## What changed
- Replace the separate MXC crates with `mxc-sdk` and adapt request construction to its policy and optional environment fields.
- Preserve the native availability probe by caching successful process security environment creation and startup attribute initialization without launching a process.
- Use the SDK's native denied-path support check and configure Bazel resource compilation for Windows GNU targets.
## Testing
Extend the request construction test to verify that nonempty environments use `Some` and empty environments use `None`.
GitOrigin-RevId: 2765c8fd19ee60661b0ce7cb3cba51acadda201a
## What changed
Add `thread/sample` to collect one model response on an ephemeral fork that inherits a loaded thread's context and configuration. Return the source turn ID, response ID, assistant text, and available token usage without modifying the source conversation.
Require an idle, persistent root thread and an `expectedTurnId` matching its latest completed turn. Reject results if the source history changes during sampling. Keep the parent responsive while sampling, hide sample forks from `thread/loaded/list`, and reclaim them after completion or timeout.
Intercept responses before tool execution or Stop hooks can run, returning null text for tool calls or responses without text. Apply optional reasoning-effort updates only when the provider and model support cache-preserving updates.
## Testing
Add integration coverage for inherited context and reasoning effort, source preservation, tool and Stop hook suppression, invalid requests, stream errors, parent responsiveness, and timeout cleanup.
GitOrigin-RevId: 08f4867e53ec7f6c8f4428d5542eeea4e6dadd0b
## What changed
- Build executor skill catalogs from discovery V2 inventories without reopening host paths or falling back to legacy discovery.
- Merge Cloud and executor skills by remote plugin identity and skill name, retaining Cloud metadata and accepted provider read routes. Apply plugin selection and disablement before merging.
- Share a stable catalog across each step's rendering, list/read tools, and explicit and implicit skill invocations.
- Preserve unmatched executor entries when Cloud catalogs are unavailable or partial; only complete Cloud catalogs disable unmatched remote entries.
- Bind discovery caches to captured environments and executor sessions, and refresh MCP when V2 inventories change. Preserve pending invalidations when forced MCP refreshes fail.
## Testing
Add regression coverage for V2 inventory sharing and refresh, environment isolation, catalog merging, partial Cloud results, disabled plugins, and catalog consistency across steps and read routes.
GitOrigin-RevId: 842bdcbc9e19364dd69a9abf9e48330b7425a76c
## What changed
- Use V2 discovery inventories for plugin MCP contributions when supplied, including empty or failed inventories; retain legacy discovery when no V2 snapshot is supplied.
- Merge plugins by canonical identity, using cloud metadata and enablement for remote plugins and attaching executor installations only when versions match. Preserve configured executor-local plugins and executor enablement when cloud data is unavailable.
- Keep installation order stable across refreshes and run merged MCP declarations on the first retained executor installation while preserving attribution for the others.
- Carry local and remote identities through selected-plugin snapshots, skill attribution, and active-plugin telemetry. Track disabled plugin IDs alongside disabled roots.
- Preserve a complete cloud catalog when a partial refresh arrives, and cap tool-description plugin attribution at 1,024 bytes while retaining all plugin associations.
## Testing
Add coverage for catalog parsing and reconciliation, enablement and discovery-mode selection, installation refresh ordering, executor-specific MCP normalization, selected-plugin snapshots, and bounded UTF-8 attribution text.
GitOrigin-RevId: a8ad352de6a2b8dc4bfd1ff6a5c62ee8ed1d1664
## What changed
Add a federated `Auth` variant that exchanges JWT subject tokens for OpenAI access tokens using identity provider and service account IDs. Serialize concurrent exchanges, cache credentials, and renew proactively with a fresh subject token.
Validate token types, bearer credentials, payload sizes, and lifetimes. Bound caching by both relative and absolute expiry, discard cached credentials before renewal, and disable redirects for federated requests. Keep credential buffers zeroizing and diagnostics free of secrets.
## Testing
Add HTTP fixture tests for concurrent cache reuse, renewal with fresh subjects, expiry across host suspension, failed renewal, oversized payloads, invalid subjects, and unsupported or missing issued token types.
GitOrigin-RevId: e7e6dacd4a834fb73166caf146d4cdc50a895f56
## What changed
Add a `GithubOidc` implementation of `SubjectTokenSource` that requests a fresh token using a bearer credential read from stdin. Validate HTTPS request URLs and replace the audience query parameter while preserving other parameters. CLI integration is not included.
Add a token HTTP client that disables redirects and request logging, applies timeouts, and bounds response bodies. Keep token response buffers in zeroizing storage and exclude credentials, request URLs, and response bodies from errors.
