## What changed
- Add model message metadata for built-in tool descriptions.
- Use the active step model's catalog description for `send_user_message_async`, including after a mid-turn model change.
- Fall back to the built-in description when catalog metadata is absent, while preserving an explicitly empty description.
## Testing
- Cover catalog serialization, fallback and empty-value behavior, and model changes within a turn.
GitOrigin-RevId: 72b953214ab9708931065321debf12133f8d2d40
## Why
Code mode wall time should measure the host operation itself, without including
client-side response delays or idle time between requests.
## What changed
- Measure each execute, wait, and terminate request in the code mode host.
- Carry the duration through the stdio and gRPC protocols and use it for
model-visible wall time.
- Emit a structured `codex.code_mode.host_timing` event correlated with the
conversation, turn, tool call, and cell.
## Testing
- Cover successful and failed execution timing, delayed response reads,
repeated waits, termination, and missing cells across stdio and gRPC.
- Verify timing survives protocol serialization and is reflected in app-server
model output and structured telemetry.
GitOrigin-RevId: d24af30c3fc5820521b4beba1f9970714dad6482
## What changed
- Add a positive `output_token_limit` setting to each entry under an MCP server's `tools` configuration.
- Apply the most restrictive limit when plugin and user policies overlap, while keeping approval policy independent.
- Carry the effective MCP output budget in conversation history so tool output, post-tool hook responses, and resumed sessions use the same truncation limit.
## Testing
- Cover configuration parsing, serialization, schema validation, and plugin policy merging.
- Cover MCP output below and above the configured limit, post-tool hook responses, and session resume.
GitOrigin-RevId: d0beb4fca9ba6055d9e1d31c137373b465d50d61
## Why
Managed configuration can disable resumable unified execution while leaving shell tools enabled. This should not remove command execution entirely or grant access to retained processes.
## What changed
- Keep `exec_command` available in completion-only mode when `unified_exec` is disabled.
- Remove `tty`, `yield_time_ms`, `session_id`, and `write_stdin` from that mode, and add a `timeout_ms` argument.
- Terminate one-shot commands on timeout or turn cancellation, reporting timed-out commands with exit code 124.
## Testing
Added integration coverage for tool availability, timeout cleanup, and interruption cleanup under managed configuration.
GitOrigin-RevId: a382d34f922fdc4ba52889272c6db985abd42e47
## What changed
- Generate a UUIDv7 turn ID for each Guardian classification and preserve it across retries.
- Record the owning turn as `parent_turn_id` and propagate its trusted `root_turn_id` when known, including through the tool lifecycle extension API.
- Omit ambiguous or unknown root lineage and keep classification identities distinct when reusing Guardian sessions and WebSocket connections.
## Testing
- Cover classification metadata across retries, connection reuse, concurrent samples, auth refresh, and consecutive owning turns.
GitOrigin-RevId: 78757f2ad031844e4b545802f634c678a9ee2298
## What changed
- Include Windows safety guidance in the `exec_command` tool description when a
single ready environment reports Windows as its executor platform.
- Omit that guidance when the selected executor reports a non-Windows platform.
- Preserve the host-based behavior when platform information is unavailable or
the tool can target multiple environments.
## Testing
- Cover Windows, non-Windows, unknown-platform, and multi-environment tool plans.
- Verify remote environments expose guidance that matches their target OS.
GitOrigin-RevId: 95e09790446c684ffaff2a0be077db426fff4618
## What changed
Update the `send_user_message_async` tool guidance to reserve it for questions
that require missing information, preferences, constraints, clarification, or
approval. Ask models to keep these questions concise, understandable, and at
an appropriate level of abstraction for the user and task.
GitOrigin-RevId: 4a16754401fb5fc106bbf65759ac4a7a78b6c7b3
## What changed
- Mark `clock.curr_time` and `clock.sleep` as built-in control tools so their calls emit control-tool analytics.
- Cover completed, failed, and interrupted calls, verify analytics omit tool arguments and output, and keep the calls out of the dynamic-tool count.
