## Why
The permissions menu needs to reflect the profiles and configuration requirements available in the active app-server scope, including remote workspaces.
## What changed
- Load permission profiles and configuration requirements asynchronously when opening the permissions menu, using the active thread working directory.
- Render loading, retry, empty-catalog, and unsupported-server states, and fall back to the legacy permissions menu when explicit profiles are not configured.
- Disable profiles rejected by server requirements or unavailable in the catalog. Remote custom profiles remain visible but cannot yet be selected.
- Bound pagination and request time, reject malformed catalogs, and ignore responses made stale by account, thread, or modal changes.
## Testing
- Cover local, session-only, remote, legacy, empty, unsupported, pagination, malformed-response, and timeout discovery paths.
- Add TUI tests for loading, failures, retries, empty results, remote catalogs, stale responses, and working-directory changes.
GitOrigin-RevId: 3e2ab53a4eae1179587d064f9a4c605765ea7880
## Why
Completion receipts for identical user messages could acknowledge the wrong
pending steer. When the receipt arrived while another thread was displayed,
the stale pending state could later be restored and resubmitted.
## What changed
- Assign each TUI submission a client message ID and pass it through turn start
and steer requests.
- Preserve pending steer IDs across thread input snapshots and match completion
receipts by ID, while retaining content-based matching for older app servers
that do not echo IDs.
- Acknowledge matching receipts for inactive threads before their notifications
can be discarded, including threads stored in the agents overview.
## Testing
Added coverage for identical steer receipts and for switching within and
between tasks before interrupting an active turn.
GitOrigin-RevId: 28bd80a735ff86cd7bf836f24b448e7499f0a902
## What changed
- Add `originator` to plugin measurement inputs and emitted analytics events.
- Populate it from the turn originator when recording plugin measurements.
- Extend analytics tests to verify the originator is preserved in event payloads.
GitOrigin-RevId: 9998f829760222fc690dc8a10324794b5da27220
## What changed
- Replace the command center's single-line new-task input with the shared chat composer, including multiline editing, paste handling, Vim mode, configured keybindings, cursor behavior, and input validation.
- Keep task drafts and editor state across dashboard refreshes and reconnects while separating composer focus from list, search, and rename actions.
- Preserve whitespace in dispatched task prompts, block submission while offline, and restore unsent prompts after dispatch failures when the composer is still available.
## Testing
- Add coverage for focus routing, draft retention, multiline pastes, custom keybindings, Vim mode, offline editing, failed-dispatch recovery, and responsive rendering.
GitOrigin-RevId: a609ae95d497cbae0ebcac4cdcc50fe49d74832a
## What changed
- Load the `/experimental` catalog from the running server for the active thread, with loading, empty, and failure states in the popup.
- Show beta features in server order and preserve server-reported names, descriptions, and configured values. Mark features as read-only when the local config writer cannot safely update them.
- Persist only changed, writable feature flags. Bound discovery with page-size and page-count limits, repeated-cursor detection, deduplication, cancellation, and a timeout.
## Testing
- Cover paginated discovery, malformed or unresponsive servers, popup cancellation, read-only controls, selective writes, and the new popup states.
GitOrigin-RevId: 1f49eb961c8ab220a466e15f032c1dc61ed86d38
## Why
Computer-use-only Guardian scoring should follow the active model's REPL
auto-review requirement, including when the model changes within a live thread.
## What changed
- Run computer-use scoring and fast approval decisions only when the active
model sets `node_repl_auto_review_required`.
- Invalidate prior or in-flight scores when a model switch skips scoring, so
switching back to a reviewed model cannot revive a stale decision.
## Testing
- Cover model switches for both `node_repl` and `cua_repl` MCP servers.
- Verify skipped scoring and stale-score rejection across requirement changes.
GitOrigin-RevId: 46aec4d017bea8f135b435bcd769b87369b8ce95
## What changed
- Add a configurable `agents.resume` action, bound to `Ctrl+O` by default, that opens the session resume picker from the agent command center.
- Preserve command-center state when the picker is cancelled, and preserve per-thread composer and queued-input state when switching sessions.
- Keep resume failures within the command-center flow and wrap footer shortcuts on narrow terminals.
## Testing
- Add coverage for picker cancellation, active-session selection, resume failures, per-thread input restoration, custom keybindings, and narrow footer layout.
