## What changed
- Reject invalid or unsupported image data before producing tool output, so
non-image file contents are not exposed through code mode.
- Preserve valid image bytes and metadata while leaving image preparation and
resizing to the history insertion path.
## Testing
- Cover invalid images in both code mode and standard `view_image` calls.
- Verify that code mode preserves PNG bytes, dimensions, EXIF orientation, and
metadata.
GitOrigin-RevId: 07343ed10b781d0ce0ffb5b24432658be4c046e3
## What changed
- Add `PersistContext` to the thread-store persistence contract so stores can
identify persistence requested immediately before model sampling. A
`TurnStart` request may be enqueued in the background when later flush and
shutdown operations fence it and report any failure; all other persistence
remains synchronous.
- Use the turn-start context only for the initial input of a regular turn, while
admission acknowledgments, steered input, and other persistence paths keep
the standard durability behavior.
- Flush pending metadata before turn-start persistence and ensure shutdown is
still attempted if that metadata update fails.
## Testing
- Verify that developer instructions and user input are persisted before the
model request completes for a default paginated-history thread.
GitOrigin-RevId: 162f0ec796a61aebe66ca0b909fbcccec3047b85
## Why
Background refreshes previously warmed only the on-disk cache, so new sessions in the same process continued using the startup snapshot.
## What changed
- Make `CloudConfigBundleLoader` retrieve the latest shared bundle on each configuration load.
- Update the in-memory bundle after successful refreshes while preserving the last successful bundle when a refresh fails.
- Stop refresh work when its loader is replaced or its final clone is dropped.
## Testing
- Cover refreshed requirements and managed configuration in later sessions.
- Cover concurrent initial loads, refresh failures and recovery, bundle clearing, and refresh-task cancellation.
GitOrigin-RevId: ae3d79b575bad71a1eed370cee6dc66dc022ffa8
## What changed
- Pass image bytes from `view_image` through unchanged for both direct and code-mode calls, leaving decoding and resizing to the shared history-insertion path.
- Represent invalid image data with the existing image-omission placeholder instead of returning a tool error.
## Testing
- Update the `view_image` integration test to cover placeholder output for invalid image data.
GitOrigin-RevId: 62863defd4815efb8a7725712fd583ad81db3fbb
## What changed
- Add `responses_api_metadata` for product-owned key/value metadata included in
every Responses API turn metadata payload, including parent and subagent
requests.
- Limit the map to 16 entries, ASCII identifier keys of at most 64 bytes, and
values of at most 128 bytes. Reject reserved Codex metadata keys and ignore
this setting in project-local configuration.
- Give configured product metadata precedence over app-server client metadata
while keeping it out of metadata sent to external MCP servers.
## Testing
- Cover reserved-key validation, metadata precedence, MCP isolation, and
propagation to parent and subagent Responses API requests.
GitOrigin-RevId: a7be798294fde25145ab375a468321bb4e4a49f1
## What changed
- Decode image data in the `view_image` handler and return a clear error for invalid or unsupported input.
- Re-encode code-mode images as PNG pixel data while preserving original image bytes for direct tool calls.
- Cover code-mode PNG output and rejection of invalid image data.
GitOrigin-RevId: 0a00e595ab749c19eab866a22f6577b6627e19f1
## What changed
- Parse safety-buffering payloads from typed `response.metadata` SSE events.
- Preserve the existing top-level `safety_buffering` field as the authoritative value when it is present, including when it is null or malformed.
- Continue applying the header-provided fallback model when the metadata payload omits `retry_model`.
## Testing
- Add parser coverage for metadata fallback, top-level precedence, and unrelated metadata events.
- Exercise metadata-based safety-buffering delivery through the core SSE integration test.
GitOrigin-RevId: 7dadfd54be28f2f33c2283de92fd49da0557d98a
## Why
Managed networking implicitly selected the elevated Windows sandbox backend,
even when the sandbox was configured to use a restricted token.
## What changed
- Select the Windows sandbox backend solely from `WindowsSandboxLevel`.
- Reject managed networking with a restricted-token sandbox before spawning a
process, since managed networking requires the elevated backend.
- Cover the rejection through sandbox preparation, unified exec, and Windows
sandbox session tests.