GitOrigin-RevId: 489c8015f836be146ccc2c7e96ef7243b0599e16
## Why
An existing terminal keeps the sandbox, network settings, and grants it had at launch. Later `write_stdin` calls must account for that retained authority, including when permissions change between turns.
## What changed
- Capture each terminal's effective launch permissions and compare them with the current environment before accepting non-empty input.
- Request approval when the terminal bypassed the sandbox, retains additional grants, strict auto-review is active, or its sandbox or network settings differ from the current policy.
- Reject input when current denied-read or environment-owned network restrictions cannot be enforced by the existing terminal, while keeping empty polls and non-TTY interrupts available without review.
- Include the effective sandbox mode and user-visible additional grants in `write_stdin` approval actions without exposing host-owned grant paths.
## Testing
Added unit and end-to-end coverage for retained cross-turn grants, strict auto-review, sandbox and network policy changes, denied reads, Windows sandbox backends, and private grant redaction.
GitOrigin-RevId: e2d71daf9358474c885998786c4928069100711c
## What changed
- Share the root thread's current service tier across its agent tree.
- Apply that tier to each subagent request when the selected child model supports it, including remote compaction requests.
- Propagate root service-tier updates to existing and newly spawned subagents without rewriting child-owned settings.
- Remove per-spawn and role-level service-tier overrides so routing remains controlled by the root thread.
## Testing
- Cover supported and unsupported child models, full-history forks, live tier changes, remote compaction, new subagents, and reloaded subagents.
GitOrigin-RevId: 6c299e224e90b41a558788fb7aa4d5f336fa383a
## What changed
- Add a stable `sleep_tool` feature that can enable or disable registration of the built-in sleep tool independently of the clock tool.
- Support structured `features.sleep_tool` configuration with `model_driven` and `always_on` modes. The default `model_driven` mode preserves the existing model and `current_time_reminder` behavior, while `always_on` registers sleep whenever the feature is enabled.
- Preserve nested sleep-tool configuration across CLI overrides, config merges, and feature toggles, and expose the settings in the generated config schema.
## Testing
- Cover feature-map overrides, both selection modes, legacy clock settings, config merging and editing, and invalid mode rejection.
GitOrigin-RevId: 18eadc582f8a4445958c29d063e5be495276703e
## Why
Microsoft Store PowerShell executables under `WindowsApps` can be inaccessible to the dedicated elevated sandbox account.
## What changed
- For local elevated sandbox commands that target Store PowerShell, select the first compatible `pwsh.exe` or `powershell.exe` from `PATH` or the standard fallback locations.
- Continue adding `-NoProfile`, and preserve the selected shell for remote execution and other sandbox modes.
## Testing
Added unit coverage for Store-path filtering, fallback ordering, local replacement, and remote-path preservation.
GitOrigin-RevId: 8ab3d0db925e886879701445040f13902fb1ad24
## What changed
- Register both `clock.curr_time` and `clock.sleep` when a model lists `clock` in `experimental_supported_tools`.
- Keep current-time reminder injection controlled separately by the `current_time_reminder` feature.
## Testing
- Cover a model-advertised clock with reminders disabled, verifying that both tools are available and no reminder is added.
GitOrigin-RevId: c39b5cb6e2da397daaaa4e0ad81f0763b8dd91e9
## What changed
- Report the executor's user home in environment metadata.
- Cache the reported home on selected turn environments and include it in
filesystem sandbox contexts, including `apply_patch` requests.
- Preserve compatibility with executors that do not report a home directory.
## Testing
- Cover local, remote, inherited, serialized, and `apply_patch` sandbox
contexts.
GitOrigin-RevId: ea65e68e33a80bc9bcfc7c53b1486ab944699470
## What changed
- Add `ToolLifecycleContributor::on_mcp_tool_result` with access to the
executed MCP tool context, rewritten arguments, extension data stores, and
mutable server result.
- Run contributors before publishing MCP completion and before preparing the
result for the model, so extensions can inspect or replace successful and
error results.
## Testing
- Cover unchanged, replaced, and error results for direct MCP calls, plus
replaced and error results through Code Mode.