GitOrigin-RevId: 59159f838a0c642200cd164e3af45b0971d29bf8
## What changed
- Add `application.network` managed requirements with exact-domain allow/deny
rules, default-enabled behavior, domain normalization, and normal managed TOML
precedence.
- Return the policy separately from agent network requirements through the
experimental `configRequirements/read` API. The endpoint reports the policy
but does not enforce it.
- Export the new protocol types and schemas, and document the TOML format.
## Testing
- Cover parsing, validation, normalization, layered precedence, and cloud
requirement composition.
- Verify app-server responses, defaults, separation from agent policy, and
rejection of invalid domains.
GitOrigin-RevId: 563eeed296d9748430b819797204a44a8db92f3b
## What changed
- Honor `McpOAuthRefreshMode::Coordinated` for streamable HTTP MCP connections by letting RMCP refresh and persist credentials through the pinned credential store.
- Reread credentials while holding the refresh lock, persist refreshed tokens before retrying requests, and serialize login and logout writes with in-flight refreshes.
- Keep OAuth preparation outside MCP operation and handshake deadlines, and allow refresh persistence to finish if the initiating caller is cancelled.
## Testing
- Cover coordinated startup refresh, concurrent refreshes, `401` retries, credential mutation races, provider timeouts, and caller cancellation.
GitOrigin-RevId: 100ae788048087be23e26bb43f868b1fcebb007a
## Why
Misalignment policy failures pause the current chat. When the server provides findings and a continuation request, users should be able to inspect them and explicitly decide whether to proceed.
## What changed
- Add a `Review findings` flow that shows the detailed explanation and quoted continuation request in an overlay.
- Require explicit acknowledgement before starting a continuation turn, while preserving the active approval and sandbox settings.
- Keep ordinary input blocked and reject stale, replaced, invalid, or duplicate continuation attempts.
- Label the overlay shortcut as `q close` to match its behavior.
## Testing
- Add TUI tests covering findings review, explicit confirmation, successful and failed continuation, stale findings, duplicate events, and invalid continuation data.
GitOrigin-RevId: 36a738adf272f95db92eaee5712fb00061d0fa52
## What changed
- Keep `!`, `/`, and `?` prefixes literal in plain-text composers instead of activating command modes or shortcuts.
- Preserve buffered characters when changing Vim mode, cancelling a draft, or pressing Enter during a paste burst.
- Show over-limit errors in embedded composer footers, retain the rejected draft, and schedule redraws when the message expires.
- Clear stale validation errors when replacing a draft or switching form fields.
## Testing
- Add coverage for literal prefixes, buffered typing, single-character paste lines, retained over-limit drafts, and clearing validation errors between fields.
GitOrigin-RevId: ed9d5b2c087abdfefd92d93033ea1c20211d56d7
## Why
Selected plugin MCP servers may be skipped after the optional startup grace
period. When a user explicitly mentions a plugin or MCP server, the turn should
continue waiting so the requested tools are available to the model.
## What changed
- Track explicitly mentioned plugin IDs and MCP servers across later samples,
steered input, and same-turn restarts.
- Require matching selected-plugin MCP servers to finish startup before
capturing the tool catalog, while leaving unmentioned servers optional.
- Match `plugin://` identities independently of display names and ignore
targeting query parameters such as `app` and `browserFamily`.
## Testing
Added coverage for linked and structured plugin mentions, direct and batched
capability discovery, delayed environment attachment, steering, and same-turn
restarts.
GitOrigin-RevId: c509ef8df45df1a7edb0da6afdb2682dc53a4de8
## Why
The managed app-server daemon and automatic TUI attachment were limited to
Unix, so Windows users could not share a background server across Codex
sessions.
## What changed
- Enable daemon lifecycle commands, `codex agents` startup, and AF_UNIX daemon
discovery on Windows.
- Require Windows daemons to start non-elevated and verify the discovered
socket directory and peer before connecting.
- Preflight detached process support, preserve path-based environment settings,
and keep daemon processes out of the launching project's working directory.
- Fall back to an embedded server when an implicitly discovered daemon cannot
connect, while preserving errors for explicit remote endpoints and bypassing
daemon reuse when `CODEX_EXEC_SERVER_URL` is set.
