## What changed
- Remove the hidden `PairProgramming` and `Execute` variants from `ModeKind`.
- Delete their unused prompt templates and simplify mode handling to cover only `Default` and `Plan`.
GitOrigin-RevId: 8d24e3f562a09e3071b2decae275d2b3871a1e9c
## Why
The bundled system-skill cache is shared by every process using the same
`CODEX_HOME`. A service with bundled skills disabled must not remove cache
files that another service still uses.
## What changed
- Filter system skill roots from disabled services without deleting the shared
cache.
- Ensure bundled system skills are installed during loads when they are
enabled, including after a runtime configuration change.
## Testing
Add app-server coverage for preserving the cache across enabled and disabled
services and refreshing stale cached skills after runtime enablement.
GitOrigin-RevId: 1eca999b33b7be69873a40a91767fd26f0c2b457
## Why
Sequential dispatch lets a long-running request block unrelated health checks
and cleanup on the same connection.
## What changed
- Add `--concurrent-requests <COUNT>` for local and remote exec-server
connections, while retaining sequential dispatch when the option is omitted
or set to `1`.
- Preserve handshake ordering before enabling concurrent dispatch.
- Reserve separate capacity for status, signal, terminate, and close requests so
they remain responsive when ordinary request capacity is saturated.
- Drain queued client responses during disconnect and cancel outstanding
request tasks during connection shutdown.
## Testing
- Cover CLI parsing and concurrency-limit validation.
- Verify default sequential behavior, pipelined handshake ordering, concurrent
request progress, control-request responsiveness, and disconnect handling.
GitOrigin-RevId: 48e4b092e318204ed635543f01f9ee0e7df095fc
## What changed
- Add a hidden global `--psp` runtime flag and propagate it through TUI, exec,
app-server, remote-control, and in-process startup paths.
- Attach the `oai-chat-psp=true` cookie to first-party ChatGPT requests when
enabled, using a cached cookie-aware client with sensitive request logging
disabled.
- Keep the routing selection out of persistent configuration layers while
preserving it across config refreshes and agent role changes.
## Testing
- Cover global flag parsing, app-server propagation, config-layer isolation,
and preservation across config rebuilds and role changes.
GitOrigin-RevId: 05cdc61ffd7162d8e48fc1e166f4732113e5a816
## What changed
- Let `HttpClientFactory` carry additional ChatGPT cookies and share their store across cloned factories.
- Attach configured cookies when route-aware clients or explicitly opted-in clients enable the ChatGPT cookie store.
- Combine configured cookies with the current path-scoped Cloudflare cookies only for HTTPS ChatGPT hosts, while preserving sensitive-header metadata.
## Testing
- Cover cookie merging, path-scoped Cloudflare updates, host and scheme restrictions, sensitive values, and factory clone/equality behavior.
GitOrigin-RevId: 5baf745859e14db739fd62ab931720dbe90c04e0
## What changed
- Treat an MCP server as trusted for ChatGPT authentication when its origin
matches the configured HTTPS `chatgpt-staging.com` host or one of its
subdomains.
- Continue trusting the production ChatGPT origin and falling back to OAuth for
other transports and origins.
## Testing
- Cover both the staging apex domain and a staging subdomain.
GitOrigin-RevId: 1b1d06ab214141d39eb38d46de9dfb74e6fedb3e
## What changed
- Add provider-owned remote compaction capabilities for unsupported, v1, and v2 protocols.
- Mark Amazon Bedrock as v1-only so manual and automatic compaction use `/v1/responses/compact`, even when the v2 feature is enabled.
- Preserve v2 support for OpenAI and Azure Responses providers and local compaction for unsupported providers.
## Testing
- Cover Amazon Bedrock manual and automatic remote compaction, including endpoint selection, authentication headers, model selection, and reuse of the compacted summary.
GitOrigin-RevId: d58093178605d1f8155b93d9a161408177f6ac72
## What changed
Run the hash-pinned `openai/fence` action in `audit` mode before checkout in
the blob size policy job.
GitOrigin-RevId: 9312897dae76d93298008b2ce8a8767680fe34b8
## Why
Session IDs are derived from file stems and can repeat across projects. Keying
connector attribution only by session ID can therefore assign one session's
connectors to another session during a batched migration.
## What changed
- Preserve connector candidates by canonical source path until each imported
session is annotated, then aggregate them for detection summaries.
- Resolve project-backed MCP tool calls from both `CallMcpTool` server IDs and
`mcpDetails.serverName`, while requiring a match in project metadata.
