## What changed
Represent denied read paths and globs with `PermissionContext` and render them through a sync-only section in `codex-guardian-context`. Keep policy resolution in the host and preserve the existing permission warning in Guardian review prompts.
## Testing
Extend registry tests to verify permission sections appear only for synchronous reviews. Extend the session reuse test to check that resolved denied paths and globs appear in both the initial review request and the next review's delta.
GitOrigin-RevId: a966a14b367f1eedb5a577f7ed74a869559ae646
## What changed
- Replace `ComposedContext` with ordered `ContextSection` values that retain section identities through transcript selection and rendering.
- Add a shared `PlannedAction` section and renderer for core synchronous approval prompts and the Guardian V2 asynchronous scorer, preserving full, delta, terminal-input, and network-request framing.
- Keep action JSON and retry reasons out of `PlannedAction` debug output.
## Testing
Update registry and transcript tests to assert section identities and source roles. Extend registry coverage to verify planned-action collection for both consumers and omission of action JSON and reasons from debug output.
GitOrigin-RevId: 675b841a2cad06afce03f414615b4d7aa0553b13
## Why
A code-mode `exec` wrapper and its nested tool calls each advance Guardian's score lag. Counting the unscored wrapper against its own nested approval can trigger a synchronous review sooner than needed.
## What changed
Track originating response items and approval tool-call IDs so cached approvals discount their own wrapper when it is newer than the latest score. Preserve wrapper identity across yields and waits, and retain the full lag when provenance is missing or evicted. Other wrappers and scoring failures still count.
Use the current `write_stdin` call's identity for approval freshness, and omit tool-call identity for `execve` intercepts that only retain the launch ID.
## Testing
Add coverage for wrapper-specific discounts, already-scored wrappers, missing and evicted provenance, identity across code-mode resumes, and approval identities for stdin writes and `execve` intercepts.
GitOrigin-RevId: 4002a06d64c4e1e0a13c072303503d6ddfacad09
## Why
Configured MCP servers must not be able to request user verification, even when they reuse the hosted apps server name. Local verification identity selection also needs to distinguish a user's workspace memberships.
## What changed
- Advertise `userVerification` only to the host-owned apps MCP server and cancel verification requests from other servers before prompting the client.
- Add `CodexAuth::get_chatgpt_account_user_id()` to read the access token's opaque `chatgpt_account_user_id` only when its workspace matches the selected account. Missing or malformed claims return no identity, without falling back to another user ID or breaking ordinary authentication.
## Testing
Add coverage for capability filtering, rejection of configured servers including those using the hosted apps name, and account-user identity selection with malformed or mismatched claims. Add an MCP round-trip test showing that verification waits for a client response even in full access mode, returns the supplied proof, and discards response metadata.
GitOrigin-RevId: 156e83d5a0302c013b85e564b46b4bfe858cbdb0
## What changed
Add `ThreadManager::fork_internal_session` to start an internal session from caller-selected committed history without reading an in-flight parent turn or appending an interruption marker. Preserve parent authentication and budget sharing, and propagate fork lineage. Keep `spawn_internal_session` starting with fresh history.
## Testing
Add a regression test verifying that the fork contains only the selected history, retains its parent association and authentication manager, and stays outside the public thread registry.
GitOrigin-RevId: df4260ed3adfa0abe7a07c2b6d8b8c6ef6ba3d16
## Why
After a cold resume and compaction, the subagent roster omitted children whose threads had not been loaded.
## What changed
Build the multi-agent v2 roster from registered direct children and render their full agent paths. Prioritize loaded children, sort alphabetically within each group, and cap the rendered roster at eight agents and 1,024 bytes. Preserve the existing behavior for other multi-agent versions.
## Testing
Extend the cold-resume integration test to check that post-compaction context includes unloaded children, excludes grandchildren, and lists a loaded child before an alphabetically earlier unloaded sibling.
GitOrigin-RevId: 745c1622133b9c01e61f4702e4b2ef6255417f39
## What changed
Add a public `codex_core::guardian_review` module exposing `GuardianAssessment`, the assessment parser and output schema, and the review session configuration builder for reuse by the Guardian extension.
Extract assessment handling and reviewer configuration into dedicated modules, preserving the existing parsing defaults, policy prompt, and read-only reviewer settings.
