## Why
With `multi_agent_v2.disable_direct_message` enabled, an unavailable agent message board could cause tool router construction to reject the turn.
## What changed
Remove the requirement that the router expose the board's `post` tool. Unavailable board calls return an unsupported-call error to the model, allowing the turn to continue.
## Testing
Update scenario coverage for a disabled board feature, legacy agents, and ephemeral sessions. Assert that unavailable board calls return an error to the model, that `post`, `send_message`, and `followup_task` are not advertised, and that no board database is created.
GitOrigin-RevId: cb9571459c128d84c3c96f185e70c404e0463473
## What changed
Remove eight tests covering experimental API schema filtering and marking,
end-of-file unified diffs, MCP prompt auto-approval, and local-link regex
initialization. Remove the associated unused test imports and regex coverage
comment. Runtime behavior is unchanged.
GitOrigin-RevId: 91f59cab82393d43000eadf4e7c55e3a6ec2aa14
## What changed
Add a unified execution test where `exec_command` yields a session and a subsequent `write_stdin` poll completes after the remote process exits while its output stream remains open. Verify that the poll returns the delayed output and exit code, emits the command completion event, and removes the background session without issuing a `process/read` request.
GitOrigin-RevId: 3a316eb9f6b29682da81a2ecbdda52f659f4b792
## Why
A remote process can exit while its output stream remains open, leaving the exit watcher waiting and delaying `ExecCommandEnd` even after output collection finishes.
## What changed
Cancel the process output token after final collection or polling, on one-shot cancellation, and after confirmed termination. This releases the exit watcher while allowing delayed output to be collected before the final poll completes.
## Testing
Add remote process event tests for output streams that remain open at the collection deadline, during interruption, and during explicit termination. Assert that `ExecCommandEnd` preserves the exit code and aggregated output, background terminals are cleared, and interruption and termination require no extra `process/read` requests.
GitOrigin-RevId: 8346e5ce446280915b6e2ffa362fcfd79280bfff
## Why
`Ctrl+V` previously attempted only image paste, so a text-only clipboard produced an image-paste error. `Shift+Insert` did not use the clipboard paste path.
## What changed
- On Windows, let `Ctrl+V` and `Shift+Insert` paste images first, then read clipboard text asynchronously when no image is available. Keep clipboard access errors distinct from missing images.
- Allow keyboard paste into composer selections and active history or Vim search queries, including inline mode with right-click paste disabled.
- Flush buffered typing before explicit paste to preserve input order. Discard pending clipboard text when the thread or editable target changes, while allowing shortcut releases and repeated paste shortcuts to leave the read pending.
## Testing
Extend shortcut and clipboard-worker tests to cover text fallback, multiline Unicode text, stale-read cancellation, shortcut releases and repeats, and read-only drafts. Add assertions for history-search preview stability and selection changes.
GitOrigin-RevId: 080c1c05a4587e325cea938a6e28c646b9ac5837
## Why
After a thread was archived externally, the TUI still advertised the Left-arrow agents shortcut, but pressing it in an empty composer did not open the agents view.
## What changed
Reuse the agents navigation handler when connected to an unavailable thread. Preserve the existing empty-composer and editor guards, and require a key press so repeated Left-arrow events do not open the view.
## Testing
Add a regression test for external thread archiving that verifies draft editing, the shortcut hint, ignored key repeats, and opening the agents command center, with a snapshot of the resulting view.
GitOrigin-RevId: a3f36b42bafee948ed7f5842fcb425e414d7e024
## Why
Startup configuration warnings can reflect settings from when the background server started, even after those settings have been fixed. A restart lets users refresh the server without leaving the TUI.
## What changed
- Add a confirmed restart action to `/daemon`, warning that active or queued work in other chats may be interrupted. Reconnect automatically and let an in-progress restart finish if the TUI exits.
- Verify that Codex manages a local server before enabling restart, including servers discovered with auto-start disabled and those started by `codex agents`.
- Show a restart hint on the first startup configuration warning for managed servers, preserving the original diagnostic for copying and dismissal.
