## Why
Resumed threads can retain stale capability root locations when the current environment supplies an explicit owner configuration. Matching roots from that configuration previously could not refresh persisted thread roots.
## What changed
Refresh persisted roots from the current attachment when both the root ID and environment ID match, including roots selected by owner-provided configuration. Preserve persisted locations when no matching root is supplied, and continue using the owner's selected roots rather than the executor's shared roots.
Apply the same merge behavior to capability root inspection and per-step resolution.
## Testing
Extend the remote environment regression test to cover owner-provided configurations with and without refreshed roots, including an executor root location that differs from the owner's selection.
GitOrigin-RevId: ad3a639924b348d6d5337ccc64dc8c08234276e3
## What changed
Move `ExecServerProcess` into `core_test_support::exec_server` and update the sandbox, plugin, access, and turn-input tests to use it. Preserve the fixture's startup timeout, temporary `CODEX_HOME`, WebSocket URL discovery, and child-process cleanup.
GitOrigin-RevId: 152de3a83f4ad39e2c1223e15438608dba452850
## What changed
Add `TurnInput::AnnotatedResponseItem` with a caller-supplied `retain` annotation. For function-call outputs, `retain: true` sets `client_authored` history metadata while keeping annotations out of model requests. Accept annotated items through the existing turn submission paths, including continuation.
## Testing
Add an integration test covering retention metadata during turn start, steering, idle submission, and rollout storage. Verify that ordinary outputs remain unmarked and model requests contain neither `retain` nor `client_authored`.
GitOrigin-RevId: 7285dde31149b17b0dcf31d4ea1c7cba66d9efe6
## Why
A credential bound to a host with MITM hooks could also be used at an alias without hooks, allowing the proxy to inject the real credential without enforcing hook policy.
## What changed
Reject requests to unhooked aliases when their selected brokered credentials are also bound to a hooked host. Check both HTTP forwarding and MITM requests before replacing dummy credentials, returning `403` with `blocked-by-mitm-hook` for denied requests.
Use the same destination and credential-selection rules for alias checks and injection, including configured URL prefixes, safe paths, equivalent credentials, merged Basic authentication fields, and environment scope.
## Testing
Add regression coverage for built-in and configured provider aliases, IPv6 destinations, credential selection, and unrelated credentials. Add an agent-started proxy test that verifies credential masking and alias denial.
GitOrigin-RevId: 12be41654761cedcf87b170f7661d6566f7a864e
## Why
A tool can return before its background watcher emits `ExecCommandEnd`. Waiting for that event first can discard an earlier `TurnComplete`, causing the shell snapshot test helper to time out.
## What changed
Update `run_tool_turn_on_harness` to track both the matching `ExecCommandEnd` and `TurnComplete` in a single event loop, returning only after both have arrived regardless of order.
GitOrigin-RevId: c9b749a46eda1244aa3e80fd88b663d110d67d1b
## What changed
Add the disabled-by-default `subagent_default_context_limits` feature and expose it in the configuration schema. When enabled, shared configuration for spawning and resuming subagents clears inherited `model_context_window` and `model_auto_compact_token_limit` overrides so subagents use their model's default context window and auto-compaction threshold.
GitOrigin-RevId: 5168ae2b4fbe72c533d8c6152922a8bceb2c5cbd
## Why
A local command can exit while a descendant keeps its inherited output pipes open, delaying `exec_command` completion and turn completion.
## What changed
Start the bounded output drain when a local exec-server process exits, whether exit is reported by an event or recovered through `process/read`. Remote execution continues waiting for output closure so buffered or delayed output is retained.
## Testing
Add regression coverage for local shell snapshot execution completing before a descendant releases stdout, preserving the foreground output and exit code. Add remote event-stream cases that retain output arriving after both reported and recovered process exit.
GitOrigin-RevId: d38bcd394be42cf48d2af02733e883b02d1dd62f
## Why
The remote environment test can steer before the wait tool call is recorded, discarding the call. The session replacement test can close the client while agents overview RPCs are still pending, leaving the proxy writing to a closed socket.
## What changed
- Wait for the `wait-for-active-environment` function call event before steering the active turn.
