## What changed
Remove `initial_messages` from `SessionConfiguredEvent` and the corresponding schema. Stop attaching replay history to startup events for resumed or rejoined threads, and remove `InitialHistory::get_event_msgs`.
## Testing
Update the MCP resume test to verify persisted tool events through `load_history`, and retain coverage that resumed requests include prior conversation items.
GitOrigin-RevId: 54b72bc44423c9b1ef2051891ef392c0ede32fe5
## Why
Hook system messages were rendered as plain text, leaving ANSI formatting uninterpreted.
## What changed
Parse hook system messages into styled spans so colors and text styles render across lines. Preserve hook prefixes, continuation indentation, and trailing blank lines.
## Testing
Add a snapshot test for multiline ANSI styling and style resets, and extend multiline coverage to include a combining character and a trailing newline.
GitOrigin-RevId: 0a5a88ec26fac114fc66efa656bacf6fa15a1adf
Return a clone immediately when the current path is not a prefix of any
registered legacy config key. This avoids recursively visiting unrelated
subtrees while preserving alias normalization along matching paths.
GitOrigin-RevId: 1c7e62898e12ab3f468b978f865805989914ac44
## Why
Closed WebSocket connections previously triggered immediate reconnects, and successful handshakes reset backoff even when connections were short-lived.
## What changed
- Delay automatic reconnects before token refresh or enrollment, and report `Connecting` while waiting.
- Use exponential backoff with jitter between half and all of the delay, starting at 5 seconds and capped at 30 seconds.
- Retain backoff across short-lived connections and reset it after a connection lasts at least 60 seconds.
- Interrupt the reconnect delay on shutdown, auth owner invalidation, or enable/disable changes, including an immediate disable/enable pair.
## Testing
Add connection tests for delayed token refresh, backoff retention and reset, explicit re-enabling, and prompt shutdown. Update retry tests to check jitter bounds, saturation during sustained failures, and backoff retention after a successful handshake.
GitOrigin-RevId: 0b9055ff64ff7d96f2d974b73ced8d4ffd02ac9e
## Why
Cached subagents can remain in the TUI picker after being archived, including when archive notifications are missed.
## What changed
- Hide archived threads from the picker and keyboard navigation, and restore them when unarchived.
- Refresh both active and archived descendants to reconcile cached visibility, including after dropped server events. Queue a follow-up refresh when needed and preserve visibility changes received during an in-flight refresh.
- Preserve picker selection by thread ID as visible rows change, and mark archived thread attachments as replay-only.
## Testing
Extend regression coverage for missed archives, unarchive notifications, hidden subagent navigation, and the subagent enable prompt when only archived subagents are cached.
GitOrigin-RevId: 9e75906dfe6946b1400583a386922453e2b77ea1
## What changed
Add an MCP integration test that forwards sandbox state from tool-call metadata unchanged to `codex sandbox --sandbox-state-json` and runs a real subprocess.
Verify that workspace writes succeed, overwriting an existing file outside the workspace fails and preserves its contents, and relative paths resolve against `sandboxCwd` rather than the MCP server's working directory.
GitOrigin-RevId: 768513c74679010e806a62dffdde6b7cccbfb41f
## What changed
Record `agree`, `disagree`, or `unavailable` comparisons between Decisions risk classifications and accepted Responses scores. Emit paired latency histograms only when both backends succeed, and include request preparation and queue time in Decisions duration. Report unavailable comparisons when the comparison feature is enabled but the Decisions sampler is not initialized.
## Testing
Extend lifecycle coverage for an uninitialized Decisions sampler, checking skipped outcome and unavailable comparison metrics while preserving the baseline score.
GitOrigin-RevId: f11789ab5d5fd6957b7913d849bbb2ae7006d3ed
## Why
A hung tmux command or a descendant holding stdout open can block terminal input setup indefinitely.
## What changed
Run tmux option probes on a worker thread with a shared one-second deadline, returning default input options when the wait times out. Prevent overlapping probes and kill and reap commands that exceed the deadline.
Capture stdout in a temporary file so completed commands do not wait for descendants to close it, and read at most 4 KiB of output.