## Testing
Add coverage for duplicate session stems, per-source connector results, and
both supported project-backed MCP tool-call formats.
GitOrigin-RevId: 10563d47c29673c07daa83be5f4e1a256740b901
## Why
Orchestrator skills with `allow_implicit_invocation: false` were still exposed in the model-visible skill catalog.
## What changed
- Hide explicit-only orchestrator skills from the prompt catalog while keeping them available for direct invocation.
- Include orchestrator resource-access metadata with injected instructions so `skills.read` can load referenced resources.
- Track visible and hidden discovery limits separately, and record discovery duration and resource-count metrics.
## Testing
Add an integration test that verifies an explicit-only orchestrator skill stays out of the prompt catalog, can be selected explicitly, and can read a referenced resource.
GitOrigin-RevId: 9cab5a61eb27c96bec9d1346c7dcdbc97376f7dc
## What changed
- Add a `features.token_budget.mode` setting with `thread` and `name` values.
- Default context-window metadata to the thread ID while allowing configurations to retain the agent name.
- Preserve the selected identity mode when applying model token-budget defaults and replaying locked configuration.
## Testing
- Cover configuration parsing and both identity formats in token-budget context messages.
GitOrigin-RevId: f6e6d2c49e09e70c0352e803bb65784ef77e5bee
## What changed
- Ignore symbolic links and other non-file, non-directory entries while copying a plugin into the store instead of rejecting the installation.
- Cover symlinked skill files and executables, verifying that the plugin installs without copying either link.
GitOrigin-RevId: da0cbbd95d12313afcaecdcb52824fc1922d0b74
## What changed
- Add the stable, default-enabled `features.view_image` flag.
- Omit the native `view_image` tool when the flag is disabled, including for fresh-context subagents and guardian reviewer turns.
- Keep unrelated execution and MCP tools available when the viewer is disabled.
## Testing
- Add app-server coverage for disabled viewer inheritance in fresh-context subagents and guardian reviewer turns.
GitOrigin-RevId: 42b1311010fbde9f064129b17b425820861c6d91
## Why
Cursor stores projectless chats under the reserved `empty-window` project, and
their transcripts may not contain embedded working-directory metadata.
## What changed
- Resolve `empty-window` sessions to the parent of the Cursor home directory,
including when that home is configured as a relative path.
- Record each created or appended session's working directory in its import
success result instead of inheriting the migration item's directory.
## Testing
- Cover projectless Cursor transcripts without embedded metadata.
- Cover working-directory resolution from a relative Cursor home.
GitOrigin-RevId: 21cc7ea6acab1ed80cc4016a881e07eca3d0abbd
## What changed
- Update the required pull request attribution to `Generated with [Codex](https://openai.com/codex/).`.
- Recognize the previous unlinked attribution when restoring saved context so it can be replaced without duplicating the attribution instructions.
## Testing
- Cover cold resume with both commit-only legacy instructions and the previous unlinked pull request attribution.
- Update app-server and MCP server assertions for the linked attribution.
GitOrigin-RevId: 8773546a6a59dab146905e50cf4434d53b9335cf
## Why
Trusting a directory enables project-local config, hooks, and exec policies, which can increase exposure to prompt injection. Require an explicit decision instead of automatically trusting projects whose trust level is unset.
## What changed
- Add a directory-trust step to TUI onboarding, with options to trust and continue or quit.
- Apply trust to the Git repository root when starting from a subdirectory, persist the decision, and reload config before continuing.
- Keep the prompt active and show the config error when trust cannot be persisted. Skip the prompt for remote workspaces and projects with an explicit trust level.
## Testing
- Cover trust-screen rendering, keyboard selection, persistence failures, and prompt visibility for explicit trust and Windows sandbox states.
GitOrigin-RevId: 850e6f54aec84d584cd161348ecdb1da89aaabd4
## What changed
- Return connector candidates found in detected external agent sessions, aggregating session counts by connector name.
- Resolve connector names from both cached plugin manifests and project MCP server metadata.
- Persist detected connector clues in the session import ledger and merge them into completed imports without case-insensitive duplicates.
## Testing
- Add coverage for project MCP metadata detection and for accumulating detected and imported connector candidates.
GitOrigin-RevId: 97a7dfe4a61599686b2222cddd9595acec8b4501
## Why
Image resize notices describe the history item immediately before them, so
remote compaction must not preserve or discard them independently of that item.
## What changed
- Group recognized `image_resize_notice` developer messages with their source
history items when filtering compacted history.
