## What changed
- Add extension-owned discovery and namespace resolution for skills loaded directly through an `ExecutorFileSystem`.
- Preserve hidden and symlinked skills, nested plugin namespaces, optional `agents/openai.yaml` metadata, product restrictions, and deterministic ordering.
- Reuse the filesystem walk inventory and bound concurrent skill, metadata, and manifest reads.
- Route direct executor catalog loading through the new extension loader.
## Testing
- Cover namespace lookup, metadata probing, walk reuse, concurrent reads, and parity with the existing environment loader.
GitOrigin-RevId: 4e0b821eb84d03f0dc1c2dee7b2b9a072ee3fd44
## What changed
- Move parsing of pre-discovered executor skill bundles from `core-skills` to
the skills extension.
- Expose shared `SKILL.md` frontmatter parsing from `codex-skills` so direct
and pre-discovered loading use the same validation and repair behavior.
## Testing
- Add parity coverage for direct and pre-discovered executor skill catalogs,
including plugin namespaces, metadata, product policy, and warnings.
- Add a snapshot for the resulting pre-discovered executor catalog.
GitOrigin-RevId: c5f888226fa5600bd8b90f5682400da39a5db5ff
## Why
R2 publication waited for DotSlash to finish before uploading any release
assets, extending the release pipeline's critical path.
## What changed
- Start an `assets` stage after the GitHub release is created, in parallel with
DotSlash publication. Upload available assets concurrently without publishing
release metadata or channel aliases.
- Run a `finalize` stage after both jobs complete. Verify assets already present
in R2, upload any assets DotSlash added, and then publish metadata, stable
installer aliases, and release channels.
- Validate downloaded assets before upload and retain no-overwrite semantics
across both stages.
GitOrigin-RevId: 1c3e8ca715be4064c2532a5c651f1bbe03ed96a4
## What changed
- Add `ThreadSpawnRequest` to carry thread options, authentication, agent
control, fork metadata, inherited state, and shell overrides.
- Route new, resumed, and forked threads through one `spawn_thread` path.
- Centralize default session-source and environment selection when the request
is consumed.
GitOrigin-RevId: 8fd1a8531a212000c7430218c2200aa4a047cb9a
## What changed
- Allow namespace tool specs to contain custom freeform tools alongside function tools.
- Include namespaced custom tools in deferred tool search and expose them to code mode with names such as `editor__apply_patch`.
- Route custom payloads to matching extension tools while preserving function-only payload validation.
## Testing
- Add serialization, tool search, code-mode definition, and end-to-end dispatch coverage for namespaced custom tools.
GitOrigin-RevId: be64d35f6ae54685c5a9fcf45a732320742ea7e5
## What changed
- Add optional `defer_loading` support to freeform Responses API tool definitions.
- Omit the field when it is unset so existing eager tool definitions retain their wire shape.
## Testing
- Verify legacy freeform tool deserialization and eager and deferred serialization shapes.
GitOrigin-RevId: 50e8658a54ac5b6ae0c1dbfe65f7bb62efef561d
## What changed
- Treat `codex.api_request` and `codex.api_request.duration_ms` as runtime-only metrics for Statsig exporters, matching the existing tool-call metric behavior.
- Keep both metrics available through other OTLP exporters.
## Testing
- Extend the Statsig filtering test to cover both API request metrics.
- Verify the OTLP HTTP exporter still sends the API request count and duration.
GitOrigin-RevId: f0f800ade7979e4da72ae59641bf42aa8a3ebd5a
## Why
Ghostty can leak release events for shortcuts that the terminal consumes.
## What changed
- Detect Ghostty when `TERM` is `xterm-ghostty`, including when `TERM_PROGRAM` is unavailable.
- Omit `REPORT_EVENT_TYPES` from keyboard enhancement flags for Ghostty while retaining alternate-key and escape-code disambiguation reporting.
## Testing
- Cover Ghostty detection through `TERM` and its keyboard enhancement flags.
