:00

tool_registration_metrics.rs

Tag tool registration metrics with effective incremental tools mode (#55692)

2026-10-20 22:34:40 +00:00

tools.rs

Pin the Rust toolchain to 1.95.0 (#57373)

2026-10-27 05:52:01 +00:00

truncation.rs

Enable unified image budgeting by default (#59282)

2026-11-04 01:24:36 +00:00

turn_error_details_tests.rs

Expose original error details to turn lifecycle contributors (#49138)

2026-09-29 02:40:51 +00:00

turn_input_submission.rs

Add per-turn prompt cache TTL options (#59480)

2026-11-04 19:58:24 +00:00

turn_phase_trace.rs

Add per-turn prompt cache TTL options (#59480)

2026-11-04 19:58:24 +00:00

turn_state.rs

Preserve Markdown formatting when copying TUI responses (#42847)

2026-09-04 20:38:08 +00:00

unified_exec_launch_failure_tests.rs

Expose lifecycle timestamps on app-server thread items (#57172)

2026-10-26 18:13:00 +00:00

unified_exec_mxc_powershell_tests.rs

Use a compatible PowerShell fallback for the Windows MXC sandbox (#49019)

2026-09-28 15:58:17 +00:00

unified_exec_process_events.rs

Read unified exec output directly from stdout and stderr (#57191)

2026-10-26 19:01:45 +00:00

unified_exec_stdin_approval.rs

Include terminal launch commands in Guardian stdin reviews (#57758)

2026-10-28 15:10:52 +00:00

unified_exec_stdin_review_size.rs

Reject NUL bytes in reviewed terminal input (#41354)

2026-08-28 15:44:48 +00:00

unified_exec.rs

Add hook configuration to environment attachments (#56302)

2026-10-23 00:02:29 +00:00

unstable_features_warning.rs

…

user_notification.rs

Add audio file references with explicit runtime rejection (#58430)

2026-10-30 20:53:25 +00:00

user_shell_cmd.rs

Accept environment requests at thread and turn settings boundaries (#51422)

2026-10-06 17:11:07 +00:00

view_image.rs

Enable unified image budgeting by default (#59282)

2026-11-04 01:24:36 +00:00

wake_reservation.rs

Preserve model catalogs when starting child agents (#60049)

2026-11-07 03:16:52 +00:00

web_search_system_proxy_tests.rs

Resolve proxy routes for standalone web search redirects (#47204)

2026-09-22 06:24:49 +00:00

web_search.rs

Remove GPT-5.4 from bundled catalogs and preserve migration prompts (#47932)

2026-09-24 20:28:31 +00:00

websocket_fallback.rs

Treat workspace access denials as terminal errors (#60480)

2026-11-10 00:54:30 +00:00

window_headers.rs

Remove the long-thread accuracy warning after compaction (#55355)

2026-10-19 19:24:26 +00:00

workspace_roots.rs

Add hook configuration to environment attachments (#56302)

2026-10-23 00:02:29 +00:00

worktree_trust.rs

Validate linked worktrees before inheriting project trust (#39616)

2026-08-20 06:29:32 +00:00