## Why
PSEC API symbols can be present on transitional Windows builds where MXC is not enabled. Availability detection needs to verify that a native process security environment can actually be created.
## What changed
- Replace `mxc-sdk` with pinned `appcontainer_common`, `learning_mode_windows`, and `wxc_common` dependencies, and update Cargo and Bazel dependency metadata.
- Use MXC's cached create/close probe for `is_available()` and query native deny-path support through `SecurityEnvironmentApi` before launching requests with denied paths.
- Adapt request construction and the existing policy test to the vector-based environment field, and update the sandbox documentation.
GitOrigin-RevId: e8cc6a35d46884d0a069b747d33e711512ec1596
## Why
Account discovery and cloud configuration GETs can fail after connecting but before receiving response headers. These request failures previously bypassed system proxy fallback.
## What changed
Allow bootstrap GETs to retry through the system proxy on request errors, alongside the existing connection failure and timeout cases, when fallback is enabled.
## Testing
Add regression coverage for connections closed before response headers on `accounts/check` and `config/bundle`, verifying successful proxy retries with the original request headers. Extend coverage to ensure HTTP responses with status `401`, `403`, `407`, `429`, or `503` do not trigger fallback, and network policy denials prevent requests to both the origin and proxy.
GitOrigin-RevId: ac34c3bcfe3bd81c905a7e616d8b821879fbe2c9
Use Codex `0.162.1` instead of `0.156.1` for
`exec-server-stable-release-test`, updating the Bazel release archive version,
checksum, and repository reference.
GitOrigin-RevId: 304108b223da1e5506483f53c476a55a8f31ce71
## Why
Equivalent local source paths can fail to match an already-added marketplace, and redirected managed roots can lose their managed classification on Windows.
## What changed
- Compare local marketplace sources after filesystem normalization.
- Reuse the resolved request path when locating an existing local marketplace so retargeting a configured junction does not switch the returned root.
- Accept both the configured managed root and its canonical target on Windows while continuing to reject unowned aliases to that target.
## Testing
Add Windows regression tests for canonical and legacy path spellings, retargeted local-source junctions, and redirected managed roots with unowned aliases.
GitOrigin-RevId: f1ae46e8e7384075ed1baa6b33b2821f795e17f8
## What changed
Pass the parent turn's `cyber_access_program` to Guardian reviewers and asynchronous classifiers. Use `daybreak_blue` for either Daybreak selection, preserve `standard`, and omit `access_programs` when no program is selected.
Capture the selection with the owning turn so asynchronous observations retain it across later turns. Resolve classifier programs using current authentication and the same provider and API-key feature policy as ordinary model requests.
## Testing
Add regression tests for program changes across reused reviewer sessions with API-key and ChatGPT authentication, snapshot and conversation classifiers at low and high risk, and enabled, disabled, and unsupported-provider API-key policies. Verify parent requests retain their selected program.
GitOrigin-RevId: 447f306df3a6bd6805464b819950690c751b04b4
## What changed
Add an optional `retain` flag to `TurnToolOutput` for `turn/start`. When set to `true`, pass the output to the core with a retention annotation to request retention in the thread's model history. The flag defaults to `false`, preserving existing behavior.
Update the generated JSON schemas, TypeScript types, and Python bindings to expose the flag.
## Testing
Add an integration test verifying that a retained tool output reaches the model and preserves client-authored sender metadata in persisted history, including the receiver message ID.
GitOrigin-RevId: 52893a8fcb308f26e77ba8f0bee9990073b26d54
## Why
Reentering V8 during termination can replace uncatchable cancellation with a catchable JavaScript exception, allowing a script to continue after cancellation.
## What changed
Skip JSON conversion and exception throwing while V8 execution is terminating, preserving cancellation through `image()` getters and JSON fallback.
## Testing
Add regression coverage for cancellation during JSON fallback and reentrant image getters, including prompt termination through the standalone host and continued usability of another session. Extend serialization error tests to cover failing image getters alongside circular JSON.