- Wait for `AgentsOverviewThreadsLoaded` before shutting down session replacement test cases that open the agents overview.
GitOrigin-RevId: 886112a56ff6e1016efe30dbbd0256807bc1cc85
## Why
Remote boards can allow replies while denying new threads. Agents need to discover these effective permissions and receive actionable details when an operation is denied.
## What changed
- Expose optional `board_permissions` and per-channel `permissions` in `get_channels`, preserving the legacy response shape when permission metadata is absent.
- Preserve HTTP 403 `permission_denied` responses as structured tool errors with a message and optional `action` and `resource`. Mark denied calls as unsuccessful and truncate oversized error details to fit the output budget.
- Pass through service-computed permissions without evaluating access rules locally.
## Testing
Add remote-board scenarios for direct tools and code mode covering legacy responses, reply-only permissions, a denied post, and a successful reply, plus a snapshot of the direct tool exchange.
GitOrigin-RevId: 76594bbc0a1283ff3c3c8682bd7615baa5ade428
## What changed
Add `preserve_fork_prefix` to the multi-agent v2 configuration, defaulting to `false`. When enabled, full forks retain the parent's model-visible history, including commentary and tool records, and append the child's instructions. Legacy compaction without a reusable context baseline still rebuilds the child context.
Mark copied history as inherited, complete unfinished tool calls in the fork snapshot, and exclude inherited manual approvals from authorization review while retaining them in model context.
## Testing
Add coverage for preserved request prefixes, child instructions, legacy and paginated histories, Code Mode, missing inherited tool outputs, compaction fallback, and approval isolation across checkpoint replay. Update the noisy helper failure test to read its response before starting cleanup.
GitOrigin-RevId: ce9235dfa111c88d6ce66cb93d564fb63b326489
## Why
Realtime v3 voice validation used the v1 voice list, limiting the available voice choices.
## What changed
- Add a dedicated `v3` voice list containing the v1 voices and 16 additional voices, and use it to validate v3 requests.
- Expose `v3` in `RealtimeVoicesList`, defaulting to an empty list when omitted during deserialization.
- Update the configuration and app-server schemas, generated TypeScript and Python types, and voice-list test expectations.
GitOrigin-RevId: 7fc8060fe01d840f28eb92c3dfe49c5878c3c258
## What changed
- Remove `ContentItemMetadata`, provenance and namespace types, and the `content_item_metadata` protocol field while retaining `content_item_kinds` classifications.
- Simplify context fragments, extension contributions, and hook output to carry content without source attribution. Return MCP tool results directly without an attribution wrapper.
- Render context-window hints together in a single text fragment.
## Testing
Update Responses and Responses Lite request assertions to expect content-kind classifications without per-content attribution, and adapt context, hook, and extension tests to the simplified types.
GitOrigin-RevId: 201894cd4c93c6d4b4c41c845e7a9af1dd3c95ca
## What changed
Add `history_initialization` to `x-codex-turn-metadata`, distinguishing `new`, `cleared`, `cold_resume`, `warm_fork`, `cold_fork`, and `supplied_history`.
Classify forks by whether the source runtime is loaded and has not shut down. Preserve the classification for the runtime's lifetime, including warm resumes and compaction. This records how history was initialized; it does not establish whether tool metadata is missing. Reserve the field against client-supplied overrides.
## Testing
Extend coverage for warm and cold forks, cold resumes, warm reconnects, supplied history, WebSocket metadata serialization, and reserved-field filtering.
GitOrigin-RevId: 468153512a84d0f4d4ea742198a29e0fa3873a72
## What changed
- Add the disabled-by-default `features.credential_masking` flag to enable credential brokerage through an already enabled network proxy, retaining custom credential providers and managed configuration precedence.
- Prevent project configuration from overriding credential masking and apply existing credential-broker protections to project shell settings when masking is enabled.
- Keep brokerage inactive when the proxy is disabled. Warn at startup and after permission-profile changes when masking is inactive because sandboxing or the proxy is disabled, or provider environment keys conflict.