## Testing
Add coverage for Windows launch restrictions and socket validation, implicit
connection fallback, executor selection, daemon discovery, and the agents
dashboard startup result.
GitOrigin-RevId: e7fd63cf8690bcca8b5155266416f31f2f792aa2
## Why
Pipe output chunks can split one protocol frame or contain several frames. A
timed-out read must also retain any partial frame it already consumed so the next
exchange can continue decoding it.
## What changed
Add a stateful `MessageReader` that buffers partial input, preserves unread bytes
from coalesced chunks, and validates frame bounds before reading the payload. Use
it for voice helper handshake and shutdown responses.
## Testing
Add async tests for fragmented and coalesced frames, cancelled reads, oversized
headers, truncated and malformed input, and invalid pipe chunk sizes.
GitOrigin-RevId: 274d9698e05f2de2147235b6e4e1bd38dbb7c23b
## What changed
- Add `Environment::last_ready_info()` to return a snapshot of the most recently accepted `EnvironmentReadyInfo`.
- Preserve the distinction between no accepted report and an accepted report with no capability roots.
## Testing
- Cover pending, ordinary, failed, recovered, replaced, empty, and invalid readiness reports.
- Verify that previously returned snapshots remain unchanged after later reports.
GitOrigin-RevId: cd051a56e7ad54a673c851eb58238c5837335c03
## What changed
- Fetch `collaborationMode/list` during TUI startup and reconnect, and use the
returned catalog for visible collaboration-mode selection.
- Keep collaboration-mode discovery optional with a two-second timeout so an
unavailable, invalid, or unsupported response does not block bootstrap.
- Preserve discovered modes when the model catalog refreshes, clear restored
developer-instruction overrides when selecting a server mode, and retain a
`/plan` draft when plan mode is unavailable.
## Testing
- Cover optional discovery failures and catalog refresh on reconnect.
- Cover server mode selection, model refreshes, restored settings, and
unavailable plan mode.
GitOrigin-RevId: a6e35c14aab2e38526606164091ac64c500151bb
## Why
Replaying a thread after a later turn has continued can treat an earlier
misalignment policy violation as still active, clearing the restored draft and
queued follow-up input.
## What changed
- Track the latest turn independently of the bounded replay buffer.
- Omit misalignment errors from older turns during snapshot and stored-turn
replay while preserving an error on the latest turn.
- Keep interrupted tool calls from the older turn visible in history.
## Testing
Added buffered replay coverage for restored drafts and queued messages, buffer
eviction, current-turn violations, and interrupted tool rendering.
GitOrigin-RevId: d6c223d9c5a1905fe1b48dc5f9514a7ccbf61d92
## What changed
- Move `AgentsOverviewView` rendering and cursor placement into
`agents_overview_render.rs`.
- Extract paste-burst Enter handling from the main chat composer into the
reconnect module while preserving the existing submission behavior.
GitOrigin-RevId: 641daf9ad6cba79d805a9ae100f63ef81470757d
## What changed
- Set `CODEX_VERSION` to the running package version in user shell and unified
exec environments, overriding stale shell-policy or snapshot values.
- Add the reserved `codex_version` field to MCP turn metadata.
## Testing
- Cover version propagation through shell policies, shell snapshots, unified
exec, and MCP metadata.
GitOrigin-RevId: 7846c70d668176530b1f467293b749dc9ddd79a0
## What changed
- Run the daemon update loop on Windows using the non-interactive PowerShell installer.
- Restart the managed app server after updates and hand updater ownership to a changed managed executable through a readiness handshake.
- Contain installer descendants in a Windows job while allowing app-server and successor updater processes to break away.
- Preserve or restore PID ownership when successor startup fails, without terminating a process that reused the PID.
## Testing
- Cover non-interactive installer success and script failure on Windows.
- Cover updater handoff, readiness, rollback, inaccessible processes, and PID reuse.
GitOrigin-RevId: 5178c01124b4dd86b507b53f5093ec9a9d48e12c
## Why
Patch targets can use a different path convention from the Codex host, so
host-native path conversion can misclassify writable roots and requested
permissions.
## What changed
- Evaluate patch targets as `PathUri` values with the active filesystem policy
context, including workspace roots and the executor's path convention.
- Distinguish executor-managed sandboxing from local platform sandboxing when
deciding whether a patch can be auto-approved and how to normalize additional
write permissions.