GitOrigin-RevId: f03dd131a62724106fad96111292ddf5b9dc99f6
## Why
A credential mismatch can trigger setup that rotates both sandbox account passwords. Before allowing repair, validate the account that logged on successfully and ensure that neither account has been replaced or has an unowned runtime registration.
## What changed
- Validate runtime records and successful logon tokens, checking account SIDs, rejecting administrators, and requiring enabled `CodexSandboxUsers` membership.
- Before repair, verify recorded account SIDs and reject existing same-family package registrations for unrecorded accounts. Propagate package-query failures while allowing initial migration when no registrations exist.
## Testing
Add tests for malformed records and unrelated logon errors, plus an ignored disposable Windows Sandbox fixture covering successful logons, group membership, SID changes, migration, and unowned registrations.
GitOrigin-RevId: bafedb52cf9bd484250ccac3b163d2041891283f
## Why
JavaScript objects containing Serde's reserved JSON keys can be reinterpreted during deserialization, allowing nested `RawValue` markers to bypass the parser's normal recursion limit.
## What changed
Reject `$serde_json::private::RawValue` and `$serde_json::private::Number` object keys before passing V8's serialized JSON to `serde_json`. Report a `reserved JSON object key` serialization error while continuing to allow marker text in strings and longer keys.
## Testing
Add runtime regression coverage for nested and escaped marker keys, recursion limits, normal JSON conversion, and session recovery without overwriting stored values. Extend the host-backed integration test to verify that stored values remain available across turns after rejection.
GitOrigin-RevId: 27ddce08e1ffe98ec9dffe02473a815ceae2cc89
## Why
Remote configuration reads need a bounded wait without disrupting valid in-flight work on connections that cannot reconnect.
## What changed
- Add `read_environment_config_with_timeout` to `ExecServerClient` and `Environment`, bounding RPC sending and receiving after connection establishment. Local reads retain their existing behavior.
- Return a typed `ExecServerError::RpcTimedOut` and classify it as retryable for read-only preparation.
- Share timeout handling with environment-info requests. Close the timed-out transport and request recovery only when a reconnect strategy exists; otherwise, keep the connection open.
## Testing
Add a regression test verifying that a timed-out configuration read preserves an in-flight stdio read and allows subsequent reads on the same connection, including after a late response.
GitOrigin-RevId: 6785d5846f4c3b07a6e7c505e359238609c3a6b6
## Why
Resumed threads can retain stale capability root locations when the current environment supplies an explicit owner configuration. Matching roots from that configuration previously could not refresh persisted thread roots.
## What changed
Refresh persisted roots from the current attachment when both the root ID and environment ID match, including roots selected by owner-provided configuration. Preserve persisted locations when no matching root is supplied, and continue using the owner's selected roots rather than the executor's shared roots.
Apply the same merge behavior to capability root inspection and per-step resolution.
## Testing
Extend the remote environment regression test to cover owner-provided configurations with and without refreshed roots, including an executor root location that differs from the owner's selection.
GitOrigin-RevId: ad3a639924b348d6d5337ccc64dc8c08234276e3
## What changed
Move `ExecServerProcess` into `core_test_support::exec_server` and update the sandbox, plugin, access, and turn-input tests to use it. Preserve the fixture's startup timeout, temporary `CODEX_HOME`, WebSocket URL discovery, and child-process cleanup.
GitOrigin-RevId: 152de3a83f4ad39e2c1223e15438608dba452850
## What changed
Add `TurnInput::AnnotatedResponseItem` with a caller-supplied `retain` annotation. For function-call outputs, `retain: true` sets `client_authored` history metadata while keeping annotations out of model requests. Accept annotated items through the existing turn submission paths, including continuation.
## Testing
Add an integration test covering retention metadata during turn start, steering, idle submission, and rollout storage. Verify that ordinary outputs remain unmarked and model requests contain neither `retain` nor `client_authored`.
GitOrigin-RevId: 7285dde31149b17b0dcf31d4ea1c7cba66d9efe6
## Why
A credential bound to a host with MITM hooks could also be used at an alias without hooks, allowing the proxy to inject the real credential without enforcing hook policy.