GitOrigin-RevId: d865a6cdd1373aad4b78099e821d1ebaeb6cfdff
## Why
Code-mode `wait` and `terminate` requests can remain pending when the host
transport stalls.
## What changed
- Add a 60-second transport allowance to the runtime timeout for `wait`, and
apply the same transport deadline to `terminate`.
- Return a model-visible timeout error and invalidate the connection when the
deadline expires, so the next execution reconnects to the host.
## Testing
- Cover queued `wait` and `terminate` requests that exceed their deadlines.
- Verify that a timed-out `wait` reports the error and reconnects on the next
code-mode execution.
GitOrigin-RevId: 5d772e5a6f3793aa8865a1160639b851fd4824fb
## What changed
Add the tool name to `ApprovalCtx` and use the context's call ID and session
telemetry when recording approval decisions. This removes redundant `ToolCtx`
and telemetry parameters from `resolve_tool_approval`.
GitOrigin-RevId: 238a6f708f83993d64606bfaa74df344b0b46178
Rename `resolve_tool_apporval` to `resolve_tool_approval` and update its
call sites in the tool orchestrator.
GitOrigin-RevId: bc7d9ae675b45dd5b6b5b5643fd75e532f6314ca
## What changed
- Replace the thread ID in `<context_window>` metadata with the session's canonical agent path.
- Default sessions without an agent path to `/root`.
- Verify that root sessions emit `/root` and subagent sessions emit their own path, such as `/root/worker`.
GitOrigin-RevId: bcf057842ed31f93d554b7de063b6c03403a2594
## Why
Large nested-tool callbacks can occupy a WebSocket and delay unrelated session
operations on the same code-mode connection.
## What changed
- Negotiate the optional `dual-websocket-v1` capability and pair a second,
token-scoped WebSocket with the control connection.
- Route nested-tool callbacks and their results over the bulk socket while
keeping session operations, notifications, and execution responses on the
control socket. Reject messages sent on the wrong lane.
- Preserve the single-connection transport when the capability is unavailable,
and bound pairing, queued callbacks, and deferred cross-socket messages.
- Defer callbacks that arrive before their execution-started response, and
return delegate errors without disconnecting the connection.
## Testing
Add protocol, transport, driver, and WebSocket integration coverage for
capability negotiation, lane routing, pairing failures, out-of-order messages,
and progress during large concurrent tool results.
GitOrigin-RevId: fa4504653e7cbf3c4ec930ae57aa0a41345bad66
## What changed
- Store the effective `allow_login_shell` setting on each turn environment, including inherited environments whose child thread has a different policy.
- Expose the `login` argument for shell tools when any selected environment permits login shells.
- Validate each command against the policy of its selected environment instead of the turn-wide configuration.
## Testing
- Cover tool schema generation for single and multiple environments.
- Cover login-shell rejection by both the command handler and the unified exec integration.
GitOrigin-RevId: 5a93149a5c86f4087f2b92d663ebc33feff8a57c
## What changed
- Add a harness that runs the Codex executable against a pinned official MCP
client conformance suite across shipping, intermediate, and modern protocol
versions, HTTP and stdio transports, and OAuth scenarios.
- Add a separate app-server regression matrix for transport, security, schema,
pagination, SSE, multi-round request, and catalog-boundary behavior.
- Check both suites against committed baselines so previously passing or
required checks cannot disappear or newly fail, while keeping known failures
visible in complete reports.
- Run the fixture self-tests and both executable-level gates from the Python
and TypeScript SDK test workflows.
## Testing
- Add unit tests for the fixture server, official-suite adapter, conformance
runner, baseline comparison, and reviewer regression runner.
GitOrigin-RevId: de59f039294e34ed72873d9f6940b52e89172c0d
## Why
Successful `codex exec resume --last` lookups should not need to audit every rollout file.
## What changed
- Query the state database first when it is available and treat the first usable matching entry as authoritative.
- Verify that an indexed rollout's session ID matches the indexed thread ID before resuming it.
- Fall back to scanning rollouts after a complete database miss, allowing the existing backfill path to repair missing entries.