- Repaint the full surface of centered dialogs to restore background colors over cached blank cells.
## Testing
Add CLI integration coverage for agents startup and restarting a discovered daemon with auto-start disabled. Extend TUI tests for confirmation, cancellation, unmanaged servers, warning hints and dismissal, and dialog background rendering.
GitOrigin-RevId: 8e4319fab84f13bf6e7335deb93364fccaff14a7
## What changed
Remove `Terminal::autoresize` and the fallible `try_draw` helpers. Render directly in `draw_with_size`, retaining automatic size updates and the existing buffer flush and cursor handling.
Update the cursor-ordering test to use `draw`, preserving its assertion that the cursor moves before it is shown.
GitOrigin-RevId: 5889e9603d772945660e7ae35690d2b7326b10ae
## Why
Dropping the event receiver before shutdown lets an in-flight notification fail delivery and terminate the worker before it sends the WebSocket close frame.
## What changed
Keep the event receiver alive until `RemoteAppServerClient::shutdown` finishes waiting for the worker, allowing it to process the shutdown command and close the WebSocket.
## Testing
Extend regression tests to verify that an event remains deliverable after shutdown is queued and that the server receives `Message::Close(None)` with an extra notification in flight.
GitOrigin-RevId: ba14bc97ffa3453b7b59660144db6da9e688983d
## What changed
Add `Alt+Left` / `Alt+Right` to the shortcut overlay's Session group as “Subagents (empty prompt)”, using the existing previous/next agent binding labels.
## Testing
Update shortcut help snapshots for narrow and wide layouts, configured bindings, and running sessions to include the new entry.
GitOrigin-RevId: 534be840e1fe5646cfb9465e78049322d7e72b4c
## Why
Turn tips are visible outside transcript history, but their text could not be selected for copying.
## What changed
Register rendered working and completion tip rows for mouse selection. Keep tips in place when selection hints or copy status appear, and use the hint “Selecting text · esc cancel”.
## Testing
Extend mouse-selection tests and snapshots to cover selecting `/help` in working and completion tips with copy-on-select enabled, and clearing the selection when a working tip disappears.
GitOrigin-RevId: 25b3f02e7e93a53e777de455943d47fbab388ff1
## Why
Cold resume can replace saved unnamed permissions with current configuration defaults or recover an executor's permissions from turn context. A first-turn context can also predate an acknowledged settings update.
## What changed
- Restore eligible unnamed permission profiles from settings snapshots owned by the resumed thread, honoring explicit caller overrides and current managed requirements.
- Use owned snapshots as the authority for named permission profiles and reapply workspace permissions for the resumed workspace roots.
- Persist a thread-owned settings checkpoint after the first turn's context, serialized with settings updates so older checkpoints cannot supersede newer settings.
## Testing
Extend regression coverage for cold resume with changed defaults, managed permission restrictions, workspace-root overrides, foreign snapshots, and settings updates during first-turn processing.
GitOrigin-RevId: e411d9fd3d586a4162498c9c77c4184459071bd1
## Why
Startup recovery treated a buffered Vim Replace key as an insertion, so the recovered unsent text could differ from the eventual edit. Replacing the first character of `abcd` with `X` should recover `Xbcd`, not `Xabcd`.
## What changed
Preserve the distinction between held typed keys and buffered pastes when building recovery snapshots. Apply Vim Replace semantics to held keys, including mouse selections and the bash-mode prefix offset, without consuming live pending input. Keep buffered pastes literal so the live paste path retains responsibility for large-paste and image classification.
## Testing
Add regression tests for recovery after startup draft handoff and replacement of mouse-selected text with and without the bash-mode prefix. Verify that taking a recovery snapshot leaves live input unchanged and that flushing the held key produces the same text.
GitOrigin-RevId: 97fada635ad9f0f01042b8e96020372d6df9d951
## Why
Piping `codex plugin list` into a consumer such as `head` can close stdout before the full catalog is written, causing a panic.
## What changed
Write both table and JSON output through a fallible writer and treat broken pipes during writing or flushing as success. Continue propagating other output errors.