- Account for each group together when trimming or truncating history to a token
budget, preserving the notice only when its source is retained.
## Testing
- Extend the remote compaction v2 follow-up test to verify that a retained user
image keeps its resize notice, while notices for discarded items and
unrecognized developer notices are omitted.
GitOrigin-RevId: 82bb70a46eb68b07b4601e7fb345921d0789f442
## What changed
- Add `features.tool_registry.error_on_tool_collisions`, defaulting to `false`, to the TOML model, generated schema, and resolved runtime configuration.
- Treat `tool_registry` as structured configuration rather than a feature toggle, including in strict config validation and profile configuration.
- Preserve the resolved collision policy in session config lockfiles when it is enabled or explicitly configured.
## Testing
- Cover deserialization, strict validation, default and enabled resolution, feature materialization, and config lockfile serialization.
GitOrigin-RevId: 2c27109dcf2a3d1e51064cc60088703e36a0f85a
## What changed
- Add a storage-neutral `QueueStore` interface backed by a dedicated SQLite
database for ordered, thread-scoped user submissions.
- Support enqueueing, paginated listing, editing, deletion, and atomic
reordering, with a limit of 100 pending items per thread.
- Remove queued submissions when their thread is deleted.
## Testing
- Cover concurrent inserts, ordering and pagination, edits, deletion,
cross-thread isolation, queue limits, and thread cleanup.
GitOrigin-RevId: 0a8e95ac71137afc6f3a039d4b5fc8603110c891
## What changed
- Keep paginated resume, transcript, and fork workflows on bounded turn and item page requests, while preserving the legacy full-history fallback.
- Refill underfilled terminal scrollback from older pages and show a transcript shortcut when earlier history is unloaded or truncated by the row cap.
- Preserve a successfully created fork if its initial history hydration fails, keep side forks bounded, and retain the correct history boundary for nested forks and subagents.
## Testing
- Add coverage for scrollback refill and truncation notices, bounded paginated requests, fork hydration failures, nested forks, and inherited subagent history filtering.
GitOrigin-RevId: 10ba952ffb2f69717fbc71aa03cac7685f7dcf78
## What changed
- Load older transcript items in bounded pages as users scroll upward, and let `Home` continue fetching until the start of the thread.
- Show loading, partial-history, retry, and complete states in the transcript overlay while preserving the visible scroll position as pages are prepended.
- Use paginated history for resume, fork, retry, and prompt-edit flows, while falling back to legacy history requests when the app server does not support pagination.
## Testing
- Cover multi-page transcript loading, page-boundary prompt reconciliation, legacy-server fallback, bounded retry history, and transcript history-state rendering.
GitOrigin-RevId: cc6b764bc4185d079b2f68bedf235c1d08278dfb
## Why
Paginated sessions can have visible messages beyond the first item page, so
bounded hydration could leave resumed history or transcript previews empty and
the transcript viewer incomplete.
## What changed
- Scan paginated history until the configured rendered-row budget is filled,
while retaining the configured scrollback beyond the visible viewport.
- Fully hydrate transcripts opened from the resume picker and build previews
from bounded item pages, including when non-visible items precede messages.
- Stop pagination on repeated cursors and let `Esc` cancel an in-flight
transcript load.
- Replay restored token usage for cold metadata-only resumes when its stored
turn can be identified.
## Testing
- Add coverage for paginated and legacy transcript loading, bounded resume
hydration, repeated cursors, transcript cancellation, and resize reflow.
GitOrigin-RevId: 2ce69f7d5eae88e2b09a27c333b00b1830ff17bf
## Why
Paginated threads should not require the TUI to load and render their entire
history when a session is resumed.
## What changed
- Hydrate a bounded initial history page for paginated resumes and forks,
respecting the configured terminal reflow row budget.
- Load older transcript items in the background as users navigate upward, while
preserving the viewport, live output, and backtrack selection.
- Reconcile review-mode prompts across page boundaries and keep restored token
usage hidden until it can be attributed to a persisted turn.
## Testing
- Added coverage for paginated resume and fork hydration, older-page merging,
transcript prepending, backtrack behavior, review prompt filtering, and token
usage restoration.
GitOrigin-RevId: 42160b943a9f6a1ba0cfe4b195c24ddf410b747d
## What changed
- Generalize `CodexThread::try_start_turn_if_idle` to accept exported
`TurnInput` values, preserving user content and client IDs in the first model
request.
- Allow non-empty user input to start an idle turn in Plan mode while retaining
the Plan-mode rejection for automatic response items and empty user input.