Generalize the locked stdin credential reader for bounded OIDC bearer tokens while preserving API key validation.
## Testing
Add tests for fresh token acquisition, short reads, credential size limits, injection rejection, redirect refusal, and credential-safe errors and logs. Extend API key tests to retain the stricter character restrictions.
GitOrigin-RevId: fd7767178f475b8161734f29d29108c795839185
## Why
Configuration loading can finish before a pending startup is visible to the thread manager. Reloads need a cancellation scope that also covers these configuration snapshots.
## What changed
- Capture an enterprise managed authentication (EMA) cancellation token before loading configuration and carry it through config layers, role overrides, runtime refreshes, and `McpConfig`.
- Cancel the previous scope on MCP or user configuration reloads and cloud config loader changes, then create a fresh scope for subsequent loads.
- Cancel the session's token when enterprise MCP authentication is disabled or a refresh leaves it unavailable.
## Testing
Extend the MCP reload test to verify that existing thread and pending startup tokens are cancelled while a fresh startup receives an uncancelled token.
GitOrigin-RevId: 5fc0658b74c360e7dc9ab3488339fcf19bfe9fae
## Why
Replacing rollout files can lose Unix ownership or macOS ACLs, changing who can read or append to a transcript. An ACL can also permit appending while denying explicit timestamp updates.
## What changed
- Preserve Unix ownership, permissions, modification times, and macOS ACLs before publishing compressed or restored rollouts, and verify the replacement can be reopened.
- Abort replacement on metadata failures, reject macOS delete-deny ACLs to keep temporary files removable, and detect Unix access metadata changes through `ctime` checks.
- Use managed restoration temporary files whose names avoid stale `*.tmp` cleanup.
- Allow appending when refreshing the rollout's modification time returns `PermissionDenied`.
## Testing
Add regression coverage for macOS ACL preservation, inherited ACL removal, deletion-protected rollouts, append access despite denied timestamp changes, Unix group preservation, and restoration temporary files surviving stale-file cleanup.
GitOrigin-RevId: 23f3de6e35c0b2e19f3491170e320159ea3bdb6f
## What changed
- Negotiate compression over TCP and local sockets with `x-codex-app-server-compression: zstd-stream-v1`. Keep JSON text messages when compression is not negotiated.
- Send compressed JSON as binary messages, retaining a separate zstd stream per direction across messages. Export reusable negotiation and codec helpers.
- Limit decompressed messages to 64 MiB and compression windows to 1 MiB. Close compressed connections on decoding errors or unexpected text messages.
- Add audit and deny ignores for the unmaintained `zvariant`, `zbus_names`, and `zvariant_derive` versions pulled in through `zbus`.
## Testing
Add codec tests for retained history, fallback, size limits, malformed data, and oversized compression windows. Add TCP and local-socket round-trip tests covering negotiation, persistent streams, and ping/pong handling, plus TCP fallback for absent or unsupported offers.
GitOrigin-RevId: 50d3861e8fe4a9c523599a5ab773bec7cb883bf2
## Why
Contextual fragments and extension-owned world-state sections currently return strings, limiting them to text content.
## What changed
- Return `ContentItem` from fragment bodies and rendering, preserving classification and attribution. Apply text markers only to `InputText`; pass other content through unchanged.
- Allow extension prompt and world-state contributions to carry typed content, and preserve media in context-window hints.
- Hash non-text world-state fragments by their serialized content and role while retaining the existing text hashing behavior.
- Add shared content-to-tool-output conversion that preserves image references, image detail, and audio.
## Testing
Add coverage for typed world-state hashing and preservation of image content and attribution. Expand code-mode output tests to cover input text, output text, file-backed and inline images, and audio.
GitOrigin-RevId: 2ed00d466a3f169b151202f3eef71e667ea64be1
## Why
Curated plugin archives should preserve executable permissions without applying setuid, setgid, or sticky bits.
## What changed
- Upgrade `zip` from 2.4.2 to 9.0.0, retaining the previous feature set and selecting the existing `bzip2-sys` backend explicitly. Update the Cargo and Bazel lockfiles.
- Adapt plugin extraction to fallible entry names and apply Unix permissions through the open output file, using the mode filtered by `zip`.
## Testing
Add a Unix regression test that encodes special permission bits directly in an archive entry and verifies that the extracted file has mode `0o755`.