## Testing
Added integration coverage for missing database entries, usable indexed candidates, and mismatched indexed rollout paths.
GitOrigin-RevId: 9959dacbc908e97f1073118142f276b470aa8e06
## What changed
- Resolve local `archive`, `delete`, and `unarchive` targets from SQLite before falling back to rollout scanning and repair.
- Verify each SQLite match points to a rollout in the expected active or archived collection with the same session ID, skipping stale entries safely.
- Preserve the existing server-side lookup behavior for remote workspaces and compatibility sorting for external app servers.
## Testing
Added coverage for archiving and unarchiving by SQLite-backed names, preferring renamed SQLite metadata over the legacy index, and skipping a stale duplicate during deletion.
GitOrigin-RevId: 5275b94e1132ca7cdbdd1adc3293d2ccc685ff6d
## What changed
- Add `codex-utils-audio` as a workspace crate for canonicalizing audio inputs
and estimating their token usage.
- Update `codex-core` to consume the new crate while preserving the existing
audio preparation tests.
GitOrigin-RevId: d719ecc08363ef52778aa37f3df0ca14f7778324
## What changed
- Track approved command prefixes separately from the stable permissions
instructions in world-state snapshots.
- Emit only newly approved prefixes after an exec-policy amendment instead of
appending the full permissions block again.
- Preserve prefix updates when full permissions instructions are disabled and
remain compatible with legacy world-state snapshots.
## Testing
- Cover incremental prefix additions, removals, legacy snapshots, history
rollback, and approval flows with permissions instructions enabled or disabled.
GitOrigin-RevId: e6f68c6a91be82750e70e28456f2b7c58607fbd8
## What changed
- Write staged `rusty_v8` checksum manifests with LF line endings on every platform.
- Strip carriage returns when verifying manifests so existing Windows-built releases with CRLF line endings remain usable.
## Testing
- Assert that staged checksum manifests contain no carriage returns.
GitOrigin-RevId: 142855c147a08a60f5e5782c61e2fcd6b2e350d6
## What changed
- Add `parse_agent_plugin_mcp_config` to translate Agent Plugins v1 `mcp.json` files into Codex MCP server configuration.
- Normalize `stdio` and streamable HTTP transports, including `PLUGIN_ROOT` and `PLUGIN_DATA` expansion, contained plugin paths, secure endpoint validation, and filtering of client-owned HTTP headers.
- Keep valid sibling servers when another server is invalid, while returning per-server parse errors.
- Preserve UTF-8 HTTP header values when forwarding streamable HTTP protocol headers.
## Testing
- Cover transport mapping, placeholder expansion, path containment, schema and field validation, per-server errors, platform-specific environment handling, and UTF-8 headers.
GitOrigin-RevId: ed4ab0fcf495afbb381ce48beb93989629444c56
## Why
Timing out a Git metadata command must not leave helper processes running after
the command wrapper exits.
## What changed
- Run Git metadata commands in a dedicated process group on Unix and a Job
Object on Windows so timeout cleanup terminates their full process trees.
- Start Windows commands suspended, assign them to the Job Object, and then
resume them so immediate descendants cannot escape containment.
- Preserve descendants when a Git command completes normally, and retain the
existing direct-spawn fallback if Windows Job Object setup fails.
## Testing
Added cross-platform regression tests for cleanup both while the command wrapper
is running and after it exits, plus Windows coverage for immediate-child Job
Object containment.
GitOrigin-RevId: 351851708e23ff06b89fe1894bd09a3558f67293
## What changed
- Add `include_plugin_usage_instructions` to model metadata, defaulting to false.
- Emit generic plugin guidance only when plugins are available and the selected model enables it.
- Enable the capability for interactive model presets while leaving `codex-auto-review` opted out.
GitOrigin-RevId: 67f5a97e978033f5f1d533956c0b9deeae610283
## What changed
- Remove `ModelInfo.base_instructions` as an in-memory instruction source and use `model_messages.instructions_template` consistently for bundled, remote, fallback, and overridden model metadata.