## Testing
Add unit tests for write and flush failures in both output formats, plus CLI tests that close stdout early and verify a successful exit without a panic.
GitOrigin-RevId: cc4a64e10ad723d26b6de9e731efdc534dbee492
## Why
Server request IDs can be reused across connections. Retained replies need to target the connection that emitted the request, even if the UI selection later changes.
## What changed
- Expose `AppServerReplyHandle` through `AppServerRequestHandle::server_request_reply_handle`, capturing the originating client and request ID for explicit `resolve` or `reject` calls.
- Share single-use completion state across clones so only the first reply is submitted. Dropping a handle sends nothing; stale connections return I/O errors without retrying or switching connections.
- Route existing client reply methods through request handles and use the new API in the managed worktree model test.
## Testing
Add in-process and WebSocket tests for replies on separate connections with identical request IDs, rejection routing, duplicate completion, and stale handles after worker shutdown. Also check that debug output redacts handle details.
GitOrigin-RevId: 940d0951ab67529b05919ca8ec7adb5813834b8c
## What changed
- Group preferences into Appearance, Notifications, Input, Sessions, and Text selection tabs, with search and links to existing theme, status line, terminal title, and keyboard editors.
- Persist preference changes to the selected local configuration file, apply supported changes immediately, and show save errors, configuration overrides, and restart requirements in the panel.
- Add a delayed notification test and controls for notification timing while preserving custom event filters.
- Add `tui.copy_on_select_clear_selection`, disabled by default, to clear transcript selection highlights only after confirmed automatic clipboard delivery.
- Keep local configuration editors usable while disconnected and prevent held activation keys or buffered input from triggering actions across editor and reconnect transitions.
## Testing
Add regression tests and rendering snapshots for panel navigation, search, dependency states, editor handoffs, offline persistence, notification timers, custom filter preservation, and confirmed-copy deselection.
GitOrigin-RevId: a16d218046060fcb6e61705a803fcd9297266e6e
## What changed
- Update the pinned `rmcp` dependency and Cargo/Bazel lockfiles, and migrate MCP handlers and fixtures to `ClientConfig` and `ServerConfig`.
- Stop requiring responses for cancelled elicitation requests in cancellation tests while retaining checks for cleanup and continued connection usability.
- Handle client disconnects during WebSocket writes in the TUI test server, use an asynchronous HTTP mock for loopback proxy testing, and improve remote executor test diagnostics and the Windows subprocess fixture.
- Use `invalid_prompt` for the memory worker failure fixture.
## Testing
Add a regression test covering transport EOF during both form elicitation and user verification. Keep the client alive while checking that pending response channels close, the timeout pause clears, and the service exits with `QuitReason::Closed`.
GitOrigin-RevId: c0166b83fab3b59d84a5207c6630cb6adcf3b230
## Why
An unfinished terminal control sequence can prevent buffered input from draining before a startup modal appears. Propagating that timeout aborts modal handling instead of keeping the screen available for an explicit user decision.
## What changed
Treat input-drain timeouts as a reason to keep startup modal input quarantined. Discard key, paste, and mouse events while retrying the drain, and continue processing server events. Preserve this protection when another request resolves and when the agent overview is restored after reconnecting.
## Testing
Add a Unix PTY regression test covering unfinished control sequences, queued approval and overview shortcuts, unrelated request resolution, and overview reconnection. Verify that buffered input cannot answer an approval or create a task, while fresh shortcuts work after the drain completes.
GitOrigin-RevId: 476bedbd45f13a15d0019e4ce2e875406d4a53ca
## Why
WSL clipboard reads previously launched PowerShell for every paste. Process creation can hang under WSL and stall the shared clipboard worker.
## What changed
- Reuse a persistent PowerShell reader on a dedicated thread, keeping clipboard requests bounded by their deadlines and restarting the reader after errors.
- Prewarm the reader at startup when right-click paste is allowed on WSL, without accessing clipboard contents.