GitOrigin-RevId: 308858652d7b629af623d22896dafde3a23d3758
## What changed
- Add `codex-history` for model-history and persisted-rollout domain types, including `RolloutItem`, `RolloutLine`, `CompactedItem`, and initial/resumed history state.
- Re-export the persisted types from `codex-rollout` and update consumers to use the new crate boundary instead of `codex-protocol`.
- Preserve existing rollout serialization, including legacy numeric compacted-window IDs.
## Testing
- Add `codex-history` tests for rollout JSON round trips, compacted-history compatibility, persisted history modes, and multi-agent version selection.
GitOrigin-RevId: 944daa9297ddd231d3aebbdcb05fff4adf8b4e1b
## What changed
- Reject patches containing multiple operations whose paths resolve to the same file, such as `duplicate.txt` and `./duplicate.txt`.
- Preserve support for patches that update multiple distinct files.
## Testing
- Add CLI integration coverage for distinct updates and duplicate resolved paths.
GitOrigin-RevId: 0fb7f69ae31acc5c677268ffd9e38ad8d8314276
## What changed
- Cover non-blocking credential probes when the file or secrets store is locked, including retaining only a matching prior credential snapshot and recovering after the lock is released.
- Extend the streamable HTTP OAuth round trip to verify that user turns continue during store contention, newly discovered servers recover after contention, and logged-out servers do not reuse authenticated connections.
- Cover reconciliation of authentication failures and effective `Authorization` headers.
GitOrigin-RevId: 8e377644001bd0be04dc9f79841080094d09d199
## What changed
- Send Unix `execve` approvals intercepted by the zsh fork through the shared approval pipeline, including permission hooks, Guardian review, user prompts, and telemetry.
- Resolve the active turn and its auto-review setting when an intercepted command needs approval, so commands sent to persistent terminals use the current turn's reviewer.
- Give each intercepted command a distinct approval ID and propagate an aborted approval as a turn abort.
## Testing
- Cover Guardian review for intercepted `unified_exec` commands and persistent terminals across turns.
- Verify repeated identical intercepted commands receive separate user approvals.
GitOrigin-RevId: e6cccf160637e4246aff4714c22f08c90b65306d
## What changed
- Restore a V2 agent's inherited environment selections when reloading its
thread after residency eviction.
- Keep the restored execution environment and its tools available when the
agent receives a follow-up task.
## Testing
- Add an integration test that evicts and reloads a V2 agent, then verifies
its environment selection and `exec_command` tool are preserved.
GitOrigin-RevId: a5d4ad0fa465c717b32b7ae6807486429187a41d
## Why
The plugin and skill test suites were excluded wholesale on Windows, even though
most cases do not depend on POSIX behavior.
## What changed
- Make generated TOML and JSON fixtures escape Windows paths correctly.
- Use Windows-safe path canonicalization and normalize advertised skill paths.
- Select test environments through the environment-aware builders.
- Run the suites on Windows while narrowly skipping cases that execute POSIX
commands or require matching host and executor path conventions.
GitOrigin-RevId: aadf31013c2bf9bac728adc4dd96f572d4a3bf3f
## What changed
- Make `package` the only required argument to `skills.read`, resolving the
owning orchestrator or executor catalog automatically.
- Default omitted `resource` values to the package's main `SKILL.md`.
- Render orchestrator skills as package locators and instruct the model to read
them directly without first calling `skills.list`.
- Update skill extension and app-server coverage for direct main-resource
reads, referenced resources, aliases, and the revised tool schema.
GitOrigin-RevId: 9faf57a8d0935566a15094931eaabaa8f0613e9e
## What changed
- Add the `apply_patch_preserve_line_endings` feature, disabled by default, to
preserve CRLF, CR, and mixed line endings when `apply_patch` updates files.
- Apply the feature consistently to built-in patch handling and patches invoked
through shell, user-shell, unified-exec, and app-server command execution.
- Keep the active feature configuration authoritative over inherited, shell
snapshot, and client-provided environment values.
## Testing
- Cover line-ending behavior with the feature enabled and disabled for custom
tool calls, shell heredocs, command execution, and the `apply_patch` CLI.
