## Why
Disabling a connector's canonical plugin could leave its tools available when another enabled plugin contributed the same connector.
## What changed
Retain `canonical_app_id` in the remote installed-plugin cache and use ownership metadata for the current account when building connector snapshots. A disabled canonical owner now excludes its connector even when another plugin contributes it or the owner's bundle is absent from the host. Match owners by plugin name and marketplace, and ignore ownership metadata when the cache no longer matches the current authentication.
Build these snapshots through `PluginsManager` when the plugins feature is enabled; otherwise use an empty snapshot.
## Testing
Add manager coverage for combined local and canonical exclusions, marketplace matching, and authentication changes. Add an integration test showing that disabling a noncanonical contributor preserves shared calendar tools, disabling the canonical owner hides them, and clearing the exclusion restores them.
GitOrigin-RevId: ee2981d1277825fefb671dd7d1078cd7ea5c0ea5
## What changed
- Replace dedicated Guardian endpoints with `/responses`, sending `x-codex-guardian: reviewer` or `x-codex-guardian: classifier` for eligible Codex backend requests over HTTP and WebSocket.
- Add model-scoped thread headers, recheck backend authentication on each request attempt, and reconnect WebSockets when the applicable headers change.
- Retain `features.guardianv2.free_guardian` for configuration compatibility while removing its routing gate; the backend now controls Guardian billing.
## Testing
Update tests for reviewer and classifier headers, model and authentication scoping, HTTP fallback, WebSocket reuse, and parent-response metadata across retries.
GitOrigin-RevId: 1c2b3c458ab77fb40aae4ee6784f6d827c60e76c
## Why
MXC is a sandbox implementation, not a restricted-token sandbox level. Executor requests need to represent that choice separately from `WindowsSandboxLevel`.
## What changed
- Introduce `WindowsSandboxSelection` for executor sandbox contexts and remove `Mxc` from `WindowsSandboxLevel`.
- Preserve the `windowsSandboxLevel` wire field and its serialized values for compatibility.
- Share sandbox selection between executor process launches and filesystem helpers, and use the new selection in capability discovery and skill reads.
- Disable Windows sandbox selection for executor paths that do not use Windows path conventions.
## Testing
Extend coverage for MXC wire serialization, Windows skill-read sandbox checks, and capability discovery with distinct permissions. Exercise remote filesystem write restrictions with both restricted-token and MXC sandboxes, including rejection when native MXC is unavailable.
GitOrigin-RevId: 266211377bcb138a0dc75861e9ff2225fa37a53d
## What changed
Move concrete reviewer settings into `guardian-v2` and replace `ReviewerConfigOverrides` with a `ReviewerConfig` callback stored in thread extension data. Apply the callback to each captured parent configuration before preparing context and checking session reuse.
Keep model selection, policy prompt construction, and live network state in the core adapter. Preserve the existing read-only reviewer settings and share `reviewer_permission_profile` with inherited environment configuration.
## Testing
Update existing Guardian configuration, session reuse, and prewarming tests to use the extension's actual configuration builder, including compiling the shared source in core's test host.
GitOrigin-RevId: dfa1dae9f8d4469f2e4f6e64ab842cc662970898
## What changed
- Record `auth_or_link` for Codex app calls with trusted connector authentication failure metadata, capturing it before result callbacks or model-facing rewrites. Propagate the classification to MCP tool-call and app-usage analytics.
- Record `approval` when a dispatched approval request is denied, times out, or aborts, covering both MCP elicitation and legacy user-input approvals.
## Testing
Add unit and turn-level coverage for authentication failures, metadata removal by callbacks, successful and rejected approvals, and closed approval response channels. Verify event counts, classification, and exclusion of sensitive test values and authentication URLs from analytics payloads.
GitOrigin-RevId: 493df2a2923f346a0f644f1f26ab8b6b9b8888e0
## What changed
- Add `AllowedTools` to the extension API, captured once at thread startup to restrict which tools can be advertised or executed. An empty list disables all tools; an absent value preserves ordinary tool setup. Callers must supply the list again when resuming a thread.
- Filter tool registration and hosted tool specifications before Code Mode and discovery. Match names with their namespaces and require generated tools such as `exec` and `wait` to be explicitly allowed.