## Testing
Move the existing embedded-JSON, bare allow/deny, and output-schema tests alongside the assessment implementation.
GitOrigin-RevId: cb2aba3ccdb597e2876015e718e923d4f8f36802
## Why
A standalone root forked from a worker needs its inherited user instructions for Guardian review, including after compaction. Parent input counters belong to a different thread, and omitted parent answers may have restricted an inherited authorization.
## What changed
- Adopt inherited user instructions into thread-owned retained context for standalone roots, recovering surviving checkpoint messages when needed.
- Keep inherited instructions before local evidence without sharing local acceptance counters, and preserve that distinction during reconciliation and rollback.
- Mark parent verified answers as incomplete and treat recovered checkpoint instructions as incomplete excerpts.
## Testing
Add coverage for standalone forks from copied history and truncated checkpoints, retention through compaction and resume, inherited/local ordering collisions, and rollback scope.
GitOrigin-RevId: bf716e224a1d29d6c528ef0dd7cdb118a413a08c
## Why
Incomplete retained checkpoints can omit root user instructions that still survive in live history. Queued input can also reach model history after a later-accepted answer, so recording order cannot reliably order grants and restrictions for subagent authorization reviews.
## What changed
- Reconcile retained evidence with surviving local user messages using source identity and persisted acceptance order, including answers present only in the checkpoint.
- Preserve checkpoint gaps and mark evidence incomplete when recovered instructions lack an order or conflict with an existing order.
- Restore the input-order counter from surviving local metadata so new instructions sort after recovered evidence, even without a retained checkpoint.
## Testing
Add unit coverage for source matching, acceptance ordering, persistent gaps, conflicting orders, and counter restoration. Extend subagent authorization tests to cover checkpoint resume, queued approvals, missing sources, and a subsequent revocation.
GitOrigin-RevId: 8bfbfd2c797d725796187e5cecf7f3f11a5f3380
## What changed
- Remove the `fast_decision` and `full_review` extension hooks and `ApprovalAssessment`, leaving `ApprovalReviewContributor::decide` as the approval decision interface.
- Remove the duplicate Guardian V2 fast-approval implementation and `StrictReviewReason` state.
- Require an explicit `GuardianReviewReason` for synchronous reviews.
## Testing
Migrate Guardian reviewer tests to the production `decide_approval` path and cached-score tests to the registry's decision interface.
GitOrigin-RevId: 1f9092c0ff5bb1eed0c63fa557fb3807e2e71564
## What changed
Resolve `GuardianContextMode` once at session construction and share it across history retention, replay, evidence capture, compaction, and review consumers.
Extract synchronous reviewer context policy and consolidate Guardian V2 parent checkpoint selection so sampling and fast approval use the same eligibility checks. Preserve legacy checkpoint omission and strict compatibility requirements for thread-owned context.
## Testing
Adapt existing review and history tests to the explicit context mode. Move checkpoint tests alongside the extracted selector, retaining coverage for latest-item identity, unusable checkpoints, and complete-item size limits.
GitOrigin-RevId: c73fb6fea556921acfffe758a5f709d7494019dd
## Why
`TurnComplete` arrives before the active turn is cleared, so submitting a
rollback immediately can race with turn cleanup.
## What changed
Wait for the thread-idle callback with a 10-second timeout before rolling back
in the first-turn model-change and generated-image tests. Fail immediately on
an error event while waiting for `ThreadRolledBack`.
GitOrigin-RevId: c17b35d709b2c74361dd7933506ae192464ea4e8
## What changed
- Use `decide_approval` for MCP elicitations, carrying the effective approval policy, reviewer, and synchronous-review requirement into the decision.
- Preserve unsupported form and URL elicitations for user review.
- Use `computer_use_review_required()` for review evidence, session policy, and turn metadata so model policy takes precedence over the legacy flag.
- Derive strict-review notifications from each assessment's review reason.
## Testing
Add coverage for model policy precedence, user and full-access modes, sensitive elicitations, independent code-mode and nested-tool policies, cached score reuse, and user review of unsupported elicitations.
GitOrigin-RevId: d0a9c40572dca7b3dbf876230d2162b72728084d
## Why
Concurrent parent compaction can remove evidence between Guardian checkpoint selection and prompt construction. New user instructions or answers received during a review can also invalidate an approval based on earlier authorization.