GitOrigin-RevId: 531a7c66761959c650270559f57941929f03e6c4
## Why
Deferred environments can become ready after a turn starts. Guardian approval
reviews must use the environment selected for the current step so their working
directory and permission context are not taken from the stale turn snapshot.
## What changed
- Carry `StepContext` through tool execution and approval handling.
- Add a Guardian review context that pairs the parent turn with the current
step's environment snapshot.
- Use that snapshot for Guardian prompts, reviewer sessions, and delegated
reviewer threads while retaining turn-level fallbacks for callers without a
step context.
## Testing
Added an integration test that makes a deferred remote environment ready before
an escalated command and verifies Guardian receives that environment's working
directory and denied-read policy instead of the initial local environment's.
GitOrigin-RevId: 779096bc7d0e0c7453a009c02141029714b9b407
## Why
Hook configurations can mark command handlers as asynchronous, but Codex previously skipped those handlers outside `SessionEnd`.
## What changed
- Run asynchronous command hooks in the background with a per-session concurrency limit, while keeping `SessionEnd` hooks synchronous.
- Prevent asynchronous hooks from blocking, stopping, rewriting, or otherwise controlling the operation that launched them.
- Deliver warnings and additional context at safe turn boundaries: inject results into an active turn after sampling, or buffer them ahead of the next user prompt when the session is idle.
- Preserve in-flight hooks across configuration reloads, scope spilled output to the thread, and abort outstanding work during session shutdown.
## Testing
Add unit and integration coverage for background scheduling, concurrency, output parsing, active and idle result delivery, configuration reloads, and shutdown cleanup.
GitOrigin-RevId: 8094552e4afe7b47b09a61bb575bb20f4e491d8d
## What changed
- Filter saved `allow` prefix rules from the execution policy for cyber-specialized models and models listed in `auto_review.ignore_rules`, while preserving prompt, forbidden, network, and host-executable policy entries.
- Apply the filtered policy consistently to permission instructions, shell commands, unified exec, and the zsh-fork backend.
- Limit cyber-model command approvals to one-time decisions without proposing reusable policy amendments. General models continue to honor saved prefixes, including after switching models within a thread.
## Testing
- Add policy-level coverage for filtering allow-prefix rules while retaining restrictive and network rules.
- Add end-to-end coverage across shell and unified exec paths, zsh-fork execution, user and automatic review, and model switching.
GitOrigin-RevId: f3bd3872424291b12354ec415f33986ec369a368
## What changed
- Add the managed `auto_review.required_on_models` requirement, unioning model slugs across requirement layers and exposing the result through `configRequirements/read`.
- Force listed models to use `on-request` approvals with the `auto_review` reviewer. Downgrade Full Access to workspace-write when starting a protected session, and reject incompatible runtime overrides or use when automatic review is disabled.
- Preserve these protections across thread starts, resumes, forks, model changes, turn overrides, MCP approvals, and TUI session attachment.
## Testing
- Add coverage for layered model requirements and exact provider-alias matching.
- Add app-server tests for protected thread lifecycle operations, unsafe setting overrides, legacy thread upgrades, disabled automatic review, and requirements API output.
GitOrigin-RevId: c4b1d52c3b5b75e86880725412b8f0812e0dfcd9
## What changed
- Add the effective permission profile as `sandbox_mode` in turn metadata for regular, prewarm, compaction, and detached memory requests.
- Reserve `sandbox_mode` so client-provided metadata cannot override the computed value.
## Testing
- Cover metadata headers and request bodies for read-only and danger-full-access modes.
GitOrigin-RevId: 13c690cc99bc2691023f281ca527af049bb1286f
## What changed
- Add `HostSkillsSnapshot::load_skill_prompts` so the skills extension owns reading and rendering selected host skills.
- Keep explicit invocation telemetry, unreadable-skill warnings, plugin prompt ordering, and suppression of host prompts superseded by provider prompts.
- Remove the legacy prompt injection and fragment implementation from `codex-core-skills`.
## Testing
- Cover prompt truncation without an installed skills extension, skill/plugin ordering, selective provider supersession, unreadable skills, and contextual fragment detection.
GitOrigin-RevId: 9c8b84ad54b90d174abc287ab49cc5a231e9e1aa
## What changed
- Stop adding `code_mode_tool_names` to Responses Lite turn metadata.