## Testing
Add coverage for configuration precedence, project protections in both configuration loaders, permission-profile transitions, inactive-masking warnings, and shell snapshot masking of built-in and custom credentials.
GitOrigin-RevId: 4bcb293356e8c1524bdaa4f1b95cbc1e935a5271
## What changed
Move incremental tool guidance out of namespace descriptions and into a developer message preceding each namespace declaration batch after the initial catalog. The notice covers newly added namespaces as well as changed ones, explaining that earlier tools remain available unless explicitly removed and that newer definitions replace earlier ones.
Retain the notice alongside tool declarations in full-history agent forks, and discard it when legacy compaction forks rebuild those declarations.
## Testing
Add unit coverage for multiple new namespaces sharing one notice. Update request-history snapshots for tool changes, removals and restoration, and regular Responses requests. Extend resume and fork tests to cover notice preservation without duplication and removal when rebuilding declarations.
GitOrigin-RevId: 05f79f5eb378a355cf935eabf63951015a9b454b
## Why
Disabling OpenAI analytics also disabled explicitly configured OTLP metrics collectors. Users should be able to export metrics to their own collectors independently of `analytics.enabled`.
## What changed
Apply the analytics preference only to the built-in `statsig` metrics exporter. Keep custom OTLP HTTP and gRPC exporters enabled regardless of that preference, and use `otel.metrics_exporter = "none"` to disable metrics export. Clarify these settings in config documentation and the schema.
## Testing
Cover exporter selection across explicit and default analytics preferences. Update app-server and daemon telemetry tests to verify custom metrics export with analytics disabled, and worktree tests to disable metrics through the exporter setting.
GitOrigin-RevId: 0c61f0f01e2b694db642ac7e7fd1dac9965c7d96
## What changed
- Add `tui.keymap.global.leader`, defaulting to `ctrl-x`, and symbolic bindings such as `leader c` that follow the configured prefix. The default prefix yields to existing custom shortcuts and chord prefixes.
- Keep leader shortcut hints open until completion or cancellation, while ordinary chords retain their one-second timeout. Pressing `esc` or repeating the leader cancels the pending shortcut.
- Add leader configuration and a `Use leader...` capture option to `/keymap`, with resolved shortcut labels and conflict validation.
- Cancel pending chords when input targets change, on paste or focus loss, and on mouse actions other than movement.
- Move the default voice mute shortcut from `ctrl-x` to `f9` and update its tests and displayed hints.
GitOrigin-RevId: 35b964cccd2812c73200f0c26b0f19506821df92
## What changed
Allow mouse selection and plain-text copying of rendered status and footer text, honoring `tui.copy_on_select` and existing selection keyboard controls. Keep the selected region stable while other content updates, preserve Unicode and terminal hyperlinks, and clear selections when their region becomes invalid.
Defer warning clicks until a stationary mouse release so dragging selects text without opening the warning viewer. Preserve the composer draft and cursor while selecting footer text.
## Testing
Add unit and snapshot coverage for visible-text copying, Unicode and hyperlinks, selection invalidation, keyboard ownership, and stationary clicks versus drags. Add a fullscreen integration test for warning selection and draft preservation.
GitOrigin-RevId: dd14d7ede52e97e507be24c4d6ac0299f7388a9b
## Why
Fixed argument limits truncated recorded tool calls even when their metadata fit within the available message budget.
## What changed
- Remove the 8 KiB per-call and 32 KiB per-output argument limits for direct calls and Code Mode.
- Preserve full recorded arguments while retaining message metadata budgets, pending-call limits, and the direct metadata retention limit.
- Rename the normalization helper to `normalize_executed_tool_call_completeness`; it now only clears completeness when calls or tool names were lost.
## Testing
Update regression coverage for large arguments, escaped inputs, reserved-key wrappers, and argument and result metadata preservation across Code Mode waits.
GitOrigin-RevId: 8c199ccf39191d5d44eef02d28b1773654735b43
## What changed
Add the disabled-by-default `guardian_trust_orchestrator_connectors` feature flag. When enabled, Guardian V2 accepts connectors with nonblank IDs from the host-owned plugin service orchestrator as a trusted source without requiring a matching user configuration declaration.