- Make full-disk and special-path policy checks honor the selected executor's
Windows or POSIX convention.
## Testing
Add coverage for Windows executor URIs, full-disk policy aliases, remote patch
permission requests, sandbox availability, and owner-provided workspace roots.
GitOrigin-RevId: 1a054ea443efd342623c67432762f85c53d20c15
## What changed
- Allow a valid Ready report to replace a deferred environment's provisioning failure while preserving the same environment instance.
- Treat provisioning failures as retryable and reconnect when a completed or concurrently publishing startup attempt contains a stale failure.
- Report provisioning failures from `status()` without starting a connection, and retain Ready state when a late failure arrives.
## Testing
- Cover recovery after failed and invalid provisioning reports, capability-root resolution after recovery, and the race between Ready and publication of an earlier startup failure.
GitOrigin-RevId: cce419403248168da81bc5a6ab20f919aed81142
## What changed
- Add the experimental `Thread.environments` field with each selected environment's ID, working directory, and runtime workspace roots.
- Populate the field from live thread state in start, resume, read, list, and unarchive responses. Use `null` for unloaded threads and an empty list when a loaded thread has no environment selection.
- Document that the field reports selection rather than connection status and does not affect executor selection or resume behavior.
## Testing
- Cover selection updates, unloaded and resumed threads, loaded pathless unarchives, and clients that subscribe after environment connection notifications.
GitOrigin-RevId: a6daa06aff7089d7c5a1e4c7d03109b41f12fa3c
## What changed
- Add the under-development `features.context_management.experimental_mode` configuration and schema.
- For eligible ChatGPT Plus, Pro, and Pro Lite sessions using the Codex backend, enable token-budget context, history notes, and the `new_context` tool when experimental context management is configured.
- Keep the feature disabled for custom providers, provider credentials, non-Codex endpoints, and temporary structured threads.
## Testing
- Cover subscription eligibility, backend restrictions, configuration resolution, token-budget guidance, and temporary-thread overrides.
GitOrigin-RevId: 19402af19c4d69e09a7cdb3687ee7d233f6a562a
## What changed
- Add a test-only `CredentialStore` adapter that maps RMCP refreshes onto Codex's pinned OAuth credential backend.
- Require refresh transaction guards for mutations, preserve the pinned backend, and update the runtime credential snapshot only after persistence succeeds.
- Preserve scopes and token expiry metadata while rejecting credentials that no longer match the connection's client or issuer.
## Testing
- Cover guarded save and clear operations, persistence failures, pinned-store read failures, replacement and removal handling, and expiry round trips.
GitOrigin-RevId: eb1b98024322c03af94f5ab2e88c7dc4ae54893a
## What changed
- Upgrade `rmcp` and `rmcp-macros` from 3.1.3 to 3.2.0.
- Refresh the Cargo and Bazel lockfiles for the new versions.
GitOrigin-RevId: a1d7696eafe6a150c6e09c3cc9c3663a8fd68679
## Why
The PID-managed app-server lifecycle previously supported Unix only, leaving Windows unable to start and stop the managed daemon.
## What changed
- Launch the Windows daemon as a detached process and fail clearly when the host Job Object prevents detachment.
- Add Windows file locking and process creation-time checks so stale or reused PIDs cannot cause an unrelated process to be terminated.
- Request graceful shutdown through a shutdown file, then terminate the verified process after the grace period.
- Prepare private daemon state directories consistently and pin the executable path across installer junction updates.
## Testing
Add Windows tests for process-query permissions, reused and inaccessible PIDs, and stale-record cleanup.
GitOrigin-RevId: 5ea579a7c3dc8bb6122ec3a02513836ccaacc41c
## What changed
- Show a confirmation before stopping a safety-buffered attempt and retrying
with the server-selected faster model.
- Explain that the retry starts a new thread, preserves actions already taken,
and may use a less capable model; allow the user to keep waiting instead.
- Dismiss the buffering or confirmation view when the response starts or the
turn is no longer eligible for retry.
- Refresh the buffering copy and wrap confirmation text correctly in narrow
terminals.
## Testing
- Cover retry confirmation, cancellation, turn completion, response startup,
stale updates, and narrow-terminal rendering.
