713caa89f3
## Why Stdio shutdown can hang on open pipes or blocked I/O, and Unix `SIGTERM` needs to run connection cleanup so owned commands terminate and session-end hooks execute. ## What changed - Handle `SIGTERM` on a dedicated signal thread and close the stdio connection through the existing cleanup path. - Move blocking stdin and stdout operations to dedicated threads so they do not hold the Tokio runtime open. Cancel message forwarding on `SIGTERM` to release blocked producers. - When shutdown signal handling is enabled on Unix, start a shared 45-second watchdog on EOF or `SIGTERM`. Preserve the first deadline and exit with status `1` if cleanup or runtime teardown stalls, even when logging is blocked. ## Testing Add Unix integration coverage for shutdown with open pipes, blocked stdout, blocked stderr, and a stalled filesystem write. Verify command and child-process termination, preserve the EOF deadline when `SIGTERM` follows, and extend session-end hook coverage to `SIGTERM`. GitOrigin-RevId: 43a80b8277eb50519cdc293eb3b5dc2cad00b3aa
User verification cancellation (experimental)
Local UI clients can cancel a native user-verification RPC by sending
userVerification/cancel with {requestId} and the experimentalApi opt-in.
The result is an empty acknowledgment ({}). This API does not enable desktop
verification capability advertisement.
requestId is the original status, enroll, delete, or verify RPC's string or
integer ID on the same connection, not the server elicitation ID. Use fresh IDs
for each operation and a distinct ID for the cancel RPC. Unknown, finished,
unrelated, and other-connection requests are no-ops.
The acknowledgment confirms the cancellation signal without waiting for the OS
prompt to close. The original RPC completes independently, with
cancelled/interrupted when cancellation prevents completion. Cancellation
cannot roll back completed effects. It remains effective while a proof waits for
outbound queue capacity, but cannot retract a response already enqueued.
Canceling or resolving an elicitation does not itself stop a separate
userVerification/verify RPC. Clients must cancel that RPC separately and discard
late proofs after the approval is canceled or resolved. Only one native worker
runs per app-server; if an OS call remains active after cancellation or timeout,
subsequent local operations return failed/providerError until that worker exits.
Hosted Codex Apps MCP protocol
The host-owned HTTP codex_apps server uses Legacy by default in app-server and
standalone Codex. To discover the 2026-07-28 protocol, set
codex_apps_mcp_2026_07_28 = true under [features], or send a true runtime
override via experimentalFeature/enablement/set. Discovery falls back to Legacy
when the server does not support it. Explicit config takes precedence.
The dedicated setting does not apply to third-party HTTP or local codex_app
stdio servers. The existing mcp_2026_07_28 flag still governs eligible other
servers, regardless of whether their names or URLs resemble hosted Apps.
App-server does not persist this selection.
Thread removal
thread/archive and thread/delete reject attempts to remove a live internal
worker with JSON-RPC error -32600. The worker's owner controls its shutdown.
For example, a Guardian reviewer remains available to its parent conversation
after a client tries to archive or delete it.
After the owner releases the worker, its saved conversation can be archived or deleted normally. Ordinary client-controlled threads keep their existing behavior.
Amazon Bedrock authentication
If model_providers.amazon-bedrock.aws.credential_export is configured, Bedrock setup and
Bedrock login return an error without changing configuration or saved credentials. Remove the
exporter configuration before selecting another credential source. aws.credential_export and
aws.profile cannot be configured together.