## What changed
Replace fixed release pins for app-server/exec-server compatibility tests with the latest stable version and the stable release published closest to 60 days ago. Exclude drafts and prereleases, and prefer the higher version when publication dates are equally close.
Resolve release versions and SHA-256 asset digests before Linux Bazel CI runs, passing them through `CODEX_COMPAT_RELEASES` to the release archive repositories. Reuse the argument comment lint action so it also prepares compatibility releases. Add bounded retries for transient GitHub release reads.
## Testing
Add unit coverage for stable release filtering, version ordering, nearest publication dates, tie-breaking, and deduplication when both selections resolve to the same release.
GitOrigin-RevId: 5a8cf8bdabd77ab3fa89bbb711367b5d9ce8044b
## Why
A plugin's scripts can change without changing its hook declaration. Declaration-only approval therefore lets changed plugin code run under an existing hook approval.
## What changed
- Fingerprint plugin bundle contents and include the content hash in the approval value returned by `hooks/list`. Persist it as `trusted_content_hash`, keeping `trusted_hash` compatible with older clients.
- Verify contents before each command or MCP hook execution, within the hook's timeout, and require renewed approval when approved contents change.
- Migrate legacy declaration-only approvals to a shared, immutable content baseline per plugin and config home.
- Exclude generated Python bytecode, `.venv`, and `.egg-info` entries from fingerprints. Run app-server hook listing on blocking tasks.
## Testing
Extend integration coverage for plugin upgrades and rollbacks requiring approval, same-turn script changes preventing further hook execution, shared legacy approval baselines, and generated Python artifacts preserving trust.
GitOrigin-RevId: faaf7658210d8adb2534ddd614c72ec993920840
## What changed
Recognize `codex_app.create_thread` deliveries when capturing sender context so Guardian receives the sender's recent user messages and assistant context for delegated tasks.
## Testing
Extend the sender-context integration test to cover `create_thread`, including reviewer-only context and clearing the snapshot on a subsequent delivery without sender provenance.
GitOrigin-RevId: 7a47c3ac5b9c9405e6728010c494529274b7b73d
## Why
The optional Guardian Decisions comparison rejected non-user messages and trusted skill evidence, and folded trusted tool evidence into the classification rubric.
## What changed
Send evidence as separate messages with their original roles, content order, boundaries, and optional `phase`. Support both `input_text` and `output_text`, keeping trusted tool and skill evidence separate from the rubric. Continue to accept inline images only in user messages and reject unsupported evidence.
## Testing
Update adapter and HTTP contract tests to cover mixed message roles and assistant output. Extend lifecycle coverage to verify that trusted skill evidence reaches Decisions while comparison results leave the baseline risk unchanged.
GitOrigin-RevId: 1b6814fe6db5891fb61604d6846a008c9e456054
## Why
Optimized `Array.prototype.sort` can write objects into incompatible array element storage when receiver element kinds differ and the comparator mutates the array.
## What changed
- Upgrade `v8` to `152.2.0`, the Bazel V8 source to `15.2.124.1`, and ICU data and initialization to version 78.
- Backport element-kind agreement checks for sort inlining in TurboFan and Maglev. Apply the patch to Bazel builds and Windows MSVC source builds, and include it in source-build cache keys and canary triggers.
- Refresh pinned sandbox archives and bindings, extend Bazel prebuilt coverage to musl Linux, and use matching sandbox bindings on Windows MSVC.
- Update Bazel integration patches and runtime dependencies for the new V8 release, and download the pinned Windows build tools in source-build workflows.
## Testing
Include the upstream sort regression test covering mixed element kinds, comparator mutation, and continued optimization for matching kinds. Add a test requiring canary and Windows source builds when the backport changes, and update artifact-fetch tests for the new version.
GitOrigin-RevId: 138b7821cddd25466c10aced1dd22be24837caf0
## What changed
Add `write_file_stream` to `ExecutorFileSystem` and `EnvironmentAccess`, preserving the accessor's captured sandbox permissions. Local and streaming-capable remote filesystems replace files one bounded chunk at a time and return the byte count. Older executors buffer the input before sending a single `writeFile` request.