- Process idle user input through the normal user-turn path so connector
selections are cleared, prompt telemetry is recorded, and referenced skill
instructions are included.
## Testing
- Cover idle user input in Default and Plan modes, response-item mailbox
merging, empty-input rejection, and skill instruction injection.
GitOrigin-RevId: 116667d160d4464b525d9e4c7e8cc05d23a94008
## What changed
- Move config-layer, user, system, plugin, extra, and repository skill-root
resolution from `core-skills` into the host skills extension.
- Keep the core loader focused on loading explicit `SkillRoot` values.
- Relocate and expand tests for root precedence, deduplication, repository
ancestry, plugin metadata, and concurrent probing.
GitOrigin-RevId: 3b95cf28101b8b4d64d54079d202154dad560aab
## Why
Reviews may use a different model from their parent turn. They need current
thread settings without inheriting defaults resolved for the parent model.
## What changed
- Build review configuration from the parent turn context while preserving
explicitly configured token-budget overrides.
- Use the review model's token-budget defaults and select a supported reasoning
effort when switching models.
- Carry the session's resolved service tier and current environment,
permissions, and approval settings into the review thread.
## Testing
Expanded review coverage for updated thread settings, model-specific
token-budget defaults, service tiers, and reasoning effort selection.
GitOrigin-RevId: cefa0f22cd9b9e28047d94e1d2d49ff83eded43e
## Why
Guardian reviews received sandbox retry reasons, but not the execution-policy reason that triggered an initial approval request.
## What changed
- Propagate approval and retry reasons through the tool approval flow and include the applicable reason in the Guardian prompt.
- Prefer a sandbox retry reason when both are available.
- Truncate approval context to 512 tokens while preserving the start and end of the reason.
## Testing
Added prompt and integration coverage for policy reasons, retry precedence, and truncation.
GitOrigin-RevId: 5b0f4e1c40b792b031bc8f7b31685a61d12b8d92
## Why
Amazon Bedrock supports hosted text web search, but it rejects the
`search_content_types` field used for multimodal search and does not support
external live or indexed web access.
## What changed
- Advertise hosted web search for Amazon Bedrock while marking external web
access as unsupported.
- Resolve unsupported live and indexed modes to cached search, or disable the
tool when cached search is prohibited by managed requirements.
- Normalize built-in and configured Bedrock model catalogs to text-only web
search, and retain the runtime provider in session configuration so turn
setup can apply its capabilities.
## Testing
- Cover cached fallback, managed-mode restrictions, text-only tool payloads,
provider capabilities, and catalog normalization.
GitOrigin-RevId: 310473849257401654388a4ebb42920e03aa3228
## What changed
- Replace the TUI directory-trust prompt with automatic trust for local projects whose trust level is unset. Keep explicit trust settings and remote workspaces unchanged.
- Persist trust for the resolved Git or configured project root, then reload configuration so project-local settings take effect.
- Fall back to an in-memory trust override and an embedded app server when the config update cannot be persisted.
## Testing
- Cover persisted and in-memory trust, custom project-root markers, and the working directories selected by resume and fork flows.
GitOrigin-RevId: 8fd51eb4cd88267073324bfd7dc4106a56d7c745
## What changed
- Remove the cached permission profile from `TurnContext` and derive the
effective profile, filesystem policy, network policy, and legacy sandbox
policy from `config.permissions`.
- Update sandbox consumers and tests to use the current turn configuration.
- Verify that role-based agent spawning reapplies runtime permissions and that
cold-resumed agents retain their disabled permission profile.
GitOrigin-RevId: d67c5d2bcbe6dc76f15b56defb485b155fd1f138
## Why
A repository can contain a tracked directory that Git implicitly treats as a bare
repository. Its configuration may select helpers such as `core.fsmonitor`, causing
Codex Git operations in that directory to execute repository-controlled code.
## What changed
- Pass `-c safe.bareRepository=explicit` to Codex-managed Git commands so they
reject implicitly discovered bare repositories.
- Continue to support repositories explicitly selected with `--git-dir` or
`GIT_DIR`.
## Testing
Add a regression test that clones a repository containing a tracked embedded Git
repository and verifies that guarded Git inspection rejects it without running
its configured filesystem monitor.
GitOrigin-RevId: 344b5bc1e0ffa94f2a1b788488aa653222da10f3
## What changed
- Move host skill discovery, snapshot caching, and configuration handling from
`codex-core-skills` to `codex-skills-extension`.