## Testing
Add Unix regression tests for successful output, killing and reaping a timed-out command, and returning promptly when a descendant keeps stdout open.
GitOrigin-RevId: a5a4c9323a3e18d1baada5ab1cf3734ce6a9403a
## What changed
Replace the rename field with a single-line `TextArea` that honors configured editor bindings and the composer's Vim setting. Start renaming in insert mode and support Vim Escape recovery on legacy terminals.
Strip carriage returns and newlines from titles and pasted text, keep Vim linewise pastes inline, and scroll horizontally at grapheme boundaries to keep the cursor visible.
## Testing
Add single-line editor coverage for newline filtering, Vim commands, repeat edits, and inline yanks. Extend command-center tests to cover Vim renaming across status-filter changes and cursor placement in narrow layouts.
GitOrigin-RevId: 8d320d6b6de9f77e18292169418383929ca6ceda
## Why
Windows Terminal forwards `Ctrl+Insert` when its Copy action has no native terminal selection. Recognize this shortcut so it can copy text selected within Codex.
## What changed
Add `Ctrl+Insert` to the shared copy-key detection used by transcript and composer selections. Use the same detection for transcript input ownership so the selection consumes the shortcut before other input handlers.
## Testing
Extend transcript tests to verify `Ctrl+Insert` input ownership and copying. Extend composer tests and snapshots to verify that failed or unconfirmed copies preserve the selection, while confirmed copies clear it without changing the draft or cursor.
GitOrigin-RevId: 5a33c72cff4c4395511779a7051fc92f8bd5e5d7
## What changed
Add `tui.mouse_scroll_speed` as a finite positive multiplier for transcript mouse wheel scrolling, including transcript overlays and session previews. Change the default from three rows to one row per wheel event; set the multiplier to `3.0` to retain the previous speed.
Fractional values accumulate movement across events and discard the remainder when direction reverses. For example, `0.5` scrolls one row every two events. Following the latest output pauses only when a whole row moves.
## Testing
Add tests for configuration validation, integer and fractional scroll speeds, direction changes, decimal accumulation, and following behavior. Extend local settings coverage to include a command-line override for the new setting.
GitOrigin-RevId: d355e246fd943415f0ce5a6affe849f77f3615e6
## Why
Table holdback kept completed tables and subsequent content mutable until the response finished. Releasing completed tables earlier also requires a final scrollback reflow when late reference-link definitions change previously emitted content.
## What changed
- Release table holdback once the containing top-level Markdown block is stable, rescanning the remaining tail for later tables.
- Track completed-block boundaries across incremental and full renders.
- Request scrollback reflow at answer completion when reference-link definitions are present, including definitions pending without a trailing newline.
## Testing
Add regression assertions and snapshots for completed tables entering scrollback while later tables remain mutable, and for late reference-link definitions resolving correctly at completion. Cover reflow requests with and without a trailing newline and reference handling with inline visualizations enabled.
GitOrigin-RevId: a6b2aac74496281495b53840bbb1daf06bef60d2
## What changed
Add `configured TUI mode` to the configuration details in human-readable and JSON doctor reports. Report `fullscreen` when `tui.fullscreen_transcript` is enabled and `scrollback` when it is disabled.
## Testing
Add an integration test covering both configuration values in JSON output and update the human-readable report snapshot to include the mode.
GitOrigin-RevId: beb62ddfa62a3516a64b5a69d5a41b257434f5d5
## Why
Account-update notifications include authentication mode and plan information but
omit the email, causing `/status` to lose the signed-in account's email after an
update.
## What changed
Fetch the ChatGPT account email asynchronously after account updates, with a
30-second timeout, without blocking terminal input. Apply the result only if its
request ID is still current, invalidating pending results on subsequent account
updates and disconnects.
## Testing
Extend the account-update test to verify that the email is restored and a stale
result is ignored. Update the status snapshot to include the account email and
plan alongside credits and limits.