- Move Guardian reviewer tool selection into the allowlist while retaining feature and sandbox restrictions, with a fallback for older reviewer sessions.
## Testing
Add coverage for selected, empty, and absent allowlists across tool sources and Code Mode. Add managed-thread tests verifying advertised tools, rejection of excluded calls, and that replacing extension state after startup cannot change the captured allowlist.
GitOrigin-RevId: 33c1722c4241f368963d8385fa0415112e16a72d
## What changed
Introduce `ReviewRequest` in `codex-guardian-reviewer` to own contributor routing, cached approvals, synchronous fallback, and review cancellation. Keep action validation and session-specific preparation in the host.
Track the complete approval operation through parent shutdown, driving cancellation through reporting and reviewer cleanup before releasing it. Preserve fresh-review requirements and validate cached approvals before recording their outcome.
## Testing
Extend coverage for cancellation before routing and during cached approval, parent shutdown cleanup, and required fresh review overriding a cached allow result with matching assessment events and a denial warning.
GitOrigin-RevId: 8dcf26cc3660e91ef94e28e0bee7327ebe34ae6c
## What changed
Replace duplicated model-selection fields in `GuardianReviewSessionConfig` and `GuardianReviewSessionParams` with the existing `ReviewModel` struct. Read model settings and selection metadata from that struct for session execution, analytics, and failed-review records, and update the existing test fixtures accordingly.
GitOrigin-RevId: 1da2001e68168ec40a3d726694eb5fd0445aa3d7
## What changed
Remove core guardian tests for transcript numbering and unpaired tool outputs. Extend `guardian-context` coverage to assert that named image-only tool outputs retain their source and use `[non-text output]` for both sync and async contexts, with tool calls included or excluded.
GitOrigin-RevId: ba483e8f6e335697106a987051687a12ad2fde01
## What changed
- Mark `guardian_ext` as a removed compatibility flag.
- Remove `InternalSessionSpawner`, `InternalSessionSpawnFuture`, `ApprovalReviewInput`, and `ApprovalReviewError` from the extension API, along with the spawner test.
- Remove `NodeReplReviewEvidence::review_inputs` and make the core re-exports of `NodeReplReviewEvidenceMode` crate-private.
GitOrigin-RevId: 1c532bc57264644cf521ef8077285a9b8ed67391
## What changed
- Make `SynchronousReview` own assessment events, telemetry, warnings, evidence-recording decisions, and consecutive-denial accounting.
- Keep action preparation, stale-approval validation, evidence storage, and event publication in the host adapter.
- Extract `Session::interrupt_turn_with_warning` to apply extension-requested interruptions to the selected active turn and emit the interrupted thread-idle lifecycle event.
## Testing
Adapt session tests to verify that extension interruptions emit the thread-idle lifecycle event and survive shutdown of the calling runtime.
GitOrigin-RevId: b234ad86206fedc2434f48fc44dc57679443c69f
## What changed
Extract V2 interruption validation and dispatch into `AgentControl::interrupt_spawned_agent`, returning the agent path and previous status with typed validation and runtime errors. Update the `interrupt_agent` tool handler to delegate to it while retaining tool error mapping and activity emission.
Preserve rejection of root and self targets and successful handling of unloaded or already-dead runtimes without reloading them.
GitOrigin-RevId: 893bbc4f464596d0fee032a71702a4a4f6becf5c
## What changed
- Use cancellation guards to tie reusable reviewers and temporary forks to their lifetimes, including when a review future is dropped. Replace cancelled reusable reviewers before reuse.
- Share `ReviewerTasks` between the pool and `ThreadManager`, and wait for tracked cleanup during pool shutdown. Remove the separate session shutdown protocol.
- Move denial cleanup from core task handling into Guardian's turn start, stop, and abort hooks. Expose `install_reviewer` to register both thread and turn lifecycle contributors together.
## Testing
Add an integration test that exercises stale denial cleanup at turn start, completion, and interruption, including starting another turn after interruption.
GitOrigin-RevId: 85badb235309c1e1576547d1746f7ee9fc66d545
## What changed
Extract target validation, runtime reloading, and message delivery from the V2 tool handler into `AgentControl::deliver_message`. Keep target resolution, analytics, and tool-facing error mapping in the handler.