Close remote handles on completion or failure, perform best-effort cleanup after cancellation, and invalidate pending metadata lookups. Document that failure or cancellation can leave a truncated or partial file and that in-flight I/O may outlive cancellation.
## Testing
Add coverage for sequential writes, binary and empty files across local and remote filesystems, source failures, handle cleanup, metadata invalidation after cancellation, and compatibility with older executors.
GitOrigin-RevId: d3eb44e0ac2f0f336e9e157d686464f4d45a3f26
## What changed
Replace the Tokio mutex protecting `RemoteFileSystem`'s in-flight metadata request map with `std::sync::Mutex`. Keep metadata I/O outside the lock and centralize locking in a helper that recovers poisoned guards.
Update the existing concurrent metadata request test to use the locking helper.
GitOrigin-RevId: 78aaecfbd8e8af9c1e5ea273758a414b0ad679a5
## Why
Missing protected metadata paths already receive read-only synthetic mounts, as established in https://github.com/openai/codex/pull/39629. The fallback creation monitor no longer receives any targets because those paths are included in the read-only mount list.
## What changed
Remove `ProtectedCreateTarget` tracking and its inotify monitor, deletion fallback, registry markers, startup pipe, and policy-violation exit override. Keep synthetic mount cleanup and propagate the bubblewrap child's exit status directly.
GitOrigin-RevId: ac747860cad845ebb89ada5a9c1009e56835c4fb
## What changed
- Add `--executor-credential-stdin` to read newline-delimited JSON credentials bound to the configured environment. Require an initial credential within 30 seconds and accept subsequent rotations.
- Reject expired credentials on each request, and stop the executor on invalid input or stdin closure. Limit credential frames to 16 KiB.
- Use scoped bearer authentication for registry requests without account credential fallback or WebSocket authentication headers. Skip workload identity loading and configured telemetry exporters in this mode.
## Testing
Add unit and integration coverage for rotation, expiry, malformed frames, environment mismatches, stdin closure, registry-only authentication, credential redaction, and telemetry exporter isolation.
GitOrigin-RevId: 30a94478165395144a765450f5ec6b3697acdd55
## What changed
- Show `Exited (status N)` instead of `Failed (exit N)` for compact command output, and remove the red bullet styling.
- Label compact exploration counts as `nonzero exit` or `nonzero exits` instead of `failed`, and remove the red styling from the count.
## Testing
Update snapshots for compact command output and exploration summaries to reflect the new labels and styling.
GitOrigin-RevId: 043593720cc3837ca530d1c008565695abcd5af1
## Why
Remote credential masking previously supported only Bash commands without login startup or shell snapshots, leaving Zsh commands with unmasked credentials.
## What changed
- Enable masking for Zsh login commands using shell snapshots on Linux and macOS.
- Capture trusted startup profiles per launch, bind the credential broker to the resulting environment, and replace credentials and supported aliases with placeholders before snapshot replay.
- Preserve explicit environment overrides, credential unsets, and launcher-managed proxy settings during replay.
- Warn and fall back to unmasked startup when a snapshot cannot safely replay credentials; stop execution if protected snapshot restoration fails.
## Testing
Extend remote execution tests for inherited and profile-defined credentials, overrides, destination changes, and unsupported-profile fallback. Add a Zsh scenario snapshot showing a credential placeholder in command output.
GitOrigin-RevId: 83193d6cbc05f3deb0d6d0b9ae80974b353ce900
## What changed
Add optional `remote_plugin_id`, `release_id`, and `auto_provision` fields to `PluginConfig` and the configuration schema. Store remote plugin identity, release, and provisioning metadata without fetching releases or triggering provisioning. Entries containing only this metadata continue to inherit existing plugin activation defaults.
## Testing
Extend configuration round-trip and plugin loader tests to cover remote metadata entries with inherited enablement and with `plugins._default.enabled = false`.
GitOrigin-RevId: bb657c25929cab100982b37120ab62b089eb7044
## Why
Explicitly selecting the default daemon socket previously classified the TUI connection as remote, changing how local configuration and thread parameters were handled. A socket at that path may also be an SSH forward, so the path alone cannot establish that the daemon is local.