- Preserve compatibility by promoting legacy `base_instructions` values when reading model responses and caches, and by including rendered legacy instructions when serializing `ModelsResponse` for older clients.
- Treat templates without instruction variables as literal text and retain the other model-message fields when applying instruction overrides.
This completes the consolidation proposed in https://github.com/openai/codex/pull/31302.
## Testing
- Cover legacy response and cache migration, canonical-template precedence, fallback instructions, personality rendering, overrides, and model switching.
GitOrigin-RevId: 089d986ca5e30da67db2c77a1b6a046d2cff52dc
## Testing
- Verify consecutive tool reviews reuse the same Guardian session without
prewarming and execute both approved commands.
- Verify interrupting a pending Guardian review prevents command execution and
records an aborted tool result for the next turn.
GitOrigin-RevId: b8371ae82b4fef206857012589668f890f9305bf
## Why
MCP tools can be exposed directly, discovered through tool search, or called
from Code Mode. Servers need to be able to opt out of any of these surfaces
without disabling their tools everywhere.
## What changed
- Add `omit_tools_from` to MCP server configuration, accepting any combination
of `direct`, `deferred`, and `code_mode`.
- Apply the exclusions independently when building direct, deferred, and Code
Mode tool surfaces while keeping omitted tools registered for permitted uses.
- Remove client-private `_meta` fields from MCP results returned to Code Mode.
- Include the new setting in the configuration schema and MCP config
serialization.
## Testing
- Cover every exposure combination across Code Mode, Code-Mode-only sessions,
tool search, direct-only namespaces, and prefixed and unprefixed MCP names.
- Verify direct and nested execution paths, parallel-call support, config
round-tripping, and `_meta` filtering.
GitOrigin-RevId: 12dfcb78bb5c5ecf4d70f38a8b5022792463a27f
## Why
Concurrent tests without a tracing subscriber can cache the network policy
callsite as disabled, causing event-capture tests to miss events.
## What changed
- Attach the test event collector directly to the captured future.
- Rebuild the tracing interest cache before running that future while keeping
tracing out of its single-subscriber fast path.
GitOrigin-RevId: 20d6160d26f56ad9fd86afd5107cb4313a5fce73
## What changed
- Replace the ordering enum and `include_disabled` boolean with named
`ConfigLayerStack` iterators for each precedence direction.
- Keep enabled-only iteration separate from `all_layers_*` iteration, which
includes disabled layers.
- Update config consumers to use the iterator matching their precedence and
disabled-layer requirements without allocating an intermediate `Vec`.
## Testing
- Add coverage that verifies ordering and disabled-layer filtering for all four
iterators.
GitOrigin-RevId: d14df3db4a2eae80ba97cdec246bff405e6c5f3d
## What changed
- Find the highest-precedence user layer by scanning the ordered config layers in reverse.
- Remove the cached user-layer index and its bookkeeping when constructing or updating a layer stack.
- Keep layer-order validation focused on validating ordering.
GitOrigin-RevId: e20510b868224ce25b2d2179f07d262d6b36e976
## Why
Codex Apps tool catalogs can exceed the standard MCP limit of 2,048 items and
still need to remain available through tool search.
## What changed
- Allow up to 8,192 catalog items for host-owned `codex_apps` registrations.
- Keep the 2,048-item limit for other MCP servers, including extensions that
register the `codex_apps` name.
- Restrict the shared Codex Apps tool cache to host-owned registrations.
## Testing
- Cover large catalogs for built-in and hosted-plugin registrations while
verifying that another extension retains the standard limit.
- Verify that a same-named extension cannot read the host-owned Apps cache.
GitOrigin-RevId: 2265693a460e9be63c4c849169cba7324def4f49
## Why
Managed proxy helpers can keep captured standard streams open after the sandboxed command exits. Proxy readiness can also fail when inherited standard descriptors are already closed, and zombie owners can leave stale socket directories behind.
## What changed
- Detach bridge and cleanup-worker standard I/O to `/dev/null`.