## What changed
Reject requests to unhooked aliases when their selected brokered credentials are also bound to a hooked host. Check both HTTP forwarding and MITM requests before replacing dummy credentials, returning `403` with `blocked-by-mitm-hook` for denied requests.
Use the same destination and credential-selection rules for alias checks and injection, including configured URL prefixes, safe paths, equivalent credentials, merged Basic authentication fields, and environment scope.
## Testing
Add regression coverage for built-in and configured provider aliases, IPv6 destinations, credential selection, and unrelated credentials. Add an agent-started proxy test that verifies credential masking and alias denial.
GitOrigin-RevId: 12be41654761cedcf87b170f7661d6566f7a864e
## Why
A tool can return before its background watcher emits `ExecCommandEnd`. Waiting for that event first can discard an earlier `TurnComplete`, causing the shell snapshot test helper to time out.
## What changed
Update `run_tool_turn_on_harness` to track both the matching `ExecCommandEnd` and `TurnComplete` in a single event loop, returning only after both have arrived regardless of order.
GitOrigin-RevId: c9b749a46eda1244aa3e80fd88b663d110d67d1b
## What changed
Add the disabled-by-default `subagent_default_context_limits` feature and expose it in the configuration schema. When enabled, shared configuration for spawning and resuming subagents clears inherited `model_context_window` and `model_auto_compact_token_limit` overrides so subagents use their model's default context window and auto-compaction threshold.
GitOrigin-RevId: 5168ae2b4fbe72c533d8c6152922a8bceb2c5cbd
## Why
A local command can exit while a descendant keeps its inherited output pipes open, delaying `exec_command` completion and turn completion.
## What changed
Start the bounded output drain when a local exec-server process exits, whether exit is reported by an event or recovered through `process/read`. Remote execution continues waiting for output closure so buffered or delayed output is retained.
## Testing
Add regression coverage for local shell snapshot execution completing before a descendant releases stdout, preserving the foreground output and exit code. Add remote event-stream cases that retain output arriving after both reported and recovered process exit.
GitOrigin-RevId: d38bcd394be42cf48d2af02733e883b02d1dd62f
## Why
A running shared background server owns its feature settings until it restarts. Differences from a client's configuration files or defaults should not trigger a compatibility warning or a restart request.
## What changed
- Check shared-service features only when explicitly overridden on the command line.
- Exclude overrides superseded by active legacy managed configuration or feature requirements, while supporting older servers without `configRequirements/read`.
- Pass only the remaining explicit feature overrides to a requested daemon restart.
## Testing
Update compatibility tests for stale daemon overrides, explicit enable/disable requests, managed configuration, and older servers. Extend CLI startup tests to verify the feature overrides persisted after a restart.
GitOrigin-RevId: ac92c9c02cd70fa233203ebef1182fd119325dd1
## Why
Interrupted automatic goal continuations reset the empty-response counter, allowing repeated interruptions without activity to keep a goal running indefinitely.
## What changed
Count interrupted automatic continuations without activity toward the existing three-turn limit that marks a goal as `blocked`. Defer evaluation until the thread is idle and serialize it with turn-start accounting. Activity and user turns still reset the counter.
## Testing
Extend accounting tests to cover interrupted and mixed empty continuations, including resets after tool activity or user turns. Add an app-server regression case where a `PreCompact` hook repeatedly interrupts automatic continuations and verify the `thread/goal/updated` notification reports `blocked`.
GitOrigin-RevId: 4c34e3ed1ae612e97cf067c2aa76836b10c50ef5
## What changed
Add `thread/items/read` to retrieve persisted items by `threadId`, `turnId`, and 1–100 `itemIds`. Return matching items in canonical stored order, omitting missing IDs and items outside the requested turn.
Add item ID filtering to the thread store while preserving inherited history and fork cutoffs. Require the experimental API capability for the new endpoint.