## What changed
- Verify the default daemon endpoint before classifying an explicit connection as local. On Unix, check the expected symlink target and the private socket directory's ownership and permissions, then connect to the protected endpoint directly.
- Preserve local workspace behavior and local thread parameters for verified attachments while keeping directly bound Unix sockets classified as remote.
- Report a missing explicitly requested socket, disable embedded fallback for explicit attachments, and restrict daemon auto-start to implicit connections.
## Testing
Extend tests to cover explicit and implicit local target selection, verified socket resolution, and rejection of a directly bound socket as a local daemon endpoint.
GitOrigin-RevId: ac2226ca1c5f60b26aad9571f945e3325d3bebfa
## What changed
Add optional `inputImages` metadata containing each referenced local image's path and SHA-256 hash of the bytes read before normalization. Compute the hash from the same bytes used to prepare the edit request.
Preserve this metadata through completion events, persisted thread history, resume, and legacy rollout migration. Update app-server schemas and generated TypeScript and Python types; older items continue to deserialize without the field.
## Testing
Add coverage for input ordering, changed contents at the same path, unreadable or invalid references, serialization, persisted history and resume, and legacy migration.
GitOrigin-RevId: 522be8ec1e39c9b2bbe5b9ccb37ea67d17f0e21a
## Why
Flowcharts with `<br>` tags in node labels previously fell back to source instead of rendering as terminal diagrams.
## What changed
Render `<br>`, `<br/>`, and `<br />` as line breaks in quoted and unquoted flowchart node labels. Apply the 40-display-cell label limit per line and keep the decision marker on the first line. Continue rejecting other HTML, break tags in edge labels, and labels containing only breaks or whitespace.
## Testing
Extend rendering snapshots across all four flowchart directions and cover per-line width limits and unsupported markup. Update TUI streaming tests to cover multiline rendering, resizing, source fallback, and preservation of the original source for copying.
GitOrigin-RevId: 61f2a84c8bb161ac4a1c26ddaa0569f52bfea749
## Why
SQLite page reclamation on NFS creates I/O load and contention.
## What changed
Detect whether `sqlite_home` is on NFS on Linux and skip reclamation before opening a maintenance connection. Cache successful filesystem probes across `SqliteConfig` clones while allowing failed probes to retry.
## Testing
Add tests for shared probe caching and recovery after a missing directory is created. Update reclamation coverage to expect no reclaimed pages or file shrinkage on NFS.
GitOrigin-RevId: 4f627cabc6ad712171654c3f8b8659d2f632bbba
## Why
Live descendants previously blocked suspension of an unfinished root turn, requiring callers to stop and unload them before recovering the root elsewhere.
## What changed
Allow `suspend_turn_and_shutdown` to suspend the root and initiate shutdown of all sessions sharing its local agent runtime, fencing new starts. Remove `SuspendTurnOutcome::HasLiveDescendants`.
Success confirms that the root has stopped and its history writer is flushed and closed; descendant cleanup completes separately. Callers must finish tree shutdown or fence and terminate the tree's persistence writers before transferring ownership. Interrupted descendants are not automatically recovered.
## Testing
Extend integration coverage to verify child shutdown, recovery under the original root turn ID without restarting children, and separate reporting of child writer failures.
GitOrigin-RevId: 5adc240ae6e34654209154ee9324621a2bd604d5
## What changed
- Launch managed processes through `taskpolicy -b` on macOS when a five-second probe succeeds, preserving the managed process PID. Fall back to direct launch if the probe fails or times out.
- Increase the macOS startup timeout from 10 to 30 seconds to accommodate background CPU and I/O scheduling, and serialize daemon startup test fixtures on macOS.
- Use the shared background command helper and retain `CREATE_NO_WINDOW` alongside Windows detachment flags.
## Testing
Add macOS tests for PID preservation, background priority when available, and direct-launch fallback after a probe timeout.
GitOrigin-RevId: ab3328e2e8f62218ac9602e4172563c00056875b
## What changed
- Upload generated images to the attachment store and expose `fileId` in image-generation items when available, with inline `result` fallback on upload or decoding failure.
- Preserve file references through legacy events, persisted rollouts, thread history, and task output summaries. Keep model-facing image preparation separate.
