## Why
Usage limit errors discarded the server-selected window responsible for the limit, leaving turn and compaction analytics unable to distinguish five-hour limits from weekly limits.
## What changed
Preserve optional `limit_window_minutes` from usage limit error responses in `UsageLimitReachedError` and report it as `usage_limit_window_minutes` in turn and compaction events. Accept unsigned integers that fit in `u16`; treat missing, null, malformed, or out-of-range values as unknown. Events for other error kinds report `null`.
## Testing
Add coverage for HTTP and wrapped WebSocket error mapping, analytics serialization and reduction, and app-server propagation to turn and local/remote compaction events. Cases include five-hour and weekly windows, missing or invalid values, and unrelated errors.
GitOrigin-RevId: a32066a007559d91a3c868a756bfd0f976777176
## Why
Threads sharing an executor and sandbox retries can reuse a public process handle while the executor still retains the previous process.
## What changed
Always append a fresh UUID to the exec-server process ID, including requests without sandbox or shell snapshot settings, to avoid collisions when handles are reused.
## Testing
Update the request-parameter test to check the UUID-suffixed format and verify that repeated calls with the same handle produce distinct process IDs.
GitOrigin-RevId: bd1fc9af3e7d5ea99fdf88382df09afa7dc9f72b
## Why
Complete assistant messages with empty text can produce misleading omitted-context notices in Guardian reviews.
## What changed
- Skip complete, empty assistant messages when recording and rendering retained context, while preserving omission notices for incomplete messages.
- Separate retained instruction fragments with blank lines and keep blank lines free of role prefixes, while labeling every nonempty line with its original role.
- Update source-order guidance detection and empty-section deduplication for the added spacing.
## Testing
Extend retained-context tests to cover empty completed messages across resume, restored empty messages, incomplete-message notices, blank-line spacing, and role labeling. Update Guardian prompt snapshots.
GitOrigin-RevId: e945717b18689fa4538d9b617b89a644858ab1c8
## Why
A Windows breakaway launch can leave an outer Job Object attached after escaping an inner job. Job membership alone does not establish whether the daemon will be terminated, so rejecting all remaining membership can block valid launches.
## What changed
Remove the job-membership checks from the launch preflight and the spawned daemon. Keep the suspended breakaway probe to verify that launch is permitted before stopping an existing daemon, and terminate and reap the probe afterward.
## Testing
Add a Windows regression test with nested jobs that verifies the probe and daemon leave the inner job while retaining the outer job, and that daemon startup succeeds.
GitOrigin-RevId: 4c6aafd158300fa428ec398d72dc5d3411c0d8b8
## Why
Approved commands need broader write access while retaining explicit read denials. On Linux, binding the filesystem root writable can shadow standard devices, and additional root-metadata mounts can reopen denied symlink targets.
## What changed
- Add `FileSystemSandboxPolicy::for_approved_command` to grant root and root-metadata writes while retaining path and glob denials. Keep the original policy when denials cannot be resolved or deny the root.
- Restore standard devices after Linux writable root binds, then apply explicit deny masks. Avoid redundant root-alias binds and inherit root-metadata writes from the root mount so denied targets stay masked.
- Preserve literal deny paths alongside resolved targets so Linux can reject denials that cross writable symlinks.
- Advertise Linux device and approved-root restriction support through two opt-in exec-server capabilities, omitted from serialization when false.
## Testing
Add regression coverage for approval policy materialization across Unix, Windows drive, and UNC paths; Windows volume expansion; Linux device access and metadata symlink restrictions; and capability serialization compatibility.
GitOrigin-RevId: 40584473da98a15e606bb1a8934308f69528850f
## What changed
Allow `cursor` to accept an item anchor such as `{"type":"item","itemId":"item-123"}` with a non-empty `turnId`. Ascending pagination returns items after the anchor; descending pagination returns items before it. The anchor itself is excluded, and subsequent pages use the returned opaque string cursor.