Represent plaintext and encrypted payloads with `AgentMessage`, sharing communication construction with agent spawning. Preserve queue-only and follow-up turn semantics, target checks before reload, and turn metadata propagation.
GitOrigin-RevId: a88bcede015a17f6c11c7cad95ee58add5dc2820
## What changed
Move shared spawn and resume configuration helpers into `agent::child_config` and route both multi-agent versions through `prepare_agent_spawn_config`.
Preserve each version's role and model precedence, full-history inheritance, service-tier selection, runtime policy, and default-role metadata for reloads. Return configuration errors as strings and convert them to `FunctionCallError::RespondToModel` at tool-handler boundaries.
GitOrigin-RevId: 9d539050aa44f94043a6487f1f6f1037de1d15ca
## What changed
Add an optional `elicitation_type` to app-used and MCP tool-call events, with `auth_or_link` and `approval` classifications and `null` for unclassified calls. Existing core app-use tracking passes `None`.
Expose an API to queue MCP classifications by thread, turn, and item before completion. Preserve them across turn completion, consume them on item completion, and clear them on thread closure. Bound pending classifications to 256 entries, evicting the oldest when full.
## Testing
Add coverage for serialization, first-classification retention during app-use deduplication, per-call classification across turn completion, pending-state eviction and cleanup, and exclusion of tool arguments from emitted events.
GitOrigin-RevId: 185a2ccb38153e123fc731231edff0259a26bce3
## Why
`slow_down` errors were treated as terminal server overloads, while exhausted credit balances and spend limits fell through to retryable stream errors.
## What changed
- Classify `slow_down` as a retryable rate limit in HTTP 503 responses and SSE failures, preserving the server message and parsing retry delays from SSE error messages.
- Map `credit_balance_exhausted`, `organization_spend_limit_exceeded`, and `project_spend_limit_exceeded` SSE errors to quota exhaustion so they terminate without retries.
## Testing
Extend tests to cover HTTP error classification and retryability, `slow_down` stream retry exhaustion and message-provided delays, and a single `UsageLimitExceeded` error with no retries for each quota error code.
GitOrigin-RevId: 7985eba71ba4a6fe897a45957e448fadd42f3963
## What changed
Copy the source thread's current attachments when creating a non-ephemeral fork, including forks at an earlier turn. Copies receive new attachment IDs and creation timestamps while preserving resource identities and payloads. Attachment membership can then change independently on either thread; referenced resources are not copied.
Await the atomic copy before publishing the fork. If copying fails, log the error and allow the conversation fork to succeed without attachments. Resuming a fork does not copy attachments again.
Document that clients should use `forkedFromId` on `thread/started` and fetch the fork's attachments with `thread/attachment/list`; copying does not emit per-attachment updates.
## Testing
Add coverage for atomic rollback, independent attachment membership, inheritance across history cutoffs, successful conversation forks after copy failures, and resuming without restoring removed attachments.
GitOrigin-RevId: 939d2c6a3073ccfcd922380c6beda45d3deac606
## What changed
Replace `AttachmentStore::persist` with `upload` and `resolve`. Uploads return inline bytes or a file ID; resolution returns optional file metadata and a download URL only when a minimum URL lifetime is requested. Add image dimensions, digest, size, MIME type, and categorized errors to the API.
Make `InlineAttachmentStore` return the original bytes and report `NotFound` when resolving file IDs. Redact attachment bytes and file URLs in debug output.
Pass the configured image store from the thread manager into sessions and inherit it in delegated sessions. Allow `TestCodexBuilder` to accept a custom image store.
## Testing
Update unit coverage for preserving PNG and JPEG bytes, redacting bytes and URLs in debug output, and rejecting file resolution in the inline store.
GitOrigin-RevId: f313e0048925998d84394c7e5a278e0d39d86a45
## What changed
Represent images in `ContentItem` and `FunctionCallOutputContentItem` with `ImageReference::Inline`, flattened to preserve the existing `image_url` wire format. Update image producers and consumers and regenerate app-server schemas and SDK artifacts.
Preserve the Python SDK's `InputImageContentItem` and `InputImageFunctionCallOutputContentItem` class names during generation.