- Keep `code_mode_tool_names` reserved so client metadata cannot reintroduce the removed, unbounded inventory.
- Use the opt-in `tool_namespaces_info` metadata, including each function's `code_mode_name`, when authoritative tool details are requested.
## Testing
- Update Responses Lite and code-mode tests to verify the opt-in namespace metadata and normalized code-mode names.
GitOrigin-RevId: cbfb9af984de71c7cc175d0cd47ae799a5275309
## What changed
- Add opt-in `tool_namespaces_info` metadata for Responses Lite turns when
`tool_registry.turn_metadata_includes_tool_info` is enabled.
- Describe each model-visible function's namespace, direct and deferred
exposure, Code Mode name, and harness or MCP ownership.
- Reject visible namespaces shared by different owners when strict collision
checking and tool inventory metadata are enabled.
- Keep tool inventories out of compatibility headers and metadata sent to MCP
servers.
## Testing
- Cover opt-in behavior, MCP exposure details, namespace ownership collisions,
reserved metadata handling, and Responses Lite request serialization.
GitOrigin-RevId: 6a6965d2ba98e29444fdfbb4ccec6aafcf0391e6
## Why
Long executor and orchestrator resource identifiers can consume enough of the
skills context budget to omit otherwise available skills.
## What changed
- Add source-aware root aliases for executor, orchestrator, and host skill
catalogs, including catalogs with a single shared root.
- Select the best combination of aliased catalogs under the shared metadata
budget while accounting for root tables and alias usage instructions.
- Explain how to expand shortened `skill://` locators and accept the resulting
description-shortening warning in app-server coverage.
## Testing
- Add rendering and production-turn coverage for singleton, executor,
orchestrator, host, and combined catalog aliases.
GitOrigin-RevId: c1bc1f3d371eae9526232674060235272cc28f16
## What changed
- Classify HTTP connection failures separately from other network errors without exposing request URLs.
- For sampling requests, retry connection failures with exponential delays from 5 to 60 seconds and show a `Reconnecting... waiting for network` stream error.
- Preserve the normal stream retry budget while waiting for the provider to become reachable. Keep the existing bounded retry behavior for other retryable errors.
## Testing
- Verify connection errors are classified without leaking URL contents.
- Verify a turn recovers after its provider becomes reachable and still applies the configured retry limit to a subsequent incomplete stream.
GitOrigin-RevId: 646553290c865a1332abd30c4a64ed9266bbfc6f
## Why
Interrupting a turn should also stop code-mode work that the turn left running.
## What changed
- Add the disabled-by-default `code_mode_interrupt` feature.
- When an interrupted turn has the feature enabled, terminate all active code-mode cells and propagate cancellation through nested tool calls.
- Keep the reusable code-mode session alive so its stored state remains available to later turns.
## Testing
Add an integration test that interrupts a long-running nested tool, verifies that active and background cells are removed, and confirms that session state is preserved.
GitOrigin-RevId: 2b8634776a89b636318a39b9e9ad2eefc07cead8
## What changed
- Preserve executor-native working directories, workspace roots, and permission profiles when preparing remote `exec_command` requests instead of resolving them through the host platform.
- Send sandbox intent to the remote executor, including a restricted-token default for Windows executors and `-NoProfile` for elevated PowerShell commands.
- Reject intercepted cross-platform `apply_patch` commands when filesystem writes are restricted, while continuing to allow them for unsandboxed or full-disk-write profiles.
## Testing
Extended remote unified-exec coverage for foreign Windows workspaces, elevated PowerShell, sandbox metadata, and restricted and unrestricted intercepted patches.
GitOrigin-RevId: 9fd328879fa2c15594fd58e40b6b32e8ba0847e7
## What changed
- Add the tool call ID to `_meta.callId` for every MCP tool request.
- Rename `features.tool_registry.include_tool_metadata` to
`features.tool_registry.turn_metadata_includes_tool_info` to clarify that the
setting controls authoritative tool information in per-turn metadata.
- Update config parsing, schema generation, and session config locking for the
renamed setting.
## Testing
- Cover `callId` metadata for custom, plugin, and Codex Apps MCP calls.