Distinguish orchestrator provenance from user configuration in trusted-tool context. Trust remains scoped to the exact server or connector identity and source; descriptions, outputs, other tools, and other connectors remain untrusted.
## Testing
Add coverage for host-owned connector context, rejection of extension-owned Apps lookalikes and blank connector IDs, source-specific trust metadata, and context token limits. Snapshot the connector approval request history.
GitOrigin-RevId: fbd87dd71110ca7b2b92d50eef02e1e739a74a02
## Why
Tools that do not opt into parallel execution acquire an exclusive scheduler lock, serializing independent reads.
## What changed
Allow skill listing and reading, memory listing, reading and searching, conversation history search and reading, plugin listing, agent listing, current time, remaining context, and `get_goal` to run in parallel. Keep goal creation and updates serialized.
## Testing
Add `cloud_skill_reads_run_in_parallel`, which uses a barrier to require two cloud skill reads to overlap and verifies that each returns the expected resource contents.
GitOrigin-RevId: 97b5634f1f84be2ba092be89e6e9c634ca75c07b
## Why
Subagents should retain the spawning turn's selected skills and plugin choices whether `fork_turns` is `none` or `all`. Capability selection should not depend on copied conversation metadata.
## What changed
- Use a shared child startup path for fresh and history-forked agents, inheriting selected capability roots from the spawning environment snapshot.
- Pass the spawning turn's `disabled_plugin_ids` through both spawn handlers. When omitted, inherit the parent's current choices; explicit lists, including an empty list, override them.
- Resolve the parent before startup so inherited client MCP settings apply even when only the session source identifies the parent.
- Carry plugin choices into delegates with inherited isolation and preserve saved capability roots when resuming a child.
## Testing
Add regression coverage for executor skill listing and reading, plugin MCP registration with both history modes, plugin overrides, capability-root precedence and isolation, and restoring saved child settings after parent settings change.
GitOrigin-RevId: 2a6891a9bc6372fd2d1f30add2b5611f96b60594
Remove the obsolete `default_zsh_path` argument from the call to
`Config::rebuild_with_session_layers` in
`local_mxc_preference_preserves_configured_backend` to match its current
signature.
GitOrigin-RevId: ddb7a73535cc605917971b974333d69bf3a92a93
## What changed
Support `plugins._default.enabled` with explicit per-plugin `enabled` overrides. Omission preserves existing source and account enablement; configuration cannot activate a plugin disabled at its source. Plugin settings such as remembered tool approvals inherit the default unless `enabled` is explicitly set.
Apply the policy to plugin skills, MCP servers, Apps, and hooks, including selected executor roots and runtime configuration refreshes. Preserve the latest plugin policy when adding MCP dependencies and rebuild hooks when concurrent configuration updates replace their inputs.
Report effective enablement in `plugin/list`, `plugin/installed`, `plugin/read`, and `plugin/share/list`. Remote installation still installs disabled packages, but skips MCP and Apps authentication setup without writing an enablement override.
## Testing
Add regression coverage for default inheritance and explicit overrides, source-disabled plugins, policy refreshes during active turns, disabled or malformed selected plugin roots, and remote installation authentication behavior.
GitOrigin-RevId: 83b70c5b47fc95474fec292f248683f1f887221e
## What changed
- Add `ContentItemMetadata` to distinguish user input, developer instructions, `AGENTS.md`, skills, harness context, and tool-supplied context independently of message role and content classification.
- Keep attribution attached to content through prompt assembly, history processing, and hook-output spilling. Distinguish command hooks from MCP hooks and retain tool namespaces when known.
- Treat missing historical attribution as unknown and send per-content metadata only to Responses Lite.
## Testing
Update request and history assertions to cover attribution persistence and Responses Lite metadata handling.
GitOrigin-RevId: 24e56005f5bdb98bf82f2b3943f29c4c81f3d587
## What changed
Add `windows.require_mxc` to managed requirements. When set to `true` on Windows, reject configurations whose effective local sandbox backend is not MXC without changing the selected backend.