GitOrigin-RevId: 75ee6879a372a36b34208c1359f42b670c9d3837
## What changed
Add the `multi_env_copy_file` feature flag, disabled by default and marked as under development, to the feature registry and configuration schema. Install the file-copy extension in app-server threads and CLI debug prompt construction when the flag is enabled.
GitOrigin-RevId: 6d8b4c7479974f4b70c39f52333491c13d60d2a2
## What changed
Read `desktop.uninstall_codex_home` from the owner's current `config.toml` before recursively deleting a desktop-created Codex home during Windows sandbox uninstall.
- Preserve the home by default for ordinary installations; retain the deletion default for OEM preinstalls when no preference is set.
- Let an explicit boolean preference override either default. Preserve the home when configuration is unreadable, malformed, or contains an invalid preference.
- Capture OEM metadata before Windows removes it during uninstall, and revoke sandbox permissions on retained homes.
## Testing
Add unit tests for missing preferences, explicit overrides, malformed or invalid configuration, and configuration read failures across both installation defaults.
GitOrigin-RevId: 46afc2a7b0f4ecf7f447e46b515e50d0d278e4a8
## What changed
Add the `codex-multi-env-copy-file` extension, exposing `multi_env_copy_file` when registered by the host. Copy files between distinct selected environments without loading their contents into model context, and return `bytes_copied` on completion.
Require absolute paths in each environment's native path convention and enforce each endpoint's sandbox policy and permission grants. Stream file contents where supported, with a buffered fallback for older executors. Reject same-environment copies and report I/O error kinds without exposing connection details. Warn that failed writes may leave a truncated or partially written target.
## Testing
Add integration tests for binary transfers in both directions, local and remote executors, path validation, opt-in tool visibility, endpoint permissions and grants, and unavailable or disconnected executors. Verify that copied contents stay outside model context.
GitOrigin-RevId: f5d9e423d105019834e0288828cb68c5711b3a49
## Why
Authorization server metadata can advertise scopes unrelated to the MCP resource. Using that list for discovery can request broader scopes than the resource requires.
## What changed
Update `rmcp` and use its initial scope selection during OAuth discovery: prefer scopes from the initial `WWW-Authenticate` challenge, fall back to protected resource metadata, and include `offline_access` when supported. Stop using the authorization server's general scope list as the discovered resource scopes.
## Testing
Add coverage for challenge scope precedence, resource metadata fallback, scope normalization, and exclusion of unrelated authorization server scopes. Add a no-browser login regression test for a preregistered client whose authorization server advertises neither scopes nor dynamic registration.
GitOrigin-RevId: 68d83cf61fb0b73dac9e861e476f484990fd93b6
## Why
A plugin's scripts can change without changing its hook declaration. Declaration-only approval therefore lets changed plugin code run under an existing hook approval.
## What changed
- Fingerprint plugin bundle contents and include the content hash in the approval value returned by `hooks/list`. Persist it as `trusted_content_hash`, keeping `trusted_hash` compatible with older clients.
- Verify contents before each command or MCP hook execution, within the hook's timeout, and require renewed approval when approved contents change.
- Migrate legacy declaration-only approvals to a shared, immutable content baseline per plugin and config home.
- Exclude generated Python bytecode, `.venv`, and `.egg-info` entries from fingerprints. Run app-server hook listing on blocking tasks.
## Testing
Extend integration coverage for plugin upgrades and rollbacks requiring approval, same-turn script changes preventing further hook execution, shared legacy approval baselines, and generated Python artifacts preserving trust.
GitOrigin-RevId: faaf7658210d8adb2534ddd614c72ec993920840
## Why
Optimized `Array.prototype.sort` can write objects into incompatible array element storage when receiver element kinds differ and the comparator mutates the array.
## What changed
- Upgrade `v8` to `152.2.0`, the Bazel V8 source to `15.2.124.1`, and ICU data and initialization to version 78.
- Backport element-kind agreement checks for sort inlining in TurboFan and Maglev. Apply the patch to Bazel builds and Windows MSVC source builds, and include it in source-build cache keys and canary triggers.
- Refresh pinned sandbox archives and bindings, extend Bazel prebuilt coverage to musl Linux, and use matching sandbox bindings on Windows MSVC.
- Update Bazel integration patches and runtime dependencies for the new V8 release, and download the pinned Windows build tools in source-build workflows.
## Testing
Include the upstream sort regression test covering mixed element kinds, comparator mutation, and continued optimization for matching kinds. Add a test requiring canary and Windows source builds when the backport changes, and update artifact-fetch tests for the new version.