## Testing
Add coverage for stored ordering, turn scoping, missing IDs, request size limits, experimental capability gating, and inherited items across fork cutoffs.
GitOrigin-RevId: 9b243dd87577bd4fe36900c388a386b2e26ff2e0
## Why
Background workspace routing reads reload configuration even when signed out or using an API key, although routing requires ChatGPT authentication.
## What changed
Check cached authentication before reading accounts for workspace routing at app-server startup and connection initialization. Skip these background reads without ChatGPT authentication, while preserving configuration reloads for explicit `account/read` requests.
## Testing
Add regression tests covering signed-out and API-key startup and connection initialization, explicit `account/read` configuration reloads, and routing after ChatGPT sign-in, including propagation of configuration errors.
GitOrigin-RevId: 8b90ee609ed24f8618cd21f160eb7001703b8bd1
## What changed
- Move the SQLite schema, database filename, and shared pool registry into `local/pool.rs`.
- Share channel insertion between runtime writes and template setup, using typed board IDs and channel descriptions.
GitOrigin-RevId: c57a79c49fe9003b3c73f38010ce9293275a714c
## What changed
Expose `LocalBoardSetup` and `configure_local_board` to load initial channels and optional descriptions before agents start. Add a `configure_board` example and setup documentation.
Save version 1 templates and channels atomically in SQLite. Identical templates are safe to retry; conflicting templates, previously used boards without a pinned template, and deleted boards are rejected. Setup accepts an optional creation timestamp and leaves agent access unchanged. Remove the pinned template when deleting a board.
## Testing
Add an integration test covering channel metadata after reopen, identical retries, conflicting template rejection, retries after adding a channel, and rejection after board deletion.
GitOrigin-RevId: 0b5c5439ab127fb5c275f024962a373a56635ad0
## Why
The Linux sandbox uses bubblewrap for filesystem isolation and seccomp for syscall filtering, but its command type, syscall-filter module, and integration test suite still used Landlock names.
## What changed
- Rename `LandlockCommand` to `LinuxSandboxCommand`, `src/landlock.rs` to `src/seccomp.rs`, and `tests/suite/landlock.rs` to `tests/suite/sandbox.rs`, updating imports and existing tests.
- Clarify the retained legacy Landlock implementation and its filesystem-policy limitations.
- Update the README to describe existing network filtering, `AF_VSOCK` and `io_uring` restrictions, and managed-proxy Unix socket behavior, including allowed Unix socket pairs.
Sandbox enforcement behavior is unchanged.
GitOrigin-RevId: be4769d5a10b90605990eb58451e83fdf1c31222
## Why
Requests with `Connection: close` must not reuse the connection even when the server responds with `Connection: keep-alive`.
## What changed
Update `hyper` from 1.8.1 to 1.11.1 in `codex-rs/Cargo.lock` and add the corresponding Bazel lockfile metadata.
## Testing
Add a regression test that sends two requests with `Connection: close` to a server that ignores the header and verifies that the second request uses a new connection.
GitOrigin-RevId: 72b464c8ea3d9a1ad5d9e62f7896ea9a4f15a93c
## Why
The remote environment test can steer before the wait tool call is recorded, discarding the call. The session replacement test can close the client while agents overview RPCs are still pending, leaving the proxy writing to a closed socket.
## What changed
- Wait for the `wait-for-active-environment` function call event before steering the active turn.
- Wait for `AgentsOverviewThreadsLoaded` before shutting down session replacement test cases that open the agents overview.
GitOrigin-RevId: 886112a56ff6e1016efe30dbbd0256807bc1cc85
## Why
Remote boards can allow replies while denying new threads. Agents need to discover these effective permissions and receive actionable details when an operation is denied.
## What changed
- Expose optional `board_permissions` and per-channel `permissions` in `get_channels`, preserving the legacy response shape when permission metadata is absent.
- Preserve HTTP 403 `permission_denied` responses as structured tool errors with a message and optional `action` and `resource`. Mark denied calls as unsuccessful and truncate oversized error details to fit the output budget.