- Move readiness pipe descriptors above the standard descriptor range.
- Treat zombie processes as exited when cleaning proxy socket directories.
- Move helper lifecycle handling into a dedicated module.
## Testing
Add coverage for output release after command exit, readiness with closed standard descriptors, zombie detection, and stale socket cleanup.
GitOrigin-RevId: 9f4081cba1b73442f02a895473c0383a795fa30e
## What changed
- Restart the test app server before injecting the source thread's active goal so a late idle hook cannot continue it.
- Remove the unrelated ordinary-fork assertion and keep the scenario focused on deferred goal continuation across paginated forks.
GitOrigin-RevId: 5383f56ffa1687a4ebd18b5e37cbd61290fa59a7
## What changed
- Enable `test_sync_tool` for the startup prewarm test.
- Hold the first user-turn response open while Git enrichment completes, then
verify the refreshed workspace metadata on the follow-up request.
GitOrigin-RevId: dd4254fba1ac2f346022988cc21a78648a29556a
## What changed
Derive code-mode tool names directly from registered tool names when checking
eligibility and collisions. Skip unsupported and empty tool specs explicitly,
without serializing schemas or augmenting descriptions that are not used during
executor registration.
GitOrigin-RevId: b439327aafd85ce3745d900301b7e48b56dbd6b4
## What changed
- Allow up to five seconds for focus-triggered input to appear in the PTY test.
- Check for unexpected foreground and background palette queries while waiting for both immediate and delayed input, so either focus path fails with the palette-specific error.
GitOrigin-RevId: b8ed4f1ced257865140b1518c8959f65371e744f
## What changed
Move shell snapshot validation in the intercepted `apply_patch` test until after
the turn completes and its patch lifecycle events have been collected.
GitOrigin-RevId: 1c16bcfcc97f09165c4a2eb2d15f4059a14b2a99
## What changed
- Route verified patches from both direct tool calls and intercepted shell commands through a shared execution helper.
- Simplify patch safety preparation to return either a runtime invocation or a rejection directly.
- Keep permission resolution, approval handling, event emission, runtime execution, and diff tracking in the common path.
GitOrigin-RevId: e16aae8e91d96b8108aefac7f3fbf2da2cbac016
## What changed
Make `ExtensionRegistryBuilder` wrap an `ExtensionRegistry` and register
contributors directly on it. Return the wrapped registry from `build()` instead
of copying each field into a new value.
GitOrigin-RevId: ae04de99c17ea951156f9892151b4196c70026bf
## What changed
Replace the type-erased `FragmentRegistration` trait and proxy objects with a
static list of `matches_text` function pointers. Remove the registration types
and their re-exports while preserving the existing contextual fragment matchers.
GitOrigin-RevId: 4e5a296b278984c6e783a67f48fa4bb37646946b
## What changed
- Store each turn's host skills snapshot in `ExtensionData` and expose it through
`TurnContext::skills_snapshot`.
- Lazily keep implicit skill invocation deduplication state in the same turn-scoped
store.
- Carry the skills snapshot into review turns without a separate
`TurnSkillsContext` field.
GitOrigin-RevId: d71579b5d230bd0b5f3c2ad062861f74d614d88c
## What changed
- Share argument normalization, server selection, cursor validation, and pagination setup between `list_mcp_resources` and `list_mcp_resource_templates`.
- Use a generic server-tagged wrapper to build single-server and deterministically sorted all-server payloads for both resources and templates.
## Testing
- Cover shared argument normalization and sorted resource-template payload serialization.
GitOrigin-RevId: 3505e4c1d2b95d8bbbb01f6f930fb914309eb898
## What changed
- Increase the listener, stream read, and overall test timeouts from 2 to 10 seconds.
- Switch the accepted stream back to blocking mode before reading the request.
GitOrigin-RevId: 1e876350421d7791194e145751603c4d709c7d39
## What changed
- Emit dynamic tool-call analytics for code mode `exec` and `wait` calls, including duration and terminal status.
- Associate code-mode cells and their nested tool calls with the originating and subsequent model response IDs.