- Verify completion waits for result processing and the processed result flows
to both completion events and subsequent model input.
GitOrigin-RevId: ece7acfe9c5eed4778cb78a29c3ffd06a74e1bcf
## Why
Planning tools for a candidate model must not change the selected model or its
Responses Lite tool inventory. Otherwise, preparing a fallback can overwrite
metadata before the current model's request is sent.
## What changed
- Build tool registries and visible specs from an explicit `ModelInfo`.
- Store the finalized tool mode, code-mode names, namespace inventory, and
terminal and child-management capabilities on `ToolRouter`.
- Publish namespace inventory only after selecting the step's router, and use
that router's mode when dispatching and recording tool calls.
## Testing
Added coverage for candidate-model isolation, fallback compaction metadata,
code-mode worker selection, normalized tool names, and router capabilities.
GitOrigin-RevId: 56df2de8f42c7e93a4c4dcd117720e40a0cca3db
## What changed
- Tell the `spawn_agent` tool to set `model` only when the user explicitly
requests a different model.
- Update the tool-description test to enforce the stricter guidance.
GitOrigin-RevId: ed46bcb544876e408896e0d8c54292192369951c
## Why
Reviewing a shortened `write_stdin` action while sending the complete input could allow unreviewed bytes to reach an escalated terminal.
## What changed
- Require the fully formatted action and approval reason to fit within 8,000 bytes.
- Reject truncated or oversized actions before requesting approval or writing any bytes to the terminal.
- Document the reviewed stdin size limit in the app-server protocol.
## Testing
Add an integration test that uses JSON escaping to push a formatted action over the limit and verifies that it is neither offered for approval nor executed, while a subsequent valid write still succeeds.
GitOrigin-RevId: f6c96a78a65a136366c8119a7d242dfc2ec05fe6
## What changed
- Recognize `codex_sensitive_action: true` on MCP approval elicitations.
- Route marked actions to the synchronous Guardian reviewer instead of extension fast approval. Absent or false values preserve the existing path.
- Cover ordinary and strict auto-review configurations, including marked, unmarked, and explicitly false metadata.
GitOrigin-RevId: dce13d1696568ca81c8d2b08a7ef0d5f13e155bf
## What changed
Expand the `send_user_message_async` tool description to:
- identify questions, blockers, significant findings, and in-progress replies as
messages that may need immediate user attention;
- distinguish those messages from routine progress updates that belong in
commentary;
- clarify that sending a message neither ends the turn nor waits for a reply;
and
- encourage formatting questions so they are easy to notice and answer.
GitOrigin-RevId: 004ba7fd77b2e225a4baa2ab69d08660a2cf73d7
## Why
Executed-tool metadata for a Code Mode cell can span its `exec` and `wait`
outputs. Consumers need to know whether that metadata contains the cell's full
tool call inventory or only a partial record.
## What changed
- Associate recorded tool calls with the originating Code Mode cell across
`exec` and `wait` outputs.
- Add a host-owned `tool_calls_complete` marker when recording finishes without
dropped or truncated calls. The marker describes inventory completeness, not
tool success.
- Preserve the cell metadata through replay and pruning, and clear the
completeness marker when prompt budgeting makes the record incomplete.
## Testing
Add coverage for multi-wait cells, retries, interruptions, recording limits,
argument truncation, prompt budgeting, and rejection of input-forged metadata.
GitOrigin-RevId: 377014edec06aab42aadab78b8b5dccc0a1c83ba
## What changed
- Add callback lifetimes to extension `ToolCall`, `ToolEnvironment`, turn-input context, and skill-read request types.
- Require extension tool executors to handle calls for any invocation lifetime and tie their returned futures to that lifetime.
- Update built-in extensions, adapters, and tests to use the lifetime-scoped APIs without retaining host-owned environment capabilities.
GitOrigin-RevId: aca9ce3a1b6870df550bc84ec9308cc65533f161
## What changed
- Inject W3C `traceparent` metadata into code-mode session and execution requests.