- Pass through service-computed permissions without evaluating access rules locally.
## Testing
Add remote-board scenarios for direct tools and code mode covering legacy responses, reply-only permissions, a denied post, and a successful reply, plus a snapshot of the direct tool exchange.
GitOrigin-RevId: 76594bbc0a1283ff3c3c8682bd7615baa5ade428
## Why
Herdr sessions can gain attached clients after Codex starts. Successful native clipboard copying should still forward the text to the attached terminal, even without inherited SSH variables.
## What changed
Detect Herdr sessions with `HERDR_ENV=1` and enable terminal forwarding for `/copy` and `Ctrl+O` even when native copying succeeds. Use OSC 52 directly when outside tmux, while preserving the native copy result.
## Testing
Add a routing test verifying that a Herdr session copies natively before sending OSC 52 and retains the successful native clipboard lease.
GitOrigin-RevId: c43c08ca037ff51e902267dc8636889493f5c30c
## What changed
Add `preserve_fork_prefix` to the multi-agent v2 configuration, defaulting to `false`. When enabled, full forks retain the parent's model-visible history, including commentary and tool records, and append the child's instructions. Legacy compaction without a reusable context baseline still rebuilds the child context.
Mark copied history as inherited, complete unfinished tool calls in the fork snapshot, and exclude inherited manual approvals from authorization review while retaining them in model context.
## Testing
Add coverage for preserved request prefixes, child instructions, legacy and paginated histories, Code Mode, missing inherited tool outputs, compaction fallback, and approval isolation across checkpoint replay. Update the noisy helper failure test to read its response before starting cleanup.
GitOrigin-RevId: ce9235dfa111c88d6ce66cb93d564fb63b326489
## Why
Pasting text ending in a newline into a composer line beginning with `> ` adds an unnecessary empty quoted line before the next Markdown block.
## What changed
Remove one trailing newline from nonempty blockquote paste content before adding quote prefixes. Preserve interior blank lines and the two unquoted newlines that move the cursor to the next block.
## Testing
Add a trailing-newline regression case, update the CRLF/CR expectations, and exercise trailing-newline input in the existing rendering snapshot test.
GitOrigin-RevId: 2367efa8253dd0512de8ba6333b39eba6381fba8
## Why
Clients need to mark threads read or unread without overwriting unseen results or another window's explicit mark.
## What changed
Add `thread/readState/update` for eligible durable local threads, gated by `initialize.capabilities.experimentalApi`. Requests include `threadId`, `expectedRevision`, and an operation of `{type:"read"}` or `{type:"unread"}`.
Marking read clears `firstUnread`; marking unread sets it to `threadStart`. Successful updates return the read state and notify subscribers through `thread/readState/changed`. Both operations require an exact revision match. Stale requests return `-32600` with `readStateConflict` and the current read state, requiring a fresh user action rather than a blind retry. Updates do not change thread recency.
## Testing
Add app-server coverage for experimental capability gating, explicit unread marks and notifications, conflicts for both stale operations, and marking read with a fresh revision.
GitOrigin-RevId: 775f6e9584dc91bd3c2ee9a309144b5baf0edffa
## What changed
Add the experimental `thread/readState/changed` notification with `threadId` and the committed `readState` receipt. Send it to existing thread subscribers when terminal activity updates read state or a revert clears a removed unread position. Emit terminal read-state updates before `turn/completed` so completion remains the last notification for that result.
Expose the notification in generated JSON schemas, TypeScript types, and Python SDK models. Document experimental capability gating, subscription lifetime, notification opt-out, and refreshing receipts when concurrent responses disagree.
## Testing
Extend the read-state integration test to assert that the notification receipt matches the receipt returned by `thread/read` after terminal activity.
GitOrigin-RevId: 28935352a881b7a5e2e7f629173c3b2061bd7941
## Why
Sessions sharing a transport can be admitted to different hosts. Each session needs its own routing token so subsequent RPCs reach the host holding its state.
