## What changed
- Read `x-codex-imagegen-request-id` from image generation and edit responses.
- Propagate the ID to `codex_image_generation_event` analytics.
- Keep the ID in process only, excluding it from extension item serialization, generated types, app-server wire data, and rollout history.
## Testing
- Cover response-header extraction and missing-header behavior in the images client.
- Verify end-to-end analytics emission and the unchanged image-generation item wire shape.
GitOrigin-RevId: 9b8e09b7d655c0c2faa84f0eee99aabae583668d
## Why
Git remote URLs can embed usernames, passwords, or tokens. Codex carries these
URLs through turn metadata and persisted thread metadata, so credentials must be
removed before a remote enters those paths.
## What changed
- Add `SanitizedGitUrl`, which parses Git URL and SCP-style remotes, strips
authentication data, and preserves the conventional `git` SSH user.
- Use sanitized remotes when collecting Git metadata, enriching model requests,
discovering cloud environments, updating thread metadata, and reading legacy
rollouts. Reject or omit malformed remotes instead of retaining their raw
contents.
- Keep API, schema, and TypeScript representations as strings while enforcing
sanitization in Rust.
## Testing
- Cover URL schemes, SCP and IPv6 forms, remote helpers, encoded paths,
malformed values, and legacy deserialization.
- Verify credentials do not appear in model requests, API responses, SQLite, or
rollout files.
GitOrigin-RevId: 6435efc4c45bfbfad4723ce7a0457cb00175f25c
## What changed
Rename the `UserInstructions` type to `Instructions` across the extension API,
its core API re-export, and all consumers. This keeps loading behavior and the
`LoadedUserInstructions` provider interface unchanged.
GitOrigin-RevId: 1ac236b34c31718e7aa38ff5eae5e9b179aeedd8
## Why
MCP servers can share an OAuth callback URL. Without a validated issuer or a
server-specific callback path, an authorization response could be associated
with the wrong server.
## What changed
- Use stable callbacks when authorization metadata advertises issuer-bound
responses, and validate the returned issuer before exchanging the code.
- Retain server-specific callback IDs for providers without issuer support,
including fallback to the global or default callback for legacy registered
clients.
- Persist registered callback URLs for MCP servers and plugins, and insert the
active listener port into portless loopback redirects.
## Testing
Add coverage for issuer validation, callback-mode discovery, registered and
legacy clients, plugin OAuth, CLI persistence, and loopback listener ports.
GitOrigin-RevId: 2878c92e237fc17fd3def0bd2e1cce3e104a3db8
## What changed
- Add the experimental `turn/start.cyberAccessProgram` option with `standard`,
`daybreakBlue`, and `daybreakRed` values.
- Forward the selection as `access_programs.cyber` on Responses, WebSocket,
and remote-compaction requests made with ChatGPT authentication, while
omitting it for API-key and custom-provider requests.
- Preserve the per-turn selection across recovery, compaction, and child-agent
turns without making it a persistent thread setting.
## Testing
- Cover app-server forwarding, authentication boundaries, WebSocket reuse,
turn recovery, compaction, and child-agent inheritance.
GitOrigin-RevId: d2eb468f365b2214c5099bc21741cf30f8bd2eb5
## What changed
- Add a feature-gated Amazon Bedrock option to eligible TUI sign-in flows.
- Discover existing AWS profiles and environment credentials, with manual setup for profiles, access keys, environment variables, and Bedrock API keys.
- Collect the AWS Region, mask secrets during entry, persist the selected Bedrock configuration through the app server, and restart the embedded server when the provider changes.
## Testing
- Cover wizard eligibility, sign-in option rendering, credential discovery ordering, region entry, and secret masking.
GitOrigin-RevId: 0a49afb6aca442b88e8448efa80336777848f4ac
## What changed
- Add the opt-in `code_mode_prewarm` feature to establish the code-mode host session during startup, before the first turn.
- Make in-progress host initialization cancellable so a stalled prewarm does not block shutdown.
- Share a failed connection attempt with concurrent callers instead of immediately starting another attempt.
## Testing
- Verify app-server contacts the configured host before the first turn and can shut down while that connection is stalled.
- Exercise shared remote-host behavior with prewarming enabled.