- Use length-framed UTF-8 responses to preserve whitespace and distinguish consecutive pastes while enforcing message size limits.
## Testing
Update the command-reader test to cover consecutive responses from one process, large clipboard text, UTF-8 and whitespace preservation, and read timeouts.
GitOrigin-RevId: 36af338097d6b178ab4887faa5918240c47e1515
## Why
Raw pastes can arrive as thousands of character, Enter, and Tab events. Redrawing the entire owned transcript before each buffered key defeats the composer's paste batching.
## What changed
Skip those redraws while the composer is capturing a paste burst. Continue refreshing geometry immediately for transcript interactions, shortcuts, and non-text keys, including Enter when an accepted Find owns it.
## Testing
Add regression tests and a render snapshot covering multiline raw paste with tabs and Korean text, deferred rendering until the burst flushes, and a single submission of the complete pasted text. Also verify that an accepted Find still handles Enter during a paste burst without submitting the draft.
GitOrigin-RevId: 49d89958a89c165249322463e6075377c517bd8e
## Why
Large test futures can occupy their caller's stack frame even when passed directly to `Box::pin`.
## What changed
- Add a non-inlined `box_future` helper and `boxed_future!` macro to construct and box futures outside the caller's poll frame. Use them for heavyweight TUI fixtures and test scenarios.
- Return the shared `App` fixture as `Box<App>` to keep it on the heap.
- Treat `ConnectionAborted` as a closed connection in the realtime speech test server, alongside `BrokenPipe` and `ConnectionReset`.
GitOrigin-RevId: 7bbf2020a5ec12bae8e0365ddf5641deef93b544
Extend `hung_grpc_stdio_host_is_reaped_and_the_session_recovers` to assert that the first execution after host replacement reports lost stored values and running cells. Verify that this rejected execution does not store a value and that the next execution succeeds.
GitOrigin-RevId: 2fc5550c32774321a969b56ba59153de0e497f19
## Why
Progress updates change task timestamps, causing recency-based sorting to move rows within the same status group on refresh.
## What changed
Retain each task's relative order while it remains in the same status group. Append new tasks and tasks that change groups after existing rows in their destination group. Forget the order of removed tasks so rediscovered tasks behave like new arrivals.
Search and status filters preserve the retained order, and pinned tasks continue to use their explicit ordering.
## Testing
Add regression tests and a snapshot covering progress refreshes, selection stability, arrivals, status transitions (including changes caused by descendants), removal and rediscovery, filters, and pins.
GitOrigin-RevId: 54008a66de5c4cf509759e25ee8c1cb6e2a70100
## Why
Client-supplied tool outputs can carry task instructions. Even when marked with `retain: true`, these instructions could be trimmed before compaction and disappear from the compacted history.
## What changed
Add the disabled-by-default `retain_client_tool_outputs` feature to honor retention for explicitly marked, named `function_call_output` items without a `call_id`.
- Preserve eligible outputs in remote compaction v2 and when starting a new context window, keeping their original role.
- Stop emergency tool-output trimming at a retained output.
- Share the existing 64,000-token retention budget, keeping outputs whole and dropping an oversized output and older items rather than partially truncating it.
- Place initial context before retained standalone outputs and account for their images in retained-image counts.
## Testing
Add a scenario covering enabled and disabled retention, emergency trimming, oversized-output handling, and preservation of the latest instruction after compaction and cold resume. Verify that retention annotations stay out of model requests.
GitOrigin-RevId: 449179670e4d2be2623928700738758e43b5dc1a
The initial user item seals realtime transcript segments, so starting speech before it completes can split the segment under test. Wait for its `item/completed` notification and assert that it is a `ThreadItem::UserMessage` before triggering speech, so only the steering under test can split that segment.
GitOrigin-RevId: 932443f4a0d6c4284cf95f44e64912506769a180
## Why
Replacing a gRPC code-mode runtime loses stored values and running cells. Silently continuing after reconnection hides that loss, while prior external tool operations may already have completed.