GitOrigin-RevId: 013bc47174811dd104b421774577c2808c732bfa
## Why
Directly deserializing the flattened `RolloutLine` envelope can reject nested
decimal values, preventing affected paginated sessions from resuming.
## What changed
- Add canonical string, byte, and reverse-scanner helpers that decode rollout
records through `serde_json::Value` before decoding the flattened item.
- Route rollout readers across session discovery, history, migration, search,
thread storage, and transcript previews through those helpers.
- Remove `Deserialize` from `RolloutLine` so new readers cannot bypass the
canonical persistence decoder.
## Testing
Add coverage that resumes a paginated rollout after a token-count record with
a decimal rate-limit value and verifies that ordinal sequencing continues.
GitOrigin-RevId: 49abac1e0751c073daa5a93a840d8a483fd2d013
## What changed
- Remove the per-thread `RealtimeConversation` feature check when starting a realtime session.
- Retain `features.realtime_conversation` as a removed compatibility setting that has no effect, even when set to `false`.
- Document the always-available behavior for `thread/realtime/start`.
## Testing
- Cover realtime startup on forked and cold-resumed threads with the legacy setting absent, disabled, or enabled.
GitOrigin-RevId: d9cd9aa3898d1c2efb9414a8f40c86be8951e210
## What changed
- Record the authenticated sandbox owner and observe package uninstall events across service restarts and session changes.
- During uninstall, serialize setup and cleanup, disable sandbox accounts, stop their processes, and remove sandbox directories, firewall and WFP rules, hidden-user entries, accounts, and the sandbox group.
- Restrict desktop-owned directory cleanup to pinned paths and perform it while impersonating the authenticated owner.
- Detect missing or disabled sandbox accounts after interrupted cleanup and reprovision them before restoring network access.
GitOrigin-RevId: 7d63fff7ddcff3eb01d018653146df12044bd277
## What changed
Move Unix detached-process launch and PID publication from `pid.rs` into
`pid_start.rs`, keeping PID reservation and lifecycle behavior unchanged.
GitOrigin-RevId: acacb33953a66adc15377294ccc46d0677cc61c4
## Why
Exec-server process and network-policy events need stable attribution to the
launching tool call and executor without recording process payloads.
## What changed
- Add optional `ExecMetadata` to `ExecParams` and propagate the thread and tool
call IDs from unified exec.
- Emit bounded OpenTelemetry events for process start, spawn failure, sandbox
denial, and exit. Correlate them with the launch trace and registry-issued
executor identity while excluding arguments, paths, environment values,
output, and error text.
- Preserve launch attribution across long-running processes and reconnects, and
attach the same metadata to network-policy audit events.
- Keep the protocol backward compatible when metadata is omitted, and prevent
invalid trace headers from inheriting an unrelated active span.
## Testing
Add coverage for metadata serialization and propagation, lifecycle event
fields, trace relationships, reconnect behavior, spawn failures, sandbox
denials, and network-policy attribution.
GitOrigin-RevId: 7aa480a7289c73cb95e2c124c35500bb6f0d5084
## Why
When ordinary included usage is exhausted, eligible users need a way to keep working with the backend-provided Luna Reserve quota and return to their previous model once ordinary usage recovers.
## What changed
- Automatically switch eligible TUI tasks to Luna Reserve after an authoritative account usage read, preserving the prior model and reasoning effort per task.
- Restrict model selection while on Reserve to its supported reasoning levels, keep queued turns on the accepted model, and restore the saved model after a fresh read confirms recovery.
- Surface Reserve usage in the composer and `/status`, and expose `normalModelSlug` in app-server rate-limit snapshots so clients can use the associated model's display metadata without changing the request model.
- Poll account limits more frequently near exhaustion and retain compatibility with app servers that only accept the legacy null request parameters.
## Testing
- Added coverage for Reserve entry, queued-turn handling, task reconstruction, recovery authorization, account changes, model selection, usage rendering, and banner dismissal.
GitOrigin-RevId: 46a435e9531051f8cec3f6a46c4b9f7cfa479747
## What changed
- Log failed MCP server startup outcomes once per startup attempt, including failures during discovery that do not emit startup notifications.
- Preserve the full error chain when converting startup failures into cloneable outcome errors.
GitOrigin-RevId: 54bbf2abaf3329d9828b2d2bc5d877fddc2917e1
## Why
A malformed or discontinuous rollout record can otherwise block later valid
thread history from being materialized in SQLite.