## What changed
- Capture the optional `x-code-mode-route` metadata from successful `OpenSession` responses and attach it to subsequent session RPCs. Reject tokens longer than 256 bytes and keep new admission attempts free of existing session routes.
- Invalidate a routed session when an `Unavailable` response explicitly sets `x-code-mode-route-lost: true`, allowing a later operation to reopen it without replaying the failed execution. Ordinary `Unavailable` responses preserve the session.
- Allow up to five admission attempts for `Unavailable` and `ResourceExhausted`, with an immediate first retry followed by jittered exponential backoff.
- Order session failure with shutdown so late callback errors cannot cancel an in-flight `CloseSession` RPC.
## Testing
Add regression coverage for independent routing on a shared provider, route-loss recovery without execution replay, preservation of unaffected session state, and callback failures racing shutdown. Extend admission tests to verify the five-attempt limit and recovery tests to distinguish explicit route loss from ordinary unavailability.
GitOrigin-RevId: 5d60ef1afa56beb8c70ba7ab27865128225b0d3d
## Why
Realtime v3 voice validation used the v1 voice list, limiting the available voice choices.
## What changed
- Add a dedicated `v3` voice list containing the v1 voices and 16 additional voices, and use it to validate v3 requests.
- Expose `v3` in `RealtimeVoicesList`, defaulting to an empty list when omitted during deserialization.
- Update the configuration and app-server schemas, generated TypeScript and Python types, and voice-list test expectations.
GitOrigin-RevId: 7fc8060fe01d840f28eb92c3dfe49c5878c3c258
## What changed
- Add experimental `readState` to `thread/read` and a thread-ID-keyed `readStates` map to `thread/list` for eligible durable local user threads. Each receipt contains `firstUnread` and an opaque `revision`.
- Publish new visible terminal results before `turn/completed`, after flushing the rollout. Reading snapshots leaves activity unread; replayed history does not publish new activity.
- Clear unread positions removed by a paginated thread revert while preserving explicit thread-start marks and concurrent receipt updates.
## Testing
Add an integration test covering completed-turn receipts, repeated reads without acknowledgement, matching list receipts, and revert cleanup with a changed revision.
GitOrigin-RevId: e7f6ddfbb1fc2fa95d1ef2876d7f0f7b9f99ff65
## Why
A stale read acknowledgement must not clear unread results published after the client’s snapshot or overwrite another read-state edit. Read state also needs to survive thread metadata rebuilds.
## What changed
- Add `thread_read_receipts` and state APIs to query read state, publish thread attention, and mark threads read or unread.
- Track the first unread turn and require matching revisions for explicit edits, returning the current state on conflicts. Allow manually marking even an empty thread unread.
- Retain the last published turn across acknowledgements to suppress duplicate delivery. Keep receipts independent of rebuildable metadata and remove them on thread deletion.
- Return initial read states without creating receipt rows.
## Testing
Add tests covering stale edits, thread-specific initial revisions, repeated unread marks, duplicate publication, persistence across metadata rebuilds and restarts, clearing a reverted turn’s unread position, and deleted-thread handling.
GitOrigin-RevId: fee8c05c20903b1d7aea7e8b61c9248c7f623a72
## Why
Wrapping can retain a cursor sentinel one byte past the end of the input. Using that range to slice source text during hyperlink remapping can panic.
## What changed
Clamp wrapped range boundaries to the input length before calculating hyperlink columns and recording logical source ranges, keeping both aligned with the visible text.
## Testing
Add a regression test that extends a wrapped range past the input boundary and verifies that the line, hyperlinks, and logical source are preserved.
GitOrigin-RevId: c83c817df8d3ea790f7d126768092ae317ff9217
## What changed
- Remove `ContentItemMetadata`, provenance and namespace types, and the `content_item_metadata` protocol field while retaining `content_item_kinds` classifications.
- Simplify context fragments, extension contributions, and hook output to carry content without source attribution. Return MCP tool results directly without an attribution wrapper.
- Render context-window hints together in a single text fragment.