## What changed
- With `GuardianThreadContext` enabled, use the same parent history snapshot for checkpoint selection and prompt evidence.
- Cancel completed allow decisions if the owning session's user-message revision or root authorization version changed during the review, even without cacheable review evidence.
## Testing
Add regression coverage for evidence preservation during concurrent compaction and aborted approvals after new user instructions or verified answers. Extend reviewer context rollover coverage to exercise `GuardianThreadContext`.
GitOrigin-RevId: 1c2c82197a27c0d3d45b6fe08d200a835d80cc30
## What changed
- Let approval extensions choose between cached approval, synchronous review, and a user prompt for tool and permission requests, while core enforces mandatory Guardian and fresh-review requirements.
- Carry an optional `review_reason` on Guardian assessment events and use it to trigger strict-review notifications, retaining the fallback for older events.
- Require synchronous review when cached evidence has an unusable encrypted parent compaction.
## Testing
Add regression coverage for manual prompts and cached approvals with non-UTF-8 working directories. Update approval contributors in existing tests to use the decision API.
GitOrigin-RevId: a4e66416070bdaa881daa41429c49021629f44c1
## Why
When no healthy pooled WebSocket is available, classification waits for a new connection to open and can stall on its handshake.
## What changed
- Use HTTP streaming when no healthy idle WebSocket is ready, and replenish the pool in the background with a five-minute cooldown after connection timeouts.
- Share concurrency limits and the sampling retry budget across both transports, and bound the wait for HTTP response headers.
- Cancel superseded requests while awaiting response headers and stop SSE polling when the consumer closes.
## Testing
Add coverage for HTTP fallback and recovery after cooldown, shared transport capacity, stalled response headers, and cancellation before headers or during body draining. Update sampler and extension tests to cover fallback after socket expiry, authentication changes, and transient failures.
GitOrigin-RevId: 0b23ccc1bfb2dfdbc8d2791d097706cd4dd44f39
## Why
Device-authenticated verification needs an app response outside automated approval and review. Previously, MCP user-verification requests were always cancelled.
## What changed
- Add typed `openai/userVerification` elicitations carrying a title, description, and challenge through core and app-server.
- Route verification to one connection enabled by trusted host activation. Restrict responses to that owner, exclude requests from replay, and cancel on disconnect or authentication changes, including account switches away and back.
- Return proofs in `content`, discard response metadata, and cancel malformed acceptances. Suppress verification response logging and analytics, and send only a generic verification notice to realtime.
- Keep the mode experimental and exclude it from stable schema exports. Capability advertisement remains disabled, and the TUI cancels verification requests.
## Testing
Add coverage for owner isolation, disconnect and authentication races, proof response handling, automated-review bypass, inactive-host cancellation, stable schema filtering, and realtime payload exclusion. Update the MCP integration test to verify that an activated request holds the tool until the client responds.
GitOrigin-RevId: c8c7b6691a3f7756682bbcca9def1df0d1feb906
## What changed
- Handle `openai/userVerification` requests through `openai/elicitation/create` when the client advertises `userVerification` support.
- Validate request fields, size limits, and base64url encoding. Require a correctly shaped, bounded proof for acceptance; cancel invalid acceptance responses and discard proof material on decline or cancellation.
- Handle request and service cancellation, including cancellation received before request dispatch. Bound early-cancellation storage and cancel new verifications when capacity is exceeded.
- Keep verification inactive in Codex: cancel requests without prompting until the typed app-server and UI path is available.
## Testing
Add tests for request and proof validation, malformed modes, cancellation races and capacity limits, timeout-pause cleanup, and independent concurrent requests. Add integration coverage showing that verification does not prompt or prevent tool and turn completion before activation.
GitOrigin-RevId: 6313c1be40fae0b33cc3ce0f8fe025b4124ed2ef
## Why
Experimental context activation previously checked the provider and account eligibility without checking model support. Child sessions also inherited token-budget activation from their parent, even when starting fresh with a different model.
## What changed
- Add `ModelInfo.supports_experimental_context`, defaulting to `false`, and enable it for the bundled `gpt-6-astra` model. Require this capability when activating experimental context.
- Snapshot configured token-budget preferences before startup activation. Restore them for fresh child sessions before applying their starting model's defaults, while history forks retain their parent's activation.