## What changed
- Skip malformed JSON, unknown records, missing or regressed ordinals, ordinal
gaps, and invalid timestamps while advancing the projection checkpoint.
- Keep unknown-record ordinals available for a subsequent valid retry.
- Record projection outcomes and anomaly kinds with OpenTelemetry counters.
## Testing
- Cover malformed lines, missing, duplicate, and forward-gap ordinals, and valid
retries after unknown records.
GitOrigin-RevId: 9ae616b44513e35a1fa209e54f05f0612abcbd86
## What changed
- Add `WorktreeManager::list` to return managed linked worktrees associated
with the repository containing a requested working directory.
- Preserve the requested repository-relative working directory in each result
and sort results by worktree root.
- Exclude primary and unrelated checkouts, paths outside the managed layout,
unsafe working directories, aliases, and stale or mismatched Git
registrations.
## Testing
Add coverage for repository filtering, native paths, nested working
directories, stale registrations, aliases, and layout validation.
GitOrigin-RevId: 385133914bd601e6c72858166853a1d42f7722ee
## Why
Detached Windows processes cannot receive console signals, so app-server daemons
need another way to enter the existing graceful and forced shutdown flow.
## What changed
- Watch the path in `CODEX_DAEMON_SHUTDOWN_FILE` for a request addressed to the
current process, and consume only a matching PID.
- Race daemon shutdown requests with Ctrl-C on Windows while leaving unmanaged
launches on the existing console-signal path.
- Exercise the SIGTERM-equivalent graceful and forced WebSocket shutdown cases
on Windows.
## Testing
Added unit coverage ensuring inherited control paths and malformed requests
cannot consume another process's shutdown request.
GitOrigin-RevId: 426a3c12edc344802395d4d26288f2bb015c484f
## What changed
- Accept optional `account/rateLimits/read` capabilities for Luna Reserve support
and lightweight background polling while preserving omitted and `null` params.
- Forward the Luna Reserve capability only for eligible ChatGPT sessions, and let
lightweight polls skip the separate reset-credit detail request.
- Return the backend's `ordinaryUsageAllowed` decision only when its account and
user identity match the active session.
## Testing
- Cover capability defaults, eligible and restricted authentication modes,
lightweight polling, identity filtering, and backend permission handling.
GitOrigin-RevId: f407a3ae1e70e411fdf245f072a16e453f59cd87
## What changed
Set `questions` to `None` when the buffered replay tests construct an
ordinary completed agent message.
GitOrigin-RevId: 8b5ff14ff8ef25f4f760441767cfaed8542f8b94
## What changed
- Add the `send_message_to_user_async` control tool for concise questions and updates during ongoing work.
- Emit messages as asynchronous agent items without ending the turn, and reject empty message text.
- Expose the tool only to root agents when the model catalog explicitly opts in, independently of `request_user_input_async`.
## Testing
- Cover catalog gating for root agents and subagents.
- Verify asynchronous item emission, tool output, empty-message validation, and continued turn execution.
GitOrigin-RevId: 8c6a7988a502f3dbc9eff7000913e85f0c596550
## What changed
- Add the default-off `windows_sandbox_service` feature and expose it through
app-server experimental feature enablement.
- When enabled, attempt service provisioning during elevated Windows sandbox
setup, using the effective network proxy ports and listener roles. Continue
through the existing setup path when the service is unavailable or the
configuration is unsupported.
- Report unsupported Codex home drives as service unavailability so the client
can fall back to the elevated helper.
## Testing
- Add a Windows-only unit test covering HTTP and SOCKS listener derivation from
the effective proxy configuration.
GitOrigin-RevId: 40b119cf51f84e5d0e94d6a0a8d5b506d1123526
## Why
The Windows sandbox service had provisioning policy and client authentication in place, but its IPC listener was still disabled.
## What changed
- Serve framed provisioning requests over a local named pipe, authenticate packaged clients, validate requests and machine policy, and report provisioning outcomes through bounded responses and Windows event logging.
- Return `unavailable` for configuration parse failures so clients can fall back to the elevated setup helper.
- Keep validated directory handles alive in the setup helper so path protections survive an unexpected service exit.
- Make connection recovery and shutdown wakeups tolerate clients that disconnect before the listener accepts them.