## What changed
- Capture the runtime generation when `execute` and `wait` calls are created. If recovery replaces it, reject those calls with an explicit reset error, including concurrent calls and calls first polled after recovery.
- Explain the lost state and advise inspecting prior tool results before retrying. Allow a fresh `exec` call to continue on the replacement runtime.
- Keep `terminate` from reopening the runtime so cleanup cannot hide a reset from the next request.
## Testing
Extend gRPC recovery tests to cover reset errors after host restarts, missing sessions, and route loss, rejection of queued calls, and successful fresh execution with cleared stored state.
GitOrigin-RevId: 914cab3bb45e30a3f3b2afacb5631e42b18e21b0
## What changed
Clicking a pinned prompt header with an unmodified left click now scrolls the transcript to the original prompt. The click also ends text selection, cancels search, and clears activity focus. Track the prompt by entry identity so navigation remains correct when history is prepended.
## Testing
Update the prompt-header snapshot test to navigate by clicking the header after prepending history and verify that the original prompt becomes visible.
GitOrigin-RevId: dea811693853e3740909ab675b1339f701e01e02
## Why
Voice failure metrics lacked cause and lifecycle phase, and session durations were recorded before the final outcome was known. A failed control send could also overwrite a more specific WebRTC error.
## What changed
- Tag `codex.voice.session.failure` with bounded `cause` and `phase` values, recording at most one failure per session.
- Capture duration when stopping and emit `codex.voice.session.duration` at cleanup with a `success` or `failure` outcome.
- Carry typed WebRTC errors into the TUI, preserve existing errors when control sends fail, and avoid duplicate errors after startup failure.
- Record app-server disconnect failures for background voice sessions as well as the visible session.
## Testing
Add coverage for terminal outcome and failure metric attributes, preservation of specific startup and audio-session errors, and startup failures without duplicate control-channel errors.
GitOrigin-RevId: 5aeda6e766093e3fce7206560aa83b6f7770dddb
## Why
A catchable exception lets JavaScript continue after `exit()`, including in `catch`, `finally`, and queued promise callbacks. Exiting should finish the cell successfully without further output or state changes.
## What changed
- Terminate V8 execution when `exit()` is called and complete the cell even if its module promise remains pending.
- Guard host callbacks against effects after exit, including when getters or value conversion request exit.
- Preserve stored writes made before exit and suppress errors when exit occurs during exception formatting.
## Testing
Add regression tests for synchronous and asynchronous exit, timers, parallel promises, value conversion, exception getters, and resuming after a yield and tool response. Verify that only prior output and stored writes survive, and separately exercise host guards while JavaScript continues running.
GitOrigin-RevId: e9487ba65ef0358612c5009bd26953b786a12798
## What changed
- Add the disabled-by-default `output_token_replay` feature to request `output.encrypted_content` from OpenAI providers.
- Preserve encrypted message and tool-call output, message and function-call status, and output-text `annotations` and `logprobs` through history and replay. Update the generated protocol schemas and SDK types.
- Strip output ciphertext from requests to other providers while retaining it in stored history, including after replay is disabled. Remove encrypted content from memory extraction inputs.
## Testing
Add integration coverage for the feature/provider combinations, metadata replay across follow-up requests, and history preservation when resuming with replay disabled.
GitOrigin-RevId: 77729a021b6771933402aebe74ece8eb39c057e2
## What changed
Add `model_messages.tools.incremental_tools` overrides for the update hint, tool and namespace removal headers, and namespace instruction update and clearing messages. Missing, null, or over-512-byte values fall back to bundled wording; empty strings omit static text while retaining runtime names and instructions.
Substitute `{name}` in namespace message templates and append runtime instructions verbatim. Wording changes alone do not trigger tool catalog updates.
## Testing
Extend unit tests and MCP request-history snapshots to cover custom wording, empty notices, tool removal and restoration, and namespace instruction changes and clearing without repeating unchanged tools or notices.
GitOrigin-RevId: 22dea0a6fb4cfcd646f5e65346424834c8b7d5a2
## Why
Lifecycle status reporting was limited to direct iTerm2 sessions. OSC 7501 lets other terminals receive Codex's program state.