Resolve anchors within the requested turn's visible history, including inherited fork history. Reject missing turn IDs and empty, unknown, or out-of-scope item IDs with invalid params (`-32602`). Preserve existing string and null cursor behavior, and update the protocol schemas, TypeScript and Python types, and API documentation.
## Testing
Add protocol round-trip and invalid-shape tests, app-server coverage for anchored pagination and errors, and thread-store coverage for growing turns, reverse pagination, page boundaries, fork visibility, and anchor scope validation.
GitOrigin-RevId: a74cea190d3ff1b44865429f8b0650b793eb688d
## Why
Cached executor MCP declarations must not gain access to host environment credentials when reconnecting to an executor that lacks environment credential resolution.
## What changed
- Retain credential policy through MCP registration, catalog materialization, and runtime setup. Derive selected HTTP plugin policy from the plugin's source environment.
- Reject host bearer-token fallback and transports requiring host environment headers or helpers for executor-owned declarations. Preserve host-configured credential resolution.
- Include credential policy in connection and tool catalog cache identities, and avoid reading host environment values for executor-only identities.
## Testing
Add regression coverage for legacy executors, cached declarations after a capability downgrade, policy preservation through catalog rebuilds, and connection and tool cache isolation.
GitOrigin-RevId: 2d5b85e4e98668c637c538cbe528914c936bd831
## Why
With `instant_interrupt` enabled, new user input should reach the model without waiting for an unfinished response or stream retry backoff.
## What changed
- Interrupt request setup, response streaming, and retry backoff when user input arrives, then continue the turn with the queued input.
- Reset the WebSocket connection and continuation state after preemption so the next request sends full history.
- Drain pending input after a preempted step even when compaction leaves the estimated context above the token limit.
## Testing
Add regression coverage for WebSocket reconnection with full history, interrupted retry backoff, input queued during compaction, and yielding running code-mode calls. Add a streaming scenario that preserves completed commentary while excluding unfinished assistant text from the replacement request.
GitOrigin-RevId: b7e42b6afffbf87da15af05e0850af8579d1353f
Set `CREATE_NO_WINDOW` when launching the code-mode host on Windows so the
child process does not create a console window.
GitOrigin-RevId: ce0d04d7f516d137bcaf5206140aaeaa23334022
## Why
User input queued during a long-running code-mode `exec` or `wait` can remain pending until the call returns. Allow these calls to yield early so Codex can receive the new input while the cell continues running.
## What changed
- Add the `instant_interrupt` feature flag, disabled by default.
- Watch queued user input for each sampling request and pass a shared preemption signal to code-mode `exec` and `wait` calls, including calls received later in the same response.
- Yield running cell IDs without stopping the cells, allowing subsequent `wait` calls to collect their results.
## Testing
Add integration coverage for enabled and disabled behavior, repeated steering during `exec` and `wait`, input deferred during compaction, and later calls in the same response. Verify that direct tool results and queued user messages are preserved, and add a scenario snapshot showing continuation after a cell yields.
GitOrigin-RevId: e33466a980d98e113bfb6c6a45c59de0cc7b3c1d
## What changed
- Let `Left` return to the command center from a conversation open in another app, including while disconnected, without discarding the retained draft.
- Respect editor and Vim keymaps, conflicting shortcuts, and chord prefixes before enabling this navigation.
- Show `←/esc` in the command center hint when `Left` is available; otherwise keep `esc`.
## Testing
Add regression coverage for connected and disconnected navigation, draft preservation, and remapped `Left` with Vim enabled or disabled. Extend attach-conflict coverage to verify that both `Left` and `Esc` preserve the command center selection, and update footer snapshots.
GitOrigin-RevId: 80ef004b548176443ebee03c2a143e723e54c44a
## What changed
Update `each_loader_owns_refresh_until_its_last_clone_is_dropped` to use
`SequenceBundleClient` request notifications and Tokio timeouts instead of
request-count polling with wall-clock deadlines. Await refresh requests from
both loader owners together while retaining the assertions that each refresh
task stops when its last loader clone is dropped.