GitOrigin-RevId: 3cfde5509be7b4aba80112c36c5616b9a9b632c6
## What changed
Mark `content_item_kinds` as stable and enable it by default. Remove the
test harness override that previously enabled the feature explicitly.
GitOrigin-RevId: 86b0c3f295c4de3b8900981bfdd8830f275073f5
## Why
App-server clients can enable `background_paginated_rollout_migration` after the server has started, so the startup-only migration path does not handle that transition.
## What changed
- Allow runtime enablement of `background_paginated_rollout_migration`.
- Start the local rollout migration when the feature transitions from disabled to enabled at runtime.
## Testing
Update the app-server integration test to enable migration through the runtime feature API, wait for paginated history, and verify that cold resume preserves model context.
GitOrigin-RevId: d695624a03b4f056be94fcaac2075f91896f19e5
## What changed
- Add an optional `turnTrigger` field to app-server `turn/start` requests and
expose it in the generated protocol schemas.
- Propagate non-empty trigger values to Responses request metadata as the
reserved `turn_trigger` field, while preserving the original value when a
request steers an active turn.
- Classify turns started by queue dispatch, goal continuation, retry recovery,
and realtime handoff.
## Testing
- Cover HTTP and WebSocket metadata forwarding, steering behavior, reserved
metadata handling, and the built-in trigger classifications.
GitOrigin-RevId: c12fe2c522286db21b76081ae6154fbf6bfb3639
## Why
Filesystem policies containing `:tmpdir` need executor-local directory bindings,
including when execution occurs in a remote environment.
## What changed
- Cache temporary directories reported by remote executors and discover the
equivalent directories for local environments.
- Preserve the cached directories across inherited environment selection and
include them in `FileSystemSandboxContext`.
- Add `FileSystemSandboxPolicyContext` and a context accessor so filesystem
policy entries can be resolved with the executor-owned current directory,
workspace roots, and temporary directories.
## Testing
Extend environment-selection tests to cover local, remote, and inherited
temporary-directory policy context.
GitOrigin-RevId: 36335af3465c529f024bf69293af288803dd582d
## What changed
- Add a feature-gated `TurnSettings` operation that can update the model,
reasoning effort, reasoning summary, and service tier for subsequent steps of
a named running turn without changing future thread settings.
- Report whether an update was applied, rejected, or lost its live target.
- Revalidate managed constraints and preserve the turn's admitted approval and
Guardian safety properties before publishing an updated settings snapshot.
## Testing
- Cover sparse updates, step capture and ordering, target replacement, managed
policy changes, model metadata safety, and separation from future settings.
GitOrigin-RevId: ecaaaa95b4fd4ec9d62265bef551582dddb36d78
## Why
Thread settings can change while a turn is running, and delegated review or
compaction steps can select a different model. Each request needs a consistent
set of settings resolved against the model that will execute it.
## What changed
- Capture immutable resolved settings for each model step, including model
metadata, reasoning options, service tier, approvals, and personality.
- Keep in-flight steps on their captured settings while applying thread updates
to subsequent work.
- Resolve inherited reasoning summaries and filter service tiers against the
selected model and feature configuration for review and compaction steps.
## Testing
Added coverage for settings updates during paused turns, model changes,
previous-model compaction, review-model defaults, and service-tier filtering.
GitOrigin-RevId: fca4b3b305379f1bf26a5cac75ee0dd1747ac1f6
## Why
Turn settings can change after an input request previews its overrides. Automatic idle work could therefore make a Plan-mode admission decision from stale settings or apply a sparse override built from an outdated collaboration mode.
## What changed
- Evaluate automatic turn admission against both the current and proposed configuration under the settings publication lock.
- Reject automatic work that would enter or leave Plan mode without committing settings or triggering runtime configuration effects.
- Keep model and reasoning-effort overrides sparse until they are merged with the configuration being committed.
- Continue allowing explicit user and recovery turns to make valid mode transitions.
## Testing
Add coverage for concurrent settings changes, sparse model and effort updates, commit-time constraint validation, atomic Plan-mode rejection, and subsequent explicit user submission.
GitOrigin-RevId: 234f06de116bdce7c3a3fb5cac3d15583304a253
## Why
Model requirements must be evaluated against the permissions that will apply
after a settings update. Validating against the current profile can reject a
valid model-and-permission update or allow a later permission-only update to
invalidate the selected model.