## What changed
- Emit OSC 7501 with `app=codex` and states `idle`, `working`, or `blocked` whenever stdout is a terminal, including multiplexed sessions. Report `blocked` when user action is required.
- Continue emitting iTerm2's OSC 21337 status and bounded activity details in direct iTerm2 sessions.
- Clear status before handing the terminal to an external program, as well as on suspension and exit, and re-emit the current state after returning.
## Testing
Add coverage for OSC 7501 encoding, combined iTerm2 output, clearing both protocols, and protocol selection across terminal and multiplexer environments. Update lifecycle tests and status snapshots for the new protocol.
GitOrigin-RevId: 6d2a6885687b0e7af825e954fab72db0765c9a07
## What changed
Expose `Environment::observe_connection_attempts` and `ConnectionAttemptOutcome` to report elapsed time and success, failure, or cancellation for initial connections. Measure from the end of provisioning through client installation, including connection retries.
The first registered observer wins. Past attempts and reconnections are omitted.
## Testing
Extend tests to assert failure followed by success when startup is retried, and a single cancellation notification when an environment is replaced during startup.
GitOrigin-RevId: 88300f38dcf9428b824c5ff36aa1b40d7d466b6f
## What changed
- Add `grpc+stdio://` as a host transport and the disabled-by-default `code_mode_host_grpc` feature flag to select it.
- Share a lazy HTTP/2 channel and host process across code-mode sessions while keeping session state isolated.
- Use HTTP/2 keepalives to detect unresponsive hosts, kill and reap disconnected children, and spawn a fresh host on reconnect. Exit the host when its stdio connection closes.
## Testing
Add coverage for shared-host session isolation, host exit on stdin EOF, and recovery after an unresponsive host is reaped. Exercise nested tool calls with both legacy stdio and gRPC stdio, asserting that the feature flag selects the expected transport.
GitOrigin-RevId: 31389d8540de236b8e0571d3c24e29e117b75c4a
## Why
Graceful shutdown rejects new sessions with an invalid-request error. Give clients a structured shutdown reason and show command center users why session creation is paused.
## What changed
- Add `data: {"reason":"serverShuttingDown"}` to app-server shutdown admission errors while retaining JSON-RPC code `-32600`.
- Show a dedicated shutdown message explaining the wait for active turns and automatic reconnection for non-embedded servers. Recognize older servers by their exact draining message only when error data is absent, and preserve retained-worktree cleanup guidance.
- Keep the command center reconnect presentation when a shutdown error covers the initial overview and no conversation is open.
## Testing
Extend admission and WebSocket shutdown assertions, add embedded and daemon shutdown message snapshots, and cover reconnection with a shutdown error over the initial command center.
GitOrigin-RevId: f167144c0ddc77872afdf3daac8bb1c89f3425b4
## Why
PSEC API symbols can be present on transitional Windows builds where MXC is not enabled. Availability detection needs to verify that a native process security environment can actually be created.
## What changed
- Replace `mxc-sdk` with pinned `appcontainer_common`, `learning_mode_windows`, and `wxc_common` dependencies, and update Cargo and Bazel dependency metadata.
- Use MXC's cached create/close probe for `is_available()` and query native deny-path support through `SecurityEnvironmentApi` before launching requests with denied paths.
- Adapt request construction and the existing policy test to the vector-based environment field, and update the sandbox documentation.
GitOrigin-RevId: e8cc6a35d46884d0a069b747d33e711512ec1596
## Why
Account discovery and cloud configuration GETs can fail after connecting but before receiving response headers. These request failures previously bypassed system proxy fallback.
## What changed
Allow bootstrap GETs to retry through the system proxy on request errors, alongside the existing connection failure and timeout cases, when fallback is enabled.
## Testing
Add regression coverage for connections closed before response headers on `accounts/check` and `config/bundle`, verifying successful proxy retries with the original request headers. Extend coverage to ensure HTTP responses with status `401`, `403`, `407`, `429`, or `503` do not trigger fallback, and network policy denials prevent requests to both the origin and proxy.