- Add attachment request tags and mark generated-image uploads with `usage=image_gen`, preserving the thread's ephemeral setting.
- Update public schemas and SDK types to accept either image representation, retain the Python `ImageGenerationThreadItem` alias, and prefer `fileId` when reading records containing both fields.
## Testing
Add coverage for file-backed generation and rollout persistence, legacy history replay, inline and transitional serialization, task output visibility, and Python SDK alias compatibility.
GitOrigin-RevId: f7a2bb5707e2f277348a547a988bc33c8e96d891
## Why
Opening an initialized database in `DELETE` journal mode previously attempted to convert it to `WAL`, which could fail while another connection held a write lock.
## What changed
- Initialize `WAL` and incremental auto-vacuum only for databases without a schema, including files left by interrupted initialization.
- Preserve journal and vacuum modes for initialized databases, use `synchronous = EXTRA` for `DELETE` connections, and retain `NORMAL` for `WAL`.
- Close failed initialization pools before retrying and restrict background page reclamation to `WAL` databases.
## Testing
Extend SQLite tests to cover interrupted initialization, opening `DELETE` databases under a write lock across all pool connections, persistence after reopening, and lock release after failed initialization.
GitOrigin-RevId: 23acecfe472618dde8545815e9a1058a51591235
## What changed
Add current terminal title and status line options to the preset picker. Generate `/title` and `/statusline` commands that preserve item order and duplicates, normalize item aliases, and retain the status line color setting. Use `--clear` for empty layouts and disable options containing unavailable items.
## Testing
Extend picker tests and snapshots to cover the new options, generated commands, empty layouts, and unavailable terminal title items.
GitOrigin-RevId: b836b15e87c03249cf479b1c3baf0bd71931a6be
## What changed
Allow inline item selection, such as `/title model reasoning` and `/statusline current-dir --no-colors`, without changing saved defaults. Support `--clear` for both commands and `--colors` or `--no-colors` for `/statusline`, including color-only updates that preserve the current items.
Carry overrides with per-thread input state across navigation and reconnects, and allow these local commands in parent-owned subagent threads. Reject invalid or conflicting arguments before applying changes. Saved editor selections supersede the corresponding overrides.
## Testing
Add coverage for argument parsing, atomic updates, rate-limit item aliases and ambiguity, thread-state restoration, saved-setting interactions, and local command submission in parent-owned threads.
GitOrigin-RevId: 909cc2ede026fbf5c7f9cd52c8cf2ae835084f14
## Why
Creating a preset from current settings only offered the model. Permission presets need to preserve the profile, approval policy, and reviewer to restore the same settings.
## What changed
- Add a “Current permissions” option alongside “Current model” when creating a preset from settings.
- Extend `/permissions` with `--approval-policy` and `--reviewer`, including granular policies and quoted profile names.
- Share argument parsing between `/model` and `/permissions`, supporting quoted arguments and both `--setting=value` and `--setting value` forms.
- Keep full-access confirmation for every reviewer and reject automatic review when unavailable.
## Testing
Add parser tests, preset picker snapshots, and permission-selection tests covering complete settings restoration, invalid arguments, unavailable automatic review, and full-access confirmation.
GitOrigin-RevId: f4c9c3f6e264ee8ea4c5244c79f39f2deb15b771
## What changed
Allow `/permissions <profile-id>` to select a built-in or custom permission profile, for example `/permissions :read-only`. Support `:ask-for-approval` and `:approve-for-me` aliases while preserving feature gates, profile requirements, full-access confirmation, and Windows sandbox setup.
Hold queued input until the selection is confirmed, and retain it on cancellation or failure. Reload custom profile definitions on re-selection without leaving unchanged requests pending.
## Testing
Add coverage for unknown and disabled profiles, approval aliases, confirmation and cancellation, discovery retries, Windows sandbox setup, and queued prompts waiting for server confirmation.
GitOrigin-RevId: ada38d3cfc6d6ac4e84ce5645fe33432c55d63cc
## What changed
Replace the `/presets` recall picker with a responsive menu above the composer. Press `0`–`9` to run a saved preset or create one in an empty slot; use `n`, `s`, `e`, and `d` to create, start from current settings, edit, and delete presets.