## What changed
- Group model, reasoning, service-tier, personality, and approval inputs into
`StepSettings`, with a single apply-and-validate path.
- Apply permission and environment changes before validating step settings, so
auto-review requirements use the proposed effective permissions.
- Revalidate existing step settings when permission or environment changes alter
their constraints, and commit the update only when the complete candidate is
valid.
## Testing
Added unit and integration coverage for atomic model/permission updates,
permission-only revalidation, environment-derived constraints, and both
standalone and turn-start settings operations.
GitOrigin-RevId: f50dfbd300484a09acc51ee4607278f300ca1cd9
## Why
Post-commit work can overlap with another settings write. Reading the session
again afterward could make a settings operation report or use the later state
instead of the state that it committed.
## What changed
- Return the committed configuration and `ThreadSettingsSnapshot` from session
settings updates.
- Use that commit result when creating a turn and emitting
`ThreadSettingsApplied`, while retaining current-state snapshots for
synthesized fork history.
- Route turn-start updates through the shared settings update path.
## Testing
Add coverage for standalone and turn-start updates that pause after committing,
restore different settings concurrently, and verify that each operation keeps
its original configuration and notification snapshot.
GitOrigin-RevId: cee5be9536d2840170893e6eb0c64cd039fb0a96
## Why
Guardian sessions can run alongside another Windows sandbox launch and should not reconcile the persistent proxy settings established by that launch.
## What changed
- Start internal Guardian sessions with `WindowsSandboxProxySettingsMode::Preserve`.
- Continue using `Reconcile` for other sessions.
## Testing
Added a thread manager test that verifies a parent session reconciles proxy settings while its internal Guardian session preserves them.
GitOrigin-RevId: c6a31637ecdf828548cfd7153da7e9405abe34fa
## Why
Selected executor plugin roots could still expose capabilities when managed
requirements disabled the `plugins` feature.
## What changed
- Suppress MCP servers, skills, apps, and connectors from selected executor
plugins when `plugins` is disabled, while preserving the selected-root
identity used to filter those capabilities.
- Apply the policy consistently to direct selected-root discovery and batched
executor capability discovery.
## Testing
- Add contributor-level and app-server coverage that verifies disabled plugin
capabilities are absent and their MCP servers never start.
GitOrigin-RevId: e30bd8a936c4b0e083908b89a65f4d02e01747de
## Why
Reusing an MCP connection that is still starting after its
`startup_timeout_sec` changes leaves the old startup budget in effect.
## What changed
- Track the effective startup timeout on each MCP connection.
- Reuse a pending startup only when its timeout still matches the current
configuration.
- Continue reusing ready connections when only the startup timeout changes.
## Testing
Added integration coverage that refreshes the timeout while one server is
still initializing and another is ready, verifying that only the pending
startup is replaced.
GitOrigin-RevId: 5ed71a57d3bf0dd6e227aacd16acd3a35bc37ecf
## What changed
- Add the under-development `skip_host_skill_discovery` feature to bypass host
skill snapshots during session warmup and turn setup.
- Let skill invocation contributors declare whether they require host-owned
skills. Preserve host discovery when no contributors are registered or any
contributor requires it.
- Keep executor and orchestrator skill catalogs and instruction loading
available when host discovery is skipped.
## Testing
- Cover executor-only, orchestrator, mixed-contributor, and legacy host-skill
behavior.
GitOrigin-RevId: 48169403090b234e1a304c6523633fd867df454a
## Why
Answers collected by `request_user_input` can change what the user authorizes, but post-tool hooks may replace or reject the tool output that Guardian normally sees.
## What changed
- Record bounded, host-observed answers before post-tool hooks run and provide them as trusted evidence to synchronous and asynchronous Guardian reviews.
- Include root-thread answers in worker review context.
- Count successful answers as authorization changes so earlier review evidence becomes stale, while ignoring empty or unrelated answers.
## Testing
Add coverage for allowed and denied stale reviews, empty and oversized answers, hook-modified output, and root-to-worker propagation.
GitOrigin-RevId: 970c52e40338ecd057c7cd2a69d04b06e97cd068
## What changed
- Emit `codex.shell_snapshot` and `codex.shell_snapshot.duration_ms` for each
exec-server capture attempt, including success and failure tags.