## Testing
Add a regression test for stable Python image class names and adapt existing image tests to the shared representation.
GitOrigin-RevId: c38a780ac3314c2ac2deb3afc1b93b94b6f93fec
## Why
Guardian reviews must stop when their parent shuts down or their history is reset. Shutdown must also finish reviewer cleanup before closing the parent's persistent history, including when a review is waiting to retry after a rate limit.
## What changed
- Let the Guardian extension own reviewer startup, prewarming, and shutdown through `ThreadManager`, tracking and joining outstanding work during teardown.
- Cancel reviews on history reset or parent shutdown and reject decisions returned after cancellation, including cached extension decisions.
- Keep background prewarm previews from overwriting the active turn's model metadata.
## Testing
Extend regression coverage to verify reviewer cleanup after parent shutdown, prompt shutdown during a 60-second Guardian retry with the network request denied, and preservation of active model review requirements during prewarming.
GitOrigin-RevId: 05efc369b9a1642a10365eac8a09da77f3f6e28c
## Why
Linux proxy-routed sandboxing denied standalone Unix sockets even when the effective network policy enabled `dangerously_allow_all_unix_sockets`.
## What changed
- Carry Unix socket permissions in `ManagedNetworkSandboxContext` and pass the prepared context through Linux sandbox launches with `--managed-network`.
- Allow `AF_UNIX` socket creation in proxy-routed mode when `dangerously_allow_all_unix_sockets` is enabled, while preserving network namespace isolation and restrictions on other socket families.
- Keep standalone Unix sockets denied by default and for path-only grants. Default missing fields in older serialized contexts to restrictive values.
## Testing
Add coverage for policy preparation and transport, legacy deserialization, and malformed policy rejection. Add a Linux integration test covering default denial, path-only denial, and explicit allow-all access, while checking that direct TCP access and `AF_NETLINK`/`AF_VSOCK` sockets remain blocked.
GitOrigin-RevId: 2695b945ad3e59fcb3faf7662d852a26650af16c
## What changed
Replace `ReviewerSessionFactory` with a startup callback installed through
`ReviewerPool::new`. Review requests supply shared setup data and reuse context,
while the pool uses its callback to create both reusable and forked reviewers.
Update Guardian session setup, prewarming, and existing test fixtures to use the
new pool API.
GitOrigin-RevId: fa171503afcee8bdbdf6822573bea8ded50ce117
## Why
Resuming a thread initialized its collaboration mode to Default, losing the saved Plan mode and its developer instructions. Reconnecting clients also lacked a server-reported mode to reconcile changes made by another client.
## What changed
- Restore the saved collaboration mode from the latest matching `ThreadSettingsApplied` event, falling back to the last legacy `TurnContext`. Apply the effective model and reasoning effort while retaining the saved mode and developer instructions.
- Include `collaborationMode` in `thread/resume` responses and update the generated schemas and bindings.
- Use the restored mode in the TUI, including the first prompt after resume. Prefer the server's mode when restoring disconnected input, while preserving the local selection for older servers that omit it.
## Testing
Add regression coverage for persisted and legacy collaboration modes, model and reasoning-effort overrides, the resumed Plan mode display and first prompt, and reconnect behavior with and without a server-reported mode.
GitOrigin-RevId: ed064516e7fae1c1668152ab448f510cbcacfe06
## Why
Inline delegates have no entry in the thread registry, so reviewer creation cannot depend on looking up the parent or waiting for its thread-ready notification.
## What changed
- Capture parent identity, authentication, shared agent control, originator, and inherited instructions in `StartThreadOptions` so `ThreadManager` can start a child without a registered parent.
- Route Guardian reviewer creation through this path, remove the standalone fallback and readiness gate, and require a Guardian extension host.
- Install explicit reviewer hosts in unit tests and the Guardian reviewer extension in the integration test harness, using `ExtensionRegistry::to_builder()` to preserve existing contributors.
## Testing
Extend the thread-manager regression test to remove the parent from the registry before starting a child, then verify inherited lineage, originator, session identity, and authentication, and exclusion from the public thread list.
