## What changed
- Add the under-development `powershell_shell_version` feature flag.
- When enabled for a single local PowerShell environment, query the selected
shell executable and include its major/minor version in
`<environment_context>`.
- Cache version lookups, bound command execution and output, and report when a
previously visible version becomes unavailable.
## Testing
- Cover environment-context diffs when the shell version appears or disappears.
- Verify on Windows that the version is model-visible only when the feature is
enabled.
GitOrigin-RevId: 3ec8e80425ec3c193134dc1b69f61ef09ede375e
## Why
Microsoft Store PowerShell executables under `WindowsApps` can be inaccessible to the dedicated elevated sandbox account.
## What changed
- For local elevated sandbox commands that target Store PowerShell, select the first compatible `pwsh.exe` or `powershell.exe` from `PATH` or the standard fallback locations.
- Continue adding `-NoProfile`, and preserve the selected shell for remote execution and other sandbox modes.
## Testing
Added unit coverage for Store-path filtering, fallback ordering, local replacement, and remote-path preservation.
GitOrigin-RevId: 8ab3d0db925e886879701445040f13902fb1ad24
## Why
Windows filesystem operations can complete while their helper process remains
alive, and elevated sandbox processes must not survive a disconnected control
pipe.
## What changed
- Read newline-delimited filesystem helper responses without imposing an
operation deadline, then bound the time spent reaping the helper.
- Drain helper stderr concurrently, retain a bounded diagnostic on failure, and
kill helpers that do not exit after responding.
- Terminate the elevated runner's job or process when its input pipe closes or
fails.
## Testing
Added coverage for delayed responses, noisy stderr, stuck helpers, duplicated
file handles, and termination of elevated descendants after a control-pipe
disconnect.
GitOrigin-RevId: c0d3d5d76e13318de17638df4db71fcfb9a7397f
## Why
Windows batch aliases can fail to invoke Codex when the executable path contains
characters that are not representable in the active console code page.
## What changed
- Generate same-volume executable paths relative to the batch file using `%~dp0`.
- Keep absolute paths as a fallback when the executable and alias are on different
volumes.
## Testing
Added Windows tests covering a Unicode profile path under code page 437 and an
executable on a different volume.
GitOrigin-RevId: 10093bbc9f19e4fbe2e22d9397e211a113302f45
## What changed
- Detect readable symbolic `:root` entries separately from effective full-disk access so narrower deny-read rules do not disable the Windows sandbox's broad-read setup.
- Add explicit readable roots to that setup while omitting the filesystem root itself, and prevent read roots at or below denied paths from being granted access.
## Testing
- Extend the elevated Windows sandbox integration test to verify that an allowed bundled skill under the user profile remains readable while exact and glob-based secrets stay denied.
GitOrigin-RevId: 8f6f267b78718b9e8609a9205c489f253f478491
## What changed
- Recognize percent-encoded drive colons when inferring Windows paths, rendering
native path strings, and resolving same-drive relative joins.
- Reject Windows file URIs with percent-encoded `/` or `\` separators before
converting them to native absolute paths, so decoding cannot reinterpret URI
segment boundaries.
## Testing
- Cover uppercase and lowercase encodings for drive colons and path separators,
including local-drive and UNC file URIs.
GitOrigin-RevId: ecb6c92f4ef1af73f85e57a135abf6bc5bb968dc
## Why
Sandbox setup runs on a Tokio worker thread without a Windows message loop, so
`ShellExecuteExW` requires synchronous activation when launching the elevated
setup helper.
## What changed
Add `SEE_MASK_NOASYNC` to the shell execution flags while retaining
`SEE_MASK_NOCLOSEPROCESS` for helper process tracking.
GitOrigin-RevId: 875cc1d49bb19f92f940633b6315711143beeae7
## What changed
- Add `WINDIR` to the Windows core environment variable allowlist.
- Extend the Windows core-inheritance test to verify that a case-variant
`WinDir` entry is retained.
GitOrigin-RevId: 0305d8fa882ba2705a7ce7661098cedac1339c43
## Why
Installer `bin` directories can be junctions, so looking for bundled helpers
relative to the apparent executable path can miss the package's
`codex-resources` directory.
## What changed
Retry bundled executable lookup from the canonical executable path when lookup
from the original path fails.
## Testing
Add a Windows regression test that creates a `bin` junction and verifies that
the sandbox setup helper is resolved from the package resources directory.
GitOrigin-RevId: f2f20ce1ccfa95ae65171a03a986d10e2560e696
## What changed
- Apply the sandbox read/execute ACL to the local Codex application root so it
inherits across its contents, while continuing to handle the managed runtime
cache separately.
- Skip missing paths, non-directories, and directory reparse points before
inspecting or updating ACLs.
- Update the runtime path test to expect the application root.
GitOrigin-RevId: 34f2946d2140f8ea2b76c449b0e5542b99cb6f70
## What changed
- Add the stable, default-enabled `in_app_updates` requirements-only feature.
- Allow administrators to disable in-app updates through `[features]` in `requirements.toml`.
- Expose the policy through `configRequirements/read` and include it in the config schema.
## Testing
- Verify that in-app updates are enabled by default and disabled by the managed requirement.
- Verify that `configRequirements/read` returns the configured policy.
GitOrigin-RevId: e9c7074b516fe58385fdf7dc8420c0109c0c3df6
## What changed
- Add a console mode to the Windows sandbox process launcher.
- Launch `--codex-run-as-fs-helper` subprocesses with `CREATE_NO_WINDOW`.
- Preserve inherited-console behavior for regular sandboxed commands.
GitOrigin-RevId: 927be36b82903b6a5fb1a243ba7f406f9ed85f3f
zm-oai