- Pass unresolved token-budget preferences to child sessions so they can use their own model's prompts.
## Testing
Extend coverage for unsupported models, model-switch guidance under explicit and experimental activation, and child configuration from both active and inactive parents. Verify that omitted capability metadata defaults to `false`.
GitOrigin-RevId: 02df9e171682267232fa923d5ea3f7af36527808
## What changed
Add the disabled-by-default `reasoning_effort_override` feature for OpenAI models with `use_responses_lite` enabled. Append a trusted `configuration_update` after accepted input when no effort is established in surviving history or the resolved effort changes. Preserve the existing history prefix and continue sending the request-level reasoning effort.
Share effort normalization through `ModelInfo::resolve_reasoning_effort` so requests and history updates resolve `ultra` consistently and translate `persistent` to `disabled`. Exclude other custom effort values from history updates, and compare only against harness-authored configuration items.
## Testing
Add integration coverage for effort transitions, deduplication, history prefix and cache-key preservation, alias normalization, and feature/provider/model gating. Add unit coverage for model-specific `ultra` resolution, fallbacks, and `persistent` translation.
GitOrigin-RevId: c3fe7050058076454d8ea20054a618bca9d48c7c
## What changed
Replace `features.guardian_thread_context` with `features.guardianv2.thread_context` and update the configuration schema. The setting controls thread-owned context for synchronous and asynchronous Guardian, defaults to `false`, and remains independent of `features.guardianv2.enabled`.
## Testing
Update configuration tests to cover the nested setting, profile overrides, and enabling thread context while Guardian v2 is disabled. Migrate Guardian approval, history, and async scorer tests to the new configuration key.
GitOrigin-RevId: 54a91555eb68001e0adedc8a07bdbc5ea2273f9b
## Why
Refreshed Apps catalogs need to survive connection reuse. Catalog revisions scoped to the connection set can lose refreshed tools during reconciliation and invalidate prepared calls for unrelated servers.
## What changed
- Store tools, revisions, and refresh coordination on each MCP client, and key cached bindings by client identity and revision.
- Preserve existing binding snapshots while rejecting stale calls before preparation. Wait for active calls to finish before publishing a refreshed catalog.
- Add `CodexThread::refresh_codex_apps_tools` to reconcile the runtime and return the refreshed client's raw Apps inventory alongside tool names eligible under that runtime's generic MCP policy. Keep hidden and disabled tools in the inventory for callers to apply app-specific policy.
## Testing
Add regression coverage for refreshed catalogs surviving client reuse, unrelated calls remaining valid, binding cache invalidation, and refresh snapshots retaining the client's own inventory when another client wins the shared-cache race. Update stale-call and preparation tests to use client-owned catalogs.
GitOrigin-RevId: f2308c81f7474eb31f3380c091c977030123cda2
## What changed
Capture the ID from `response.created` and pass it as `parent_response_id` in Guardian review and classifier request metadata. Clear the current response ID before sampling retries so tool reviews cannot inherit a failed response's ID.
Request Guardian credits with `guardian_credits_requested` on eligible parent requests. Remove the ticket protocol, transport attachment, and ticket-specific body redaction. Keep ordinary app-server client `parent_response_id` values inside `x-codex-turn-metadata` rather than promoting them to Guardian request metadata.
## Testing
Update coverage for HTTP fallback, WebSocket review reuse, missing response IDs, classifier transport retries, and code-mode yield/resume attribution. Extend app-server tests to verify client metadata placement over HTTP and WebSocket.
GitOrigin-RevId: c1665e56382ecec8d260fc2ca0ecd5e20b0b2391
## Why
Plugin updates made by another process do not notify a loaded session's hook runtime, leaving it with stale hooks.
## What changed
Compare the current plugin hook sources and load warnings with those retained by the hook runtime during turn construction. Refresh hooks when either differs so existing sessions pick up external plugin updates.
## Testing
Add an app-server regression test that updates the shared plugin store without notifying the server and verifies that successive turns in the same thread run the installed hooks across an upgrade and a rollback.
GitOrigin-RevId: d3a2653ac4c069d9d8a02f30e21e4506d76a091c
## Why
Background and empty-input turns could lack a `root_turn_id`, and detached memory requests omitted turn identity entirely. Tasks without a root could also adopt one from coalesced mailbox input.