- Update strict-config, config-loading, feature-config, and config-lock tests for
the renamed setting.
GitOrigin-RevId: ac0e58c489b03bd9b55a356f545de86c8ecaf865
## Why
Plugin suggestions should report skills only when the plugin has an enabled skill.
## What changed
- Load suggestion metadata through the shared plugin skill-root loader.
- Apply skill configuration when setting `has_skills` on suggestion candidates.
## Testing
Added coverage for local plugin suggestions with the plugin skill both enabled and disabled.
GitOrigin-RevId: bceb14528c9042b474eaad6efaf919bef72e0ca4
## Why
Persisted base instructions need to retain whether they were explicitly customized or generated from a model template. Without that distinction, forks and config-lock replays can treat model-generated instructions as custom and keep the wrong template after a model or personality change.
## What changed
- Record custom or model provenance with base instructions in rollouts and config locks.
- Preserve custom instructions across model changes, while allowing model-generated instructions to follow the selected model and personality.
- Keep legacy rollouts without provenance compatible and propagate provenance through forks and spawned agents.
## Testing
- Cover provenance serialization and legacy rollout decoding.
- Cover role personality changes, forked model changes, config-lock replay, and multi-agent configuration.
GitOrigin-RevId: 801c26559835f558027ce5112700c0cd31fcb21b
## What changed
- Inject the host skill loader into `PluginsManager` so plugin discovery and agent turns use the same loading and product-policy behavior.
- Share plugin skill snapshots across those paths, preserving a consistent view of skills across workspaces.
- Apply migrated-command precedence after product filtering, allowing an eligible migrated command to replace a filtered native skill with the same name.
## Testing
- Add coverage for product-restricted plugin skills, native-versus-migrated command precedence, and the skills exposed to agent turns.
GitOrigin-RevId: f5ef0d0766ebeeb30d73ffaf044d003c2906ea4d
## Why
Applying `project_doc_max_bytes` independently to every selected environment
allows the total project instruction payload to grow with the number of
environments.
## What changed
Treat `project_doc_max_bytes` as one shared byte budget. Consume it in selected
environment order, truncate the entry that reaches the remaining limit, and
skip later environments once the budget is exhausted.
Update the configuration descriptions to document the aggregate limit.
## Testing
Add unit and integration coverage for partial and exhausted budgets across
multiple environments.
GitOrigin-RevId: 4664bdf1f23b66986349d503f44cf51560b9024f
## Why
Forked subagents can inherit a parent's compacted history, but their context-window metadata needs to identify the child and start a distinct window lineage.
## What changed
- Always identify context windows by agent name and remove the `features.token_budget.mode` setting.
- Persist the agent path in world state and emit context-window metadata as a standalone developer message when the identity changes.
- Reset inherited compaction metadata to the forked subagent's initial context window and restore that window in session state.
## Testing
Extend the full-history subagent test to verify parent and child world-state snapshots, agent identities, distinct window IDs, and the reset child checkpoint.
GitOrigin-RevId: 6584201e57b3d2fba0ce626b89a8b3b0b3c752db
## What changed
- Add an `x-codex-routing-hint` header containing the request model and, when selected, the service tier.
- Send the hint on Responses HTTP requests, remote compaction requests, and WebSocket handshakes, including prewarm connections.
- Limit the header to Codex-backend authentication with the OpenAI provider, omitting it for API-key and provider-specific credential paths.
## Testing
- Cover routing hints for HTTP, remote compaction, WebSocket streaming, and tiered prewarming, along with the credential paths where the header must be absent.
GitOrigin-RevId: d8d415d7fadddecf9a132d05920b856a35ac9960
## Why
Converting each environment's working directory to a host-native path caused
turn-input contributors to omit environments with foreign path formats.
## What changed
- Expose `TurnInputEnvironment.cwd` as a `PathUri`.
- Pass every turn environment to contributors without host-path conversion.
## Testing
Added an integration test that submits a foreign working-directory URI and
verifies the contributor receives the environment unchanged.
GitOrigin-RevId: a122526be47f5331614381e9c6e4b85087a96bed
## Why
An OAuth-backed Streamable HTTP MCP server can fail startup when its stored credentials are rejected. If a client then completes OAuth sign-in and replaces those credentials, the failed server needs to become available without restarting the Codex session.
