Restore the workspace version to 0.0.0 after branching from rust-v0.152.0,
as required by the stable branch release helper. Release publication stamps
the actual patch version in a separate commit.
## What changed
- Add `auto_review.node_repl_policy` to model messages for `node_repl` and `cua_repl` reviews.
- Use the reviewer model's configured policy, falling back to the bundled policy when the field is absent and skipping injection when it is explicitly empty.
- Include the effective policy in Guardian session reuse checks and reject unsafe parent-model fallback transitions that would change it.
## Testing
- Cover catalog, bundled, and explicitly empty policies across Node and CUA review paths.
- Verify that policy changes invalidate cached reviewer sessions and incompatible fallback transitions.
GitOrigin-RevId: 51c0bdfed9b464091b6eb47d91ca5a0990d7a315
(cherry picked from commit 865bbf9a69)
- Vim mode supports `/` and `?` searches within drafts, highlighted matches, and repeat navigation with `n` and `N`. (#41586)
- Rate-limit banners offer actions for checking usage, managing credits, resetting limits, and managing plans. (#41742)
- The terminal UI and `codex exec` show credential-refresh progress, including Amazon Bedrock reauthentication. (#41239)
- MCP server names can contain `:`, `@`, `/`, and `.`, supporting package-style names throughout CLI commands and authentication. (#41700)
- Individual MCP tools support an `output_token_limit` setting, with consistent truncation across session resumes. (#41421)
- App-server clients can configure `thread/shellCommand` timeouts, including deadlines longer than one hour. (#41384)
## Bug Fixes
- Automatic approval reviews preserve user instructions, answers, and valid authorizations across history compaction. (#41660, #41846, #41852)
- Resumed threads restore their saved working directory when none is supplied, and client metadata updates preserve filesystem permissions. (#41567, #41464)
- MCP tools remain available through cache refreshes and remote plugin changes; authentication retries use refreshed helper-provided headers. (#41336, #41344, #41396, #41400)
- Opening the model picker refreshes available models without losing the highlighted choice. (#41467)
- Fixed Windows sandbox execution with Microsoft Store PowerShell, subprocess hangs on terminal queries, and cursor-related display corruption in older JediTerm terminals. (#41227, #41436, #41673)
- Cloud task requests reject untrusted backend URLs and disable redirects to protect saved credentials. (#41403)
## Chores
- The planning tool is disabled by default; enable it with `tools.update_plan.enabled = true`. (#41744)
- Plugin recommendations begin loading during startup, reducing delays before the first turn. (#41375)
## Changelog
Full Changelog: https://github.com/openai/codex/compare/rust-v0.151.0...rust-v0.152.0
- #41210 Enable clock tools from model metadata @copyberry
- #41215 Roll over Guardian context before follow-up reviews @copyberry
- #41218 Share linked tool mention parsing in the TUI @copyberry
- #41219 Retry confirmed remote registration conflicts @copyberry
- #41221 Honor turn token budgets in Guardian review rollover @copyberry
- #41223 Add recency sorting to `project/list` @copyberry
- #41226 Move Guardian review session tests to a separate file @copyberry
- #41227 Use compatible PowerShell for elevated Windows sandbox commands @copyberry
- #41230 Apply app routing policy to unauthenticated plugin reads @copyberry
- #41231 Instrument the loaded plugin cache @copyberry
- #41232 Expose the PowerShell version in environment context @copyberry
- #41235 Sanitize history notes backend errors @copyberry
- #41239 Surface model provider authentication recovery progress @copyberry
- #41243 Add configurable gating for the sleep tool @copyberry
- #41250 Include thread source in realtime connection metadata @copyberry
- #41260 Let the history backend enforce tool output budgets @copyberry
- #41285 Drive keymap conflict checks from the action registry @copyberry
- #41292 Forward history note images to the model @copyberry
- #41308 Make subagents follow the root service tier @copyberry
- #41309 Honor required reviews when reusing Guardian scores @copyberry
- #41313 Decouple HTTP retry backoff from overload integration testing @copyberry
- #41322 Isolate required-model Guardian approval coverage @copyberry
- #41328 Review terminal input against retained permissions @copyberry