GitOrigin-RevId: 202421f78f3d6a7b373194f9c65d1c22d70a04c1
## What changed
Allow the issuer `https://mcp.mercadopago.com/mcp` to use authorization endpoints on `https://auth.mercadopago.com` and token endpoints on `https://mcp.mercadopago.com` without issuer-bound callbacks. Remove the previous Figma exception.
## Testing
Update the provider-exception test to accept the Mercado Pago combination and reject lookalike issuer hosts, unrelated token hosts, and HTTP issuer and token URLs.
GitOrigin-RevId: 3838c7e4c32d6a2022f0011d6020e383035fe67f
Teach the issue labeler to suggest `dots` for issues about setting up
ChatGPT dots or managing their ongoing work. Exclude these issues from
the generic `agent` fallback.
GitOrigin-RevId: 6950c1bbde3aaf7f050e64484658f4ed1e4ae6e8
## What changed
Advertise `fileWriteStreaming` and support `fs/open` with `mode: "replace"` to create or truncate a file for writing. Implement `fs/writeBlock` with explicit offsets and nonempty chunks of up to 1 MiB, rejecting ranges beyond the signed 64-bit file offset limit.
Apply write sandbox permissions when opening writable handles, including when full-disk reads are allowed. Keep `read` as the default open mode.
## Testing
Add integration coverage for positional writes, chunk and offset bounds, replacement truncation, read/write handle permissions, and sandbox write restrictions. Verify that duplicate handle IDs and exhausted handle capacity reject replacement opens without creating or truncating files.
GitOrigin-RevId: 696ee6437dd5f5b69d5a7667dddea0ff44472094
## Why
Local secrets storage pulled in the unmaintained `proc-macro-error2` through `age` and `i18n-embed-fl`, requiring an exception for `RUSTSEC-2026-0173`.
## What changed
Upgrade `age` to `0.12.1` and update the Cargo and Bazel lockfiles. The updated dependency chain uses `proc-macro-error3`, allowing removal of the advisory exception from both `cargo-audit` and `cargo-deny` configuration.
GitOrigin-RevId: 7e18dec4d71d9260512f54fbfe71dbe4e6ee8a5d
## Why
The per-connection limit of 128 file read handles was checked only after opening the file, leaving pending opens outside the limit.
## What changed
Reserve a semaphore permit before polling the file-open future, counting pending opens and registered handles against the same limit. Release capacity when an open fails or is cancelled, or when a handle closes, even if a read still retains the file.
Use synchronous handle-table locks that never cross an await, and recheck duplicate IDs after opening to preserve the winning handle during concurrent opens.
## Testing
Add tests for stalled-open progress, pending-open admission limits, permit cleanup after failure or cancellation, capacity reuse while a file remains in use, and concurrent duplicate IDs.
GitOrigin-RevId: caabf38c74dda5951f2fc75234a7149daaa01263
## What changed
Expose `create_worktree`, `get_worktree_creation_status`, and `list_worktrees` through MCP when the worktrees feature is enabled for a trusted local project and attachment storage is available. Support both embedded and local daemon sessions.
Create worktrees asynchronously and attach them to the requesting task, with ownership and attachments retained across restarts. Default to the repository's remote default branch unless `ref` is supplied. Keep the task's working directory and execution environment unchanged, and leave uncommitted source changes in place.
Reject creation in ephemeral side conversations and explicitly untrusted source projects, reuse pending operations, and reject configured MCP servers that conflict with the TUI tools namespace.
## Testing
Add integration and model-request snapshot coverage for creation, polling, listing, attachment persistence across restart, task isolation, trust checks, namespace conflicts, and worker failure reporting.
GitOrigin-RevId: b6a57e92cf5f6fc51fd6d4028543d6fabaf5ac49
## Why
Permission shortcuts checked local configuration while the picker used the connected server's catalog and requirements. Shortcuts should respect the same server restrictions, including model-specific auto-review requirements.
## What changed
- Share a cached server catalog between the permission picker and shortcuts. Show the loading picker when no catalog is available and reuse an outstanding fetch.
- Clear the cache on session, account, working-directory, or connection changes.
- Give discovery RPCs distinct request IDs for each fetch and profile page so repeated requests after timeouts do not collide.