GitOrigin-RevId: 5fea595fa67d5348a23f59033502e012406a2bd1
## What changed
Add an optional `preempt` signal to `CodeModeSession::execute` and `CodeModeSession::wait` so callers can end an observation early while the cell continues running and remains available for later waits.
Support the signal in the in-process runtime and across both remote transports: `operation/yield` with the negotiated `yield-observation` capability for stdio, and `YieldObservation` for gRPC. Preserve signals received before gRPC observation registration, and retain normal timeout behavior for older hosts that lack support.
## Testing
Add runtime and transport tests covering early execute and wait yields followed by successful cell completion, yields before observation registration, and suppression of yield frames for older stdio hosts.
GitOrigin-RevId: 3f8049d8f0582be6b8f0832cc03f2d974a0b8f18
## Why
Starting a new session from the command center could clear the startup composer or replace it with `Loading task` before the attached chat was ready to render.
## What changed
Show the startup draft immediately and skip loading frames while it is present. Reset transcript state without clearing the visible draft, deferring the terminal clear until the next synchronized draw. Preserve this behavior during resize reflow as well.
## Testing
Add a regression test and snapshot covering inline and owned-screen modes. Verify that draft text survives the handoff, queued events leave the startup frame intact, and the attached composer retains the draft.
GitOrigin-RevId: 26a7ba2929a3b46537da960cbb7201b21b5dc61f
## Why
The worker's completion notice can interrupt the root's one-shot question response before the messaging call reaches its cancellation point in `guardian_subagent_review_preserves_late_root_user_authorization`.
## What changed
Gate the worker's initial response with a `oneshot` channel and a streaming SSE server. Release it after the root's question turn completes or its cancellation is observed, then wait for worker completion and shut down the server.
GitOrigin-RevId: d7f287557a7c27f1054c7ae90ba331ff26bba8ef
## What changed
- Add `tui.right_click_paste` with `auto`, `on`, and `off` modes. The default `auto` enables the fallback on Windows and Linux, including WSL when terminal detection is conclusive. `on` also enables macOS. Both modes skip SSH sessions and recognized VS Code terminals.
- Paste clipboard text through the normal composer input path when no selection, search, or blocking view takes precedence. Discard pending results after intervening input, focus loss, or changes to the target thread, draft, or cursor.
- Read text asynchronously through the shared clipboard worker, with a five-second deadline and the message size limit. Read the Windows clipboard through PowerShell on WSL and reject overlapping clipboard operations.
## Testing
Add coverage for platform and terminal policy, normal paste delivery, stale reads, overlapping clipboard operations, read timeouts, oversized text, and large command output.
GitOrigin-RevId: 0a7b6d445c09928da6c5335841ba2a9a66cc7e4b
## Why
Reasoning shortcuts stopped before Max even when the active model supported it, requiring users to open the advanced-reasoning picker.
## What changed
Allow `Alt+.` and `Shift+Up` to raise reasoning to Max in default and Plan modes. Keep Ultra behind the explicit picker and update the guidance to mention only Ultra.
## Testing
Add coverage for both shortcuts reaching Max in both modes, with footer snapshots. Update the Ultra boundary test to verify that raising from Max shows picker guidance without changing reasoning effort.
GitOrigin-RevId: 4e5ef2866f118a1f59313d494a2383db43293da9
## Why
Local compaction flattened retained user messages into a single text part, losing their original content boundaries and per-part annotations.
## What changed
Preserve the original content parts and annotations for text-only user messages that fit within the token budget. Borrow the original messages until selected history entries are materialized, and rebuild only the text fallback for truncated messages or messages containing media.
## Testing
Extend unit coverage for text boundaries, empty parts, omitted media, and retained metadata. Update the compaction integration test to verify that a multipart user message survives unchanged in the next request and retains its content parts and annotations in persisted replacement history.
GitOrigin-RevId: 39d9df9ae5360506c2a4bdeac76d89198dbbd39c
## Why
Async Guardian requests include retained user instructions even when complete copies are already present in the same request's transcript.
## What changed
- Include retained source metadata and order labels in async user transcript entries.