## What changed
- Set `root_turn_id` to the task's turn ID at task start unless an inherited or recovered root is already present.
- Stop assigning roots from mailbox input or steering an active turn.
- Give detached memory requests a fresh UUID for both `turn_id` and `root_turn_id`, included in turn headers and client metadata while still omitting session and thread identity.
## Testing
Extend assertions for background turns, empty input, goal continuations, manual compaction, and detached memory requests. Exercise mailbox coalescing with both independent and inherited roots to verify the task keeps its established root.
GitOrigin-RevId: ee0f2f1b43542a9f5884f694c1d94341b476779c
## What changed
- Introduce an async-question editor component with per-question drafts, navigation, replay deduplication, and submit or queue handling using the shared composer.
- Add bounded `AnsweredQuestion` framing that truncates question text at a UTF-8 boundary and flattens line breaks before prepending it to an answer.
- Add `prompt_stack_back` and `skip_question` keybinding actions and the `tui.question_esc_back` setting. Normalize `Ctrl+]` and `Ctrl+5` for key matching and conflict detection, and let default question shortcuts yield to explicit bindings.
- Flush buffered typing in both the main composer and the covering view so background input cannot keep the draw loop waiting.
The async-question component is not yet connected to the TUI event flow.
## Testing
Add regression coverage for bounded Unicode question framing, question-shortcut conflicts, and paste-buffer flushing in background and covering editors.
GitOrigin-RevId: 4098043cf588ddafc05c27505645495edd690cb9
## Why
Clients need a per-thread Daybreak toggle that survives restarts and can be
restored on resume without changing the access program of an active or future
turn.
## What changed
- Add experimental `daybreakEnabled` support to `thread/metadata/update` and
expose the saved value on thread responses.
- Store the preference in SQLite, including for threads without a first turn,
and preserve it through reads, resumes, reconciliation, and restarts.
- Copy the preference when forking a thread while keeping subsequent updates
independent.
- Keep `daybreakEnabled` separate from the per-turn `cyberAccessProgram` field;
app-server does not derive one from the other.
## Testing
- Cover persistence across restarts, cold reads, reconciliation, and forks.
- Verify metadata updates do not alter the access program of active or later
turns.
GitOrigin-RevId: bcf987a9fcd7b0ac8a88b1c8f0df06b33ed8ad6e
## Why
Guardian reviews must not lose user authorization constraints or reuse an
unreadable or incompatible parent checkpoint after compaction.
## What changed
- Retain bounded excerpts of oversized root user messages across compaction,
resume, and rollback, and recover excerpts from legacy Guardian history when
available.
- Require thread-owned Guardian review sessions and asynchronous scoring to
reuse only non-empty checkpoints produced by a compatible review model.
- Fail closed instead of reviewing without the required checkpoint when reuse
is disabled, compatibility is unknown, or checkpoint content is unusable.
## Testing
Expanded retained-context, review-session, asynchronous-scoring, and app-server
coverage for oversized instructions, legacy recovery, model incompatibility,
missing content, resume, rollback, and disabled checkpoint reuse.
GitOrigin-RevId: f30d837197e0d838e656a632109f490c38208f5e
## What changed
- Add rendered HTML alongside the original Markdown when copying a whole response through the native clipboard, so rich-text destinations preserve headings, lists, tables, code, and other formatting.
- Keep code-block, blockquote, transcript, terminal, and WSL clipboard copies as plain text.
- Escape raw HTML, omit remote image sources, and render unsupported link destinations as visible text when producing clipboard HTML.
## Testing
- Add coverage for rich formatting, local and unsafe links, inert images, fenced tables, copy selection formats, and clipboard fallbacks.
GitOrigin-RevId: c6f5edd88b65f9e9b1ddc5618442868cf47ee560
## Why
Guardian reviews need the original user instructions even when compaction or
transcript selection removes them from the active conversation window.
## What changed
- Capture complete user messages in host-owned retained context and include them
as ordered authorization evidence alongside verified answers.
- Omit oversized instructions atomically and emit an explicit incomplete-evidence
notice instead of exposing a potentially misleading partial permission.
- Mark user messages inherited by forked agents so they remain model-visible
without becoming child-local authorization.
## Testing
- Cover retained instructions across compaction, resume, rollback, and agent
forks, including oversized evidence and legacy context behavior.