- Label exec-server metrics as `v2` and existing core snapshot metrics as `v1`
so the two implementations can be distinguished.
- Use the exec server's metrics client when available and fall back to the
configured global client for local execution.
## Testing
- Extend the bounded-retry and single-flight snapshot test to verify metric
counts and tags for first-attempt success, retries, recovery, and exhaustion.
GitOrigin-RevId: 94f73e58a4a1a90c518fa102f138ca7ee29b5627
## What changed
- Add `serviceTierForTurn` to `turn/start` so a newly started turn can override the service tier without changing the thread's saved tier.
- Treat `"default"` as standard speed and omitted or `null` values as inheriting the thread tier.
- Keep `serviceTier` authoritative for subsequent turns when both fields are supplied, and ignore the turn-scoped override when steering an active turn.
## Testing
- Extend the app-server turn-start test to verify both the one-turn `"default"` override and inheritance on the following turn.
GitOrigin-RevId: 4c2c4db21d8d31617a7a6e6df65bf54834e72383
## Why
Pending user input or agent mail could cause a regular task to restart immediately after a terminal compaction error, retrying the failed turn instead of completing it and preserving the pending input.
## What changed
- Stop the regular-task continuation loop when the turn records a terminal error.
- Allow turn completion to persist pending input so a later explicit request can retry it after the error is resolved.
## Testing
Added coverage for pre-turn and mid-turn compaction failures with steered input, queued agent mail, and mail that triggers a turn.
GitOrigin-RevId: 48c7a2cba44ac2444957556dd94910fb34515f09
## Why
History estimation and executed-tool-call limits only need the size of serialized JSON, not the serialized output itself.
## What changed
- Add a shared `serialized_json_bytes` helper that streams JSON into a byte counter.
- Use it for response-item size estimates and executed-tool-call argument limits.
- Preserve serialization errors so callers can apply their existing fallback behavior.
## Testing
- Cover response-item sizing with escaped characters, newlines, and multibyte text.
GitOrigin-RevId: a4417996df96df5c51cae62830adc496912f69c7
## Why
Background memory consolidation must honor managed completion policies without
running project completion checks or sending user-facing notifications.
## What changed
- Add a memory-consolidation stop target that selects managed policy hooks and
executor-scoped cleanup while excluding user, project, session, and plugin
stop hooks.
- End memory consolidation with an error when a managed stop hook rejects it,
and propagate that turn error into agent status.
- Disable legacy completion notifications for the background memory worker.
## Testing
- Cover hook selection, executor cleanup, managed rejection, agent error
status, and notification suppression.
GitOrigin-RevId: be350679ddcde2dde8a408b0972f08facff01a37
## What changed
- Record collaboration tool analytics for `send_message`, `followup_task`,
`interrupt_agent`, and `list_agents`, including receiver attribution, duration,
failures, and interrupted calls.
- Include these calls in per-turn subagent tool counts while keeping the existing
`subAgentActivity` output unchanged and omitting additional public collaborator
tool items.
- Extend the collaboration tool schemas with the new tool variants and the
`interrupted` terminal status.
## Testing
- Add an app-server integration test covering successful and failed calls,
receiver attribution, duration, prompt omission, activity items, and turn
counts.
GitOrigin-RevId: e73eaa05c508261e5fc97e7d08d7881a31e04e22
## What changed
- Add the under-development `transcript_v2` feature for the interactive
transcript composer and turn-selection UI.
- Keep it disabled by default and expose it through the configuration schema
and `codex features enable transcript_v2`.
## Testing
- Verify explicit configuration overrides and CLI persistence for the new
feature.
GitOrigin-RevId: 138ab7851621c066e8121cc3eb6cd4e7299f9c31
## What changed
- Add Windows sandbox mode, private-desktop behavior, and legacy Landlock selection to each `EnvironmentConfig`.
- Centralize sandbox context construction on `TurnEnvironment`, preserving environment-owned permissions, paths, and backend settings while applying additional permission grants.
- Use the environment-derived context for project instructions, capability discovery, file uploads, and filesystem-oriented tools.
## Testing
- Verify capability discovery uses the selected environment's permission profile and sandbox backends when they differ from the thread defaults.
GitOrigin-RevId: 7ae2fed90c8ada950f2e8431e571e9b2c793c291
## What changed
- Add a `ContextWindow` prompt slot for thread-scoped extension contributions.