## Testing
Update Responses and Responses Lite request assertions to expect content-kind classifications without per-content attribution, and adapt context, hook, and extension tests to the simplified types.
GitOrigin-RevId: 201894cd4c93c6d4b4c41c845e7a9af1dd3c95ca
## What changed
Add `history_initialization` to `x-codex-turn-metadata`, distinguishing `new`, `cleared`, `cold_resume`, `warm_fork`, `cold_fork`, and `supplied_history`.
Classify forks by whether the source runtime is loaded and has not shut down. Preserve the classification for the runtime's lifetime, including warm resumes and compaction. This records how history was initialized; it does not establish whether tool metadata is missing. Reserve the field against client-supplied overrides.
## Testing
Extend coverage for warm and cold forks, cold resumes, warm reconnects, supplied history, WebSocket metadata serialization, and reserved-field filtering.
GitOrigin-RevId: 468153512a84d0f4d4ea742198a29e0fa3873a72
## Why
Durable remote-control RPC changes need to update the managed daemon's launch settings so future launches use the saved preference.
## What changed
- Save non-ephemeral `remoteControl/enable` and `remoteControl/disable` requests to `remoteControlEnabled` in `app-server-daemon/settings.json` for managed daemons.
- Preserve other settings and write updates atomically. Skip persistence when `daemon.lock` is held so concurrent lifecycle operations take precedence without blocking the RPC.
- Leave daemon settings untouched for ephemeral requests and unmanaged servers.
## Testing
Add integration coverage for durable enable and disable, ephemeral requests, and lock contention. Extend the unmanaged-server test to verify that no daemon settings file is created.
GitOrigin-RevId: 2baf261ed62f7c7ad87c9779ffb91c59e923f0f8
## What changed
- Add the disabled-by-default `features.credential_masking` flag to enable credential brokerage through an already enabled network proxy, retaining custom credential providers and managed configuration precedence.
- Prevent project configuration from overriding credential masking and apply existing credential-broker protections to project shell settings when masking is enabled.
- Keep brokerage inactive when the proxy is disabled. Warn at startup and after permission-profile changes when masking is inactive because sandboxing or the proxy is disabled, or provider environment keys conflict.
## Testing
Add coverage for configuration precedence, project protections in both configuration loaders, permission-profile transitions, inactive-masking warnings, and shell snapshot masking of built-in and custom credentials.
GitOrigin-RevId: 4bcb293356e8c1524bdaa4f1b95cbc1e935a5271
## Why
Parallel Bazel artifacts are advisory while Cargo remains the release path.
## What changed
- Set `continue-on-error` for Bazel matrix jobs covering builds, Windows symbols and signing, and macOS signing, packaging, and verification.
- Assign the main release build jobs in both workflows to the `bazel` environment with `deployment: false`.
GitOrigin-RevId: e8a0fd522ec6482c0f39abdfc8677018be409361
## What changed
Move incremental tool guidance out of namespace descriptions and into a developer message preceding each namespace declaration batch after the initial catalog. The notice covers newly added namespaces as well as changed ones, explaining that earlier tools remain available unless explicitly removed and that newer definitions replace earlier ones.
Retain the notice alongside tool declarations in full-history agent forks, and discard it when legacy compaction forks rebuild those declarations.
## Testing
Add unit coverage for multiple new namespaces sharing one notice. Update request-history snapshots for tool changes, removals and restoration, and regular Responses requests. Extend resume and fork tests to cover notice preservation without duplication and removal when rebuilding declarations.
GitOrigin-RevId: 05f79f5eb378a355cf935eabf63951015a9b454b
Remove the repeated `selected_capability_roots` initializers from the two
`TurnEnvironmentSelection` fixtures in
`mcp_context_preserves_selected_executor_order_and_unavailability` so the
test can compile.
GitOrigin-RevId: 6e773cdcba84b95220eb024d51619fea67780617
## Why
Disabling OpenAI analytics also disabled explicitly configured OTLP metrics collectors. Users should be able to export metrics to their own collectors independently of `analytics.enabled`.