Add `tui.keymap.chat.open_presets` with an implicit `leader p` shortcut that yields to existing bindings and explicit configuration. Show the action in `/keymap` and add a shortcut tooltip.
Preserve the composer draft, respect popup ownership, and consume held-key repeats after menu actions.
## Testing
Add snapshots for empty, populated, and narrow preset menus, plus coverage for draft preservation, cancellation, held-key handling, transcript search precedence, and default shortcut conflicts.
GitOrigin-RevId: f438c7015dbd416c90cdeb479d2a15d9d6d24954
## What changed
- Add a TUI picker with ten numbered preset slots, an editor, and confirmation before replacement or deletion.
- Create presets from composer text or current model, reasoning effort, and speed settings. Run saved inputs through the normal queued submission path while preserving the composer draft.
- Persist presets under `tui.presets` in the active user configuration, respecting configuration layer ownership and leaving in-memory settings unchanged when writes fail.
- Preserve permissions when changing effort or speed for the effective model, keep default collaboration settings intact in Plan mode, and allow standard-speed selection with older app servers.
## Testing
Add persistence tests for save, replace, delete, configuration ownership, and write failures; picker and confirmation snapshots; and regression coverage for model permissions and standard-speed fallback.
GitOrigin-RevId: 5f11699112cd404cc8e954872d53495c6edd0c0a
## What changed
Add `tui.presets` entries keyed by a single digit from `0` to `9`, each with an `input` prompt or slash command and an optional `label`. Expose presets in the configuration schema, load them into runtime configuration, and preserve them in TUI local settings.
Reject invalid slots, blank inputs, shell commands beginning with `!` after leading whitespace, and inputs exceeding 8,000 UTF-8 bytes.
## Testing
Extend the runtime configuration test to verify loading both a slash command with a label and a prompt without one.
GitOrigin-RevId: d2911e540bc50f05b4a5224abf17ce4ef5a18ea3
## What changed
Allow `/model [model] --reasoning <level> --speed <tier>` to update the current session without changing saved defaults. Both space-separated and `=` flag values are supported; omitting the model applies settings to the current model. Bare `/model` still opens the picker.
Validate model availability, supported reasoning levels, and speed tiers before applying changes. Reject unknown flags, duplicate settings, and missing values. Apply model, reasoning, and speed together after server acceptance.
Restore each thread's speed when switching threads, and use destination configuration defaults for new sessions instead of carrying over the active session's speed.
## Testing
Extend regression coverage for inline commands, invalid arguments, unchanged saved defaults, settings-only updates to hidden current models, destination speed defaults, and speed restoration on the next turn after switching threads.
GitOrigin-RevId: ad9cecbdb3554e34a6518367364978a37fb68439
## Why
Competing SQLite writers can cause database opening and writes to fail with `SQLITE_BUSY`. Deferred write transactions can also encounter contention after taking a read snapshot.
## What changed
- Add up to two retries with 100 ms and 200 ms delays for SQLite busy errors during pool opening, writer admission, and standalone writes.
- Use a shared `BEGIN IMMEDIATE` helper across state, thread history, and agent message board writes to acquire the writer slot before reading.
- Preserve bound arguments when retrying standalone writes, and commit writes using `RETURNING` before exposing their results. Retry transaction admission without replaying an already-started transaction.
## Testing
Add tests using real SQLite writer contention to verify recovery after a competing writer releases its lock. Queue tests cover enqueue, update, and delete, checking preserved payloads, single revision increments, and no duplicate messages or unintended deletions.
GitOrigin-RevId: ac5bd31a87c67cc47fb385bf3fa5435a54ff70f0
## Why
When a command starts before an assistant message completes, the TUI can flush the streamed text and then render it again when the completion arrives. This duplicates the preamble in both live output and replay.
## What changed
Track the turn ID, item ID, and source text of the flushed message. Skip rendering its completion again when the identity and text match, allowing for the trailing newline added during stream finalization. Continue rendering completions whose identity or text differs.
## Testing
Add an end-to-end test that delays message completion until a command starts and checks that live and replayed transcripts contain the preamble once. Add regression coverage for completions with different text or item IDs.