- Include fragments in that slot in the token-budget context-window message.
- Keep the MCP `notes/thread_hint` bridge when the native history-notes extension is disabled, without falling back to it after a native request failure.
GitOrigin-RevId: befcb7cc8570b846094b2b542a112b186b39a30a
## What changed
- Add a `writeStdin` Guardian action carrying the approval, process, input, and working-directory details.
- Distinguish `command` and `writeStdin` execution approval requests while defaulting missing kinds to `command` for compatibility with older events.
- Render terminal-input review progress, denials, timeouts, and retry actions in the TUI, and record the action separately in analytics.
- Keep terminal-input reviews as child approvals so they do not change the parent command item's lifecycle or reconstructed history.
## Testing
- Cover Guardian serialization, app-server protocol conversion, command history reconstruction, analytics classification, and TUI review flows for terminal input.
GitOrigin-RevId: b083d5e2963bdd23b928644ec03c7eb68ebf2950
## Why
A provider auth command can fail during initial credential resolution, leaving
no cached authentication. A subsequent `401` should still give the configured
provider one bounded opportunity to recover.
## What changed
- Treat configured external authentication with an empty cache as eligible for
unauthorized recovery.
- Allow authority refresh to invoke the external provider when no prior auth is
cached, while preserving the existing requirements for managers without an
external provider.
## Testing
Added unit and client coverage for a provider command that fails initially and
succeeds during `401` recovery.
GitOrigin-RevId: 7cab9a03f90ce29b412be8fbd97b297acdad4482
## What changed
- Bind `.` in Vim normal mode to repeat the last complete edit.
- Record semantic delete, change, replace, paste, and insert-mode actions so repeats preserve motions, text objects, inserted text, and editor actions across keymap changes.
- Expose `vim_normal.repeat_last_change` in the configurable keymap and keymap picker, including conflict handling for existing custom bindings.
## Testing
- Add coverage for repeating deletes, replacements, complete changes, pasted and literal text, insert-mode editor actions, custom bindings, unavailable motions, and cleared buffers.
GitOrigin-RevId: 3213df964811e7902377ff1d93641e59f4037914
## What changed
- Add an `Interrupt` hook event that runs for an active top-level turn before its
interrupted abort event is emitted.
- Flush the turn transcript before invoking the hook and provide the session,
turn, transcript, working directory, model, and permission mode in its input.
- Support command and MCP handlers, including asynchronous commands, with a
one-second default timeout and a three-second maximum.
- Expose the event through hook configuration, managed requirements, app-server
notifications, generated schemas, analytics, and the TUI hook views.
## Testing
- Cover handler discovery, timeout normalization, output parsing, protocol
compatibility, TUI rendering, and interrupt execution ordering.
GitOrigin-RevId: 163fa7c098d94ac2775f6d137f8e916f8ea9b6eb
## Why
Clients need a bounded view of realtime conversations that preserves the order of speech, agent work, and turn lifecycle events without loading the full thread history.
## What changed
- Persist realtime session boundaries, transcript segments, and promoted agent items in paginated thread rollouts.
- Add the experimental `thread/timeline/list` API to page ordinary items, realtime items, and turn boundaries in canonical rollout order. Include `activeRealtimeSessionAtPageStart` so each page can be rendered independently.
- Emit typed `thread/realtime/item/started`, `thread/realtime/item/transcript/delta`, and `thread/realtime/item/completed` notifications around durable realtime items.
- Keep the existing `thread/items/list` response and legacy thread history behavior unchanged.
## Testing
- Cover mixed timeline pagination, realtime-session state at page boundaries, rollout replay, subagent history prefixes, transcript streaming, steering, and promoted agent artifacts.
GitOrigin-RevId: faa2c420192d63e060e8fb32446e3c797422656e
## Why
Internal Guardian reviews must remain independent of parent-session customization while still honoring managed execution and environment restrictions.
## What changed
- Apply the restricted Guardian session path to both internal and subagent review sources.
- Start internal reviews without inherited user instructions, extensions, MCP servers, or multi-agent behavior.
- Preserve managed execution policy and selected environment constraints while exposing only the allowed review tools. Honor shell feature restrictions across every selected environment and retain code mode when enabled.