## What changed
- Track the credential store and OAuth tokens used for each MCP connection, and detect replacements after authentication failures.
- Refresh affected MCP servers before the next turn and include their recovered tools in the model request.
- Classify HTTP authentication challenges and rejected refresh tokens as requiring reauthentication, with sign-in guidance appropriate to local and client-managed environments.
## Testing
- Cover recovery from expired credentials through an externally written replacement token.
- Cover authentication-error classification, startup messaging, and `Auto` store migration from file credentials to the keyring.
GitOrigin-RevId: 9b090089d4e7a44ffc182f4e25da20a18e97b70f
## Why
MCP tool handlers and their Code Mode definitions are immutable for the lifetime
of a stable MCP binding, so rebuilding them for every sampling step repeats schema
construction unnecessarily.
## What changed
- Cache MCP handlers per session and reuse them while the same binding remains
active, invalidating the cache when the binding changes.
- Lazily cache schema-free Code Mode definitions on MCP handlers while continuing
to rebuild definitions for step-local tools whose specifications may change.
- Reapply current app enablement, tool policy, exposure, and plugin schema budgets
whenever cached handlers are registered for a step.
## Testing
- Cover handler and Code Mode definition reuse, binding invalidation, changing app
policy, stable continuation schemas, and step-local custom tool updates.
GitOrigin-RevId: 69c5011fb97c08580ac476e7fb2286b1e92e0359
## Why
Subagents can reuse cached MCP tool definitions without starting every optional
server before any of its tools are used.
## What changed
- Defer startup for subagent-owned, optional MCP servers when their cache has at
least one visible, allowed tool, and trigger startup on the first operation
that needs the live client.
- Keep root sessions, required servers, selected plugin servers, and explicit
reconnects eager.
- Exclude empty catalogs from cache eligibility and keep dormant servers out of
the initial startup summary.
## Testing
- Extend MCP tool-cache coverage for eager root startup, unused and filtered
subagent servers, deferred startup status events, and startup that survives an
interrupted first tool call.
GitOrigin-RevId: e7528ff08312583a6747cbc6550ea5b6eabda9a6
## Why
A model switch on the first turn has no prior turn settings to compare, and rolling that turn back could leave its model instructions in history.
## What changed
- Track the model that supplied the session's base instructions so first-turn switches inject the target model's instructions, including the selected personality.
- Preserve inherited custom base instructions when starting from an empty fork.
- Remove first-turn model-switch developer content during rollback so retries and cold resumes do not retain or duplicate stale instructions.
## Testing
Add integration coverage for first-turn switches, personality changes, empty-prefix forks, rollback retries, and cold resume.
GitOrigin-RevId: 9df532e9e337521ad3b315b77f8c98e039fb384e
## What changed
- Fetch the paginated installed-plugin snapshot without a `scope` query instead of issuing separate requests for global, user, and workspace plugins.
- Use the combined snapshot for installed-plugin caching and bundle synchronization while continuing to reconcile each scope's marketplace independently.
## Testing
- Cover pagination across mixed scopes, request query parameters, marketplace reconciliation, stale cache cleanup, and discoverable-plugin filtering.
GitOrigin-RevId: 7428a9db81d7ec04e65cc4b236b652278b200956
## What changed
- Add the gated `unified_image_budget` feature for models that support original image detail or Responses Lite.
- Apply one 6,000-pixel, 10,000-patch preprocessing limit regardless of legacy image detail hints.
- Hide detail controls from `view_image` and code mode while continuing to accept existing hints for compatibility.
- Preserve detail-based resizing and tool contracts for unsupported models.
## Testing
- Cover unified resizing limits, Responses Lite, legacy detail hints, unsupported models, and `view_image` integration in code mode.
GitOrigin-RevId: cb07bff1669a96599fdfd076b3d9ec80f2b6fff7
## What changed
- Add a storage-neutral queue extension for listing, adding, editing, reordering, deleting, and explicitly starting queued user messages.
- Dispatch queued messages in FIFO order when a thread becomes idle after a completed turn, while leaving them queued after interruptions or failures.
- Wait for user input to be persisted before removing its queue item, and report hook rejection, task termination, and persistence failures distinctly.
