Charlie Marsh 5b98eaafeb Treat access program denials as terminal errors (#60476) ...

## What changed

Recognize `access_program_not_enabled` in HTTP 403 responses and response stream errors as a dedicated, non-retryable error. Preserve HTTP diagnostic details and provider stream messages, with a default message when none is supplied.

Stop SSE streams immediately on this error and avoid triggering WebSocket fallback for explicit access program denials. Add a fixed diagnostic label for doctor output and telemetry.

## Testing

Extend coverage for HTTP and WebSocket denials, immediate SSE termination despite retry headers, and doctor diagnostic redaction.

GitOrigin-RevId: 3a41f7bb80ad5e13a87e831b458d17cdd19a4b62

2026-11-10 00:08:32 +00:00

..

models

Route response item IDs through a shared generator (#59312)

2026-11-04 04:02:00 +00:00

openai_models

Allow model overrides for incremental Code Mode tool messages (#60188)

2026-11-08 01:13:32 +00:00

permissions

Centralize filesystem permission resolution for sandbox enforcement (#59009)

2026-11-02 23:19:47 +00:00

prompts/base_instructions

…

account.rs

Add a built-in Google Cloud Vertex AI provider (#56265)

2026-10-22 21:01:14 +00:00

agent_error.rs

Add bounded diagnostics for agent spawn failures (#51355)

2026-10-06 12:32:27 +00:00

agent_path.rs

…

approvals.rs

Add managed command checkpoints requiring fresh human approval (#58045)

2026-10-29 11:23:51 +00:00

auth.rs

Add support for Academic Researchers plans (#55387)

2026-10-19 21:43:19 +00:00

capabilities_tests.rs

…

capabilities.rs

Bind capability roots to environment selections (#51493)

2026-10-06 22:39:32 +00:00

codex_error_info.rs

Distinguish policy-restricted capacity failures from server overloads (#57452)

2026-10-27 13:31:38 +00:00

config_types.rs

Retire the personality feature flag and document deprecated settings (#45809)

2026-09-15 23:39:40 +00:00

context_window_id.rs

Introduce a dedicated context window ID type (#59328)

2026-11-04 06:05:16 +00:00

conversation_start_params_tests.rs

Forward client voice session IDs in realtime requests (#53784)

2026-10-13 22:21:31 +00:00

dynamic_tools.rs

…

environment.rs

Add hook configuration to environment attachments (#56302)

2026-10-23 00:02:29 +00:00

error_tests.rs

Point usage and credit links to ChatGPT settings (#49874)

2026-10-01 05:16:40 +00:00

error.rs

Treat access program denials as terminal errors (#60476)

2026-11-10 00:08:32 +00:00

exec_output_tests.rs

…

exec_output.rs

…

guardian_transcript.rs

Add an optional JSON transcript format for Guardian (#51465)

2026-10-06 19:30:57 +00:00

hooks.rs

Add hook configuration to environment attachments (#56302)

2026-10-23 00:02:29 +00:00

item_id_generator.rs

Route response item IDs through a shared generator (#59312)

2026-11-04 04:02:00 +00:00

items.rs

Preserve display instructions in answer moderation (#60172)

2026-11-07 21:31:08 +00:00

legacy_events.rs

Preserve display instructions in answer moderation (#60172)

2026-11-07 21:31:08 +00:00

lib.rs

Introduce a dedicated context window ID type (#59328)

2026-11-04 06:05:16 +00:00

local_media_tests.rs

Add audio file references with explicit runtime rejection (#58430)

2026-10-30 20:53:25 +00:00

local_media.rs

Add audio file references with explicit runtime rejection (#58430)

2026-10-30 20:53:25 +00:00

mcp_approval_meta.rs

Include tool names and annotation hints in MCP approval metadata (#58161)

2026-10-29 19:34:46 +00:00

mcp_policy.rs

…

mcp.rs

Allow deferring plain-text MCP output in thread item listings (#60390)

2026-11-09 12:54:12 +00:00

memory_citation.rs

…

memory_version.rs

Add configurable memory versions with isolated storage (#43797)

2026-09-08 10:55:48 +00:00

models.rs

Budget retained file audio during remote compaction (#59237)

2026-11-03 21:53:26 +00:00

network_policy.rs

…

num_format.rs

…

openai_models.rs

Resolve saved Daybreak preferences against advertised model programs (#59192)

2026-11-03 16:33:17 +00:00

parse_command.rs

…

permission_profile_intersection_tests.rs

Protect .aws directories under sandbox writable roots (#48176)

2026-09-25 19:14:31 +00:00

permission_profile_intersection.rs

Preserve target-native paths in command approvals (#42577)

2026-09-03 16:21:10 +00:00

permission_profile_snapshot_tests.rs

Preserve executor path URIs in permission profile workspace roots (#45863)

2026-09-16 04:23:46 +00:00

permission_profile_snapshot.rs

Preserve executor path URIs in permission profile workspace roots (#45863)

2026-09-16 04:23:46 +00:00

permissions_tests.rs

Move protocol permissions tests into a separate file (#58966)

2026-11-02 20:13:51 +00:00

permissions.rs

Use permission profiles for protected-model startup downgrades (#59933)

2026-11-06 16:00:54 +00:00

plan_tool.rs

…

protocol.rs

Support cancellation and deadlines for realtime attachments (#60443)

2026-11-09 20:24:40 +00:00

realtime.rs

…

request_permissions.rs

Preserve target-native cwd in permission approval requests (#42314)

2026-09-02 17:27:50 +00:00

request_user_input_tests.rs

…

request_user_input.rs

…

response_item_id_tests.rs

Route response item IDs through a shared generator (#59312)

2026-11-04 04:02:00 +00:00

response_item_id.rs

Route response item IDs through a shared generator (#59312)

2026-11-04 04:02:00 +00:00

response_usage.rs

Preserve raw response usage metadata (#41980)

2026-09-01 05:17:11 +00:00

review_format.rs

…

sandbox.rs

Preserve sandbox overrides across execution requests (#51786)

2026-10-07 17:59:22 +00:00

sanitized_git_url_tests.rs

Start cloud threads with the local GitHub project (#60007)

2026-11-06 23:00:38 +00:00

sanitized_git_url.rs

Start cloud threads with the local GitHub project (#60007)

2026-11-06 23:00:38 +00:00

security_risk.rs

…

session_id.rs

…

shell_environment_tests.rs

Expose originating tool call metadata in command environments (#52119)

2026-10-08 13:45:19 +00:00

shell_environment.rs

Expose originating tool call metadata in command environments (#52119)

2026-10-08 13:45:19 +00:00

thread_id.rs

…

tool_name.rs

…

turn_input.rs

Allow per-turn overrides for direct-only tool namespaces (#59481)

2026-11-04 19:58:49 +00:00

user_input.rs

Add audio file references with explicit runtime rejection (#58430)

2026-10-30 20:53:25 +00:00