- Carry each execution's trace context on streamed tool callbacks so callback and nested-tool spans remain connected across the gRPC boundary.
- Preserve the relevant spans when execution, callback, and dispatch work moves into spawned tasks.
GitOrigin-RevId: 6482963cb9b2e2f0ea27f1345bba208b70a80d0b
## What changed
- Add the `write_stdin_approval` feature flag, disabled by default, to require a fresh approval before sending non-empty input to an escalated unified-exec terminal.
- Route these reviews through hooks, Guardian, app-server, and the TUI as `writeStdin` approvals while keeping the parent command item unchanged.
- Preserve the terminal environment, launch directory, and escalation state across turns, and revalidate the process identity after approval before writing input.
## Testing
- Cover approval routing, policy decisions, process reuse, terminal identity preservation, app-server events, analytics, and TUI rendering.
GitOrigin-RevId: 4ba29eaae6208e934737ba078c96e589c7c2164d
## What changed
- Add optional `McpToolContext` metadata to `ToolStartInput`, exposing the
model-visible MCP tool details and its source classification without exposing
the executable client.
- Classify MCP calls as connectors, configured servers, plugin servers,
executor-selected plugins, or other registrations based on the prepared call.
- Prepare each MCP call before notifying tool lifecycle contributors and reuse
that same call for execution so the callback describes the call that runs.
## Testing
- Cover host-owned connector calls and extension-owned Apps server calls,
including their distinct provenance and executed tool names.
GitOrigin-RevId: efd23f511b1045ffdd96349d621ad62365569b2b
## What changed
- Add effective workspace roots to `EnvironmentConfig` and use them when
materializing permission profiles and filesystem context.
- Preserve selection roots for thread-owned configurations while allowing a
ready environment attachment to supply its resolved roots.
- Propagate resolved roots to child environments and validate both command and
`apply_patch` writes in owner-provided secondary workspaces.
GitOrigin-RevId: 1832c168ce1fc37fa67efc2a472998ab4f448c70
## What changed
- Add the originating Responses item ID to MCP tool request metadata as
`_meta.itemId`.
- Preserve the initiating `exec` item ID across code-mode cells so nested MCP
calls carry the same origin.
## Testing
- Cover metadata generation for direct and code-mode MCP tool calls.
GitOrigin-RevId: 1161cac64f1cc3a6d4dac4368e63804bd9d2c417
## Why
Guardian approval reviews may need the original user instructions to decide
whether a command is authorized.
## What changed
- Forward the parent thread's `history.list_windows`, `history.list_items`,
`history.read_item`, and `history.search_contents` executors to Guardian
reviewer sessions.
- Keep other parent extension tools, including the `notes` namespace, isolated
from Guardian reviewers.
## Testing
Add an app-server integration test that reads parent history during a Guardian
review and verifies that `notes` tools are not exposed.
GitOrigin-RevId: 65a90036577050adfa23b1d98f862233c994d9d7
## Why
Tool actions and approval retries can outlive the step that issued them. If approval handling reads newer turn settings, a delayed action can use the wrong approval policy or reviewer.
## What changed
- Capture the approval policy and reviewer in `GuardianReviewContext` from the issuing step.
- Use step settings for command, patch, permission, sandbox-retry, and remote-network approval decisions.
- Use the active task's published settings for background network approvals and long-lived Unix shell interception.
- Preserve explicit MCP reviewer overrides.
## Testing
Added regression coverage for permission requests, same-turn network policy changes, delayed commands after a new turn starts, sandbox retries, patch policy selection, and MCP reviewer overrides.
GitOrigin-RevId: b7e84a2e1e79a71502272b15b5ef5b0e5643f8b0
## Why
MCP tool calls can be issued by a model step whose settings differ from the
turn's initial settings. Request metadata must describe the issuing step.
## What changed
- Build MCP tool-call metadata from the captured `StepContext` model and its
effective reasoning effort.
- Populate `node_repl_disabled` from the issuing step while leaving turn-owned
Responses metadata unchanged.
- Apply the same step-scoped values to MCP requests emitted by stop hooks.