- #41331 Classify clock tools as built-in control tools @copyberry
- #41336 Preserve cached MCP tools during binding capture @copyberry
- #41344 Use refreshed MCP tool caches during binding capture @copyberry
- #41349 Assign stable IDs to generated Responses input items @copyberry
- #41354 Reject NUL bytes in reviewed terminal input @copyberry
- #41357 Support compression for shared rollout lineages @copyberry
- #41360 Measure Codex home usage at app-server startup @copyberry
- #41364 Test resuming compressed shared rollouts @copyberry
- #41365 Restrict async user messages to questions @copyberry
- #41368 Match Windows shell guidance to the executor platform @copyberry
- #41375 Preload plugin recommendations during session startup @copyberry
- #41380 Clarify proactive multi-agent delegation guidance @copyberry
- #41384 Support configurable timeouts for thread shell commands @copyberry
- #41385 Give Guardian classifications distinct turn identities @copyberry
- #41392 Add shared Guardian context primitives @copyberry
- #41393 Preserve one-shot exec when unified exec is disabled @copyberry
- #41396 Refresh runtimes for remote plugin state changes @copyberry
- #41400 Refresh MCP HTTP helper headers after authorization failures @copyberry
- #41403 Restrict cloud task credentials to trusted origins @copyberry
- #41413 Optimize history item lookups @copyberry
- #41416 Add app-server notification media filtering @copyberry
- #41421 Support per-tool MCP output limits @copyberry
- #41422 Add shared Guardian transcript collection @copyberry
- #41424 Preserve context baselines across nested agent forks @copyberry
- #41427 Filter media from function call output notifications @copyberry
- #41429 Retain the last selected step context for each turn @copyberry
- #41432 Run executor hooks for interrupted turns @copyberry
- #41435 Allow bundled browser cleanup hooks on subagent stop @copyberry
- #41436 Respond to terminal queries from TTY subprocesses @copyberry
- #41447 Support `openai/elicitation` form requests @copyberry
- #41448 Clarify question handling in Default collaboration mode @copyberry
- #41449 Rename the read-only Seatbelt platform defaults policy @copyberry
- #41452 Report code mode host request durations @copyberry
- #41454 Block goals after repeated execution host failures @copyberry
- #41456 Support app targets in executor plugin hooks @copyberry
- #41457 Source proactive multi-agent instructions from the model catalog @copyberry
- #41461 Source async user message descriptions from the model catalog @copyberry
- #41464 Preserve permissions when updating session metadata @copyberry
- #41467 Refresh the TUI model picker from the app server @copyberry
- #41476 Use rules_rs platforms for release binaries @copyberry
- #41477 Organize bundled Rust resources under asset directories @copyberry
- #41562 Preserve turn lineage across goal continuations @copyberry
- #41567 Restore thread cwd from owned settings snapshots @copyberry
- #41569 Harden diagnostic report uploads @copyberry
- #41570 Fix proactive multi-agent instruction grammar @copyberry
- #41586 Add Vim search motions to the composer @copyberry
- #41613 Move Vim history tests into the history search module @copyberry
- #41630 Update tests for default-enabled update_plan @copyberry
- #41660 Preserve Guardian authorization across history compaction @copyberry
- #41666 Approve the first Node REPL execution without a Guardian wait @copyberry
- #41673 Repair cursor-style rendering on older JediTerm terminals @copyberry
- #41683 Set working directories for environment MCP tests @copyberry
- #41700 Support package-style MCP server names @copyberry
- #41742 Show actionable rate-limit banners in the TUI @copyberry
- #41743 Mark history ingestion requests in turn metadata @copyberry
- #41744 Make the update_plan tool opt-in @copyberry
- #41803 Allow models to enable token budgeting by default @copyberry
- #41840 Use the async stack budget for approval reviews @copyberry
- #41846 Preserve Guardian review evidence across compaction @copyberry
- #41852 Preserve Guardian user answers across compaction @copyberry
- #41853 Box the session startup future at its API boundary @copyberry
- #41857 Preserve Guardian user answers from current history @copyberry
- #41858 Preserve user text when Guardian history drops oversized images @copyberry
- #41861 Keep history extension tools out of Guardian reviews @copyberry
- Raise the Guardian message transcript budget from 10,000 to 20,000 tokens.