- Omit retained instructions when the current transcript contains the same complete source revision. Keep ordering guidance in every async sample and never rely on previous samples for deduplication.
- Preserve retained originals when transcript copies are incomplete or lack source metadata.
## Testing
Extend retained-instruction tests to cover async deduplication, preservation of originals without complete source proof, and budget protection. Update async scorer expectations for source order labels and deduplicated instructions.
GitOrigin-RevId: 7029731b296d2342eea4ad74ffa9d3447578d83e
## Why
Synchronous Guardian reviews can include the same user instruction in both the retained instructions section and the conversation transcript. Avoid this duplication while preserving complete authorization evidence and its original acceptance order.
## What changed
- Carry retained source metadata into transcript rendering. Omit a retained instruction when the transcript delivers its complete matching source revision.
- Label qualifying transcript entries with retained source order and protect them from budget truncation. Keep separate retained instructions when source metadata is missing or incomplete.
- Track delivery of source-order guidance so it remains available even when all retained instructions are delivered through the transcript. Invalidate that delivery proof when messages are shortened.
## Testing
Add coverage for complete-source deduplication, missing or incomplete metadata, budget protection, guidance redelivery, and source metadata preservation across resume. Update Guardian review assertions and snapshots to verify instructions are delivered once.
GitOrigin-RevId: 20ad0304501fa49f1596c4cfaf3ef89d64815753
## Why
`/ps` previously showed only the first line of each background command, hiding useful details when a command began with an opening parenthesis.
## What changed
Render LF and CRLF line breaks as `↵` in command previews. Include subsequent lines within the existing 80-grapheme limit, and show the truncation marker only when the command exceeds that limit.
## Testing
Update snapshot coverage for multiline commands, including parenthesized commands and CRLF line endings, and add a snapshot for a multiline command exceeding the preview limit.
GitOrigin-RevId: 92544e5636821fc94bc1ca4af389c3c646127c0e
## What changed
Add `codex-agent-message-board-client` with a `RemoteAgentMessageBoard` implementation of the existing `AgentMessageBoard` interface over a versioned HTTP API. Use the shared HTTP client for authenticated board creation, deletion, member registration, and board operations.
Validate endpoints and credentials, bound request and response sizes, and support a caller-supplied clock. Allow post retries without a fresh timestamp so the service can replay an already committed result.
Provide live SSE receivers that wait for readiness and reject notifications for another agent or turn, as well as previews exceeding 150 characters.
## Testing
Add a mock HTTP integration test covering endpoint and returned-credential validation, bearer authentication, post retries when the clock is unavailable, Unicode post reads, SSE readiness and notification validation, and service error handling.
GitOrigin-RevId: 844f63ee14dc216a9d61767115892c4783fe9d44
## Why
Legacy shell snapshots could retain exports excluded by `shell_environment_policy` and restore captured values over explicit overrides when replayed.
## What changed
- Build snapshots with the resolved environment's policy and omit filtered exports and original values for variables overridden by `set`.
- Skip eager snapshot creation when configuration is unavailable, and reject snapshots whose policy differs from the current turn's policy.
## Testing
Add a regression test covering default and custom exclusions, `include_only`, preservation of multiline values, and `set` overrides that survive snapshot replay. Verify excluded and overridden captured values are absent from the snapshot file.
GitOrigin-RevId: 4b785130f6c5a4d268ab86fd36ab9d77d8c4a3b9
## Why
User messages could fill the root context limit before assistant questions were considered, while commentary could displace relevant conversational context. Guardian needs that context to interpret user authorization when reviewing subagent actions.
## What changed
- Select recent user and assistant evidence together under a shared message limit, discarding assistants with unknown ordering first.
- Exclude explicit assistant commentary and retain message phases across compaction. For older retained records, check available source messages for commentary phases.
- Mark missing instructions or assistant context when the shared limit removes corresponding evidence, and use remaining space for legacy instructions.
## Testing
Update Guardian authorization tests to cover shared message limits, commentary filtering across compaction and resume, and preservation of ordered replies when legacy assistant context has unknown ordering.