GitOrigin-RevId: 138b7821cddd25466c10aced1dd22be24837caf0
## What changed
Add optional `inputImages` metadata containing each referenced local image's path and SHA-256 hash of the bytes read before normalization. Compute the hash from the same bytes used to prepare the edit request.
Preserve this metadata through completion events, persisted thread history, resume, and legacy rollout migration. Update app-server schemas and generated TypeScript and Python types; older items continue to deserialize without the field.
## Testing
Add coverage for input ordering, changed contents at the same path, unreadable or invalid references, serialization, persisted history and resume, and legacy migration.
GitOrigin-RevId: 522be8ec1e39c9b2bbe5b9ccb37ea67d17f0e21a
## Why
SQLite page reclamation on NFS creates I/O load and contention.
## What changed
Detect whether `sqlite_home` is on NFS on Linux and skip reclamation before opening a maintenance connection. Cache successful filesystem probes across `SqliteConfig` clones while allowing failed probes to retry.
## Testing
Add tests for shared probe caching and recovery after a missing directory is created. Update reclamation coverage to expect no reclaimed pages or file shrinkage on NFS.
GitOrigin-RevId: 4f627cabc6ad712171654c3f8b8659d2f632bbba
## What changed
- Launch managed processes through `taskpolicy -b` on macOS when a five-second probe succeeds, preserving the managed process PID. Fall back to direct launch if the probe fails or times out.
- Increase the macOS startup timeout from 10 to 30 seconds to accommodate background CPU and I/O scheduling, and serialize daemon startup test fixtures on macOS.
- Use the shared background command helper and retain `CREATE_NO_WINDOW` alongside Windows detachment flags.
## Testing
Add macOS tests for PID preservation, background priority when available, and direct-launch fallback after a probe timeout.
GitOrigin-RevId: ab3328e2e8f62218ac9602e4172563c00056875b
## What changed
- Upload generated images to the attachment store and expose `fileId` in image-generation items when available, with inline `result` fallback on upload or decoding failure.
- Preserve file references through legacy events, persisted rollouts, thread history, and task output summaries. Keep model-facing image preparation separate.
- Add attachment request tags and mark generated-image uploads with `usage=image_gen`, preserving the thread's ephemeral setting.
- Update public schemas and SDK types to accept either image representation, retain the Python `ImageGenerationThreadItem` alias, and prefer `fileId` when reading records containing both fields.
## Testing
Add coverage for file-backed generation and rollout persistence, legacy history replay, inline and transitional serialization, task output visibility, and Python SDK alias compatibility.
GitOrigin-RevId: f7a2bb5707e2f277348a547a988bc33c8e96d891
## Why
On case-insensitive macOS filesystems, paths such as `.GIT/config` refer to protected `.git/config` metadata but can pass case-sensitive write permission checks.
## What changed
Check native filesystem case sensitivity when matching protected metadata paths, including case aliases in workspace roots. Recheck both the target and policy entries with normalized aliases so explicit metadata grants and narrower restrictions retain their precedence. Return errors when filesystem case sensitivity cannot be established.
## Testing
Add macOS coverage for metadata and workspace-root case aliases, explicit grants, narrower restrictions, and missing directories. Strengthen the patch regression test to assert the approval rejection message for both direct `apply_patch` calls and shell interception.
GitOrigin-RevId: 8ae2eb97ce6ec71c51bead130515b9ce6c1cdfab
## Why
Keychain signing reconstructs its own authentication context, so invalidating the caller's context does not reliably cancel the context that owns the biometric prompt.
## What changed
Evaluate the stored key's access-control policy explicitly with `LAContext` before signing. On cancellation, invalidate that context and wait for its authorization callback before releasing the lifecycle lock, rejecting any late success. Reload the key with the authorized context and disable further interaction so signing cannot open another prompt.
## Testing
Update unit tests to cover waiting for cancellation completion and rejecting completed authorization after cancellation. Add an ignored macOS hardware test and setup instructions covering persisted Secure Enclave key reuse, signature verification, cancellation, retry signing, and cleanup.
GitOrigin-RevId: 4ea9756430c5649654e95e047d1666617503072c
## What changed
- Return qualified skill names such as `team:deploy` and parsed `dependencies` and `policy` instead of a separate namespace and raw metadata file. Share `agents/openai.yaml` parsing and validation between skill loaders and executor discovery.
- Include each standalone skill's search-root ID and path in `discoveryRoot`, while accepting responses from older executors that omit it.
- Add plugin `displayName`, falling back to the manifest name or installation directory.
- Materialize inline MCP declarations in `mcpConfig` with the manifest as their source path, and report incomplete discovery when declared MCP or Apps configuration files have no returned contents.