## Testing
- Cover internal review isolation from parent state and managed instructions.
- Cover optional tool filtering, managed shell restrictions, code mode, and secondary environment profiles.
GitOrigin-RevId: edbf7d8a6fe3ee8213a1c75bc8ec331a1cf49006
## What changed
- Emit control-tool analytics for history and notes extension calls and for
`send_user_message_async`.
- Preserve non-default namespaces in reported tool names, such as
`history.read_item` and `notes.write_file`.
## Testing
- Add an app-server integration test covering successful and failed calls,
turn-level tool counts, and omission of tool argument values from analytics.
GitOrigin-RevId: b15a53a311228339f4d577a7b96146ed67f22253
## Why
`skills.read` paginated resources against a fixed response limit, so a page could exceed a smaller tool-call response budget.
## What changed
- Size each serialized `skills.read` page to the current call's response budget, accounting for JSON escaping and UTF-8 boundaries.
- Cache one bounded executor-resource snapshot per thread so cursor continuations return consistent contents without rereading the file. Replace the snapshot when another resource is read, and reject stale cursors after a reread.
- Tie cached executor snapshots to the selected environment and sandbox context without keeping the environment alive.
## Testing
- Cover budget-constrained reads, escaped and multibyte contents, multi-page reconstruction, changed resources, snapshot eviction, and expired turn-scoped access.
GitOrigin-RevId: e515935b82771b3f29b3fb91ea7a7a72e19a65ee
## Why
Managed network requirements can remain present when `enabled = false`, but a
disabled configuration should not create or expose an active proxy runtime.
## What changed
- Start the managed network proxy only when its effective specification is
enabled.
- Clear an existing proxy when a permission-profile refresh disables managed
networking.
- Keep remote executor launches free of managed-network proxy settings when the
requirements explicitly disable the feature.
## Testing
Added session and unified-exec coverage for initial startup and refresh with
disabled managed networking.
GitOrigin-RevId: f76699802e079eb746d5b1ea6547d19a4bfb7715
## What changed
- Add `codex-agent-roles` for agent role configuration types, parsing,
discovery, validation, and layered loading.
- Update `codex-core` to consume the new crate's public role configuration and
parsing APIs.
GitOrigin-RevId: 5a963a219a581b2848dae6fd071aa31a0b5ff22c
## Why
Analytics need to associate subagent activity with the top-level turn that
caused it, while avoiding a stale association when steering makes that origin
ambiguous.
## What changed
- Add `root_turn_id` to turn and tool-item analytics events.
- Read the root from live turn metadata when each event is built, reporting
`null` when the root is unknown or ambiguous.
- Propagate the metadata through control-tool and code-mode completion facts so
correlated and background tool events retain the correct root.
## Testing
- Cover root IDs for top-level turns, subagent turns, correlated code-mode
calls, and tool events emitted after turn completion.
- Verify that queued and subsequent events report `null` after the live root is
invalidated.
GitOrigin-RevId: 42fd76541c3c716cec74787d47b50adb2d22e6d2
## What changed
- Add the experimental `amazonBedrockAccessKeys` app-server login flow, persist its credentials in the configured auth store, and use them for SigV4-signed Bedrock requests.
- Report `bedrockAccessKeys` as a distinct auth mode and document access-key login alongside AWS profile and environment credential setup.
- Clear the selected Bedrock provider, AWS settings, and Bedrock-specific model on logout while leaving external AWS credentials and `.env` untouched.
- Reject managed access-key login when higher-precedence configuration would prevent its region or profile settings from taking effect.
## Testing
- Cover access-key login, storage, request signing, configuration conflicts, status reporting, and logout cleanup.
GitOrigin-RevId: bbf297887c6503d3651ceb2aad85c4d626e32723
## What changed
- Add `features.guardianv2.review_scope.computer_use_only` to restrict asynchronous classification and fast approvals to browser and computer-use REPL tools.
- Keep other tools on the synchronous approval path without letting them age or reuse scores from in-scope calls.
- Give this scope precedence over `sandboxed_exec_commands` when both options are enabled.
## Testing
- Cover configuration precedence, direct and code-mode tool detection, fast-approval isolation, and end-to-end approval routing for browser, computer-use, and unrelated MCP servers.