GitOrigin-RevId: 468ded6fdce7520cb39d55c1a884dcfa5aaea2d9
## What changed
Add `auto_review.experimental_policy_template` to override the Guardian prompt template in `config.toml`. Trim the configured value and ignore it when empty. Prefer the override over the model catalog template, retaining the bundled template as the final fallback.
The template's `{{ tenant_policy_config }}` placeholder is replaced with the resolved Guardian policy.
## Testing
Extend tests to cover template deserialization, trimming, precedence over the catalog template, and rendered policy text in Guardian inference requests.
GitOrigin-RevId: 85b4a8fc193a42735354894203ccbd1f738a3b58
## Why
Building MCP search entries eagerly cloned tool specs and normalized schemas even for tools that were never selected.
## What changed
Store search specs in `Arc<ToolSpec>` and let MCP search entries share the handler's spec. Materialize and normalize loadable specs only for selected results, preserving existing result formatting and dynamic-tool cache equality behavior.
## Testing
Add coverage for function, freeform, and namespace specs that verifies shared specs produce equivalent results, retain the source while needed, and release it when the search entry is dropped.
GitOrigin-RevId: 4260f2e2527834d8a856b1528654c6951aab8a7d
## Why
Persisting user input received during an active turn currently blocks the next model request. Stores that support background persistence can overlap this checkpoint with inference.
## What changed
- Add `PersistContext::SteeredUserInput` and `allows_background_persistence()` so stores may enqueue these checkpoints, with durability and error reporting enforced by later flush or shutdown operations.
- Use the new context for accepted steered user input and apply the same metadata handling as turn-start persistence.
- Keep tool outputs synchronous, including in mixed input batches, and allow stores to retain synchronous persistence for all contexts.
## Testing
Add gated-store integration tests covering background user-input persistence, synchronous stores, and synchronous tool-output checkpoints. Verify that the next request includes the steered input and waits for persistence when required.
GitOrigin-RevId: c60b7b6c9b483245fd3169306bcf0de248ccdf35
## What changed
- Add spans for one-shot and resumable `exec_command`, `write_stdin`, session creation, and output collection, recording outcomes and output collection stop reasons.
- Correlate calls with conversations, turns, and processes; link stdin interactions to the original exec call and process start requests to executor process IDs. Omit empty turn and call IDs and those longer than 256 bytes.
- Propagate the current tracing span into the spawned one-shot execution task and distinguish timeouts, cancellations, and failures.
GitOrigin-RevId: 722728dc3f5b624e7a4da69fc867c3c672465af0
## Why
Callers need to tie isolated threads to an explicit lifetime and wait for cleanup even when startup is cancelled or its result is never received.
## What changed
- Add `ThreadManager::start_thread_until` to run an isolated thread until a caller-provided future completes or the thread exits, with a `TaskTracker` covering cleanup and deregistration.
- Retain persistence and session resources across interrupted startup so cleanup can release partially initialized resources or shut down a running session using normal history rules.
- Reject resumed history and startup without explicit session isolation.
## Testing
Add integration tests for cancellation during stalled required MCP initialization, dropping an unconsumed startup result, and owner cancellation that preserves history and parent usability. Also verify that failed duplicate startup leaves the existing thread's writer intact.
GitOrigin-RevId: 47251c1b0c43821ab8f950816c6d341d39cdc823
## What changed
Restrict `run_before_review_deadline_with_cancel` and its re-export to `codex-guardian-reviewer`. Move its timeout, abort, and successful-completion tests from core into the reviewer's deadline module, and remove the standalone `run_before_review_deadline` tests from core.
GitOrigin-RevId: dd9f1ed571a40a4bd66b08c88f3ee2be071f4870
## Why
Session initialization can be cancelled after a persistence writer is installed but before acquisition returns. Cleanup must wait for acquisition to finish so it can discard the writer.
## What changed
Extend `LiveThreadInitGuard` to own in-flight acquisition and finish it before discarding persistence, including when the guard is dropped. Use the guard for thread creation, resume, and inherited model context initialization.
## Testing
Add a regression test that cancels acquisition after writer installation, verifies cleanup waits for handoff, and confirms the writer is removed afterward.
GitOrigin-RevId: 09041fa5cd675d082a86a4cc8a719c572afe11a8
## What changed
- Retain the trusted enterprise identity provider in runtime configuration and bind winning MCP registrations during catalog finalization. Require `features.use_xaa` and a configured identity provider for activation, while preserving existing server restrictions.