Validate after cloud configuration loads and outside startup recovery fallbacks. Apply the check to app-server startup and configuration loads, in-process bootstrap, session creation, sandbox debugging, and runtime configuration refreshes.
## Testing
Extend configuration tests to cover required and optional MXC selection, separately loaded policy requirements, and runtime refresh validation. Expand app-server startup tests to cover local and cloud MXC requirements, cloud preference selection, and failures without default-config recovery.
GitOrigin-RevId: 16456611bfd9df77e7f959b52515f1885b59ac75
## What changed
- Accept an optional `description` in `create_channel` and return it in channel summaries so agents can describe a channel's purpose.
- Enforce a limit of 512 UTF-8 bytes and account for JSON escaping in the output budget before creating the channel.
- Store descriptions in both board backends and migrate existing SQLite databases, leaving older channels without descriptions.
## Testing
Add coverage for UTF-8 byte limits, serialization, output budgets, legacy database migration, and persistence after reopening. Update the model-context scenario to create and list a described channel before posting and reading a message.
GitOrigin-RevId: cf6f395944da23e238e078eefa5de201c8b9c197
## Why
MCP servers receiving sandbox state need a usable Codex executable to launch commands with the issuing call's policy. HTTP and remote servers cannot assume access to the host's filesystem.
## What changed
- Include optional `codexExecutable` metadata for local stdio servers when the host supplies an absolute, UTF-8 path to a CLI supporting `sandbox --sandbox-state-json`. Cache capability probes by executable path and bound them to five seconds.
- Document forwarding the sandbox state unchanged and requiring an explicit opt-out rather than silently falling back to PATH lookup or unsandboxed execution when the launcher is absent.
- Honor `useMxc` from forwarded sandbox state when selecting the Windows sandbox backend and network proxy policies, preserving a parent's selection made through CLI overrides.
## Testing
Add coverage for launcher eligibility across local, remote, and HTTP servers, invalid or missing executable paths, and binaries without sandbox-state support. Extend metadata integration and serialization tests to cover the optional launcher field, legacy state, and unknown future fields.
GitOrigin-RevId: ea8cd3770616e5a620b423a01052a7bc828bceb9
## Why
GovCloud guidance was tied to Bedrock credential setup, so users with an already configured provider could miss it.
## What changed
Check for GovCloud during TUI startup using the app server's resolved provider, including when connecting to a server. Require acknowledgment before proceeding and save `notice.hide_gov_cloud_guidance = true` to suppress the screen on subsequent launches. Quitting the guidance exits startup without saving acknowledgment.
## Testing
Add a terminal integration test covering acknowledgment persistence, quitting without saving, and suppression after restart. Retain coverage for explicit acknowledgment and scrolling in short panes.
GitOrigin-RevId: f09fd73a66fb02f94ebdd3c3b0dbe5712dfa9be7
## What changed
Add `include_environment_context_time`, enabled by default. Setting it to `false` omits `<current_date>` and `<timezone>` while retaining the rest of the environment context, and skips the clock read used to populate the date.
## Testing
Extend configuration, session context, and external time provider tests to cover enabled and disabled time fields, context updates across turns, and current-time reminder behavior.
GitOrigin-RevId: 5071ce1701c044b680624d0cdbba7e0bc2b5bbe6
## What changed
- Use the standard shell executor and remove the zsh fork escalation runtime, `codex-execve-wrapper`, and `shell-escalation` crate.
- Ignore `shell_zsh_fork` and `unified_exec_zsh_fork`, emit migration notices for legacy configuration, and warn when ignoring managed requirements for these flags.
- Keep the active session's `apply_patch` alias directory readable under restricted filesystem permissions.
## Testing
Add coverage for legacy configuration startup and shell execution, migration notice rendering, active alias directory selection, and nested `apply_patch` execution while other files in `CODEX_HOME` remain unreadable.
GitOrigin-RevId: 43af461fea32b4980550ee7237effd2bc0646ed8
## Why
Command processes need thread and tool call labels for correlation, without stale values from inherited environments or cached shell snapshots.
## What changed
- Export the originating `exec_command` call ID as `CODEX_TOOL_CALL_ID`; later `write_stdin` calls leave it unchanged.