- Buffer correlated tool events until the next response is known, while flushing pending events when turns, threads, or the analytics queue close.
## Testing
- Add reducer coverage for correlating `exec`, `wait`, and nested tool events across turns.
- Add an app-server test that verifies production analytics include the cell and response IDs for a code-mode `exec` call.
GitOrigin-RevId: 8b34ab59c1ad68ebbd57f9c8a05f19ab04df48a4
## What changed
- Store synchronization primitives directly in `TurnMetadataState` instead of
wrapping each field in its own `Arc`.
- Require an `Arc<TurnMetadataState>` when spawning Git enrichment so the
background task retains the complete state.
- Update Git enrichment tests to use the shared state container.
GitOrigin-RevId: 745ca6504c0a6533cb7726d045905472e51726df
## What changed
- Add a shared runner for MCP resource operation lifecycle events, output serialization, truncation, timing, and error handling.
- Use it for listing resources, listing resource templates, and reading resources.
GitOrigin-RevId: 84cae2e01a096d5b8ed97ea1cb462f01fe2ed1f9
## What changed
- Charge `codex_rollout_budget_units` against the shared rollout budget when the provider includes it in response usage.
- Fall back to weighted input and output token accounting when provider units are absent.
- Reject non-finite or negative provider units as a fatal response error.
## Testing
- Cover provider units in reminder thresholds and local and remote compaction budget exhaustion.
- Verify invalid units fail without retrying the response.
GitOrigin-RevId: b452403e365985854d16f298d1ba46383e9892c4
## What changed
- Parse `codex_rollout_budget_units` from completed Responses API usage into
`TokenUsage`.
- Keep the provider-only value out of serialized protocol, JSON schema, and
TypeScript representations.
## Testing
- Cover the value in unit and end-to-end SSE response parsing tests.
GitOrigin-RevId: a53d4202beb9c8985d25894cb10e7c01f20b2a44
## What changed
- Accept the allowlisted `.onboarding_entrypoint=life_sciences` suffix on a valid OAuth state while continuing to reject unknown or malformed suffixes.
- Return the parsed callback metadata from the login server without including the suffix in the token exchange redirect URI.
- Add the optional `onboardingEntrypoint` field and `life_sciences` value to the v2 `account/login/completed` notification and generated protocol exports.
## Testing
- Cover valid, invalid, and repeated OAuth state suffixes.
- Verify the end-to-end login callback result, token redirect URI, and app-server notification payload.
GitOrigin-RevId: c2ee146328ddd43c03a503260d5d492e186fa889
## Why
Setting or clearing a thread goal could reconcile an already indexed rollout and overwrite SQLite-only thread metadata, including the thread preview.
## What changed
Skip rollout reconciliation when SQLite already references the same existing rollout and its session metadata matches the requested thread. Continue reconciling when the SQLite row is missing or the stored rollout is invalid so goal mutations can still repair thread metadata.
## Testing
Add coverage that verifies goal set and clear preserve SQLite previews, and that goal set restores a deleted SQLite thread row.
GitOrigin-RevId: cf19cef98559fc67182ac7430e4e50ed2eed83f3
## Why
Agent Plugins use a schema-declared root `plugin.json` and can have dotted names or versions that do not fit Codex's directory-safe version format. The packaging and installation paths still assumed the legacy manifest layout and identifier rules.
## What changed
- Recognize valid root Agent Plugin manifests when discovering, packing, and installing plugins, while leaving unrelated root manifests on the legacy path.
- Accept safe dotted plugin names, default missing Agent Plugin versions to `1.0.0`, and derive stable directory-safe versions when necessary without rewriting the portable manifest.
- Skip legacy command migration for Agent Plugins and reject symlinks or other unsupported file types while copying plugin sources.
## Testing
Add coverage for portable bundle round trips, manifest discovery, dotted names, version handling, command preservation, and symlink rejection.
GitOrigin-RevId: 61476c4c4100495842253d8b429c0b896490962d
felixxia-oai