- Rename `SkillsService` and `SkillsLoadInput` to `HostSkillsService` and
`HostSkillsLoadInput` to distinguish the host implementation from other skill
providers.
- Keep shared loading primitives and skill outcome modeling in
`codex-core-skills`.
GitOrigin-RevId: d81a21791d2ef8c066e157e7e538b8cb7ee4c24b
## What changed
- Discover plugins from configured and repository marketplaces using the request's `cwds`, and merge up to 100 ranked local matches into the first remote result page.
- Match local plugin names, display names, and keywords without case or punctuation sensitivity, while applying global, personal, and workspace scope semantics.
- Deduplicate local and remote copies, preserve local installation metadata on the remote result, and treat the remote global catalog as authoritative over the local curated marketplace.
- Keep local search available for API-key authentication and when `remote_plugin` is disabled, and consistently report `enabled: false` because search results describe discovery rather than effective activation.
## Testing
- Add coverage for merged pagination and ranking, API-key local search, scope and feature behavior, deduplication, installed state, and explicit disabled-state reporting.
GitOrigin-RevId: 63696a00d16166dfdd86e0cc456769c583ebe9a7
## What changed
Expand the ChatGPT dual-surface plugin integration test to cover both enabled
and disabled app configurations. Verify that plugin app guidance and searchable
app tools follow `apps.calendar.enabled`, while plugin MCP guidance and tools
remain suppressed.
GitOrigin-RevId: 40c51fbc075e07a8b03b5c520f5c46e360f71ceb
## What changed
- Add `AppToolPolicyEvaluator::apply_app_enabled_state` and use it when
presenting app lists, building plugin context, and deciding whether app
instructions are available.
- Preserve each app's source state unless local or managed configuration
explicitly overrides it.
- Keep connector discovery and post-install refresh checks based on raw
accessibility rather than configured enablement.
## Testing
- Cover default enablement, per-app overrides, managed disablement, and
preservation of unconfigured source state.
GitOrigin-RevId: f1a62d55e7cc48b37113848e3baa0d69d8d9c8a8
## What changed
- Move `resolve_disabled_skill_paths` into `codex-skills` and expose it from the crate.
- Re-export the resolver from `core-skills` to preserve existing callers.
- Split config-layer and policy-resolution coverage into focused unit tests, including ordered path and name overrides.
GitOrigin-RevId: 6528ff99285925132bf80eb33eafb1b62118e033
## Why
Thread settings can update the approval policy after a turn context is created.
Keeping a separate copy on `TurnContext` could leave tool approval checks using
the previous policy.
## What changed
- Remove the duplicated approval-policy field from `TurnContext`.
- Resolve the policy through the turn's current configuration everywhere it is
needed, including tool execution, Guardian routing, MCP handling, and
permission requests.
## Testing
- Update the shell escalation test to apply a thread-level policy override and
verify that the next turn rejects an escalation using the updated policy.
GitOrigin-RevId: e5966ba08f179d53fd76871ad904762958c0f5ea
## Why
App-server clients need to advertise structured MCP extension settings, including supported MCP App UI MIME types, rather than only opting into OpenAI form elicitation with a boolean.
## What changed
- Add an `extensions` map to initialize capabilities and preserve `mcpServerOpenaiFormElicitation` as a legacy alias for `openai/form`.
- Capture the declared extension profile when a thread is started, resumed, or forked, propagate it to subagents, and advertise it to downstream MCP servers during initialization.
- Keep the profile stable for the lifetime of the loaded session instead of changing it on later turns or direct tool calls.
## Testing
- Cover extension conversion, downstream MCP initialization, session isolation, legacy form support, and subagent inheritance.
GitOrigin-RevId: fbcedbb74ce788e574b0f884a4c45c4cedb9de54
## Why
Bearer credentials can contain characters outside the previous token pattern or
start with another recognized key prefix. This could leave part of the
credential visible after redaction.
## What changed
- Recognize bearer tokens containing URL-safe and base64-style characters,
optional padding, and horizontal whitespace after the scheme.
- Redact bearer credentials before matching narrower OpenAI and AWS key forms so
the whole credential is replaced.
- Preserve delimiters following the credential and avoid matching short tokens,
joined scheme names, or tokens separated by vertical or non-ASCII whitespace.
## Testing
Added focused positive and negative cases for the supported token forms and
false-positive boundaries.
GitOrigin-RevId: 1e5b10685281dc91d232d619b938bacbadaa47f9
## Why
Reloading an unloaded v2 agent could inherit the model provider from the
agent that triggered the reload, even though the worker's model was restored
from its persisted thread state.