- Apply executor metadata as `CODEX_THREAD_ID` and `CODEX_TOOL_CALL_ID` after environment policies, overlays, and snapshot replay. Clear omitted fields when metadata is present; without metadata, preserve thread context and remove the call ID.
- Exclude both IDs from newly captured snapshots and omit the call ID from capture and validation helpers.
- Preserve empty call IDs, omit NUL-containing IDs, and handle case-insensitive environment names on Windows. Document that these labels support correlation, not authorization.
## Testing
Add regression coverage for metadata precedence, missing and invalid IDs, snapshot capture and replay, local and remote execution with pipes and TTYs, sandboxed remote execution, and preservation of the originating call ID across later input.
GitOrigin-RevId: 1027212b5d495d8e7cfac0f498c3134e060aa897
## Why
Persisted multi-agent v2 children created after the client disconnects need lifecycle listeners so their runtimes can be released once idle. Listener attachment must also wait for an earlier runtime's cleanup to finish.
## What changed
- Start lifecycle listeners for persisted v2 children even when no initialized clients are connected, and defer attachment until pending unload cleanup completes.
- Keep ephemeral children loaded so follow-up tasks retain their model context.
- Raise the default `thread_unload_delay_secs` from 60 seconds to 1800 seconds (30 minutes), updating the configuration documentation and sample.
## Testing
Add regression coverage for children spawned after disconnect with zero- and one-second unload delays, including waiting for pending cleanup, keeping running threads loaded, releasing idle runtimes, and preserving an ephemeral child's earlier reply across a follow-up. Update configuration tests for the new default and explicit overrides.
GitOrigin-RevId: 2fecc77b5c03237aa8fd7eacc4bd119b99d36e0a
All callers already check that an assessment payload is present before parsing it. Change `parse_guardian_assessment` to accept `&str` instead of `Option<&str>` and remove its redundant missing-payload check.
Update the callers and existing parser tests to pass text directly.
GitOrigin-RevId: e4fb4bf7aca5b20f25f5b27300ce9a6f22c97939
## What changed
Add a scenario test that queues a message for an idle worker, evicts it, and resumes it with `followup_task`. Assert that the same worker is reloaded and that queuing mail and eviction do not start another model turn.
Snapshot the complete parent and worker request histories and the resumed worker's mailbox to verify that earlier context and unread mail survive eviction in order.
GitOrigin-RevId: 2d0f7c63a2221df9c3d7e378eecaf14b8441d2b9
## Why
A conversation classifier waiting for preparation or full response completion can block newer classifications. Concurrent reviews also need to prevent a later action's evidence or low-risk score from being reused for an earlier action.
## What changed
- Run conversation classifications independently, forking the latest compatible completed history from an earlier action. Only a valid completion with a newer action index can replace retained history.
- Keep admission and observation ordering atomic, and hold capacity permits through full response completion.
- Reject cached low-risk scores from later actions for tool-linked approvals, including initial approval checks.
- Track originating tool-call IDs separately from approval display IDs, preserving stdin write provenance and excluding synthetic MCP elicitation IDs from tool ordering.
## Testing
Add regression coverage for delayed preparation, capacity admission, out-of-order completion, cancellation, invalid retained output, and history snapshots. Exercise pending approval ordering in both `snapshot` and `conversation` modes, and verify linked and unlinked MCP elicitation provenance.
GitOrigin-RevId: 097476ccb3b8718369a69f55c3c39132f7f1a4c1
## What changed
Extend `steered_input_checkpoint_controls_next_request` to cover user input with `InstantInterrupt` enabled under both background and synchronous checkpoint policies. Keep the original response gated until the follow-up request arrives to prove that interruption advances the turn while preserving checkpoint ordering.
Explicitly disable `InstantInterrupt` for user-input cases that wait for response completion, and enable it for the tool-output case to verify that tool outputs still wait for completion and synchronous persistence.