- Raise the per-message entry limit from 2,000 to 5,000 tokens.
GitOrigin-RevId: 93a92e3d806fd3bf005e6c27964babd7ed2f948e
(cherry picked from commit 4ac20a7f74)
## What changed
- Start the composer in Vim Insert mode when Vim is enabled and return to
Insert mode after submissions and slash-command dispatch.
- Record the fresh Insert session as a Vim edit so `.` can repeat text entered
in a new draft.
- Keep `/` and `?` as Normal-mode composer searches, and let Backspace cancel
an empty search query and any pending operator without changing the draft.
## Testing
- Add coverage for startup, submitted and queued drafts, inline and goal slash
commands, repeatable edits, and canceled searches.
GitOrigin-RevId: 1a5ee30c44685d2b2a037e46c3ab4ab611024919
(cherry picked from commit 0344625ccf)
## What changed
- Initialize Guardian reviewer subthreads with empty extension data.
- Remove the special registration that exposed inherited read-only `history`
tools in the Guardian tool plan.
GitOrigin-RevId: 7700f033faab125d59d11bc2d82955c67689e3c3
## Why
User messages with images larger than the Guardian history budget were skipped
entirely, removing any accompanying instructions from retained review context.
## What changed
- Retain the text and message metadata from oversized user messages while omitting
their images.
- Keep the existing behavior for other oversized history items.
## Testing
- Cover text and metadata retention, content ordering, and the integration path
with an image larger than the 4 MiB history budget.
GitOrigin-RevId: 91d99609a8d096b87d0f2b1d149f577a00dce699
## What changed
Match recorded user-input tool calls against both the current conversation and
retained review history when collecting Guardian review evidence. This keeps
answers available when their original tool call exists in either history.
GitOrigin-RevId: e511e2d252d31fa8658c34db19f0151699e9a34a
## What changed
- Make `Session::spawn` return a `BoxFuture` while preserving lazy session
initialization.
- Prevent the startup wrapper from being inlined so callers do not expose its
concrete future.
- Await the returned future directly at session creation call sites.
GitOrigin-RevId: 5432745aae1c934b16202716a8d49a8553de2018
## Why
Compaction removes the original `request_user_input` tool call from model-visible history, causing its trusted user answer to be omitted from subsequent Guardian reviews.
## What changed
Match recorded user answers against retained review history so they remain available through compaction and review-history eviction. Explicit rollback still removes the associated answer.
## Testing
Extend the Guardian history integration test to verify trusted user answers survive compaction and eviction but not rollback.
GitOrigin-RevId: 00681ee8df51cf36421b6fdc5446565dff3776fe
## Why
Context compaction can replace original conversation items that Guardian still needs to review approval-sensitive actions.
## What changed
- Retain a bounded, chronological review history independently of the model's compacted history.
- Keep separate limits for user messages and other transcript items so tool traffic cannot evict user instructions.
- Use the retained evidence for synchronous and asynchronous Guardian transcripts, while resetting it after rollback or history reconstruction.
## Testing
- Cover retention through compaction and eviction, reset behavior after rollback, independent size limits, and asynchronous transcript construction.
GitOrigin-RevId: c5851e992820504fc18de8cfec7f6f9f1b69f316
## What changed
- Define the shared 16 MiB thread stack budget in `codex-async-utils`.
- Use it for both the async main/runtime threads and the dedicated approval-review thread.