GitOrigin-RevId: c369a2760917cba9d7dfca37fb5e85a7ec49012f
## Why
Large shell snapshots need a replay path that does not add their state to the child process environment.
## What changed
- Keep captured state cached in memory and give each Bash or Zsh launch an independent, read-only file descriptor to source. Unlink the file before writing shell state, create it under the sandbox-protected daemon directory, and close the carrier descriptor before restoring functions.
- Probe descriptor-path access inside the capture sandbox. Retain environment replay for `sh` and when descriptor paths are unavailable; use normal shell startup if preparing the replay file fails.
- Group options and aliases during capture so sourcing preserves their parsing behavior.
## Testing
Add coverage for concurrent replays with 480 KiB payloads, pipe and TTY execution, stdin preservation, descriptor cleanup, sandbox protection, blocked descriptor-path fallback, and alias/option parsing equivalence.
GitOrigin-RevId: 8103d5c37ce4d1885628a4efba3551549f12bea8
Derive `Serialize` and `Deserialize` for `CreateChannelRequest`,
`ReadPostRequest`, and `SubscriptionRequest`.
GitOrigin-RevId: 7da638c029f7d57b59e865a3a45ae80924780fba
## Why
Runtime filesystem grants, such as those used for plugin metrics, could trigger unnecessary approval for `write_stdin` and prevent input when sandbox approval was disabled.
## What changed
Include retained runtime grants in the baseline permission comparison for stdin review. Continue requiring review for additional agent permissions, sandbox bypasses, and policy changes. Update the approval description to report current permissions when only runtime grants are present.
## Testing
Extend unit coverage to ensure runtime grants do not require review or mask agent filesystem and network grants, and that sandbox bypasses still require review. Add local and remote plugin regression cases that send stdin and verify metric emission with sandbox approval disabled.
GitOrigin-RevId: 989098bdc7fbf839786c01f11cbf02999bae1cc1
## What changed
Return post metadata from the in-memory message board after updating board state when no notification recipients remain. This avoids constructing an unused notification preview, including when the author is the only requested recipient.
## Testing
Run the existing post-and-search model-context scenario against both disk and in-memory message boards, checking that post metadata and search results reach the model without self-notifications.
GitOrigin-RevId: dcf07a5fd55738fbcd6edd3dce3f6fb8fc910eaf
## Why
The network command can yield before its request reaches Guardian, allowing a parent request to consume the mock response intended for Guardian.
## What changed
Update `guardian_receives_exact_trigger_for_single_network_request` to match parent and Guardian requests separately. Have the parent poll running processes with `write_stdin` until they exit, and bound the wait for turn completion to 30 seconds. Preserve the assertion that Guardian receives exactly the original call ID and command.
GitOrigin-RevId: f39e9461c3628fbab00ba241f828d318b17975b5
## Why
Reused Guardian sessions already contain previously delivered instructions. Follow-up reviews can avoid repeating that evidence, but must deliver it again if it changes or compaction removes it.
## What changed
- Track retained source identity, revision, and completeness in host-owned history metadata, preserving revisions during replay.
- Omit retained instructions from synchronous review inputs only when the same complete revision remains in reviewer history.
- Restore missing evidence after reviewer compaction, enforcing the request budget before persisting additions. Classify restored evidence as context rather than new user authorization.
- Keep source-order labels stable across eviction and retain full delivery for legacy records without reliable provenance.
## Testing
Add coverage for consecutive-review deduplication, changed revisions, missing or incomplete metadata, and restoring compacted evidence exactly once. Extend compaction and resume coverage to verify retained revisions.
GitOrigin-RevId: e90fca16cde0a0970da36dd873af2ca1dbaaf4d3
## What changed
- Stop sending `includeExtensions=true` when fetching installed plugins and remove extension metadata from remote plugin models.
- Remove `PluginSummary.extensions` and the associated extension declaration types from the app-server protocol.