GitOrigin-RevId: 97122509d818c90d2f87c6a1b29c99c05ad0316e
## What changed
- Render sparse, fading stars across the composer when using an Astra model in a true-color terminal.
- Preserve composer content, cursor state, effort effects, and terminal colors, and pause the animation while popups are open.
- Add the default-on `tui.whimsy` setting so decorative effects can be disabled independently. Sparkles also respect `tui.animations`.
## Testing
- Cover model and setting eligibility, terminal color handling, protected composer cells, popup behavior, effort effects, and layout stability.
GitOrigin-RevId: fe0471ebef0bca21c44e1d8f731d46959eba0165
## Why
Guardian approval actions can contain paths from a remote executor whose path convention differs from the host, such as Windows paths reviewed on a POSIX host. Converting those paths to host-native absolute paths prevents the action from being reviewed.
## What changed
- Render command working directories using the executor's reported path convention, and preserve URI-backed paths for attribution.
- Carry foreign command and patch paths through Guardian events and app-server schemas as legacy path strings.
- Bound remote plugin attribution within the overall review deadline and reject Guardian action payloads that exceed the review byte limit.
## Testing
- Cover Windows and POSIX executor path rendering, foreign patch paths, protocol round trips, oversized payload rejection, and remote Guardian review context.
GitOrigin-RevId: 38be0fcdac897139519e74e077eb5cb4f8f8017e
## Why
Windows sandbox setup reconciles persistent deny ACLs against the paths supplied for a session. The `codex sandbox --permission-profile` path supplied an empty list, which could discard the profile's deny-read restrictions.
## What changed
Resolve deny-read paths from the selected permission profile and workspace roots before starting a Windows sandbox session, and pass them through to setup.
## Testing
Add a Windows CLI integration test that launches the same managed-deny profile twice and verifies that denied file reads and DLL loads remain blocked while allowed access still works.
GitOrigin-RevId: 6ec8b6a13a33b862d7b152eadbbdde3146de4b7d
## Why
Guardian reviews for delegated workers need the current root instructions and verified answers even after the parent context is compacted. Approvals must also become stale when that root authorization changes.
## What changed
- Build bounded root review evidence from retained context, preserving source order and answer scope while prioritizing user instructions over optional assistant context.
- Recover retained instructions from Guardian history after compaction and mark authorization incomplete when required instructions or answers are unavailable.
- Version root authorization in synchronous and reusable review sessions so an allow result is cancelled when its evidence changes.
- Strip parent-only Guardian approvals when forking worker history in retained-context mode.
## Testing
- Cover retained and legacy context modes, oversized evidence, message limits, parent compaction, and authorization changes during review.
GitOrigin-RevId: 658219b7cee08f2752adcea9966268fd21727976
## What changed
- Extend `ApprovalReviewContributor` with a `decide` hook that can allow an
action, return a synchronous review result, or hand the request to the user.
- Pass contributors the request's approval state and a callback bound to the
existing synchronous reviewer. Review results satisfy the review gate while
the host continues to enforce permissions.
- Add structured reasons for requesting a fresh Guardian review and select the
first contributor decision in registration order.
GitOrigin-RevId: ec84474b3fcbcf1027c8502aa1c2947c10149f9d
## Why
Queued prompts and `request_user_input` answers can be persisted in a different
order from when the host accepted them. Using persistence order can therefore
reorder retained instructions during replay or apply the wrong rollback
boundary.
## What changed
- Reserve an acceptance sequence for user prompts and elicitation responses
when retained thread context is enabled.
- Persist that sequence with user-message metadata and verified answers, and
use it when ordering, bounding, replaying, and rolling back retained context.
- Keep events without acceptance metadata compatible with legacy recording
order.
## Testing
- Cover delayed queued-input recording, rejected prompts, checkpoint replay,
compaction, rollback migration, and legacy retained-context behavior.
GitOrigin-RevId: 42d24465cc2033bc51c0c2da79d3c0884a8ad98a
## Why
Guardian review needs the original user instructions alongside verified answers, even after compaction, resume, or rollback. A summarized or legacy checkpoint cannot establish a complete instruction history.
## What changed
- Capture text user messages in retained context when `guardian_thread_context` is enabled, preserving their message identity through compaction and replay.