GitOrigin-RevId: 59af0198a99f26ba8ba2a47644ba662301c30011
## What changed
On Windows, omit network roots whose filesystem identity cannot be inspected when expanding implicit `:root` read access. Retain inspectable shares and roots containing the policy or command working directory, and apply the same filtering during policy inspection and command launch.
Keep explicit grants unchanged and continue expanding `:root` write and deny rules across all executor volumes.
## Testing
Extend policy tests to cover filtered read roots, explicit grant precedence, and approved-command write access across all volumes.
GitOrigin-RevId: c4d7c8ce2c9138cdb4518385e2cd05f66518628e
## Why
A thread-wide index can scan earlier turns when a turn's final item page is underfilled.
## What changed
Force `idx_thread_items_by_turn_page` for turn-scoped item queries when neither `item_ids` nor `after_updated_at_ordinal` is set.
GitOrigin-RevId: 63c86fafa08446351a5d9828b479c497c76a8555
## What changed
- Add `RemoteEnvironmentConfig::with_executor_credential_auth()` for Noise transport, requiring exactly one `Authorization: Bearer <credential>` header without accompanying account credentials.
- Require HTTPS registry URLs except on loopback, and bypass system proxies for loopback HTTP requests.
- Mark credentials as sensitive, suppress registry diagnostics that could echo them, and reject registration responses containing the credential while preserving recognized retry error codes.
- Reject scoped executor credentials for Direct registration and WebSocket connections. Keep legacy authentication as the default.
## Testing
Add tests for invalid credential headers, HTTPS and loopback restrictions, proxy bypass, credential echoes in registry responses, and rejection before Direct transport sends requests.
GitOrigin-RevId: a427d648a0520d2e187dd40ca63268903a949f94
## What changed
Replace duplicated content-kind strings with constants shared by fragment producers and consumers, including authorization checks, forked-history filtering, and memory instructions. Share the compaction summary kind between core and Guardian's transcript filter.
## Testing
Add a regression test verifying that Guardian excludes compaction summaries while retaining surrounding user messages, including a user message with identical text.
GitOrigin-RevId: 36dbdf0f82c61b52d2571ac1c392fb151c98151b
## Why
Syntax theme colors can have insufficient contrast against the terminal background or the shaded proposed-plan surface.
## What changed
- Adapt themed Markdown foreground colors to the terminal background while preserving inline code colors from the syntax theme.
- Adjust proposed-plan foreground colors after applying the plan background, including retained styles used for reflow. Apply the same styling to streamed and completed plans.
## Testing
Expand snapshots across syntax themes and light and dark backgrounds, and cover proposed-plan tables and streamed plans with wrapped hyperlinks. Update streaming assertions to expect contrast-adjusted blockquote colors.
GitOrigin-RevId: 0e358412562c438af17be5bcded9d058b56212b7
## What changed
Negotiate executor support for `credential_masking` and enable built-in credential brokerage in executor-local network proxies. Supported non-login Bash commands on Linux and macOS receive credential placeholders, with real credentials injected by the proxy for matching destinations.
Retain credential mappings across process launches within the same executor session, scoped by environment, conversation, and broker configuration. Keep credentials and destination context on the executor.
Fall back to unmasked execution for unsupported shells or shell startup, and for configured credential providers. Emit warnings when masking is unavailable, preserving shell profiles and snapshots.
## Testing
Add coverage for capability negotiation, fallback behavior, mapping reuse and isolation, proxy credential injection, and keeping executor credentials out of model-visible request history. Test warning, removal, and rejection modes for credentials left unmasked during preparation.
GitOrigin-RevId: f64e916a5de8350fa0d289d3440ec29761accd75
## Why
Local compaction stores generated summaries with the `user` wire role, but those summaries are not user authorization. Guardian transcripts need to preserve that distinction when reviewing compacted history.
## What changed
Classify messages marked with `compaction.summary` as assistant entries in Guardian transcripts, while preserving the attribution of actual user messages.
## Testing
Add transcript collection coverage and regression tests for both line and JSON transcripts that verify generated summaries are attributed to the assistant and original user instructions remain attributed to the user.