## Testing
Add coverage for JSON round trips, omitted `discoveryRoot`, optional and invalid skill metadata, qualified names, display-name fallbacks, and inline MCP configuration. Verify standalone search roots survive cached discovery and sandboxed RPC responses.
GitOrigin-RevId: 4124972444ad7c2fb8c6418acbf9a589d797fad2
## Why
`codex app-server daemon restart` previously reused saved settings without applying feature flags supplied on the command line.
## What changed
Apply `--enable`, `--disable`, and boolean `-c features.*` overrides during an explicit restart and persist them for subsequent restarts. Accept nested `enabled` values, normalize feature aliases, and replace conflicting saved aliases while preserving unrelated settings.
Reject invalid feature toggles before stopping the daemon or saving settings.
## Testing
Add integration coverage for overrides on stopped and running daemons, alias replacement, preservation of saved settings, restarts without flags, and rejection of non-toggle keys without interrupting the running daemon.
GitOrigin-RevId: 14a657bc4758b9c248e363f9dac58f8887070a04
## Why
Rewriting source agent names and instruction filenames inside URLs and email addresses can change their destinations when importing external agent content.
## What changed
Use `linkify` to preserve recognized URLs and email addresses while rewriting surrounding text, including Markdown link labels and titles. Continue migrating instruction filename references to `AGENTS.md`, including relative links and references with line or column suffixes.
## Testing
Add rewrite coverage for URLs, email addresses, Markdown links, and surrounding Unicode text. Extend skill import and app-server configuration import tests to verify that link labels migrate while URL destinations remain unchanged.
GitOrigin-RevId: c4d210a287c99b6440438c99527364d379c568bd
## What changed
Update `codex-rs/Cargo.lock` and `MODULE.bazel.lock` for `quinn-proto` 0.11.18, replacing 0.11.15. Refresh its resolved dependencies to use `rand` 0.10.1 and `getrandom` 0.4.2, and add `rand_pcg` 0.10.2.
GitOrigin-RevId: 642bdeccbff8017f2f97b640a2b2c48294c97bba
## Why
Repeated turn diff notifications can print the same file changes multiple times, including after an unrelated command.
## What changed
Track the last diff and print nonempty updates only when they differ from the previous notification. Remember empty updates so a restored diff prints again, and reset the tracked diff when a new turn starts.
## Testing
Add a stderr snapshot test covering repeated, changed, empty, restored, and new-turn diffs. Add an integration test that applies one edit, runs an unrelated command, and verifies that the diff appears exactly once.
GitOrigin-RevId: db0a2aa8b77b800ca661e7d1314ed1e571743e74
## What changed
- Update the pinned `rmcp` dependency and Cargo/Bazel lockfiles, and migrate MCP handlers and fixtures to `ClientConfig` and `ServerConfig`.
- Stop requiring responses for cancelled elicitation requests in cancellation tests while retaining checks for cleanup and continued connection usability.
- Handle client disconnects during WebSocket writes in the TUI test server, use an asynchronous HTTP mock for loopback proxy testing, and improve remote executor test diagnostics and the Windows subprocess fixture.
- Use `invalid_prompt` for the memory worker failure fixture.
## Testing
Add a regression test covering transport EOF during both form elicitation and user verification. Keep the client alive while checking that pending response channels close, the timeout pause clears, and the service exits with `QuitReason::Closed`.
GitOrigin-RevId: c0166b83fab3b59d84a5207c6630cb6adcf3b230
## Why
Voice failure metrics lacked cause and lifecycle phase, and session durations were recorded before the final outcome was known. A failed control send could also overwrite a more specific WebRTC error.
## What changed
- Tag `codex.voice.session.failure` with bounded `cause` and `phase` values, recording at most one failure per session.
- Capture duration when stopping and emit `codex.voice.session.duration` at cleanup with a `success` or `failure` outcome.
- Carry typed WebRTC errors into the TUI, preserve existing errors when control sends fail, and avoid duplicate errors after startup failure.
- Record app-server disconnect failures for background voice sessions as well as the visible session.
## Testing
Add coverage for terminal outcome and failure metric attributes, preservation of specific startup and audio-session errors, and startup failures without duplicate control-channel errors.
GitOrigin-RevId: 5aeda6e766093e3fce7206560aa83b6f7770dddb
## What changed
- Add `grpc+stdio://` as a host transport and the disabled-by-default `code_mode_host_grpc` feature flag to select it.
- Share a lazy HTTP/2 channel and host process across code-mode sessions while keeping session state isolated.