- Keep retained instructions and verified answers in arrival order, with independent size and completeness tracking for each family.
- Roll back retained evidence at the exact user-message boundary, including steers that share a turn ID, and apply the same semantics during rollout migration.
- Treat checkpoints without retained user messages as incomplete while preserving their verified answers.
## Testing
- Cover capture, compaction, resume, rollback, child forks, legacy checkpoints, storage bounds, and rollout migration.
GitOrigin-RevId: 72706731b54e5ac8645db61b446d2401afb42235
## What changed
- Request and parse server-issued Guardian tickets for eligible Codex backend responses.
- Scope each ticket to the response that produced a Guardian review or classifier request, including HTTP and WebSocket retries, without adding it to model-visible or persisted context.
- Validate ticket shape, reserve its metadata keys, redact it from debug and request-body logging, and attach it only at the Guardian transport boundary.
## Testing
- Cover ticket parsing, endpoint and authentication routing, retry scoping, classifier retries, and redaction for compressed and uncompressed requests.
GitOrigin-RevId: 6219dd15c9f19ed3387de516aac1b8e7c9cdb0e3
## Why
Automatic title generation used a provisional thread name and only applied the
generated result while its thread remained active. Switching threads could
therefore leave the originating thread without its generated name.
## What changed
- Track title-generation requests by thread so results are persisted for the
originating thread, while preserving any name set before generation finishes.
- Show a `renaming...` spinner instead of a provisional name, including across
thread switches and failure paths.
- Add `thread-name` items to the status line and terminal title, and include the
generated thread name in both default layouts.
## Testing
- Cover automatic naming, manual-name precedence, thread switching, failed
requests, deduplication, and status-surface rendering and animation.
GitOrigin-RevId: a03ae4849bedec9f62f256fadad72c1685ce46e0
## Why
A remote process can finish while a network policy review is still pending. Normal process cleanup should withdraw that review without turning the completed command into a review failure or losing its output.
## What changed
- Record whether a network policy request was withdrawn because the process finished, was cancelled, lost its executor connection, or timed out.
- Treat normal process completion as cleanup while retaining fail-closed behavior for other cancellation causes.
- Preserve explicit network denials before policy persistence so cleanup cannot replace the reported call outcome.
## Testing
Add an integration test that completes a remote process during a pending network review and verifies that the command reports its successful exit and output without approving the withdrawn request.
GitOrigin-RevId: 7f42d75631ee29eba43bf04cc953eea490f553fc
## What changed
- Add optional per-model Guardian modes for computer use, shell, code mode,
file changes, MCP, network, and permission requests.
- Apply disabled, synchronous, or adaptive review by action category while
preserving legacy configuration when model policy is absent.
- Bind cached risk scores to the active model policy, thread settings, and
environment selections so outdated scores cannot approve later actions.
- Keep unknown review modes on the synchronous path and ignore unknown policy
fields for forward compatibility.
## Testing
- Cover policy serialization, legacy fallback, scoped tool classification,
disabled categories, and score invalidation after policy changes.
GitOrigin-RevId: f334a5f4fffb198da66cde3a400233e0df650516
## What changed
- Add the stable, default-on `unified_exec_tty` feature.
- When disabled, omit `tty` from the `exec_command` tool schema and reject calls that explicitly request a TTY.
- Continue to support commands that omit `tty` or set it to `false`.
## Testing
- Add unified exec coverage for the disabled tool schema, explicit TTY rejection, and non-TTY command execution.
GitOrigin-RevId: c5934fe9db1423170b891c7ecd0188792cd03f42
## What changed
- Add the macOS-only `allow_symlinked_codex_home` user setting. When enabled in the execution host's `$CODEX_HOME/config.toml`, writable roots at or beneath that home may traverse symlinks.
- Keep the exception disabled by default and prevent project config, command-line overrides, and ignored user config from enabling it. Other writable roots remain subject to symlink checks.
- Propagate the resolved setting through local, interactive, and exec-server sandbox paths, including `CODEX_HOME` aliases.
- Explain the opt-out in symlink rejection errors, including that it trusts targets outside `CODEX_HOME` and targets that change between commands.
## Testing
- Add macOS coverage for shell commands, patches, filesystem helpers, process execution, and interactive startup with enabled, disabled, aliased, and out-of-scope homes.