GitOrigin-RevId: c825669e1545bcfaeaaaa07066dc63874f46630f
## What changed
- Add model metadata flags for enabling token budgeting and its history-notes extension.
- Apply those activation defaults once at thread startup when the user has not explicitly configured token budgeting, while respecting managed feature requirements.
- Continue resolving model-owned prompts for the active model so model switches can use their own token-budget guidance.
## Testing
- Update the token-budget integration test to verify that model metadata activates the feature without manual configuration.
GitOrigin-RevId: 73a32623eaeabb9243e240c43da7a5e7e93e9a19
## What changed
- Default `tools.update_plan.enabled` to `false`; users can explicitly enable it to expose `update_plan`.
- Remove bundled `update_plan` guidance from model, collaboration-mode, multi-agent, compaction, prewarm, and goal-continuation prompts when the tool is disabled.
- Preserve custom base instructions, model catalog instructions, collaboration policies, and user goal text even when they mention planning or `update_plan`.
## Testing
- Cover default and explicitly enabled tool registration, prompt consistency across request paths, and preservation of custom instructions.
GitOrigin-RevId: a53964e6e72f98e2557dd3090fdb7caccb956527
## What changed
- Set `history_ingest_requested` to `true` in Responses turn metadata when the
history-notes token-budget extension is enabled.
- Reserve the metadata key so caller-provided metadata cannot override the
core-owned value, and omit it when the extension is disabled.
GitOrigin-RevId: e750bcb729292c407e1d443857cdb584a88aac97
## What changed
- Carry optional backend-owned banner and account identity data through
`account/rateLimits/read`, filtering banners that do not match the authenticated
account and user.
- Render supported rate-limit notices above the composer with actions for usage,
credits, resets, owner notifications, and plan management while preserving the
existing fallback UI for absent or unsupported banners.
- Refresh usage after limit errors, reject stale responses, and keep queued input
paused until recovery completes. When instructed by the banner, switch to the
first available fallback model without changing unrelated thread settings.
## Testing
- Add protocol, banner parsing and rendering, CTA, identity filtering, refresh
ordering, fallback-model, account-change, and queued-input recovery coverage.
GitOrigin-RevId: e03d75a82e425deb87f4b120a71cf2286c0ef6cc
## What changed
- Allow MCP server names to contain `:`, `@`, `/`, and `.`, enabling names such as `npm:@modelcontextprotocol/server-sequential.thinking`.
- Preserve these names across `mcp add`, `get`, `list`, and `remove`, runtime tool namespaces, and OAuth credential lookup.
- Quote non-bare server names in generated `config.toml` recovery hints and keep similarly escaped OAuth credential names isolated.
## Testing
- Add CLI and runtime round-trip coverage for npm-style names.
- Add snapshot coverage for quoted recovery hints and a regression test for OAuth credential-name collisions.
GitOrigin-RevId: 97e9353cdbc544db4eb2377ddbfa1d2d539b1e04
## Why
Environment-backed stdio MCP servers have no host-local working-directory
fallback, so their test fixtures must provide a workspace explicitly.
## What changed
- Set the fixture workspace as `cwd` for environment-backed MCP servers across
the core integration tests.
- Reuse the same test environment when configuring MCP servers and building
fixtures that need an explicit working directory.
GitOrigin-RevId: e38f2029e01fc1377cdc34d01a392ad310419766
## Why
Older JediTerm versions can print the space intermediate in `DECSCUSR`,
overwriting the glyph beneath a cursor-style command.
## What changed
- Apply cursor-style commands at a repairable, terminal-owned glyph and redraw
that glyph with its original style and hyperlink before restoring the requested
cursor position.
- Omit the style command when the viewport has no safe repair anchor.
- Handle skipped cells, wide glyphs, and single-column viewports without
corrupting content or causing scrolling.
## Testing
Add cursor rendering tests for styled and cursor-only frames, skipped and wide
hyperlinked glyphs, single-column viewports, and viewports without owned cells.