- Apply plugin `ema_auth` client, issuer, resource, and scope settings to installed and selected plugins. Disable registrations with mismatched endpoints or empty resources without rewriting plugin endpoints.
- Preserve enterprise auth policy across catalog rebuilds and rebind registrations when materialized server settings change. Keep registration rejection separate from persistent server-name vetoes so it does not disable replacement hosted apps.
## Testing
Add coverage for activation gates, configuration ownership, plugin endpoint validation, catalog rebuilds, and skipping interactive OAuth during installation of enterprise-managed plugins. Stabilize the sandbox network proxy test by reading request headers before closing the loopback connection.
GitOrigin-RevId: 3374f507d120835b285767cedbbb511fc7b0fba2
## Why
Command execution and plugin measurement events lack model and reasoning-effort labels. Attribution needs to reflect the step that invoked the command, even when model settings change before a background process finishes.
## What changed
- Add `model_slug` and `reasoning_effort` to command execution and plugin measurement analytics.
- Capture model context from resolved step settings and carry it through execution, approval, Guardian review, and plugin metrics collection.
- Preserve the first command-start model context when subsequent start notifications arrive.
- Keep the carried context out of serialized protocol items and generated schemas.
## Testing
Extend analytics tests to cover model switches before invocation and during background execution, default reasoning effort, Guardian-denied commands, and repeated start notifications retaining the original model context.
GitOrigin-RevId: af90e1c0d39bab625f2e89786085b61a9b96c0ce
## Why
Running code-mode cells can request Guardian review while the next response is in flight. Clearing the response ID before that response emits `response.created` leaves those reviews without a `parent_response_id`.
## What changed
Keep the latest response ID received in the turn until a later `response.created` replaces it, including across sampling retries.
## Testing
Add regression coverage for reviews before and after a response handoff and for a fresh turn that must not inherit the previous turn's ID. Update retry coverage to expect the last known parent when the retry supplies no response ID.
GitOrigin-RevId: af0a08de09edad59e1a7ade7904a42d616b05679
## Why
Idle Apps clients and cached MCP bindings can retain replaced tool definitions. Shared catalog updates can also invalidate prepared calls even when the current definitions match the captured catalog, including after tools are restored while a call awaits approval.
## What changed
- Share immutable tool arrays across equivalent live discovery contexts and reuse storage for equal results. Let unused providers and cached bindings expire.
- Include requested capabilities and initialization results in the sharing scope, and detach servers that disable catalog caching from live sharing.
- Capture catalog snapshots for prepared calls. Accept equivalent shared catalogs regardless of tool-list order, while rejecting changed definitions and calls captured before an explicit refresh on that client.
## Testing
Add regression coverage for shared storage and scope isolation, release of replaced tools and unused bindings, equivalent catalog restoration, explicit refresh invalidation, and an Apps call completing after catalog restoration while awaiting approval.
GitOrigin-RevId: a0516186e4286d0ff13405fafbab6fcf3f1f3773
## Why
MCP tool parsing eagerly cloned structured output schemas and built full call-result envelopes. Cloning tool definitions also copied their output-schema JSON, even before a consumer needed it.
## What changed
- Introduce `ToolOutputSchema` with immutable `Arc` storage so tool definitions share output schemas when cloned.
- Retain MCP structured output schemas and materialize the call-result envelope only when JSON is requested.
- Update code-mode consumers and schema mutation sites to materialize JSON explicitly, reusing uniquely owned storage when possible.
- Move structured content into the MCP envelope without an extra clone, preserving property order.
## Testing
Add tests for JSON preservation, mutation isolation, equality between lazy and materialized schemas, reuse of uniquely owned storage, and equivalent code-mode definitions.
GitOrigin-RevId: e98ba4c2f0efedc99f7cbc7bba206cc63a3bd8f4
## What changed
Add `ConversationState` and `ConversationCheckpoint` to `codex-guardian-reviewer` and use them in core review sessions to track transcript cursors, completed review counts, and committed snapshots. Keep history and admitted evidence host-owned.
Preserve the separation between live review progress and committed checkpoints so forks inherit the history, cursor, and review count from the last committed snapshot.