GitOrigin-RevId: 99fcdf611200c9e1b7713cf06f7fdea5bfa7f089
## What changed
Remove guidance that told `send_message_to_user_async` to request missing
information, preferences, constraints, clarification, or approval. Keep the
tool focused on critical blockers, direction-changing findings, and replies to
user questions or status requests during ongoing work.
GitOrigin-RevId: c764ffc2b9c14e37467bd25ee3ed07407d550290
## What changed
- Add the experimental `worktrees` feature and a shared `--worktree` flag for new and forked `codex exec` sessions.
- Create each enabled session in a managed Git worktree, use that checkout as the session working directory, and bind the checkout to the new thread.
- Share the configured worktree pool with Desktop while leaving automatic cleanup disabled for CLI allocations.
- Reject unsupported commands, remote execution, ignored user configuration, ephemeral sessions, and use without the feature enabled before allocating a worktree.
## Testing
- Cover flag placement and inheritance, supported and rejected command combinations, worktree allocation and thread ownership, configuration gating, and compatibility with existing worktree-backed sessions.
GitOrigin-RevId: 011ff4639b09e8992c50d7b823df23e71798670e
## What changed
- Add the `codex-attachment-store` crate with storage-neutral attachment metadata, references, errors, and an asynchronous persistence interface.
- Provide an inline implementation that preserves attachment bytes as media-typed base64 data URLs.
- Inject the store into `ThreadManager`, expose it to consumers, and retain inline storage as the default for existing entry points.
## Testing
- Verify inline storage round-trips binary, text, PNG, and JPEG data.
- Verify attachment debug output redacts URLs while retaining file IDs.
GitOrigin-RevId: 7688dcd3c89d7540ed2398f3e7c63881fbfcda97
## What changed
- Add `PromptImageMode::HIGH_DETAIL` and `PromptImageMode::ORIGINAL_DETAIL`
constants with the standard resize limits.
- Use the shared modes during core image preparation instead of defining the
limits locally.
- Cover the dimension and patch budgets for both detail modes in the image
utility tests.
GitOrigin-RevId: 27fdc77719f23d2e8f1060886576b3be843a8491
## What changed
- Add the hidden `gpt-6-astra` model definition, including its reasoning levels,
tool capabilities, context limits, agent instructions, and review policies.
- Reorder existing model priorities around the new catalog entry and provide the
browser-use policy to the bundled auto-review model.
- Keep TUI snapshots pinned to `gpt-5.6-sol` and make Guardian coverage read the
policy from the model selected by each test case.
- Allow the expanded `models.json` through the repository blob-size check.
GitOrigin-RevId: 039b224b91ca35c8d894cf6d23568bc6dc18ceeb
## Why
Guardian can reuse an opaque parent compaction only when the checkpoint's
recorded producer hash matches the scoring model. Missing or incompatible
provenance must not allow an asynchronous score or cached approval to omit
compacted context.
## What changed
- Record the producing model's compatibility hash on compaction history items
and expose the latest checkpoint hash through conversation snapshots.
- In thread-owned context mode, fail closed and require synchronous review when
checkpoint reuse is enabled but the latest checkpoint is incompatible or has
unknown provenance.
- Reject incompatible checkpoints in the sampler while preserving the legacy
context behavior.
## Testing
Add coverage for local, remote, resumed, compacted, and rolled-back histories,
including matching, mismatched, missing, and empty compatibility hashes.
GitOrigin-RevId: 1ce959cb276edc602fd7dfa442133c7fe5e53857
## Why
Guardian authorization reviews need host-verified `request_user_input` answers to
remain aligned with thread history across compaction, resume, and rollback.
## What changed
- Record verified question-and-answer pairs in retained thread context when
`GuardianThreadContext` is enabled, and source both local and delegated Guardian
review evidence from that context.
- Preserve complete answer records within the evidence budget. Mark authorization
context incomplete when records are unavailable or oversized, and defer cached
fast approvals in that case.
- Keep the existing runtime-only answer path for threads that do not enable the
thread-owned context.
## Testing
- Cover answer retention through compaction and resume, removal after rollback,
source-call eviction, oversized answers, delegated review evidence, and legacy
behavior.
GitOrigin-RevId: 01f6f4541515434a0d00fdde318ff59f2f8bd2eb
felixxia-oai