GitOrigin-RevId: c8bbb74c53737b5980c533859af39da26f0e06cc
## Why
The first REPL execution should proceed while its initial asynchronous Guardian
classification is still pending.
## What changed
- Fast-approve the first `js` execution from a Node REPL-backed server while
continuing its asynchronous classification.
- Track `js` executions separately so setup and reset tools do not consume the
first-execution allowance.
- Apply the normal Guardian review policy to subsequent executions.
## Testing
Add coverage for browser and computer-use startup, reset, and module-directory
setup sequences, verifying that only the first `js` execution skips the wait.
GitOrigin-RevId: 7297b35411a6317bcf9e7058c08c6db3e3310ac8
## Why
Compaction and host-injected context can rewrite the model-visible conversation
without changing what the user authorized. Treating those updates as authorization
changes prevents Guardian from reusing an otherwise valid review.
## What changed
- Track a host-owned user-message revision separately from the conversation history
generation.
- Advance the revision for genuine user messages and history resets, while preserving
it across compaction and internal context injection.
- Use message content-kind metadata to distinguish host context from user input,
conservatively treating unknown or incomplete metadata as user authorization.
## Testing
Added coverage that cached Guardian authorization survives compaction and internal
context, but is invalidated by user input and rollback.
GitOrigin-RevId: c7960fa182d1686042c23764d2abc58acbc4b882
## What changed
- Cover the default, explicitly enabled, and explicitly disabled states of
`tools.update_plan.enabled`.
- Verify prompt tool lists remain consistent across requests, including when
custom base and developer instructions are configured.
- Explicitly enable `update_plan` in existing fixtures that depend on the tool.
GitOrigin-RevId: 3be279cb5195dfc5892c2c8ff6a1461fac879309
## What changed
- Relocate Vim history-navigation tests alongside the history search implementation.
- Share the human-like typing test helper with the nested test module.
GitOrigin-RevId: e2d03a173d2f3b73cf9f0c30411284a47f623838
## What changed
- Add draft-local forward and backward literal search with `/` and `?`, plus
wrapped repeat navigation with `n` and `N`.
- Support search motions after delete, change, and yank operators, while keeping
queries separate from the draft and skipping atomic elements and partial
grapheme matches.
- Render and edit the query in the composer footer, highlight matches, and add
configurable `tui.keymap.vim_search` bindings to the keymap picker and schema.
## Testing
- Cover navigation, wrapping, operator composition, repeat behavior, Unicode
graphemes, atomic elements, query editing, paste handling, and rendering.
GitOrigin-RevId: 087b080ff8fd74e48456c6b899c07ea5eed38e0c
## What changed
- Send the core report event before its attachments, then upload each attachment in a separate gzip-compressed envelope linked to that event.
- Bound encoded and decoded payload sizes, truncate oversized attachment copies with format-aware handling for JSONL, and preserve attachment priority when applying size limits.
- Retry transient attachment failures within a shared upload-time budget while honoring Sentry rate-limit and retry headers without replaying the core event.
- Add APIs to prepare and send persisted report events and attachments using a stable report ID, explicit delivery outcomes, and caller-controlled retries.
## Testing
- Cover attachment retries, truncation, rate limits, rejected responses, transport failures, redirect handling, content types, diagnostic consent, and report tags.
GitOrigin-RevId: 5eacd384843795d05d1c024b76e1c6d0c1c4b8d7
## Why
Resuming a thread without an explicit `cwd` should restore that thread's latest
retained setting. Forked history can contain settings copied from another
thread, while compaction can move the latest setting outside the replay window.
## What changed
- Record the owning thread ID on new settings snapshots and only use snapshots
owned by the resumed thread when restoring `cwd`. Older snapshots without an
owner remain readable but do not override the startup `cwd`.
- Checkpoint the current settings after compaction and serialize checkpoints
with settings updates so the retained history contains an accepted, current
snapshot.
- Cover resume behavior across compaction, forks, reverts, legacy histories,
and concurrent settings updates.