GitOrigin-RevId: 66183028ce70a2500d47d3347b110f95471ba868
## What changed
- Add `ComposedContext::retain_new_images` and use it in Guardian review sessions and the async scorer. Compare host-prepared image references against admitted history, ignoring image detail, and skip scanning history when no images need checking.
- Restore `ConversationState` directly from a checkpoint, retaining committed history for rollback or transferring it with `take_history` for ephemeral forks.
## Testing
Extend tests for prepared-image matching across differing detail levels, image-free continuations that avoid scanning history, and checkpoint restoration and history transfer.
GitOrigin-RevId: bafeb6de9babc721182be43d0eb1a653955a0ebb
## Why
On case-insensitive macOS filesystems, paths such as `.GIT/config` refer to protected `.git/config` metadata but can pass case-sensitive write permission checks.
## What changed
Check native filesystem case sensitivity when matching protected metadata paths, including case aliases in workspace roots. Recheck both the target and policy entries with normalized aliases so explicit metadata grants and narrower restrictions retain their precedence. Return errors when filesystem case sensitivity cannot be established.
## Testing
Add macOS coverage for metadata and workspace-root case aliases, explicit grants, narrower restrictions, and missing directories. Strengthen the patch regression test to assert the approval rejection message for both direct `apply_patch` calls and shell interception.
GitOrigin-RevId: 8ae2eb97ce6ec71c51bead130515b9ce6c1cdfab
## What changed
Add an integration test that approves a sandboxed `exec_command` attempt, simulates a sandbox denial, and denies the subsequent unsandboxed retry. Verify that Guardian reviews the retry separately with `require_escalated`, that the denied retry never reaches the executor, and that the tool result includes the denial rationale.
Use a fake executor to exercise the sandbox denial consistently across hosts.
GitOrigin-RevId: cd644255f7a7b7561c9e52a5b6e40f0859b70547
## Why
A failed Guardian inference can retain its input in a reusable session. Tracking transcript progress only after successful reviews can admit the same evidence again on retry.
## What changed
Advance transcript progress when a failed turn has retained its input and the session remains reusable, without counting it as a completed review or changing the committed fork checkpoint. Leave progress unchanged when failure occurs before input admission.
## Testing
Extend regression coverage for encrypted agent messages across review retries, pending evidence after compaction failures, and fork checkpoints after transcript admission without a completed review.
GitOrigin-RevId: 36239ec9d47f484bcfe68d65e7c8d8ab8660db0d
## Why
Guardian approval covers the permissions of the reviewed action. A retry outside the sandbox needs a fresh review of its broader permissions.
## What changed
- Track the initial approval source so Guardian approval does not preapprove an escalated retry, while preserving existing user and hook approval behavior.
- For exec retries that can run without the sandbox, set the approval action to `RequireEscalated` and clear `additional_permissions` so review and caching reflect the retry's actual permissions.
GitOrigin-RevId: 06f8d53745a7bcfe9fdb5628ff9e85da6060547d
## Why
Trimming interleaved realtime transcripts by utterance order can discard the latest speech from an earlier utterance. Evicting after each delta can also drop one speaker before the other speaker's delta from the same frame arrives, losing recent instructions at handoff.
## What changed
Use raw frame recency to trim timed frameless bidirectional transcripts within the 8 KiB budget. Defer eviction until the frame advances or the transcript is consumed, and retain both speakers' suffixes when they share the newest frame. Preserve conversation order and fall back to FIFO eviction when timing is unavailable.
Track trimmed prefixes so final transcripts can extend retained speech without making delayed finals appear newer.
## Testing
Add regression coverage for frame recency, same-frame event ordering, UTF-8 truncation, delayed finals, and untimed fallback. Add an app-server handoff test verifying that both speakers' recent speech and the latest user instruction survive while live transcript notifications remain unchanged.
GitOrigin-RevId: b01b729d8bdd4acb26e0385442ce40819355deac
## What changed
- Verify that freeform `apply_patch` calls and shell-intercepted patches cannot modify `.git/config` through `.GIT/config` when approvals are disabled, while an ordinary workspace file remains writable.
- Add macOS Seatbelt coverage for uppercase protected metadata paths, including absent directories, existing directories with either casing, and case variants of the workspace root. Assert that metadata creation and modification are denied while sibling workspace writes succeed.