GitOrigin-RevId: ac34c3bcfe3bd81c905a7e616d8b821879fbe2c9
Use Codex `0.162.1` instead of `0.156.1` for
`exec-server-stable-release-test`, updating the Bazel release archive version,
checksum, and repository reference.
GitOrigin-RevId: 304108b223da1e5506483f53c476a55a8f31ce71
## Why
Equivalent local source paths can fail to match an already-added marketplace, and redirected managed roots can lose their managed classification on Windows.
## What changed
- Compare local marketplace sources after filesystem normalization.
- Reuse the resolved request path when locating an existing local marketplace so retargeting a configured junction does not switch the returned root.
- Accept both the configured managed root and its canonical target on Windows while continuing to reject unowned aliases to that target.
## Testing
Add Windows regression tests for canonical and legacy path spellings, retargeted local-source junctions, and redirected managed roots with unowned aliases.
GitOrigin-RevId: f1ae46e8e7384075ed1baa6b33b2821f795e17f8
## What changed
Pass the parent turn's `cyber_access_program` to Guardian reviewers and asynchronous classifiers. Use `daybreak_blue` for either Daybreak selection, preserve `standard`, and omit `access_programs` when no program is selected.
Capture the selection with the owning turn so asynchronous observations retain it across later turns. Resolve classifier programs using current authentication and the same provider and API-key feature policy as ordinary model requests.
## Testing
Add regression tests for program changes across reused reviewer sessions with API-key and ChatGPT authentication, snapshot and conversation classifiers at low and high risk, and enabled, disabled, and unsupported-provider API-key policies. Verify parent requests retain their selected program.
GitOrigin-RevId: 447f306df3a6bd6805464b819950690c751b04b4
## What changed
Add an optional `retain` flag to `TurnToolOutput` for `turn/start`. When set to `true`, pass the output to the core with a retention annotation to request retention in the thread's model history. The flag defaults to `false`, preserving existing behavior.
Update the generated JSON schemas, TypeScript types, and Python bindings to expose the flag.
## Testing
Add an integration test verifying that a retained tool output reaches the model and preserves client-authored sender metadata in persisted history, including the receiver message ID.
GitOrigin-RevId: 52893a8fcb308f26e77ba8f0bee9990073b26d54
## Why
Reentering V8 during termination can replace uncatchable cancellation with a catchable JavaScript exception, allowing a script to continue after cancellation.
## What changed
Skip JSON conversion and exception throwing while V8 execution is terminating, preserving cancellation through `image()` getters and JSON fallback.
## Testing
Add regression coverage for cancellation during JSON fallback and reentrant image getters, including prompt termination through the standalone host and continued usability of another session. Extend serialization error tests to cover failing image getters alongside circular JSON.
GitOrigin-RevId: f03dd131a62724106fad96111292ddf5b9dc99f6
## Why
A credential mismatch can trigger setup that rotates both sandbox account passwords. Before allowing repair, validate the account that logged on successfully and ensure that neither account has been replaced or has an unowned runtime registration.
## What changed
- Validate runtime records and successful logon tokens, checking account SIDs, rejecting administrators, and requiring enabled `CodexSandboxUsers` membership.
- Before repair, verify recorded account SIDs and reject existing same-family package registrations for unrecorded accounts. Propagate package-query failures while allowing initial migration when no registrations exist.
## Testing
Add tests for malformed records and unrelated logon errors, plus an ignored disposable Windows Sandbox fixture covering successful logons, group membership, SID changes, migration, and unowned registrations.
GitOrigin-RevId: bafedb52cf9bd484250ccac3b163d2041891283f
## Why
JavaScript objects containing Serde's reserved JSON keys can be reinterpreted during deserialization, allowing nested `RawValue` markers to bypass the parser's normal recursion limit.
## What changed
Reject `$serde_json::private::RawValue` and `$serde_json::private::Number` object keys before passing V8's serialized JSON to `serde_json`. Report a `reserved JSON object key` serialization error while continuing to allow marker text in strings and longer keys.