## Testing
Add coverage for configured and model-default reasoning effort, model changes,
Node REPL restrictions, and preservation of the original step and turn
metadata.
GitOrigin-RevId: f9cce52fbe559f15437bd19d699b657229c0d145
## Why
Tool execution can use an environment whose sandbox configuration differs from the turn-wide configuration. Sandbox selection and process setup need to follow the environment that owns the tool request.
## What changed
- Source Windows sandbox level, legacy Landlock mode, and Windows private desktop settings from the selected turn environment across tool orchestration, unified exec, patch application, and zsh fork escalation.
- Preserve Windows sandbox level overrides in restorable thread settings and invalidate MCP configuration when that level changes.
## Testing
- Add a resume test that verifies an elevated Windows sandbox override survives thread restoration.
GitOrigin-RevId: 9d8fc46404919f5ae97c9ed712c0932a1f095e36
## What changed
- Convert unstructured MCP results into typed function-call output items instead of serializing the entire content array as a text string.
- Keep structured MCP results as serialized text and preserve media, encrypted content, and unknown content through their existing item conversions.
- Drop empty text items during output truncation so they do not consume API array slots.
## Testing
- Cover text-only, mixed unstructured, structured, and image-sanitized MCP results.
- Verify empty text items are discarded under byte- and token-based truncation policies.
GitOrigin-RevId: fa1c5b7dee6f003a094265379dcabdd060386a48
## What changed
- Read `x-codex-imagegen-request-id` from image generation and edit responses.
- Propagate the ID to `codex_image_generation_event` analytics.
- Keep the ID in process only, excluding it from extension item serialization, generated types, app-server wire data, and rollout history.
## Testing
- Cover response-header extraction and missing-header behavior in the images client.
- Verify end-to-end analytics emission and the unchanged image-generation item wire shape.
GitOrigin-RevId: 9b8e09b7d655c0c2faa84f0eee99aabae583668d
## What changed
- Add the experimental `turn/start.cyberAccessProgram` option with `standard`,
`daybreakBlue`, and `daybreakRed` values.
- Forward the selection as `access_programs.cyber` on Responses, WebSocket,
and remote-compaction requests made with ChatGPT authentication, while
omitting it for API-key and custom-provider requests.
- Preserve the per-turn selection across recovery, compaction, and child-agent
turns without making it a persistent thread setting.
## Testing
- Cover app-server forwarding, authentication boundaries, WebSocket reuse,
turn recovery, compaction, and child-agent inheritance.
GitOrigin-RevId: d2eb468f365b2214c5099bc21741cf30f8bd2eb5
## What changed
- Add the opt-in `code_mode_prewarm` feature to establish the code-mode host session during startup, before the first turn.
- Make in-progress host initialization cancellable so a stalled prewarm does not block shutdown.
- Share a failed connection attempt with concurrent callers instead of immediately starting another attempt.
## Testing
- Verify app-server contacts the configured host before the first turn and can shut down while that connection is stalled.
- Exercise shared remote-host behavior with prewarming enabled.
GitOrigin-RevId: 3cfde5509be7b4aba80112c36c5616b9a9b632c6
## Why
Filesystem policies containing `:tmpdir` need executor-local directory bindings,
including when execution occurs in a remote environment.
## What changed
- Cache temporary directories reported by remote executors and discover the
equivalent directories for local environments.
- Preserve the cached directories across inherited environment selection and
include them in `FileSystemSandboxContext`.
- Add `FileSystemSandboxPolicyContext` and a context accessor so filesystem
policy entries can be resolved with the executor-owned current directory,
workspace roots, and temporary directories.
## Testing
Extend environment-selection tests to cover local, remote, and inherited
temporary-directory policy context.
GitOrigin-RevId: 36335af3465c529f024bf69293af288803dd582d
## Why
Thread settings can change while a turn is running, and delegated review or
compaction steps can select a different model. Each request needs a consistent
set of settings resolved against the model that will execute it.
## What changed
- Capture immutable resolved settings for each model step, including model
metadata, reasoning options, service tier, approvals, and personality.