## Testing
Add coverage for loading and catalog reuse, managed permission restrictions, and refetching after disconnect. Update timeout coverage to verify that repeated discovery attempts use distinct IDs and each reports a timeout.
GitOrigin-RevId: 7d79874294136bfe3a654bb306eb7caf36d4df1e
## What changed
Add `codex tcp-tunnel --diagnostics-json` to emit versioned, newline-delimited JSON diagnostics on stderr. Records classify startup, CONNECT, transport, and control failures without exposing credentials, addresses, headers, or raw error messages. Rejected CONNECT records may include a validated `http_status`.
Distinguish terminal failures from recoverable stream and transport events, flush terminal records before returning a generic error, and preserve stdout readiness and credential acknowledgments. Keep human-readable diagnostics as the default and document the version 1 schema and consumer fallback rules.
## Testing
Add tests for bounded output, error-chain suppression, terminal flushing, control error classification, CONNECT status validation, legacy behavior, and flag parsing. Extend the reconnect test to exercise a rejected CONNECT followed by a successful connection in JSON mode.
GitOrigin-RevId: 350f67fe8e3f313e8a6d3bb0fd891952b77647fd
## Why
When Codex runs on Unix and launches a stdio MCP server on a Windows executor, explicit remote environment variables activate an allowlist based on Unix defaults. This can filter out Windows runtime and temporary-directory variables.
## What changed
Include `SYSTEMROOT`, `TEMP`, and `TMP` in the remote environment allowlist whenever explicit remote variables are requested.
## Testing
Extend the environment-filtering test to verify that `SystemRoot`, `TEMP`, and `TMP` survive alongside requested variables while unrequested secrets remain excluded.
GitOrigin-RevId: 059c9e23833be66aaf5b65ba5f95013f94f0f792
## What changed
Add `CodexThread::current_turn_model` to return the model slug selected for the named running turn's next step, independently of settings for future turns. Return `None` when the turn ID does not match, the task is cancelled, or the turn is no longer running.
## Testing
Extend the step-settings test to verify that the accessor ignores model changes for future turns, reflects active-turn model updates, and returns `None` for a mismatched ID or a completed turn.
GitOrigin-RevId: 2cae7c07fa761ed4d64befaa3419a2f9bce4b161
## What changed
Add `codex-cloud-client`, a reusable Rust client for `ThreadService.Resume` and live `ThreadService.Attach` over HTTP/2. Callers supply the native gRPC origin, bearer token, account ID, and `HttpClientFactory`.
- Reuse shared proxy, custom CA, and network policy handling for HTTPS. Reject redirects and allow plaintext HTTP only on direct loopback with unrestricted, unmanaged policy.
- Preserve notification and server-request protobuf payloads as opaque bytes and expose native gRPC status details while redacting credentials, payloads, and error details from diagnostics.
- Bound resume and attach setup to 150 seconds without retrying requests or imposing an idle deadline on live streams. Attach ends on its first error and provides no history or automatic reconnect.
- Select Rustls in `HttpClientBuilder::http2_prior_knowledge()` so HTTPS advertises `h2` through ALPN.
Include a standalone attach example and documentation of admission semantics and stream behavior.
## Testing
Add HTTP/2 fixture tests for protobuf framing, authentication metadata, status trailers, event preservation, malformed responses, stream cancellation, redirect rejection, and diagnostic redaction. Add checks for unsafe origins, network policy restrictions, and TLS `h2` advertisement.
GitOrigin-RevId: 55db70438bb5e59272c6995c67a46ced5fa28ff4
## What changed
Move the voice connection spinner into shared helpers in `codex-rs/tui/src/motion.rs`, keeping its 100 ms animation cadence and static reduced-motion glyph. The helpers handle frame scheduling, and `loading_glyph_with_delay` supports hiding the animated spinner until a specified delay expires.
GitOrigin-RevId: c4ebe5e6a33239999aab2f4432c9145432c8f4fd
## Why
Long drafts need to remain browsable while leaving room for the transcript. Remote image attachments also need to leave an editable prompt row visible.