## What changed
Apply the analytics preference only to the built-in `statsig` metrics exporter. Keep custom OTLP HTTP and gRPC exporters enabled regardless of that preference, and use `otel.metrics_exporter = "none"` to disable metrics export. Clarify these settings in config documentation and the schema.
## Testing
Cover exporter selection across explicit and default analytics preferences. Update app-server and daemon telemetry tests to verify custom metrics export with analytics disabled, and worktree tests to disable metrics through the exporter setting.
GitOrigin-RevId: 0c61f0f01e2b694db642ac7e7fd1dac9965c7d96
## Why
Domain wildcards need to retain the byte-based behavior of `globset`. Counting Unicode scalar values changes how `?` matches non-ASCII hosts.
## What changed
Match domain patterns against UTF-8 bytes so `?` consumes exactly one byte. For example, `api??.com` matches `apié.com`. Match hosts through borrowed byte slices, avoiding the per-match character-vector allocation.
Document ASCII case insensitivity and the absence of IDNA conversion: hosts supplied as Punycode require patterns using their Punycode spelling.
## Testing
Compare Unicode wildcard cases against `globset` for both allowlists and denylists, including multibyte characters, combining marks, Punycode, and case sensitivity. Update the exhaustive dynamic-programming comparison and retry-boundary tests to operate on bytes.
GitOrigin-RevId: fae5b3b1ae60b469cd61a44c5c6e245730adc8ba
## What changed
- Add debug spans with review, thread, turn, and tool-call identifiers to correlate approval reviews and background scoring.
- Log review retry scheduling with failure details, attempt limits, backoff, and remaining deadline budget.
- Emit warnings for Guardian V2 background scoring failures with the failure reason, context mode, and duration, even when metrics are unavailable.
GitOrigin-RevId: 3e20d16836576f834998af473815bfb55e671de5
## What changed
- Add `tui.keymap.global.leader`, defaulting to `ctrl-x`, and symbolic bindings such as `leader c` that follow the configured prefix. The default prefix yields to existing custom shortcuts and chord prefixes.
- Keep leader shortcut hints open until completion or cancellation, while ordinary chords retain their one-second timeout. Pressing `esc` or repeating the leader cancels the pending shortcut.
- Add leader configuration and a `Use leader...` capture option to `/keymap`, with resolved shortcut labels and conflict validation.
- Cancel pending chords when input targets change, on paste or focus loss, and on mouse actions other than movement.
- Move the default voice mute shortcut from `ctrl-x` to `f9` and update its tests and displayed hints.
GitOrigin-RevId: 35b964cccd2812c73200f0c26b0f19506821df92
## What changed
Allow mouse selection and plain-text copying of rendered status and footer text, honoring `tui.copy_on_select` and existing selection keyboard controls. Keep the selected region stable while other content updates, preserve Unicode and terminal hyperlinks, and clear selections when their region becomes invalid.
Defer warning clicks until a stationary mouse release so dragging selects text without opening the warning viewer. Preserve the composer draft and cursor while selecting footer text.
## Testing
Add unit and snapshot coverage for visible-text copying, Unicode and hyperlinks, selection invalidation, keyboard ownership, and stationary clicks versus drags. Add a fullscreen integration test for warning selection and draft preservation.
GitOrigin-RevId: dd14d7ede52e97e507be24c4d6ac0299f7388a9b
## Why
Fixed argument limits truncated recorded tool calls even when their metadata fit within the available message budget.
## What changed
- Remove the 8 KiB per-call and 32 KiB per-output argument limits for direct calls and Code Mode.
- Preserve full recorded arguments while retaining message metadata budgets, pending-call limits, and the direct metadata retention limit.
- Rename the normalization helper to `normalize_executed_tool_call_completeness`; it now only clears completeness when calls or tool names were lost.
## Testing
Update regression coverage for large arguments, escaped inputs, reserved-key wrappers, and argument and result metadata preservation across Code Mode waits.
GitOrigin-RevId: 8c199ccf39191d5d44eef02d28b1773654735b43
iceweasel-oai