- Keep in-flight steps on their captured settings while applying thread updates
to subsequent work.
- Resolve inherited reasoning summaries and filter service tiers against the
selected model and feature configuration for review and compaction steps.
## Testing
Added coverage for settings updates during paused turns, model changes,
previous-model compaction, review-model defaults, and service-tier filtering.
GitOrigin-RevId: fca4b3b305379f1bf26a5cac75ee0dd1747ac1f6
## Why
Answers collected by `request_user_input` can change what the user authorizes, but post-tool hooks may replace or reject the tool output that Guardian normally sees.
## What changed
- Record bounded, host-observed answers before post-tool hooks run and provide them as trusted evidence to synchronous and asynchronous Guardian reviews.
- Include root-thread answers in worker review context.
- Count successful answers as authorization changes so earlier review evidence becomes stale, while ignoring empty or unrelated answers.
## Testing
Add coverage for allowed and denied stale reviews, empty and oversized answers, hook-modified output, and root-to-worker propagation.
GitOrigin-RevId: 970c52e40338ecd057c7cd2a69d04b06e97cd068
## Why
History estimation and executed-tool-call limits only need the size of serialized JSON, not the serialized output itself.
## What changed
- Add a shared `serialized_json_bytes` helper that streams JSON into a byte counter.
- Use it for response-item size estimates and executed-tool-call argument limits.
- Preserve serialization errors so callers can apply their existing fallback behavior.
## Testing
- Cover response-item sizing with escaped characters, newlines, and multibyte text.
GitOrigin-RevId: a4417996df96df5c51cae62830adc496912f69c7
## What changed
- Record collaboration tool analytics for `send_message`, `followup_task`,
`interrupt_agent`, and `list_agents`, including receiver attribution, duration,
failures, and interrupted calls.
- Include these calls in per-turn subagent tool counts while keeping the existing
`subAgentActivity` output unchanged and omitting additional public collaborator
tool items.
- Extend the collaboration tool schemas with the new tool variants and the
`interrupted` terminal status.
## Testing
- Add an app-server integration test covering successful and failed calls,
receiver attribution, duration, prompt omission, activity items, and turn
counts.
GitOrigin-RevId: e73eaa05c508261e5fc97e7d08d7881a31e04e22
## What changed
- Add Windows sandbox mode, private-desktop behavior, and legacy Landlock selection to each `EnvironmentConfig`.
- Centralize sandbox context construction on `TurnEnvironment`, preserving environment-owned permissions, paths, and backend settings while applying additional permission grants.
- Use the environment-derived context for project instructions, capability discovery, file uploads, and filesystem-oriented tools.
## Testing
- Verify capability discovery uses the selected environment's permission profile and sandbox backends when they differ from the thread defaults.
GitOrigin-RevId: 7ae2fed90c8ada950f2e8431e571e9b2c793c291
## Why
Internal Guardian reviews must remain independent of parent-session customization while still honoring managed execution and environment restrictions.
## What changed
- Apply the restricted Guardian session path to both internal and subagent review sources.
- Start internal reviews without inherited user instructions, extensions, MCP servers, or multi-agent behavior.
- Preserve managed execution policy and selected environment constraints while exposing only the allowed review tools. Honor shell feature restrictions across every selected environment and retain code mode when enabled.
## Testing
- Cover internal review isolation from parent state and managed instructions.
- Cover optional tool filtering, managed shell restrictions, code mode, and secondary environment profiles.
GitOrigin-RevId: edbf7d8a6fe3ee8213a1c75bc8ec331a1cf49006
## What changed
- Emit control-tool analytics for history and notes extension calls and for
`send_user_message_async`.
- Preserve non-default namespaces in reported tool names, such as
`history.read_item` and `notes.write_file`.
## Testing
- Add an app-server integration test covering successful and failed calls,
turn-level tool counts, and omission of tool argument values from analytics.
GitOrigin-RevId: b15a53a311228339f4d577a7b96146ed67f22253
## Why
Analytics need to associate subagent activity with the top-level turn that
caused it, while avoiding a stale association when steering makes that origin
ambiguous.