## What changed
- Cap the fullscreen composer, including padding and hints, at two-thirds of the screen, with a minimum of eight rows when the screen allows.
- Support mouse-wheel browsing without moving the caret or changing transcript selection, search, or activity focus. Show arrows for hidden prompt rows and hide the cursor when the caret is offscreen.
- Resume caret following on editor input, paste, and external edits.
- Keep the selected remote image visible while reserving space for prompt text.
## Testing
Add regression tests and snapshots for fullscreen scrolling, caret restoration after navigation, paste and external edits, remote image navigation and deletion, resizing at scroll boundaries, and disconnected editing.
GitOrigin-RevId: 9a1e4ce14b3b3747e6d136207546327531339258
## What changed
Move footer property construction, mode resolution, hint overrides, quit shortcut hints, and custom footer height calculation from `chat_composer.rs` into `chat_composer/footer_state.rs`. Preserve existing behavior and expose the moved helpers to the parent module where needed.
GitOrigin-RevId: 4a23753ac1648352ab19d4bcc3da9f368c48f619
## What changed
Add the disabled-by-default `guardianv2_decisions_comparison` feature to run Decisions alongside Guardian V2 snapshot classification using the same policy and evidence. Initialize the comparison sampler with `CODEX_GUARDIAN_DECISIONS_API_KEY`.
Publish the baseline score before awaiting comparison results, and keep comparison results and failures from changing approvals. Apply Guardian's input token budget, skip conversation evidence, and cancel comparison work when the baseline classification is superseded. Record success, failure, and skip outcomes with bounded diagnostic reasons, including setup failures.
## Testing
Add lifecycle tests covering disabled comparison, disagreeing classifications, backend failures, unchanged published scores, matching policy and evidence, and rejection of over-budget requests before either backend sends them.
GitOrigin-RevId: 743d34c8ee440362da94f001058366027b39bd11
## Why
`thread/attachment/list` lists attachments for a known thread. Clients also need to find the threads associated with a given attachment identity.
## What changed
Add `thread/attachmentOwner/list` to return owning thread IDs and archive status for an exact `attachmentType` and `identityKey`. Support cursor pagination and an optional `archived` filter, including both archived and non-archived threads by default.
Wire the request through the thread store and update documentation, protocol schemas, and generated TypeScript and Python types. The lookup is limited to the configured thread store and reports current membership, not an atomic resource-cleanup check.
## Testing
Extend app-server integration tests to cover exact type-and-key matching, multiple owners, archive filtering, and invalid cursor rejection.
GitOrigin-RevId: 30f4a20e00243d0023246d465a9b95213b3adeb6
## Why
Reloading an unloaded root from a surviving child can supply the shared instruction wrapper already registered for that root. Replacing its underlying provider with that same wrapper makes instruction loading recurse into itself.
## What changed
Reuse the existing wrapper without replacing its provider when both are the same `Arc`. Continue to accept distinct replacement providers.
## Testing
Extend regression coverage to reload the root from a surviving child and verify that shared instructions still update. Check wrapper reuse, replacement with a distinct shared provider, and freezing the shared snapshot when switching to a provider that does not share with subagents.
GitOrigin-RevId: 7b6b2f9031f206e203f6fa14e1478a36b305ec39
## Why
Unread queue-only messages prevented idle agents from unloading, and sending a
message to an evicted agent reloaded its session. Pending mail should not require
an idle recipient to occupy a loaded thread slot.
## What changed
- Retain queue-only mail in an in-memory runtime mailbox when a session unloads.
Queue new messages for locally evicted agents without reloading them or
starting a turn.
- Add `AgentControl::take_mailbox` and `AgentControl::watch_mailbox` so sessions
can consume retained mail and react to host mailbox notifications.
- Preserve message order across eviction, reload, and subsequent follow-ups.
Keep agents with outstanding durable sleep or turn-triggering mail loaded,
and discard retained mail when an agent is removed or its tree shuts down.
## Testing
Add integration coverage for retaining mail across eviction, sending while
unloaded, and ordering messages around a follow-up after reload. Add a host
controller test verifying that mailbox notifications wake `wait_agent` and
that the message is delivered exactly once.