## Testing
Added Windows tests for response framing, configuration-error classification, pipe security and reconnect behavior, shutdown wakeups, and retained helper handles.
GitOrigin-RevId: 68e9d546dcada88ff162ea4f98c0f4d748706b34
## Why
Sandbox provisioning IPC must authenticate callers before request handling can be enabled.
## What changed
- Authorize named-pipe clients against the Codex package identity and keep the client process open through authentication.
- Impersonate the caller and require its token to match the client process user, belong to an interactive named user, and not belong to the sandbox group.
- Prepare and pin the requested Codex home, then validate machine policy with the impersonated token.
- Allow known Codex package families when running an unpackaged debug service in foreground mode.
Provisioning IPC remains disabled until this authentication is connected to the transport.
## Testing
- Add a Windows test that verifies an unpackaged pipe client is rejected before it sends a provisioning request.
GitOrigin-RevId: b0e87450c06f8de3eca6cb77daa9b11ef80699a9
## What changed
- Add a Windows sandbox service validator that loads managed configuration while impersonating the provisioning client.
- Reject elevated sandbox or network settings that conflict with managed requirements, including local binding and HTTP or SOCKS proxy-port restrictions.
- Add a one-shot cloud configuration loader that bypasses the disk cache so policy checks use a fresh backend response without modifying cached configuration.
- Keep the provisioning integration disabled until authenticated transport can supply the policy inputs.
## Testing
- Cover elevated sandbox restrictions, disabled networking, local binding, proxy-port classification, malformed policy, impersonation failure, and cache bypass behavior.
GitOrigin-RevId: b76aa8959c515c6507c2eaf61af768efa1305253
## Why
Windows sandbox provisioning performs privileged work beneath a requested Codex home. Provisioning paths and output entries must remain bound to the files and directories that were validated, without following reparse points or writing through caller-controlled hard links.
## What changed
- Add reusable no-reparse directory opens, path validation, directory guards, and handle-relative atomic file replacement.
- Use fresh or retained handles for provisioning logs, sandbox credentials, setup markers, and error reports in service provisioning mode.
- Add service-side validation for framed provisioning requests, proxy settings, fixed-drive Codex homes, and pinned sandbox directories.
## Testing
Add Windows tests covering junction and unsafe-path rejection, hard-link-safe output replacement, retained output handles, request framing and normalization, and ancestor pinning.
GitOrigin-RevId: 2ec4f0d15404c3387df1414bb0c1915cf452ecf2
## What changed
- Add the `codex-windows-sandbox-service` workspace crate and Windows-only build target.
- Integrate `CodexSandboxService` with the Windows Service Control Manager, including start, stop, shutdown, status reporting, and event-log handling.
- Support service mode by default and a debug-only `--foreground` mode. Keep provisioning IPC disabled until authenticated request handling is available.
## Testing
- Add argument-parsing tests for service, foreground, unknown, and multiple arguments.
GitOrigin-RevId: 1c84f0a593b65e5cf97ab7606cde03675542b0b0
## What changed
- Add a client for the packaged Windows sandbox provisioning service that verifies the named-pipe server belongs to the running `CodexSandboxService` process before exchanging a versioned provisioning request.
- Treat an absent, busy, timed-out, or disconnected service as unavailable while surfacing provisioning and authentication failures.
- Send the complete `WindowsSandboxProvisioningSettings` and classify inherited HTTP and SOCKS proxy listeners separately for managed-policy validation.
- Share bounded frame-readiness handling between runner and provisioning IPC.
## Testing
- Extend proxy environment tests to cover network-enabled profiles, mixed HTTP and SOCKS listeners, explicit proxy-port overrides, case-insensitive schemes, and unclassified protocols.
GitOrigin-RevId: 6ff6741fc3ecd76314a7a045523a8d7a7e7af686
## What changed
- Define a versioned, length-prefixed JSON request/response protocol for the
machine-wide Windows sandbox provisioning service, including its named pipe
and network setup parameters.
- Add a readiness check that compares the recorded proxy ports and local-binding
policy with the requested provisioning settings.
- Share framed JSON I/O, sandbox-group creation, and SID resolution between the
existing elevated setup path and provisioning clients.
GitOrigin-RevId: d6250542d06f7646ffeb92150472e7d7fa1e5e66
Eric Traut