GitOrigin-RevId: d39544ce6f5ad83489fd8a80b1e731a64c7a876c
## What changed
Add `cancelled_v2_send_finishes_reload_registration` to verify that cancelling a multi-agent V2 send during an evicted child's reload does not cancel registration. The test checks that the thread-created notification arrives and evicted-environment state is cleared.
Evict and reload the child again with only one child slot available to catch leaked residency pins or reservations, and verify that only the subsequent follow-up message is delivered.
GitOrigin-RevId: ce6ed90d0049245370f26d8dbb35b9f1cd0b3063
## What changed
- Route app-server idle unloading of multi-agent v2 children through local eviction that preserves unread mail and environment selections for reload.
- Hold residency pins through input submission so newly reloaded children cannot be evicted before receiving their work.
- Guard listener cleanup against replacement runtimes and subscriptions, and reject local eviction of host-controlled threads.
## Testing
Add coverage for unsubscribe-driven eviction followed by `followup_task`, verifying restored conversation context and exactly-once delivery of queued mail. Extend tests to check that residency pins block eviction and that rejected host eviction preserves the thread and mailbox.
GitOrigin-RevId: e36723730af683d2081e495e637f0e6d23548b8d
## What changed
Record local MXC availability and the selected Windows sandbox backend at app-server and session startup. Log the backend again when an accepted session settings update changes the Windows sandbox level, using a blocking task for the log write.
Selection entries distinguish `mxc`, `disabled`, `unelevated`, and `elevated` in the sandbox logs under `.sandbox` in Codex home.
## Testing
Update the remote thread persistence assertion to allow the `.sandbox` directory on Windows, since startup logs are not thread persistence artifacts.
GitOrigin-RevId: 4130b59ac7761223775ac9b6afb096abb7fb4615
## What changed
Add `functions_namespace_functions_description_prefixes` to model tool messages, keyed by unqualified tool name. Prepend this guidance to descriptions in the `functions` namespace across direct declarations, Code Mode documentation, and tool-search results, including custom tools.
Trim prefixes, ignore empty values and unavailable functions, and enforce a combined 256-byte UTF-8 limit including separators for reachable tools. Keep overrides local to each step, preserve search ranking text, and retain runtime caches for unaffected tools.
## Testing
Extend coverage for direct and indirect descriptions, clearing prefixes when switching models, namespace scoping for deferred dynamic tools, and tool-search cache reuse and reset.
GitOrigin-RevId: f434e37cec010764fe3e09fb12c339e933b3c21c
## Why
Disabling `experimental_request_user_input_enabled` previously left `request_user_input_async` available when the model advertised support for it.
## What changed
Require the user input setting to be enabled before registering `request_user_input_async`, while preserving the root-agent restriction and support for both current and legacy model capability names.
## Testing
Add parameterized tests covering enabled and disabled settings, current and legacy capability names, missing capabilities, and subagents. Also verify that `send_message_to_user_async` remains available to root agents independently of the user input setting.
GitOrigin-RevId: 27156a3fe7da38d10fccb6384f28e755c39abc39
## Why
Full WebSocket requests previously used the generic `other` reason when continuation failed because request properties or input changed, obscuring why incremental reuse was unavailable.
## What changed
- Report specific reasons for changed request properties, shortened or mismatched input, and missing response state or response IDs.
- Add `previous_item_type` and `current_item_type` labels to continuation metrics and failure traces. Diagnostics use bounded labels without request contents or identifiers.
- Centralize response item type names in `ResponseItem::item_type()` and reuse them for output logging.
## Testing
Add coverage for unavailable response state and empty response IDs. Expand WebSocket tests to check fallback reasons and item types for rewritten or shortened input, replaced input, changed model, and changed output schema, including precedence when multiple properties change.
GitOrigin-RevId: 3951853dfe87d40b7046af6f6a8efd5d4f5b06d1
## What changed
Record `codex.tools.incremental_updates` through session telemetry with an `action` tag for `added`, `removed`, and `schema_changed`. Definition changes include description edits.
Exclude initial catalogs, unchanged tools, and namespace headers from the counts. Count each removed namespace member even when the removal notice lists only the namespace.
## Testing
Extend the namespace transition snapshot test with in-memory metric assertions covering additions, removals, definition changes, and excluded initial or unchanged catalogs.