## Testing
Add a unit test verifying that forks retain committed history and progress after an uncommitted review, then advance when the next snapshot is committed.
GitOrigin-RevId: 9f92410b11beec6b8f413c4c922fabba65852399
## What changed
Move full/delta transcript selection into the shared `TranscriptMode::select` API and use it when building guardian prompts. Export `TranscriptCursor`, `TranscriptMode`, and `TranscriptSelection` from `codex-guardian-context`.
Preserve full-transcript fallback when the history version changes or the saved cursor exceeds the collected entry count. Select entries before profile retention, preserving their numbering and returning a proposed cursor that counts all collected entries. Hosts remain responsible for committing and invalidating cursors.
## Testing
Add a regression test verifying that sliding-window retention preserves the collected-entry cursor and that an appended entry is selected and numbered correctly in the next delta.
GitOrigin-RevId: a2192c08e23c18302b0105ba47aeb2780eb4a015
## Why
A summary-free parent context reset could reuse a Guardian review session and carry forward rationale from before the reset.
## What changed
Track destructive history replacements with `reset_version` and include it in the Guardian session reuse key. Ordinary input and compaction preserve this version.
## Testing
Update the review-session reuse test to require a new Guardian thread after a summary-free reset, with no prior review context or previous rationale.
GitOrigin-RevId: bd05c149774839f68b75294751f7619ba7ce0bfe
## What changed
Include `sessionId` and the originating `windowId` alongside `threadId` and optional `itemId` in MCP request metadata. Retain the originating item and window for code-mode cells across waits and compaction, including the window when no matching history item is found.
## Testing
Extend metadata assertions for direct and nested MCP calls. Add a regression test verifying that a code-mode cell retains its original item and window IDs when it resumes after compaction.
GitOrigin-RevId: 5e3cf761f2bed4c16565334c94654496367325fd
## What changed
Expose `prepare_windows_sandbox_config` and `PreparedWindowsSandboxConfig`
and use them during config loading. Preserve requirement enforcement and the
separation between the configured mode and the effective sandbox level.
## Testing
Add a unit test covering explicit mode precedence over feature fallback and
ensuring a feature-only fallback leaves the configured mode unset.
GitOrigin-RevId: 98e7f9fbc473b6a841257eca80d9a51950986055
## What changed
- Add a configurable `new_worktree` action, bound to `w`, for local sessions with worktree support enabled.
- Create the worktree from the cached project default branch, preferring remote `HEAD` and falling back to conventional `main` or `master` refs without fetching. Preserve the selected subdirectory and source checkout edits.
- Start and bind a blank session in the new worktree, preserving the selected approval reviewer without sending an initial turn.
- Show creation progress, pause conflicting actions, clean up unclaimed clean worktrees, and report retained checkout paths when session startup fails. Clear pending creation state on reconnect.
## Testing
Add coverage for default-branch selection, source checkout preservation, session ownership and approval settings, cleanup, startup failures, reconnect state, and busy-state rendering. Extend Git environment isolation coverage and test unrelated non-UTF-8 refs.
GitOrigin-RevId: 771ddc12d04dbf0d12e77e9c96c8386cf31e67c5
## What changed
- Replace the inline task composer with a session list: `n` opens a blank session in the selected checkout without sending an initial turn or interrupting running agents.
- Use single-letter action shortcuts and `Enter` to open a session. `Esc` cancels search or rename without closing the list; `Ctrl+C` quits from the list.
- Load destination settings for new sessions while carrying over explicit permission choices. Retain blank sessions and their drafts across navigation until the first turn.
## Testing
Update tests and snapshots for command center navigation, shortcuts, blank draft restoration, destination defaults, permission carryover, and directory trust.
GitOrigin-RevId: bddd04fdbe6ac2f5b7bd70293fd04f673b97ba02
## Why
Model and reasoning effort updates during a turn can leave request metadata and tool hooks reporting the turn's initial settings. Metadata should describe the step that issued the request or tool call.
## What changed
- Share captured execution metadata across Responses, MCP, and extension tool calls, including model, reasoning effort, and automatic review and Node REPL flags.
- Build Responses tool inventory metadata from the issuing step's finalized tool router. Attach the finalized inventory separately for remote compaction.