- Update generated JSON schemas, TypeScript and Python bindings, and precomputed protocol exports to match.
GitOrigin-RevId: 56509437b6bdf58d99badff68e86bcf7f09fe036
## What changed
Add app-server integration coverage for awaiting `request_permissions` and then running `exec_command` in the same code-mode cell:
- Verify that turn- and session-scoped write grants allow the command to create a file, including grant propagation to Windows command approval requests.
- Verify that `strictAutoReview` immediately triggers review for a command needing no additional access and returns the reviewer's denial rationale.
GitOrigin-RevId: 02c958071db4e9ba667be9ba95fbb3a506ae1572
## Why
Tool suggestions could pass unchecked `install_url` values to the app link view for opening in a browser.
## What changed
Reuse the external URL validator to require HTTPS URLs with a host and no embedded credentials. Decline suggestions with invalid URLs on the requesting thread without showing a popup.
## Testing
Add a regression test covering malformed URLs, unsupported schemes, embedded credentials, and a valid HTTPS URL. Verify that rejected suggestions leave the popup unchanged and resolve on the requesting thread, while the valid URL opens on confirmation.
GitOrigin-RevId: e47bf09868ec81aeaf1ffed8330039b69c60e093
## Why
The sample hardcoded file-based credential storage and omitted configured auth routing and login restrictions. It should use the configured credentials, including secure storage in `cargo run` builds.
## What changed
- Load authentication settings through the shared bootstrap path and re-export the required helpers and types from `codex-core-api`.
- Honor CLI and MCP credential stores, `features.secret_auth_storage`, auth routing, the ChatGPT base URL, and system proxy settings.
- Preserve managed login-method and ChatGPT workspace restrictions while keeping the sample's built-in execution settings.
- Document the sample's authentication configuration behavior.
GitOrigin-RevId: b49883537acbebf9266b3970d2709e8e7d1bf217
## Why
When a container denies fresh `/proc` mounts, the existing sandbox fallback retains the caller's `/proc` while creating a new PID namespace. Process IDs inside the sandbox can then differ from those exposed by `/proc`, breaking process lookups.
## What changed
- Add `codex exec-server --linux-sandbox-pid-namespace=inherit` to reuse the caller's PID namespace and `/proc` for both process and filesystem helpers. Repository config and command environment variables cannot enable it.
- Keep `isolate` as the default, preserving the existing mount fallback and compatibility with older helpers. Inheritance requires an updated helper and omits `--unshare-pid` and `--as-pid-1`.
- Preserve other sandbox restrictions. With `:minimal`, bind the inherited `/proc` read-only with its container masks and apply explicit filesystem denials afterward.
Inheritance is intended for dedicated environments: it allows sandboxed commands to signal other same-UID processes, including the executor.
## Testing
Add unit and integration coverage for namespace flags, denied proc mounts, consistent process IDs, retained sandbox restrictions, and startup-only selection across process and filesystem helpers.
GitOrigin-RevId: dd13f2b9286d7edcf366b3a42a455f4d78daaf27
## Why
Refreshing the MCP catalog with unchanged tool metadata recreated handlers and forced the tool search index to rebuild.
## What changed
Cache handlers by canonical tool name and reuse them when tool metadata, agent plugin status, and the input schema size limit are unchanged. Replace handlers when those inputs change and evict tools removed from the catalog, preserving search index reuse across equivalent bindings.
## Testing
Extend the deferred tool world state test to verify that an unchanged catalog refresh captures a new binding without rebuilding the search index, and that removing all deferred tools stops advertising `tool_search`.
GitOrigin-RevId: 150866f635e9ee817d7ca44fb76e724a3f7608a5
## What changed
- Record successful spawn phase durations in `codex.multi_agent.spawn.phase.duration_ms`, covering residency reservation and fork context when applicable, child creation, durability waits, input admission, and total latency.
- Count spawn failures from the V1 and V2 tool handlers in `codex.multi_agent.spawn.failure`, grouped by bounded error categories.
- Use bounded labels for fork mode, multi-agent version, product SKU, and successful-spawn history mode. Emit phase timings only after a successful spawn.