GitOrigin-RevId: 0fadb40a3aa7abf5ef1757811ebfb5749505b3d9
## Why
Truncating recorded arguments does not lose the call inventory. Clearing `tool_calls_complete` in that case incorrectly treats retained calls and tool names as incomplete.
## What changed
Define `tool_calls_complete` as completeness of the ordered call inventory, independent of recorded arguments. Preserve it for direct tool outputs and Code Mode cells when argument limits or message budgets truncate arguments, including across later waits. Continue clearing completeness when calls are omitted or tool names are truncated.
## Testing
Update protocol, recorder, and integration tests to verify completeness survives argument truncation and message budgeting. Add coverage confirming that omitted calls and truncated tool names still clear completeness.
GitOrigin-RevId: 1534dbfabbd1291b840dd6fb6738ed51bcd4c0c4
## Why
Prediction forks need to preserve the parent's effective context and request settings to maximize prompt-cache reuse.
## What changed
- Add `experimentalPredictionMode` to `thread/fork` for ephemeral forks of loaded, persisted parents. Reject configuration overrides, `path`, `lastTurnId`, and `beforeTurnId` in this mode.
- Inherit the parent's effective configuration, tools, environments, collaboration settings, disabled plugins, and persisted history.
- Enable `features.reasoning_effort_override` on the fork while preserving the parent's request-effort baseline, including when overrides were disabled on the parent.
- Report the fork's effective model, service tier, and reasoning effort in the response.
## Testing
Add coverage for matching parent and fork requests and prompt-cache keys across legacy and paginated history, invalid fork parameters, and reasoning-effort inheritance. Add a context snapshot for identical parent and fork continuations.
GitOrigin-RevId: 46b41f2ac331562b441dadff1a0a9f926c94880d
## Why
Global requests can inherit project settings from the app-server's launch directory. This can prevent marketplace removal or expose project-only feature settings, and config reloads can fail if that directory is deleted.
## What changed
- Load configuration without project context when no working directory is supplied, using `CODEX_HOME` to materialize `Config.cwd`.
- Use global configuration for marketplace mutations, marketplace upgrade reloads, and MCP requests without thread context.
- Pass the launch directory explicitly during startup to preserve project-aware startup configuration.
## Testing
Update regression tests to verify that marketplace removal ignores launch-project configuration and leaves the project config intact. Extend feature-list coverage to verify that global requests ignore project features, thread requests retain them, and global requests work after the launch directory is deleted on Unix.
GitOrigin-RevId: b77063a7ea0b09fd0a79cfc4040db9f1d02606b3
## What changed
Add the `codex.tools.registered` histogram to count finalized tool registrations by `exposure` and `tool_mode`, including zero counts for empty exposure categories. Record it once per sampling request before transport retries, excluding hosted tools. These counts describe the registered inventory, not model visibility or tool reachability.
## Testing
Add an integration test covering a stream retry, direct and deferred namespace tools, a model-only tool, and hosted web search. Verify that registrations are recorded once, hosted tools are excluded, and metric labels contain no tool names or descriptions.
GitOrigin-RevId: 02b450743886e3d487d6c3bcda12eb65f6d1104b
## What changed
Wire existing sandbox integrity checks into local command preparation, exec-server process preparation, and sandboxed filesystem helper and file-open operations. Make execution request preparation asynchronous so callers can await the checks.
The checks remain observational: failures and timeouts do not prevent command execution.
## Testing
Add regression tests that launch a real command after checker preparation fails or exceeds its timeout, verifying successful output and exit status.
GitOrigin-RevId: a82399f8aeb8b08f9965e6121b4c7f460552af3f
## What changed
Mark `code_mode_interrupt` as stable and enable it by default, so interrupting a turn terminates active code mode cells and nested tool calls.
## Testing
Update the existing interruption test to use the feature default instead of explicitly enabling `CodeModeInterrupt`. It verifies that active cells and nested tools are aborted while stored session values remain available.
GitOrigin-RevId: 17be94f208713bc232e2292feb48261938254db3
teddywyly-oai