The tests skip filesystems that do not support the case-insensitive aliases they exercise.
GitOrigin-RevId: 5cf6b0c36eee348e1ba0db0bc2d3bff072458364
## What changed
Use the active syntax theme's markup foregrounds for headings, emphasis, strong text, list markers, links, and blockquotes. Preserve existing bold, italic, and underline modifiers, and retain previous styles when a scope provides no foreground.
## Testing
Update rendering snapshots and streaming blockquote assertions for themed colors. Exercise existing fallback expectations with an empty syntax theme.
GitOrigin-RevId: b00aa4af30f73f538ff5f888a0f9b4edbdc15893
## What changed
Render local viewed images and generated image artifacts as bounded thumbnails in the rich fullscreen transcript using Kitty or Sixel graphics. Viewed images appear when their activity is expanded or the detailed presentation is active; generated images appear alongside their saved-path entry.
Keep previews clipped to the viewport, retain graphics across unrelated redraws, and remove them when overlays open. Bound image decoding and cache memory, and preserve text-only entries for remote workspaces, unsupported terminals, missing files, and oversized images. Image rows do not enter searchable or selectable text.
## Testing
Add layout and snapshot coverage for disclosure, viewport clipping, rewrapping, raw-mode fallback, deleted files, and oversized rasters. Add terminal coverage for retained Kitty graphics, repainting after a clear, local-file transport, and overlay cleanup.
GitOrigin-RevId: fb2ec146331acfcfc82b2b283616671c9ee93757
## What changed
- Remove feature-flag checks from managed worktree creation and repository-aware session discovery, while retaining local workspace and trust checks.
- Make TUI voice availability follow platform support instead of `features.realtime_conversation`.
- Ignore `features.worktrees` and `features.realtime_conversation` configuration overrides, warn when managed requirements reference them, and hide both flags from `/experimental`, including catalogs from older servers.
## Testing
Add coverage for ignored configuration overrides and managed requirements, and update session filtering, worktree grouping, and experimental feature discovery tests for the retired flags.
GitOrigin-RevId: 1d64e890e6e2f8a78926a9ea163126c0890b068e
## Why
MCP servers at `https://gov.chatgpt.com` were treated as untrusted for ChatGPT authentication and switched to OAuth, preventing local Gov Apps from retaining the ChatGPT auth provider.
## What changed
Trust the `https://gov.chatgpt.com` origin alongside the existing ChatGPT origin when resolving MCP server authentication. Origin matching preserves scheme, host, and port restrictions.
## Testing
Add regression coverage for Gov Apps URL construction, trusted origin normalization, rejection of lookalike hosts and nonstandard schemes or ports, and retention of the local ChatGPT auth provider. Verify that explicit OAuth servers and servers in remote environments do not receive the host provider.
GitOrigin-RevId: 7ceaf7c524d963005d9f23204489bbde269f0dd5
## Why
The app server retained its startup model provider for catalog requests, so signing in or out could leave `model/list` using stale provider settings or requiring a restart after managed provider requirements changed.
## What changed
- Invalidate the catalog after successful login and logout, then reload the effective configuration on the next model list or background refresh. Rebuild the models manager when the provider or catalog changes, while preserving existing threads' routes.
- Retain the original project context and the TUI's `--oss` provider selection across reloads. Retry configuration loading after falling back to defaults so temporary failures do not pin the fallback catalog.
- Keep provider policy checks for cached catalogs and apply runtime `api_key_model_discovery` toggles to the active catalog manager.
## Testing
Add and extend tests for provider selection and definition changes after login, catalog reloads after logout, OAuth gateway transitions, fallback recovery, project context, and runtime model discovery toggles.
GitOrigin-RevId: bce2e23ff567e1a52eac2b6ad736a6e63ff61e2b
## Why
The `/keymap` action catalog and root-config binding lookup duplicated the same action inventory, requiring both to be maintained together.
## What changed
Use `define_keymap_actions!` to generate `KEYMAP_ACTIONS` and `binding_slot` from a single declaration grouped by context. Preserve the existing action order, descriptions, feature gates, and binding mappings.
GitOrigin-RevId: 182e937d9642a8b5a4aa787691da793712f29010
felixxia-oai