## Testing
Add in-memory metrics tests for phase durations and labels, plus a tool-handler test verifying that a thread-limit failure emits one counter increment with the expected labels.
GitOrigin-RevId: 04cba9042b9b34acdf57376ace5288c3f741f3b2
## What changed
Prepare each MCP call from the selected server's current client and catalog instead of building a full runtime binding. Match the advertised tool by server, tool name, and connector ID, and enforce current tool filters and model visibility.
Preserve the advertised `callable_namespace` and `callable_name` while using current schema, annotations, approval metadata, timeout, and permission authority for execution.
GitOrigin-RevId: 703a90926fc72bd446d83ac974162aee6439f363
## Why
Queued voice answers could reappear as text under a newer question when speech failed, the pending queue overflowed, or voice stopped, including answers already spoken as paraphrases.
## What changed
Filter recovered and replayed speech by the current input generation, preserving that generation across conversation resets. Keep text fallbacks for answers still awaiting turn completion so delayed user transcripts do not discard unspoken answers.
## Testing
Add regression coverage for paraphrased answers, queue overflow, stop and replay, failed delivery for current versus superseded input, and delayed transcripts.
GitOrigin-RevId: b7b230910bf4fdb4ae93f7de8ca2222a19c55d7f
## Why
A `.git` pointer can resolve to a Git directory inside another writable root. Broader Seatbelt grants or later bubblewrap mounts can leave that directory writable despite its metadata protections.
## What changed
Include resolved Git directories in read-only exclusions for broader writable roots on Linux and macOS. Resolve symlink aliases when locating exclusion targets and retain explicit policy overrides.
## Testing
Add regression tests for Git directories reached directly or through symlink aliases in another writable root, and for linked worktree metadata under the macOS temporary directory. Verify that metadata writes are denied while ordinary files in the surrounding writable root remain writable.
GitOrigin-RevId: 6971f1cf35008d23eaeb0d02a9c61bee7cf83b12
## What changed
- Recognize `promax` in authentication, account responses, and backend rate limits; update generated schemas and client types.
- Display `prolite` as “Pro”, `pro` as “Pro (More)”, and `promax` as “Pro (Max)” in account labels, status, and analytics.
- Include Pro Max in experimental context eligibility, paid-plan tooltips, and usage-limit guidance for purchasing credits.
## Testing
Extend coverage for Pro Max plan parsing, account and rate-limit responses, experimental context eligibility, and plan display names. Update the login token test to expect “Pro (More)”.
GitOrigin-RevId: 197e00fa7a99cbce125c8f1d43a451ec1ed5c1fb
## Why
`active_turn_environment_selections()` returns the selections captured at turn start, so it does not reflect later environment settings updates.
## What changed
Add `CodexThread::current_turn_environment_selections(expected_turn_id)` to read the running turn's current selections, including environments that are still starting or have failed. Return `None` when the requested turn is no longer active or has been cancelled.
## Testing
Add a regression test covering selection updates, mismatched turn IDs, and completed turns, while verifying that the initial selection snapshot remains unchanged.
GitOrigin-RevId: bb526a686d549209142150ffde99ad1444add205
## Why
Btrfs subvolumes can report an `st_dev` that differs from the device in `/proc/self/mountinfo`, causing daemon socket mount validation to reject valid mounts.
## What changed
Allow the mismatch only when the opened directory and its uniquely identified mount are both verified as Btrfs. Discover socket directory aliases using both device identities while retaining checks that reject unsafe directory and socket bind mounts.
## Testing
Add regression tests for aliases under both device numbers, unverified or inconsistent filesystems, unavailable or missing mount IDs, duplicate mount IDs, and unsafe bind mounts.
GitOrigin-RevId: 921d6465b7a97022573a42412606a26560cc086a
## What changed
- Recognize `flex_unavailable` in HTTP 429 responses and streamed `error` and `response.failed` events. End normal turns without retries and report `Flex capacity unavailable.`
- Expose `flexUnavailable` through the core and app-server protocols and generated schemas and SDK types.