GitOrigin-RevId: 1efc9cf55472d6b88c465c4efe44672a232dbf64
## Why
Automatic goal continuations should remain attributable to the turn that created the goal. External input, hook context, or goal edits can make that attribution ambiguous and must not leave stale lineage metadata behind.
## What changed
- Carry the trusted root and previous parent turn through successive automatic goal continuations.
- Invalidate stored lineage when external context reaches an active turn or when a goal is edited or cleared.
- Preserve lineage for async hook results only when they belong to the receiving turn.
## Testing
- Cover goal continuations across intervening user turns and external objective edits.
- Cover active, buffered, and externally injected hook or response context.
GitOrigin-RevId: 22ccc07961cd0ed8f4b17912b7efa416b342bf50
## Why
The `core` and `tui` Bazel targets treated nearly their entire crate trees as
compile-time data, mixing embedded runtime resources with source files and test
fixtures.
## What changed
- Move embedded resources for `core` and `tui` into dedicated `assets/`
directories and update their `include_str!` paths.
- Restrict Bazel compile data to explicit asset and frame directories.
- Move test-only prompts into `tests/fixtures`, resolve the core prompt through
`find_resource!`, and reuse the integration-test file glob when assembling
Bazel test data.
GitOrigin-RevId: eee9b0e41df77ea2604215a7f7333a6fe8317bfa
## What changed
- Map each supported release platform name to its Rust target triple.
- Build multiplatform release binaries against the corresponding `rules_rs`
platform instead of the LLVM platform definitions.
- Document that `multiplatform_binaries` accepts a subset of the declared
release platforms.
GitOrigin-RevId: 55e2fb0f92e5fa9e608c10380b1c5d893ca83895
## Why
The model picker can open from a cached startup catalog that no longer reflects the models available to the current account.
## What changed
- Fetch the current model list asynchronously whenever the picker opens, while showing cached choices immediately.
- Refresh an open model picker in place, preserving its highlighted model, dismissal behavior, and reasoning submenu.
- Apply accepted catalog updates to model-dependent UI, service-tier controls, and new-thread defaults. Ignore stale, failed, empty, unchanged, or account-invalidated responses.
## Testing
- Added coverage for catalog refreshes, stale and unusable responses, popup state preservation, empty choices, service tiers, and new-thread defaults.
GitOrigin-RevId: 45abe1d309ff7f90701fffe29c6544ca4157f836
## What changed
- Defer legacy sandbox policy projection until a working-directory change may require rebinding project-root writes.
- Keep client name and version updates from resolving filesystem paths or altering the existing permission snapshot.
## Testing
- Add regression coverage for updating client metadata with a managed, restricted filesystem policy that includes both a writable path and a nested denied path.
GitOrigin-RevId: d84dbcd09b9d1961a11b2889d79479e30eb54149
## What changed
- Add model message metadata for built-in tool descriptions.
- Use the active step model's catalog description for `send_user_message_async`, including after a mid-turn model change.
- Fall back to the built-in description when catalog metadata is absent, while preserving an explicitly empty description.
## Testing
- Cover catalog serialization, fallback and empty-value behavior, and model changes within a turn.
GitOrigin-RevId: 72b953214ab9708931065321debf12133f8d2d40
## What changed
- Add an optional `proactive` multi-agent mode message to model metadata.
- Use the catalog's proactive message for `Ultra` reasoning when no general mode hint is configured. A missing value falls back to the built-in proactive instructions, while an empty value suppresses the mode message.
- Keep explicit mode behavior for other reasoning efforts and refresh the applicable catalog message when the model changes.
## Testing
- Cover proactive overrides, built-in fallback, empty-value suppression, mode-hint precedence, non-`Ultra` behavior, and model switches.
GitOrigin-RevId: da0a9ebd9b58cf04ef13a703c210e5da2eed0884
## What changed
- Admit the curated remote Browser plugin's `Stop` and `SubagentStop` hooks when its listed `browser.turn_ended` tool matches the expected connector and is enabled by app policy.