## Testing
Add runtime regression coverage for nested and escaped marker keys, recursion limits, normal JSON conversion, and session recovery without overwriting stored values. Extend the host-backed integration test to verify that stored values remain available across turns after rejection.
GitOrigin-RevId: 27ddce08e1ffe98ec9dffe02473a815ceae2cc89
## Why
Remote configuration reads need a bounded wait without disrupting valid in-flight work on connections that cannot reconnect.
## What changed
- Add `read_environment_config_with_timeout` to `ExecServerClient` and `Environment`, bounding RPC sending and receiving after connection establishment. Local reads retain their existing behavior.
- Return a typed `ExecServerError::RpcTimedOut` and classify it as retryable for read-only preparation.
- Share timeout handling with environment-info requests. Close the timed-out transport and request recovery only when a reconnect strategy exists; otherwise, keep the connection open.
## Testing
Add a regression test verifying that a timed-out configuration read preserves an in-flight stdio read and allows subsequent reads on the same connection, including after a late response.
GitOrigin-RevId: 6785d5846f4c3b07a6e7c505e359238609c3a6b6
## Why
Resumed threads can retain stale capability root locations when the current environment supplies an explicit owner configuration. Matching roots from that configuration previously could not refresh persisted thread roots.
## What changed
Refresh persisted roots from the current attachment when both the root ID and environment ID match, including roots selected by owner-provided configuration. Preserve persisted locations when no matching root is supplied, and continue using the owner's selected roots rather than the executor's shared roots.
Apply the same merge behavior to capability root inspection and per-step resolution.
## Testing
Extend the remote environment regression test to cover owner-provided configurations with and without refreshed roots, including an executor root location that differs from the owner's selection.
GitOrigin-RevId: ad3a639924b348d6d5337ccc64dc8c08234276e3
## What changed
Move `ExecServerProcess` into `core_test_support::exec_server` and update the sandbox, plugin, access, and turn-input tests to use it. Preserve the fixture's startup timeout, temporary `CODEX_HOME`, WebSocket URL discovery, and child-process cleanup.
GitOrigin-RevId: 152de3a83f4ad39e2c1223e15438608dba452850
## What changed
Add `TurnInput::AnnotatedResponseItem` with a caller-supplied `retain` annotation. For function-call outputs, `retain: true` sets `client_authored` history metadata while keeping annotations out of model requests. Accept annotated items through the existing turn submission paths, including continuation.
## Testing
Add an integration test covering retention metadata during turn start, steering, idle submission, and rollout storage. Verify that ordinary outputs remain unmarked and model requests contain neither `retain` nor `client_authored`.
GitOrigin-RevId: 7285dde31149b17b0dcf31d4ea1c7cba66d9efe6
## Why
A credential bound to a host with MITM hooks could also be used at an alias without hooks, allowing the proxy to inject the real credential without enforcing hook policy.
## What changed
Reject requests to unhooked aliases when their selected brokered credentials are also bound to a hooked host. Check both HTTP forwarding and MITM requests before replacing dummy credentials, returning `403` with `blocked-by-mitm-hook` for denied requests.
Use the same destination and credential-selection rules for alias checks and injection, including configured URL prefixes, safe paths, equivalent credentials, merged Basic authentication fields, and environment scope.
## Testing
Add regression coverage for built-in and configured provider aliases, IPv6 destinations, credential selection, and unrelated credentials. Add an agent-started proxy test that verifies credential masking and alias denial.
GitOrigin-RevId: 12be41654761cedcf87b170f7661d6566f7a864e
## Why
A tool can return before its background watcher emits `ExecCommandEnd`. Waiting for that event first can discard an earlier `TurnComplete`, causing the shell snapshot test helper to time out.
## What changed
Update `run_tool_turn_on_harness` to track both the matching `ExecCommandEnd` and `TurnComplete` in a single event loop, returning only after both have arrived regardless of order.
GitOrigin-RevId: c9b749a46eda1244aa3e80fd88b663d110d67d1b
jif