- Use HTTP/2 keepalives to detect unresponsive hosts, kill and reap disconnected children, and spawn a fresh host on reconnect. Exit the host when its stdio connection closes.
## Testing
Add coverage for shared-host session isolation, host exit on stdin EOF, and recovery after an unresponsive host is reaped. Exercise nested tool calls with both legacy stdio and gRPC stdio, asserting that the feature flag selects the expected transport.
GitOrigin-RevId: 31389d8540de236b8e0571d3c24e29e117b75c4a
## Why
PSEC API symbols can be present on transitional Windows builds where MXC is not enabled. Availability detection needs to verify that a native process security environment can actually be created.
## What changed
- Replace `mxc-sdk` with pinned `appcontainer_common`, `learning_mode_windows`, and `wxc_common` dependencies, and update Cargo and Bazel dependency metadata.
- Use MXC's cached create/close probe for `is_available()` and query native deny-path support through `SecurityEnvironmentApi` before launching requests with denied paths.
- Adapt request construction and the existing policy test to the vector-based environment field, and update the sandbox documentation.
GitOrigin-RevId: e8cc6a35d46884d0a069b747d33e711512ec1596
## Why
Requests with `Connection: close` must not reuse the connection even when the server responds with `Connection: keep-alive`.
## What changed
Update `hyper` from 1.8.1 to 1.11.1 in `codex-rs/Cargo.lock` and add the corresponding Bazel lockfile metadata.
## Testing
Add a regression test that sends two requests with `Connection: close` to a server that ignores the header and verifies that the second request uses a new connection.
GitOrigin-RevId: 72b464c8ea3d9a1ad5d9e62f7896ea9a4f15a93c
## Why
Sessions sharing a transport can be admitted to different hosts. Each session needs its own routing token so subsequent RPCs reach the host holding its state.
## What changed
- Capture the optional `x-code-mode-route` metadata from successful `OpenSession` responses and attach it to subsequent session RPCs. Reject tokens longer than 256 bytes and keep new admission attempts free of existing session routes.
- Invalidate a routed session when an `Unavailable` response explicitly sets `x-code-mode-route-lost: true`, allowing a later operation to reopen it without replaying the failed execution. Ordinary `Unavailable` responses preserve the session.
- Allow up to five admission attempts for `Unavailable` and `ResourceExhausted`, with an immediate first retry followed by jittered exponential backoff.
- Order session failure with shutdown so late callback errors cannot cancel an in-flight `CloseSession` RPC.
## Testing
Add regression coverage for independent routing on a shared provider, route-loss recovery without execution replay, preservation of unaffected session state, and callback failures racing shutdown. Extend admission tests to verify the five-attempt limit and recovery tests to distinguish explicit route loss from ordinary unavailability.
GitOrigin-RevId: 5d60ef1afa56beb8c70ba7ab27865128225b0d3d
## Why
MCP servers receiving sandbox state need a usable Codex executable to launch commands with the issuing call's policy. HTTP and remote servers cannot assume access to the host's filesystem.
## What changed
- Include optional `codexExecutable` metadata for local stdio servers when the host supplies an absolute, UTF-8 path to a CLI supporting `sandbox --sandbox-state-json`. Cache capability probes by executable path and bound them to five seconds.
- Document forwarding the sandbox state unchanged and requiring an explicit opt-out rather than silently falling back to PATH lookup or unsandboxed execution when the launcher is absent.
- Honor `useMxc` from forwarded sandbox state when selecting the Windows sandbox backend and network proxy policies, preserving a parent's selection made through CLI overrides.
## Testing
Add coverage for launcher eligibility across local, remote, and HTTP servers, invalid or missing executable paths, and binaries without sandbox-state support. Extend metadata integration and serialization tests to cover the optional launcher field, legacy state, and unknown future fields.
GitOrigin-RevId: ea8cd3770616e5a620b423a01052a7bc828bceb9
## What changed
- Use the standard shell executor and remove the zsh fork escalation runtime, `codex-execve-wrapper`, and `shell-escalation` crate.
- Ignore `shell_zsh_fork` and `unified_exec_zsh_fork`, emit migration notices for legacy configuration, and warn when ignoring managed requirements for these flags.
- Keep the active session's `apply_patch` alias directory readable under restricted filesystem permissions.
## Testing
Add coverage for legacy configuration startup and shell execution, migration notice rendering, active alias directory selection, and nested `apply_patch` execution while other files in `CODEX_HOME` remain unreadable.