## What changed
- Restore both the model and model provider from the stored thread when
reloading a v2 agent.
- Return an invalid-request error if the stored provider is no longer present
in the configured provider map.
## Testing
Extend the v2 agent reload test to trigger the reload with a different sender
provider and verify that the worker retains its stored provider.
GitOrigin-RevId: 6401d9f0d1c116e9954e3bd193d016f04da5f223
## What changed
- Persist `rmcp` and `codex_rmcp_client` events only at `INFO` level or above.
- Cover nested targets from both namespaces in the SQLite log filter test.
GitOrigin-RevId: dfeeec302a9562f533a09a735b392d202c1f7801
## What changed
- Move skill interface validation and asset-path resolution into `codex-skills` so both skill loaders share the same behavior.
- Populate host-loaded skills with validated display metadata, prompts, brand colors, and local icons from `agents/openai.yaml`.
- Allow plugin skills to reference icons under the plugin's shared `assets` directory while rejecting absolute paths and paths that escape permitted asset roots.
## Testing
- Add resolver tests for valid, invalid, local, and plugin-shared interface assets.
- Add host loader coverage for interface fields and asset-path restrictions.
GitOrigin-RevId: 3f316191752eeebd15d11ac0bee82201574320ec
## What changed
- Apply the session's current approval policy whenever per-turn configuration is built.
- Have review threads inherit the parent turn's full permission settings and approval reviewer.
- Add coverage for settings updated after session startup, including the approval policy, permission profile, and approval reviewer.
GitOrigin-RevId: bff050c6de157dd65d62f7b49651bef3f426ee3f
## What changed
- Gate Codex Apps MCP tool registration on whether apps are enabled instead of requiring each tool's connector to appear in the accessible connector list.
- Continue enforcing model-visibility and app-tool policy checks, including the requirement for connector metadata.
- Use the merged connector catalog for tool-suggestion discovery.
## Testing
- Cover app-tool registration from catalog metadata, including synthetic links, source ordering, and the apps-disabled case.
GitOrigin-RevId: eef4eb03da9738d3a165dd6cfda0d3c1844d51e7
## What changed
- Reuse directory-entry file types in local memory listing while continuing to
exclude symlinks, and reuse rollout metadata when reading modification times.
- Avoid following non-symlinks twice in direct filesystem metadata and directory
listing operations while preserving target classification for valid symlinks.
## Testing
- Cover symlink handling in local memory listing and search.
- Extend Unix filesystem tests for followed file and directory symlinks and
dangling metadata links.
GitOrigin-RevId: e4e24576e2e9db704f9da54727928e121f81dc86
## Why
MCP startup status delivery can lag. Treating a server that is still starting or
has not reported yet as cancelled produces a misleading interruption warning and
can hide its eventual terminal result.
## What changed
- Only report an interrupted startup when a server explicitly enters the
cancelled state.
- Allow a complete set of terminal updates received after the lag timeout to be
promoted and reported, including failures and cancellations.
## Testing
Added TUI tests covering unresolved servers at the lag timeout and late failure
and cancellation updates.
GitOrigin-RevId: 555f3d13ac87bda6e9b0bf72335a1c04851ac25a
## Why
Client-facing command execution items can include recognizable secrets in the
rendered command or parsed command actions.
## What changed
- Redact secrets in `commandExecution.command` and `commandActions` for live
items, completed items, and replayed thread history.
- Keep command approval requests backed by the original executable command and
parsed actions while using the redacted representation for display items.
- Document that execution item commands are redacted display values rather than
executable commands.
## Testing
- Cover redaction for command conversion, parsed search actions, legacy replay,
approval flows, completion notifications, and rejected commands.
GitOrigin-RevId: 2ad056f21882bf5166182ad1a4ff0bf6471d9c0e
## What changed
- Allow multi-agent v2 parents to spawn any visible model that has not explicitly disabled multi-agent support.
- Expose collaboration tools to child agents only when their selected model supports multi-agent v2, keeping legacy models as leaf workers.
- Preserve a worker's selected model when reloading it into residency.
- Propagate multi-agent capability metadata to Amazon Bedrock model entries so delegation is gated consistently.
## Testing
- Cover model selection, leaf-worker tool visibility, Bedrock capability handling, and model preservation after reload.
GitOrigin-RevId: 1457adb1a09806d1f0621311d5a42a6815b9dd4e
andrewgu-oai