GitOrigin-RevId: 4b55647f9ee9d1aaf3753f0688863bda81617327
## What changed
Add `StateRuntime::list_thread_attachment_threads` to find threads by exact `attachment_type` and `identity_key`, including threads without previews. Return thread IDs and archive state, with filters for all, archived, or non-archived threads.
Order results by thread ID and bind pagination cursors to the attachment identity and archive filter. Add a database index on `(attachment_type, identity_key, thread_id)` to support the lookup.
## Testing
Add coverage for exact identity matching, archive filters, pagination, rejection of cursors reused with different lookup parameters, and membership updates after attachment removal or thread deletion.
GitOrigin-RevId: 21f32eb0cb1845a82d740d67b374080b6e12eb03
## Why
Subagents spawned without forked history do not receive their parent's client-defined dynamic tools, preventing them from using those tools for delegated work.
## What changed
Add the disabled-by-default `multi_agent_v2_dynamic_tools` feature flag. When enabled, fresh V2 subagents inherit the parent's dynamic tool definitions and persist them in session metadata.
## Testing
Add coverage for V1 and V2 feature gating, tool persistence, and a fresh V2 subagent calling an inherited tool and receiving its result without inheriting parent history. Update TUI assertions and a snapshot to reflect blank-line separation and question text in recovered answers.
GitOrigin-RevId: a17a16bf5570f54ce922c1521cffb883022354f2
## What changed
Add a Decisions sampler under `#[cfg(test)]` for Guardian's optional comparison classifier, without wiring a runtime caller.
- Encode text and inline image evidence as a `guardian_risk` choice request using `gpt-6-luna`, accepting only `low` or `high` responses. Reject the complete request when evidence cannot be represented.
- Bound concurrency to 16 requests, cancel the oldest unfinished request at capacity, and abort unfinished work when its owning task is dropped.
- Enforce a six-second HTTP deadline, an 8 MiB inline image data limit, and a 16 KiB response limit. Keep credentials and wire bodies out of errors.
## Testing
Add tests for the HTTP contract, unsupported evidence, inline image preservation and size limits, response validation, oldest-request cancellation, and capacity release when a caller is dropped while awaiting completion.
GitOrigin-RevId: e7209ca49a04505acf10ff1aeaca941514589e13
## Why
Bubblewrap consumes and closes the file descriptor for each `--ro-bind-data` mount. Reusing one descriptor across multiple file masks prevents the sandbox from starting.
## What changed
Open and preserve a separate `/dev/null` descriptor for each empty-file mask.
## Testing
Extend unit tests to verify distinct descriptors for multiple denied files and missing-path masks. Add integration coverage for exact-path and glob deny rules, checking that the sandbox starts, denied files remain unreadable and unwritable, and allowed files remain accessible.
GitOrigin-RevId: 85158c83699afd36bb7aca453b2652d777cf65e4
## What changed
- Centralize `windows-sys` at version `0.61.2` in the workspace and migrate dependent crates to it.
- Adapt Windows API calls to the updated handle, boolean, and type definitions. Replace custom handle owners with `OwnedHandle` and use `BorrowedHandle` where ownership stays with the caller.
- Add explicit wrappers for non-owning Windows handles passed between threads.
## Testing
Enable the MCP refresh cleanup test on Windows. Retain process handles to verify that a superseded MCP server stays alive during an in-flight call, exits after cancellation, and leaves the replacement running until shutdown.
GitOrigin-RevId: 86f53d9b300d13edff7154f4a7c32e34dacd2919
## What changed
Update `post_sampling_token_estimate_is_disabled_by_always_on_sinks` to register explicit event metadata with the subscriber and assert that its interest is `never`. This replaces the scoped default subscriber and global interest-cache rebuild with a direct check of the configured logging layers.
GitOrigin-RevId: 7c4ecd9c4adef148fd222394ad1ad326e8033d95
## Why
When a turn ends, unsent question answers are recovered into the main composer. Recovering only the answers loses which question each answer belongs to.