GitOrigin-RevId: 43af461fea32b4980550ee7237effd2bc0646ed8
## Why
A conversation classifier waiting for preparation or full response completion can block newer classifications. Concurrent reviews also need to prevent a later action's evidence or low-risk score from being reused for an earlier action.
## What changed
- Run conversation classifications independently, forking the latest compatible completed history from an earlier action. Only a valid completion with a newer action index can replace retained history.
- Keep admission and observation ordering atomic, and hold capacity permits through full response completion.
- Reject cached low-risk scores from later actions for tool-linked approvals, including initial approval checks.
- Track originating tool-call IDs separately from approval display IDs, preserving stdin write provenance and excluding synthetic MCP elicitation IDs from tool ordering.
## Testing
Add regression coverage for delayed preparation, capacity admission, out-of-order completion, cancellation, invalid retained output, and history snapshots. Exercise pending approval ordering in both `snapshot` and `conversation` modes, and verify linked and unlinked MCP elicitation provenance.
GitOrigin-RevId: 097476ccb3b8718369a69f55c3c39132f7f1a4c1
## What changed
Add Linux dependency discovery and policy preparation to `exec-server`'s sandbox integrity module. Inventory bundled and system `bwrap` candidates and the deny-glob scanner using the launcher's location and the command's `PATH` and working directory.
Resolve `:tmpdir` and tilde-prefixed deny globs using the command's `TMPDIR` and `HOME`, with account home-directory fallback. Reuse Linux sandbox helpers to expand deny globs in the command's explicit environment.
## Testing
Add Linux tests covering symlinked launchers, relative and empty `PATH` entries, and empty, relative, and tilde-prefixed `TMPDIR` values alongside home-relative deny globs.
GitOrigin-RevId: fe404fa4be77ece677b22d52d77a7234dbf0cffe
## What changed
Add Windows MXC backend helpers to inventory the Codex executable, sandbox
launcher, and available `rg` scanner when deny globs are configured. Prepare
filesystem policies for inspection by reusing MXC temporary-directory and volume
resolution and replacing deny globs with concrete path snapshots.
Allow Windows deny-glob resolution to run its scanner with an explicit command
environment and working directory, including an empty environment. The integrity
helpers are not yet invoked by an execution runner.
## Testing
Add a backend test verifying that deny-glob snapshots replace the original
patterns, including empty snapshots, and affect `FileContentsChecker` results.
GitOrigin-RevId: 409c527663d230d76d65be3bf0a37959f694d77e
## What changed
- Replace the separate MXC crates with the pinned `mxc-sdk` 1.0.0 dependency and update Cargo and Bazel lockfiles.
- Use the cached PSEC API-set check for availability and the SDK's native deny-path capability check before launch. Native creation and request-specific capabilities are validated at launch.
- Map empty environments to `None` to retain Windows user-profile defaults, while keeping nonempty environments explicit. Document the SDK's `SystemRoot` and `LOCALAPPDATA` requirements.
- Configure Bazel's LLVM resource compiler for Windows GNU builds, document Cargo's `RC_PATH` requirement, and add `libproc` and `libsandbox` to the macOS SDK libraries.
## Testing
Update the request-building test to verify that nonempty environments remain explicit and empty environments become `None`.
GitOrigin-RevId: f3ccbb92ceaa71f16c5d6cb185a7602a5bb8da53
## Why
Skill selection and disabled-path matching need to recognize equivalent Windows paths across case and separator differences while preserving literal spaces, `%`, and `#` in native filenames.
## What changed
- Carry `PathUri` through skill metadata, discovery mappings, filesystem lookups, disabled-path sets, and invocation analytics.
- Match linked skill mentions and TUI selections by parsed path identity.
- Use `LegacyAppPathString` for app-server skill paths and regenerate schemas and SDK types, preserving native path strings on the wire.
- Preserve native catalog display paths and ordering. Keep host filesystem probes and configuration writes restricted to host-compatible paths.
## Testing
Add regression tests for Windows path identity and disabled-skill matching, literal filename characters, catalog resource reads, native path ordering, and foreign-path analytics normalization.
GitOrigin-RevId: c212916dc9fef0e7616542726e107f0d6a313267
## What changed
For managed app-server daemons using Unix sockets, raise the soft
`RLIMIT_NOFILE` limit to 4096 at startup, capped by the inherited hard limit.
Preserve existing higher soft limits and log a warning if the adjustment fails.
GitOrigin-RevId: 2ef27370e55cd86a7a62cbc3d47041933b89ac21
## What changed
Introduce `TranscriptRecord` and `PreparedTranscript` to retain attributed transcript text through preparation and composition. Cache rendered content, byte counts, and token estimates, refreshing them when text or framing changes.