GitOrigin-RevId: bfd9ab6abdbd90634b265d354e038724b1e81d65
## Why
Multi-Agent V2 children are owned by their parent at runtime. Resuming an
unloaded child directly could rebuild it from caller-provided settings instead
of the parent's current authority.
## What changed
- Route child reloads through their loaded immediate parent and reject direct
cold resume when that parent is unavailable.
- Preserve the child's recorded model, provider, reasoning effort, and role
while inheriting the parent's execution policy and MCP extensions.
- Validate cached environments against the parent, intersect local permission
profiles, and reject stale remote or workspace-root configurations.
- Keep paginated cold-resume token usage attribution when attaching to the
reloaded child.
## Testing
Add coverage for owner validation, nested-parent reloads, permission and
environment changes, role instruction restoration, paginated usage replay,
and app-server child resume behavior.
GitOrigin-RevId: 84014762bcdb57f94fc23974c9c1af55dc1babf1
## What changed
- Split the approval review contributor into a `fast_decision` path for existing evidence and a `full_review` path for structured reviews.
- Add host-owned full-review inputs with action evidence, conversation history, thread and turn identifiers, approval context, and extension data.
- Add structured assessment and error types, and resolve full reviews using the first contributor that claims the request.
## Testing
- Cover full-review input propagation, first-claim ordering, and short-circuit behavior in the extension registry tests.
GitOrigin-RevId: 6f763d874af8c0b66a0d760b7b7c7dfe32251c9e
## What changed
- Add `features.network_proxy.credential_broker` and preserve structured network proxy settings when toggling the feature through config APIs.
- Protect broker enablement and provider context variables from project config, while carrying trusted context into filtered shell environments.
- Propagate brokered credentials through shell snapshots and restore real credentials for unsandboxed escalated commands.
- Normalize broker context environment keys case-insensitively on Windows and avoid conflicting remote managed-network enforcement when no proxy launch configuration is available.
## Testing
- Cover config layering, editing, project sanitization, Windows environment handling, shell snapshots, escalated execution, and end-to-end GitHub credential brokering in the zsh-fork runtime.
GitOrigin-RevId: 500e51e804e1988022052ccfe00b8fac5e495f4f
## What changed
- Add the under-development `content_item_kinds` feature, disabled by default.
- Strip content item classifications from Responses input when the feature is
disabled while preserving other passthrough metadata.
## Testing
- Add coverage that disables the feature and verifies requests omit content item
kinds without removing the turn ID.
GitOrigin-RevId: f938feb2895d766d979b1666fc7b97fd128fe8a7
## What changed
- Record the initiating agent path when inter-agent communication triggers a turn.
- Emit completed subagent activity to that agent's turn instead of always using the completed agent's parent thread.
- Keep parent-directed completion messages unchanged.
## Testing
Added a multi-agent v2 regression test where one sibling requests follow-up work from another and receives the resulting completion activity on the requesting turn.
GitOrigin-RevId: 949dd1116cccdd461c66a9b213a5bcd554cb3720
## What changed
- Detect readable symbolic `:root` entries separately from effective full-disk access so narrower deny-read rules do not disable the Windows sandbox's broad-read setup.
- Add explicit readable roots to that setup while omitting the filesystem root itself, and prevent read roots at or below denied paths from being granted access.
## Testing
- Extend the elevated Windows sandbox integration test to verify that an allowed bundled skill under the user profile remains readable while exact and glob-based secrets stay denied.
GitOrigin-RevId: 8f6f267b78718b9e8609a9205c489f253f478491
## Why
A Multi-Agent V2 child can finish after the parent turn that spawned it, so its
successful completion needs to remain associated with that parent turn in
notifications and history.
## What changed
- Add `completed` to `SubAgentActivityKind` and emit the corresponding started
and completed item events on the spawning parent turn when a child succeeds.
- Persist completed activity as a canonical turn item in both legacy and
paginated history, and expose it through app-server history and schemas.
- Render completed activity as terminal in the TUI without counting it as a
separate tool call or tool-runtime event.
## Testing
- Cover successful completion in legacy and paginated history, late updates to
completed parent turns, TUI rendering, analytics, and rollout tracing.
- Verify that terminal child errors do not emit completed activity.
GitOrigin-RevId: 6c71eb8b10e7327611c6af84f70e294e27d94d02
Chris Dong