## What changed
Prepend each recovered answer with its question title as a Markdown blockquote. Separate questions, answers, and existing composer text with blank lines.
Sanitize question titles and limit them to 512 bytes at a UTF-8 character boundary, adding an ellipsis when truncated. Keep answer text untruncated.
## Testing
Add coverage for bounded titles, multibyte characters, control characters, and multiline question-and-answer submission. Update recovery assertions and snapshots for turn completion, failure, interruption, large pastes, and Vim undo.
GitOrigin-RevId: 141dacfb64bcad5fcabc5be217d2340ef7de1eb5
## Why
Environment changes and overlapping catalog refreshes can cause a step to use another step's selected plugins or executor skills. Model context and skill tools need to agree on the capabilities captured for that step.
## What changed
- Resolve selected plugins from each step's ready capability roots, honoring disabled plugins, and retain the snapshot with the step's extension data.
- Use that snapshot for skill attribution in World State and the first step's active-plugin telemetry.
- Return executor skill catalogs directly from refresh so overlapping requests render their own results while retaining thread caches.
## Testing
Add regression coverage for overlapping executor catalogs and environment changes during step preparation. Verify that `skills.list` retains the original step's skills, the next step advertises the new skills, and disabled executor and plugin skills remain absent from model context.
GitOrigin-RevId: 37d3cbe8c7e062fd06290aa985ada4d3b3462d43
## Why
Cygwin records installation timestamps in an unused Java truststore, changing Bazel action cache keys when the same tools are reinstalled.
## What changed
Exclude `cygwin/etc/pki/ca-trust/extracted/java/cacerts` from the generated `cygwin` filegroup in `.github/scripts/voice_windows_tools.py`.
GitOrigin-RevId: 8fdd910fadba7d977b45718546232652d073cdc8
## Why
Starting Find expanded the entire transcript into detailed mode. Searching hidden content should preserve the compact view and manually expanded activities.
## What changed
- Search full transcript content, including hidden live output, and temporarily expand only the current matching entry.
- Preserve manual disclosure state and retained text revisions while reading or selecting a match. Allow activity controls while reading results.
- Use `Enter` or `Ctrl+P` for older matches and `Ctrl+N` for newer matches, with matching footer hints.
## Testing
Add regression tests and snapshots for selective expansion, manual disclosures, hidden live matches, retained selections across updates and resizing, and Find in compact transcript overlays.
GitOrigin-RevId: 618ee47ba6c3f3a5138c9e3fe0961e7faa3383da
## Why
Closing Find previously restored the pre-search view, making it difficult to read a match and its surrounding transcript context.
## What changed
- Make `Esc` with a nonempty query close query editing while preserving the query, highlighted match, and expanded output. A second `Esc` returns to the latest output; `Ctrl+C` cancels Find and restores the pre-search presentation.
- Allow paging through surrounding context and loading older history without losing the query. Keep `Ctrl+N` and `Ctrl+P` available for match navigation, and reopen Find to edit the retained query.
- Show context above matches when space permits, preserve match layouts across resizing, and display navigation and history status while reading results.
## Testing
Add regression tests and snapshots for retained results, surrounding context, resizing, paging around live output, older-history loading, and footer status. Update interaction tests for the additional `Esc` transition.
GitOrigin-RevId: d822956d3c6ffab88fc1665ebdf0c86ccf110899
## Why
Legacy MCP tool discovery discarded pagination cursors, leaving tools on later pages unavailable.
## What changed
Pass `tools/list` pagination cursors to the existing collector in both legacy and modern protocol modes. Legacy discovery now follows subsequent pages and applies the same pagination limits and cursor validation as modern discovery.
## Testing
Extend integration coverage to both protocol modes, checking that tools from later pages reach the model and can be called successfully, while catalogs with oversized cursors are rejected. Update the legacy discovery test to expect an error for a repeated cursor.
GitOrigin-RevId: a6daa8034d2a403c1f2a5846e385789d8a620af7
## Why
A user restriction such as “Cancel the deployment” can fall outside the recent-message window after unrelated status questions. Guardian reviews need that restriction when assessing delegated actions.