- Carry trusted app routing metadata and the MCP environment through hook registration and execution.
- Register hooks from multiple executor environments, while deduplicating cleanup calls that share an event, MCP environment, server, and tool.
## Testing
- Cover Browser and Computer Use cleanup through separate MCP routes, including user- and managed-policy disablement.
- Verify routing metadata, environment selection, multi-environment registration, and target deduplication.
GitOrigin-RevId: 66de088fd201b9ed0db8b97c23d33de88135120d
## What changed
- Track failed `exec` attempts whose handler ran for each active goal.
- Mark the goal as blocked after three qualifying failure turns.
- Reset the failure streak when any tool succeeds, and keep failures from carrying over to a replacement goal.
## Testing
- Cover failure classification, streak resets, goal replacement, and end-to-end goal blocking through the app server.
GitOrigin-RevId: 14dac7f4eb35507f12df3b2a82ab97bdafe7b897
## Why
Code mode wall time should measure the host operation itself, without including
client-side response delays or idle time between requests.
## What changed
- Measure each execute, wait, and terminate request in the code mode host.
- Carry the duration through the stdio and gRPC protocols and use it for
model-visible wall time.
- Emit a structured `codex.code_mode.host_timing` event correlated with the
conversation, turn, tool call, and cell.
## Testing
- Cover successful and failed execution timing, delayed response reads,
repeated waits, termination, and missing cells across stdio and gRPC.
- Verify timing survives protocol serialization and is reflected in app-server
model output and structured telemetry.
GitOrigin-RevId: d24af30c3fc5820521b4beba1f9970714dad6482
## What changed
- Allow `request_user_input` for optional questions that materially improve work quality.
- Continue with best judgment when the tool returns no answers.
- Keep permission requests, escalations, and other required input out of the tool; ask one concise plain-text question when progress cannot safely continue.
- Update the collaboration-mode preset test for the revised direct-question guidance.
GitOrigin-RevId: 8393621f0d8b59d8b164368ab7f2c8f4f6b3b14e
## What changed
- Advertise `openai/elicitation` form support when the client declares an
object-valued `form` capability, without deriving it from the legacy
`openai/form` capability.
- Handle `openai/elicitation/create` requests in `form` mode and forward their
metadata and opaque schema through app-server as `openaiForm`, preserving
`x-openai-*` annotations.
- Keep legacy form handling independent and have the TUI automatically decline
the new form requests it cannot render.
## Testing
- Add an app-server round-trip test for capability negotiation, request
forwarding, and accepted responses.
- Extend MCP capability filtering coverage for `openai/elicitation.form`.
GitOrigin-RevId: 88f39257bffafe4ee98a9c910e38507843cd7eeb
## Why
Programs running in a PTY can block while waiting for replies to terminal
queries.
## What changed
- Intercept device-status, window-size, cursor-position, and DEC private-mode
queries from TTY subprocess output and write bounded responses to the
subprocess input.
- Remove handled queries from the output stream while preserving other escape
sequences and output, including queries split across chunks.
- Apply the responder to both direct and driver-backed TTY process spawning.
## Testing
Added tests for driver-backed query handling and for a PTY subprocess that
waits for a cursor-position response before exiting.
GitOrigin-RevId: de92e06d183647271ef49024da9c30f01699f886
## What changed
Allow bundled browser and computer-use plugins to invoke the existing
`node_repl.turn_ended` cleanup hook for `SubagentStop` events, matching the
allowlist behavior for `Stop` and `Interrupt` events.
GitOrigin-RevId: 0fe1784321e793e9861e728b40a48662625b7dca
## Why
Executor-scoped cleanup hooks need to observe an interrupted turn as well as a
normally completed one.
## What changed
- Allow bundled executor plugins to register the allowlisted `Interrupt` hook
alongside `Stop`, while preserving multiple allowed hook entries from the
selected executor environment.
- Run interrupt hooks with the interrupted turn's last step discovery and turn
metadata. Turns without a step context do not reuse discovery from an earlier
turn.