Keep JSON records structured during budget recovery so truncation replaces only `text`, preserving metadata, field order, and framing without reparsing serialized JSON. Preserve whole-entry truncation for line transcripts and update synchronous and asynchronous consumers to use the preparation API.
## Testing
Expand coverage for cached estimates and delivery with escaped text, Unicode, and large payloads; metadata and framing preservation during recovery; and stable asynchronous history prefixes in both line and JSON formats.
GitOrigin-RevId: 8b3b5231ca4a6ee47d17dcc788ea68c56dd1a9bc
## Why
Serial connection opens let a stalled handshake delay healthy sockets. Waiting until the idle pool is empty to refill also leaves classification bursts using HTTP fallback.
## What changed
- Open up to four WebSockets concurrently and start replenishing when the idle pool falls to half capacity. Preserve successful in-flight opens when another open fails or times out.
- Make explicit prewarming wait for an existing refill before checking readiness.
- Add `ResponsesWebsocketClient::connect_with_connector` and reuse one connector per sampler, initializing TLS configuration on a blocking task while retaining per-connection authentication and destination policy checks.
- Record connection lease durations for admission, setup, and total time, tagged by transport.
## Testing
Add regression tests for a stalled handshake alongside a healthy socket and replenishment before the last idle socket is leased. Update cooldown, authentication, and transport retry tests to account for concurrent handshake completion.
GitOrigin-RevId: f4a8258977c1f2a58e00c6badc7b599280ef22ad
## Why
Windows Terminal's `sendInput` mapping delivers `ESC[13;2u` as individual console key events. Decode it as `Shift+Enter` so the mapping inserts a newline in the composer.
## What changed
- Wrap the Windows event stream with a decoder for the complete Escape-prefixed sequence, including interleaved key releases.
- Use a fixed 50 ms deadline for partial sequences and replay incomplete or mismatched input unchanged. Preserve literal text, paste events, and native key events.
- Update the `crossterm` revision and dependency lockfiles.
## Testing
Add tests for repeated and fragmented mappings, deadline handling, unchanged input, error and end-of-stream replay, and composer newline rendering with a snapshot.
GitOrigin-RevId: 95ab39960510d71322824c63817710633a2fda23
## Why
Paginated thread history can persist large MCP results in completed tool-call items. Bound these stored results to avoid retaining multi-megabyte payloads.
## What changed
Apply a 64 KiB preview budget when persisting oversized MCP results in paginated history. Replace the result with a truncated text preview of its serialized JSON, preserving `is_error` and clearing `structuredContent` and `_meta`. Leave small results unchanged.
Share the truncation helper with the existing MCP tool-call event path.
## Testing
Add helper tests for unchanged small results and oversized results with structured content and metadata. Add a thread-history test verifying that persisted MCP results contain a bounded preview with the beginning, end, and truncation marker while preserving tool arguments.
GitOrigin-RevId: 09dce73c70bfd357c9b9630f456e9e5c1d8492cf
## What changed
- Combine file-backed rollouts and buffered rollout prefixes into `rollouts.tar.gz`, keeping diagnostics as separate attachments.
- Bound the archive and its upload envelope by the existing size limit, skip invalid or duplicate archive filenames, and fall back to individual rollout attachments if archiving fails.
- Add `rollout_archive_filename` to the report thread index so rollout filenames identify archive entries or fallback attachments.
## Testing
Add an upload test that extracts the archive and verifies the filenames and contents of both a compressed file-backed rollout and a buffered rollout. Update the thread index test to check the archive filename.
GitOrigin-RevId: 973da6eec2249b04ef7992b5e1e4fd27f044b80f
## Why
Paginated history previously persisted completed commands' full `aggregated_output`, allowing large command outputs to inflate stored history.
## What changed
- Limit persisted command `aggregated_output` to 64 KiB, including a truncation marker. Preserve the beginning and end of the output without splitting UTF-8 characters.
- Apply the shared persistence policy to rollout recording, thread-store appends, and legacy-to-paginated history migration.
- Measure persisted payload bytes after truncation so persistence metrics reflect the stored representation.
## Testing
Add coverage for the byte limit, UTF-8 boundaries, unchanged inputs that fit, and markers that exceed the budget. Verify capped output in paginated thread history and migrated legacy history, and verify persistence metrics use the truncated payload size.
GitOrigin-RevId: 01d420d396ad34b42dc5dc208c0bf88d890639ee
johnl-oai