## What changed
- Add `root_turn_id` to turn and tool-item analytics events.
- Read the root from live turn metadata when each event is built, reporting
`null` when the root is unknown or ambiguous.
- Propagate the metadata through control-tool and code-mode completion facts so
correlated and background tool events retain the correct root.
## Testing
- Cover root IDs for top-level turns, subagent turns, correlated code-mode
calls, and tool events emitted after turn completion.
- Verify that queued and subsequent events report `null` after the live root is
invalidated.
GitOrigin-RevId: 42fd76541c3c716cec74787d47b50adb2d22e6d2
## Why
Multi-Agent V2 children are owned by their parent at runtime. Resuming an
unloaded child directly could rebuild it from caller-provided settings instead
of the parent's current authority.
## What changed
- Route child reloads through their loaded immediate parent and reject direct
cold resume when that parent is unavailable.
- Preserve the child's recorded model, provider, reasoning effort, and role
while inheriting the parent's execution policy and MCP extensions.
- Validate cached environments against the parent, intersect local permission
profiles, and reject stale remote or workspace-root configurations.
- Keep paginated cold-resume token usage attribution when attaching to the
reloaded child.
## Testing
Add coverage for owner validation, nested-parent reloads, permission and
environment changes, role instruction restoration, paginated usage replay,
and app-server child resume behavior.
GitOrigin-RevId: 84014762bcdb57f94fc23974c9c1af55dc1babf1
## What changed
- Add `features.network_proxy.credential_broker` and preserve structured network proxy settings when toggling the feature through config APIs.
- Protect broker enablement and provider context variables from project config, while carrying trusted context into filtered shell environments.
- Propagate brokered credentials through shell snapshots and restore real credentials for unsandboxed escalated commands.
- Normalize broker context environment keys case-insensitively on Windows and avoid conflicting remote managed-network enforcement when no proxy launch configuration is available.
## Testing
- Cover config layering, editing, project sanitization, Windows environment handling, shell snapshots, escalated execution, and end-to-end GitHub credential brokering in the zsh-fork runtime.
GitOrigin-RevId: 500e51e804e1988022052ccfe00b8fac5e495f4f
## What changed
- Add `ToolCallSource` to extension `ToolCall`s and propagate direct or Code Mode
invocation metadata, including the runtime cell and nested tool-call IDs.
- Add `ToolCall::response_byte_budget` so extension tools can bound direct-call
responses by the host truncation policy while allowing Code Mode responses up
to the tool's own limit.
- Share the skills extension's response-size limit between its `list` and `read`
tools.
## Testing
- Verify that Code Mode source metadata is preserved when core constructs an
extension tool call.
GitOrigin-RevId: b10aef01be30d35b67bee3af24a1a4175c9ee112
## What changed
- Recognize `cua_repl` alongside `node_repl` when collecting Guardian review evidence, applying computer-use policy, and capturing transcript images.
- Render `cua_repl.js` results with the compact REPL history and transcript views.
- Preserve failed MCP call status and result content when replaying app-server history.
## Testing
- Cover both REPL server names across Guardian policy, evidence, image capture, history rendering, and failed-call replay tests.
GitOrigin-RevId: 8c13a721f718add403b07e727c1634b59203c51a
## What changed
- Use the shared approval-policy check for unified exec sandbox escalation so
`require_escalated` commands can prompt when granular `sandbox_approval` is
enabled and remain rejected when it is disabled.
- Add an approval scenario covering sandbox escalation with granular approvals
enabled.
GitOrigin-RevId: 98907960cd9df181e1b2fd9d7fea11fa3c0ed7e6
## What changed
Propagate tool cancellation tokens into Guardian approval reviews so interrupting a tool also aborts its pending review. Apply the same cancellation behavior to server-initiated MCP approval elicitation.
## Testing
Add integration coverage for cancellation from direct tool calls, code-mode turns, background code-mode cells, and MCP elicitation.
GitOrigin-RevId: cbee4b422bbcbf6984e415ef6409cee705beebdc
rhan-oai