- Keep executor-scoped interrupt hooks asynchronous and omit public hook
lifecycle events for them, matching executor `Stop` hook behavior.
## Testing
Added coverage for hook filtering and registration, interrupt execution and
metadata propagation, environment selection, and turns without a step context.
GitOrigin-RevId: f0c536b3382a37cf3bf693c4573d21f6f66ace4e
## What changed
- Store the most recently captured execution `StepContext` in the active turn state.
- Keep speculative model-fallback captures from replacing that context, and update it only when the fallback is selected for remote compaction.
- Preserve the retained context when a turn completes or is interrupted.
## Testing
- Add coverage for completed and interrupted turns, successful primary compaction, fallback compaction, and interruption while a fallback is running.
GitOrigin-RevId: c7dee36ec8e88ba2f4fb4a9c0322e5c86a0caf0e
## What changed
Strip inline image and audio content from function call output thread items when
filtering app-server notifications. Preserve text and encrypted content, and
leave text-only function call outputs unchanged.
GitOrigin-RevId: ca3ad70e843aafbed49c693aa8963bea86cf95dc
## What changed
- Treat a surviving full world-state snapshot as a context baseline when a fork removes the associated user message.
- Restore the previous turn settings and reference context from that baseline, without treating the segment as a user turn for rollback.
- Ignore partial snapshots and full snapshots superseded by compaction.
## Testing
- Cover resumed rollout reconstruction with removed task messages, partial snapshots, and compaction.
- Verify nested agents inherit developer instructions and environment context exactly once across history modes and compacted histories.
GitOrigin-RevId: 9f9f6992d7ea8cff9ac82a7fcdf0c8fb764db81c
## What changed
- Add a reusable transcript contributor for synchronous and asynchronous Guardian context, with borrowed conversation history and request-specific configuration.
- Preserve conversation order and role or tool attribution while applying separate per-entry limits for messages, ordinary tools, and Node REPL-backed outputs.
- Make tool calls, tool outputs, and reasoning independently configurable, and expose transcript collection without requiring section composition.
- Register the transcript contributor in a process-wide default registry that retains no request state.
## Testing
- Add unit coverage for role and tool attribution, optional evidence sources, orphaned and named tool outputs, registry reuse, and request-specific entry limits.
GitOrigin-RevId: 2b60f8db4618de8a7175f8ee0183375a526a87db
## What changed
- Add a positive `output_token_limit` setting to each entry under an MCP server's `tools` configuration.
- Apply the most restrictive limit when plugin and user policies overlap, while keeping approval policy independent.
- Carry the effective MCP output budget in conversation history so tool output, post-tool hook responses, and resumed sessions use the same truncation limit.
## Testing
- Cover configuration parsing, serialization, schema validation, and plugin policy merging.
- Cover MCP output below and above the configured limit, post-tool hook responses, and session resume.
GitOrigin-RevId: d0beb4fca9ba6055d9e1d31c137373b465d50d61
## What changed
- Add the disabled-by-default `omit_app_server_notification_media` feature.
- When enabled, remove inline image and audio content from `item/started`,
`item/completed`, and `rawResponseItem/completed` notifications, including
tool output and image-generation results.
- Keep the media in model input; the filter only changes app-server
notifications.
## Testing
- Verify that image content is absent from all three notification types while
the model request still receives it.
GitOrigin-RevId: 9a4434d18a3dac6d67c2e0c3723ff4595a9b3797
## What changed
- Lazily index items in larger thread-history turns so late updates can reuse
their positions after turn completion and rollback.
- Map reverse-history search matches back to Unicode byte ranges with a linear
scan.
- Preserve first-occurrence semantics for duplicate item IDs and Unicode match
boundaries.
## Testing
- Cover indexed duplicate updates before and after the indexing threshold.
- Cover retained-turn updates after rollback and Unicode history-search ranges.
GitOrigin-RevId: 3a9c819966d90d833c4183cf6523b6ea4f7be7e7
Roy Han