## What changed
- Preserve root user messages during handoff relevance filtering, subject to the existing shared message cap.
- Apply handoff filtering during heartbeats while retaining saved heartbeat instructions and the active turn's trusted skills.
- Mark assistant context as incomplete when handoff filtering omits it, so ordinary user replies are not interpreted without their missing context.
## Testing
Add regression coverage for restrictions followed by status questions, bounded user history, omitted assistant questions, and trusted skills across first and repeated heartbeats. Update the delegation request-history snapshot.
GitOrigin-RevId: 67f77313572dc54225713cd7cdb90f06b0fbe030
## What changed
Add `CODEX_GUARDIAN_DECISIONS_API_KEY` to the non-inheritable environment variables and the HTTP header environment denylist. Case-insensitive filtering removes it from child process environments, including explicit shell policy and command overrides, and rejects its use through `http/request` header `value_env_var`.
## Testing
Extend regression coverage for inherited and overridden variables, mixed-case names, and HTTP header rejection before any network request is sent.
GitOrigin-RevId: 1adeef814fdccb2d6c77dd68f7a5dfcec0b41cc6
## Why
Concurrent Linux test spawns can inherit writable descriptors for executable fixtures, preventing those fixtures from being executed even after the writing test closes its descriptor.
## What changed
Replace direct executable fixture writes and copies across the Rust tests with `codex_utils_cargo_bin::write_executable` and `copy_executable`. These existing helpers complete writes and copies in separate processes on Linux.
Remove the empty temporary inode before creating fake bubblewrap executables, and stage tampered bubblewrap bytes in a separate data file before copying them into the executable fixture. Add the required test dependencies.
GitOrigin-RevId: c875c83088731a4933ef1574e8d79d8cecc12f54
## Why
Fresh TUI threads should use the app server's model settings unless the launch explicitly overrides them. Sending resolved configuration values in `thread/start` turns defaults into explicit overrides.
## What changed
- Track explicit launch choices for `model`, `model_provider`, and `model_reasoning_effort`, and omit unselected settings from the initial `thread/start` request.
- Preserve accepted model migrations as explicit model and reasoning-effort choices.
- Keep explicit profile launches on the existing resolved-configuration path.
## Testing
Update startup request tests to cover omitted defaults, CLI model and provider overrides, repeated model overrides, reasoning-effort overrides, accepted migrations, and explicit profiles.
GitOrigin-RevId: 4e2661ba42322a80e2b769a55c62f61a576762b0
## Why
The rolling retained-context window can change as assistant messages are added or evicted. Placing it before the transcript invalidates the reusable history prefix.
## What changed
Move retained user instructions and context after the transcript and action-specific attestations, immediately before the planned action in asynchronous Guardian requests. Keep synchronous section ordering unchanged.
## Testing
Extend the cache-prefix regression test to cover retained assistant message growth and eviction alongside changing attestations. Update app-server and async scorer assertions to verify the new request ordering.
GitOrigin-RevId: 59953d582d4b174ce3e083606626c7532ce0776d
## What changed
- Add `EmaAuthenticatedHttpClient` to cache and renew resource bearers, serialize concurrent renewals, and include authentication time in the request deadline. Confine bearers to the configured MCP endpoint and reject redirects.
- Return authentication-required errors for `401` responses without replaying MCP operations. Preserve a newer cached bearer when a delayed response rejects an older one.
- Add revocable request authority that cancels pending requests and ends response streams.
- Pin enterprise credentials to a persistent version advanced on save or deletion. Use short credential locks and invalidate rejected grants only when their record and version are still current, preserving newer logins.
- Hide keyring account identifiers from enterprise credential errors and traces while preserving authentication failure classification.
## Testing
Add tests for token expiry and renewal, endpoint confinement, redirects, request deadlines, revocation during renewal and streaming, delayed `401` responses, credential replacement and logout races, and credential error privacy.
GitOrigin-RevId: ee3e5cf7ecbba3d09e1ab29ed4fbb2a35eacc60d
Owen Lin