- Use captured step settings for pre- and post-tool hooks, and captured review settings for permission-request hooks.
## Testing
Add and extend regression tests for model and effort changes during a turn, MCP metadata, pre-tool hook model attribution, captured review flags, and tool inventory matching the issuing request.
GitOrigin-RevId: 9dee46a8b4839de8b434cdad4ed441cc0bb6ff9b
## Why
Direct tool-call records need to stay associated with the invocation that produced each output, including when call IDs are reused. Completeness must describe the recorded call inventory, independently of tool success.
## What changed
- Attach direct-call records to outputs before they enter history, and set `tool_calls_complete` when the invocation's arguments are fully recorded.
- Bound pending recordings and retained metadata, release reservations on completion or cancellation, and invalidate pending records when capture is disabled.
- Apply request budgets to direct metadata and strip it from inference and compaction inputs when capture is disabled.
- Remove executed-call metadata from app-server raw response notifications and exclude its size from Guardian history retention budgets.
- Track call IDs that bypass dispatch so their reuse cannot incorrectly establish Code Mode completeness.
## Testing
Add regression coverage for direct-call attribution, malformed calls, metadata budgets, cancellation, configuration changes, compaction, notification filtering, and Guardian context isolation.
GitOrigin-RevId: 2ebd39c7f141d04788736491495109841656b4c0
## What changed
- Introduce `PreparedNetworkConfig` to separate proxy preparation from applying managed network requirements, preserving preparation before permission fallback in local configuration loading.
- Add helpers to build portable environment policies, retain selected or managed policies even when the proxy is disabled, and validate policies against the final permission profile using the execution resolver.
- Strip listener addresses from environment network configuration and reject unsupported settings, malformed domain patterns, and invalid Unix socket paths.
- Expose supporting managed-feature and permission-profile configuration helpers.
## Testing
Add coverage for policy retention, listener removal, unsupported and malformed policies, and validation against permission profiles. Strengthen configuration tests to compare rebuilt proxy specifications and verify proxy configuration survives permission fallback.
GitOrigin-RevId: 444bf02d8543eaebdbd2ebc14b56d92ce6d2ad2f
## What changed
- Add explicit MXC backend selection and carry its identity through exec-server process reporting and sandbox violation classification.
- Launch MXC through the Codex executable with the effective permission profile and command environment.
- Reject exec-server MXC requests when native MXC is unavailable or when they request a TTY, an `arg0` override, or managed networking. Reject private desktop isolation during MXC preparation.
- Allow an explicitly empty child environment and avoid exposing request payload values in launcher decode errors.
## Testing
Add coverage for sandbox selection and unsupported-request rejection, plus Windows RPC tests for stdin writes and temporary-directory permissions derived from the command environment. Native MXC tests skip when MXC is unavailable.
GitOrigin-RevId: 3626ff0f9ad7f9b812ce09b68c31ea9a5a9c72b1
## What changed
Add the disabled-by-default `send_message_to_user_async` feature flag so root agents can use the tool without model catalog support. Preserve catalog-based opt-in and keep the tool unavailable to subagents. Register the flag as under development and expose it in the configuration schema.
## Testing
Extend integration tests to cover feature and catalog opt-ins, deduplication when both are enabled, subagent exclusion, and the retired `send_async_message` flag. Check that either opt-in allows messages to be emitted without ending the turn.
GitOrigin-RevId: 3f53181ab074b0432c795550de73a9b1da7caf15
## Why
Serialized response items include message IDs, metadata, and JSON escaping that inflate token estimates without adding model-visible content.
## What changed
- Estimate each response item from its content, retaining JSON syntax for structured tool payloads.
- Apply image estimates to all image inputs, including non-base64 URLs, and count audio and encrypted content through their modality-specific estimates.
- Exclude plaintext reasoning and bookkeeping-only items from replay accounting.
## Testing
Update unit expectations for text, images, audio, and encrypted content. Add a remote compaction regression test showing that equal-length text produces identical token usage estimates despite different message IDs, metadata, and JSON escaping, while preserving the submitted messages.
GitOrigin-RevId: 1c43d5abbcc1668b4ab413901a2b4b6511ca5892
Matthew Zeng