- Keep Flex capacity failures eligible for Guardian review and sampler retries, with a distinct telemetry classification.
- Map unexpected HTTP responses to `HttpConnectionFailed`, preserving their status codes.
## Testing
Add regression coverage for terminal Flex failures over HTTP, SSE, and WebSocket, HTTP 504 status preservation after a stream retry, and protocol serialization. Update Guardian retry and sampler recovery tests to cover Flex failures.
GitOrigin-RevId: f2e03a6d2d36a6d9748c35952e40397f8670d121
## What changed
Keep `x-amzn-mantle-client-agent: codex` in the Amazon Bedrock Runtime provider instead of clearing the headers inherited from the Amazon Bedrock provider.
## Testing
Update provider construction expectations and extend the API provider header test to cover both Amazon Bedrock providers.
GitOrigin-RevId: eab07f347b53f0a6ba2e224a39590f49f181363e
## What changed
- Default `MALLOC_CONF` to `thp:always` for Cargo child processes, including tests and `cargo run`, while preserving an explicitly set value, even if empty.
- Patch `rules_rust` to request transparent huge pages for `codex-rs/` compilation with Linux GNU `rustc` on x86_64 and aarch64. Check policy on the execution worker and enable the setting only when seccomp is disabled, transparent huge pages are permitted, and no allocator, preload, or sanitizer configuration conflicts are detected. Leave the environment unchanged when policy cannot be determined.
GitOrigin-RevId: 3a9b2572ec9e1f30e2f719f30c885914c165eccd
## Why
Removing tool-result metadata alone can leave requests above the 15 MiB message budget when recorded tool calls and arguments occupy the remaining space. If trimming loses calls or arguments from a Code Mode cell, later waits must not report its call inventory as complete.
## What changed
- Bound all optional tool-call observations against the serialized HTTP or WebSocket message size, preserving ordinary tool outputs and continuation history.
- Shed generic result metadata, sources, and recorded arguments before resource-access evidence, retaining tool names and smaller metadata where possible.
- Invalidate completeness across affected cell outputs and later waits when the outgoing copy loses calls or arguments.
- Preserve size-limit omission markers for direct tool-result metadata when they fit, while continuing to exclude that metadata from custom providers.
## Testing
Add regression coverage for HTTP and WebSocket message budgets, unchanged tool results and history, resource-evidence retention, direct-call omission markers, and Code Mode waits after argument truncation.
GitOrigin-RevId: 538dc9d8c11b0830ec70327422f98a1803122e85
## Why
Editing recent conversation images failed when the selected images included a file reference from a message or tool output.
## What changed
Use `ImageReference` in `ImageEditRequest` to accept both `image_url` and `file_id` inputs. Pass file references from conversation history through to image edit requests while preserving image selection order.
## Testing
Update tests to cover file references from messages and tool outputs, and serialization of mixed inline and file references in image edit requests.
GitOrigin-RevId: 2764bf36a81a62ddd25cf9df27346a434a10c449
## What changed
Show the startup tip beneath the session header in the fullscreen transcript, with wrapping on narrow terminals. Remove rotating tips and startup announcements from above the composer, leaving that area for usage warnings.
## Testing
Add startup transcript snapshots at 80 and 32 columns and assert that compact tooltip rendering preserves styled links. Update usage-warning tests to verify composer geometry and recovery without rotating tips.
GitOrigin-RevId: b5e79a46147d112cd50802b0702537deb9b87001
## Why
Dropping the last board handle releases its state but leaves a stale entry in
`InMemoryMessageBoards`, allowing registry entries to accumulate across sessions.
## What changed
Prune entries whose state has no remaining strong references whenever a board is
opened, while preserving shared state for live boards.
## Testing
Add a regression test that repeatedly opens and drops boards, checks that expired
entries are removed, and verifies that reopening a live board shares its state.
GitOrigin-RevId: c3f1c27b42ee17915f0ece01b85a22d0fdf632ce
rhan-oai