- Snapshot local image and audio attachments into validated data URLs before storing them, enforce input limits, and emit `ThreadQueueChanged` events after mutations.
## Testing
- Cover queue mutations, automatic and explicit dispatch, interruption and failure behavior, hook rejection, invalid records, input limits, and local attachment snapshotting.
GitOrigin-RevId: 14f39d7c8cbaccb767a6da84b82cced0edfcb4b9
## What changed
- Add a Guardian circuit-breaker policy for models whose catalog specialty is
`cyber`.
- Interrupt those models after the first Guardian denial while retaining the
existing denial thresholds for other models.
- Centralize the `cyber` model-specialty identifier for use across core,
protocol, app-server, and TUI code.
## Testing
- Cover the cyber-specific threshold in the circuit-breaker unit tests.
- Verify end to end that a denied command is not executed and the turn is
interrupted after one denial.
GitOrigin-RevId: fad24c9e7aa280432580db1f0e39d13535779710
## Why
Resumed sessions need the current multi-agent usage instructions when configuration changes or the saved history predates usage-hint tracking.
## What changed
- Store multi-agent usage hints in world state and refresh changed or previously untracked hints before re-emitting the active multi-agent mode.
- Present `wait_agent` polling guidance in the overridable developer instructions only when the tool is enabled, instead of embedding it in the tool schema.
## Testing
- Cover cold resumes, changes to `wait_agent` availability, custom usage hints, message ordering, and tool-schema behavior.
GitOrigin-RevId: a9c6798d5dc2dedc8dadc49e0a80ff50a757ab83
## What changed
- Move tool mention parsing, skill-name counting, and implicit invocation detection into `codex-skills` and expose them through its public API.
- Decouple implicit invocation detection from `SkillLoadOutcome` with an `ImplicitSkillLookup` trait, while preserving the existing `core-skills` interface through re-exports.
- Cover remote plugin attribution for both implicit `SKILL.md` reads and skill script runs.
GitOrigin-RevId: f3da85c9821868638ccfd2fc2e01e0869d2fd437
## What changed
- Add `session_source()` to `McpServerContributionContext` for thread-scoped MCP resolution.
- Propagate each thread's `SessionSource` through initial setup, per-step resolution, and runtime refreshes.
## Testing
- Verify global contexts omit the source while thread-scoped contexts retain it.
- Verify MCP contributors observe distinct sources for a root thread and its spawned subagent.
GitOrigin-RevId: 23da1509858e023fbd9e2d179034ddc83553f17b
## What changed
- Load ordinary recursive host skill roots with the skills extension's host loader.
- Keep plugin-specific roots on the existing loader so plugin snapshot caching and namespacing continue to work.
- Merge both kinds of root snapshots through the existing precedence and deduplication logic, including discovery paths and source filesystem mappings.
- Move `HostSkillsSnapshot` into the skills extension as the owner of host skill loading.
## Testing
- Cover merged host and plugin catalogs, precedence for symlinked roots, discovery paths, and end-to-end rendering and invocation of host, repository, and plugin skills.
GitOrigin-RevId: c18080afb917c33c57bc17e36b40dd0f3c72d1d7
## What changed
- Add end-to-end coverage for a remote environment whose provisioning status is
reported ready before it is selected for a turn.
- Verify that `wait_for_environment` makes remote execution tools and selected
capability-root context available once the transport is ready.
- Update pending-environment and relay tests to cover separate materialization
and readiness reporting, including deferred connection and reconnection.
GitOrigin-RevId: d86d66e8f722e9bafac88b93d93e7c5244a7156e
## What changed
- Move the orchestrator skill catalog from thread context into its own
`orchestrator_skills` world-state section so unchanged catalogs remain
incremental across turns.
- Discover executor, orchestrator, and host catalogs together and render them
against one context-window-aware metadata budget, preserving executor entries
before orchestrator and host entries under pressure.
- Emit catalog metrics and budget warnings when each world-state section is
rendered.
## Testing
- Cover incremental orchestrator catalogs across production turns, combined
catalog budgeting, disabled and unavailable providers, caching, warnings, and
metrics.
GitOrigin-RevId: a0fb25d39dcaf43c978aff9da7972a1206f736e4
rka-oai