## What changed
Add the default-off `api_key_model_discovery` feature and expose it through app-server experimental feature enablement, respecting user configuration overrides.
When enabled, fetch OpenAI API-key model metadata from the Codex backend, honoring explicit provider base URLs. Treat remote catalogs containing visible models as authoritative. When disabled at startup, skip discovery requests and cached catalogs and retain bundled models.
## Testing
Add coverage for feature enablement and user overrides, cached catalogs across sessions, provider routing, and API-key `model/list` results. Extend coverage for remote instructions and auth-specific cache isolation.
GitOrigin-RevId: 4b189c37c615a7f808cb6ff5f0858a9a55f36ebc
## What changed
Replace full additional permission profiles with network-only metadata in Guardian reviewed actions, and remove the `program` field from `execve` analytics. Preserve absent and empty permission requests and the optional `network.enabled` value.
## Testing
Add serialization tests for enabled and disabled network permissions, absent and empty permission requests, and an unset network permission value.
GitOrigin-RevId: 9904e5f5bd6723d0c09fb423b4818cb8bf12d397
## Why
Attachment mutations must coordinate with thread deletion so queued requests cannot use metadata belonging to a deleted thread.
## What changed
- Add typed `ThreadStore` operations for idempotent attachment creation, paginated listing, and removal, with capability detection and unsupported defaults.
- Implement attachment operations for SQLite-backed `LocalThreadStore`, including unloaded threads, and preserve invalid-request and missing-thread errors.
- Coordinate attachment mutations with lifecycle locks and move SQLite cleanup into thread-store deletion. Remove state rows only after rollout deletion, preserving retries after cleanup failures.
- Give the in-memory store ownership of its associated SQLite cleanup and remove duplicate cleanup from the app-server.
## Testing
Add coverage for attachment pagination and idempotency, unsupported stores, error categories, lifecycle exclusion, mutations queued behind single and batch deletion, cleanup failure retries, and in-memory state cleanup. Extend the app-server descendant deletion test to verify SQLite rows are removed.
GitOrigin-RevId: f0157538c7c5c2ee1362ce40eac157101c5d4505
## Why
Forked threads reported `startup`, causing startup hooks to run again even when their context was inherited from the parent. Resuming with supplied history also reported `startup` instead of `resume`.
## What changed
- Add `fork` as a `SessionStart` source and expose it in the hook input schema.
- Report `fork` for histories with a fork parent and `resume` for supplied histories without one.
- Continue dispatching `SubagentStart` for spawned subagents with either fresh or forked context.
## Testing
Add regression coverage for fork hook matching without duplicate startup context, resume hooks with supplied history, and `SubagentStart` context injection for fresh and forked subagents.
GitOrigin-RevId: 5ac1ae4ab8adcbbbceb8cb0ffb9b32b6402c585b
## What changed
- Add host-recorded `tool_result_metadata` snapshots with size limits, redacted debug output, and protection against deserialization from untrusted input. MCP capture remains disabled.
- Preserve accepted metadata across retries and delayed Code Mode results. Shed raw metadata before source evidence, calls, or completion markers when the request budget is exceeded.
- Send raw metadata only to allowed OpenAI and ChatGPT HTTPS endpoints, filtering by the resolved destination for HTTP and WebSocket requests.
- Encode source parse failures as an array entry with type `parse_failed` and an empty ID.
## Testing
Add coverage for metadata bounds and redaction, retained-call updates, budget shedding, disabled MCP capture, and HTTP/WebSocket destination filtering.
GitOrigin-RevId: b1a396323ad0623167cdd9e20ff9453f0d01bbf7
## What changed
- Add `disabled_plugin_ids` to thread startup options, settings overrides, snapshots, and persisted turn contexts. Omitted overrides preserve the current list; an empty list clears it.
- Restore the selection on resume and capture it before truncating history for a fork. Prefer the owning thread's latest settings snapshot, falling back only to the latest turn context so stale history cannot resurrect an older selection.
- Freeze the selection at turn admission and retain compatibility with histories that lack the new fields.
## Testing
Add coverage for owned settings, explicit clears, latest-turn fallback, and legacy snapshots. Extend settings tests to cover plugin selection during runtime restoration and compaction, and verify initial turn persistence without extra settings checkpoints in both history modes.
GitOrigin-RevId: 75ffbff5763cd93cc5ac69d73b08b237f59bc009
## Why
Automatic goal continuations can repeatedly return empty final answers without
making progress. Stop this loop by marking the goal as `blocked` after three
consecutive empty turns with no other activity.
## What changed
- Observe completed turn items through a new `on_item_completed` lifecycle hook.
- Track empty final answers only for automatically admitted goal turns, resetting
the streak on activity, user turns, or goal changes.
- Preserve normal turn completion and streamed message deltas when blocking a goal.
## Testing
Add accounting coverage for the three-turn threshold and streak resets, plus
app-server tests for empty continuations and recovery through final-answer text,
commentary, or tool activity.
GitOrigin-RevId: 4b9d2cb2e306b0adc316972429cc35000115b88b
## Why
Hosted Codex Apps shared the `mcp_2026_07_28` protocol setting with other MCP servers, preventing independent protocol selection.
## What changed
- Add `features.codex_apps_mcp_2026_07_28`, disabled by default, for the host-owned HTTP `codex_apps` server. Enabling it attempts 2026-07-28 discovery with Legacy fallback.
- Keep other servers, including third-party registrations with Apps-like names or URLs and local stdio servers, governed by `mcp_2026_07_28`.
- Support the new flag through `experimentalFeature/enablement/set` and refresh protocol settings in existing sessions. Track protocol mode per server when deciding whether to reuse connections.
## Testing
Add coverage for independent feature and protocol selection, hosted event-stream protocol selection, standalone Legacy defaults and discovery fallback, and runtime enablement refreshing an existing app-server thread.
GitOrigin-RevId: 640e8e251f0c45e5f4829cc2b73c3082cf42f715
## What changed
Populate `turn_trigger` in request metadata with `guardian_review` for guardian reviews, `guardian_classifier` for classifier requests, and `memory_consolidation` for both detached memory requests and consolidation agent turns.
## Testing
Extend request metadata assertions to cover each trigger across guardian reviews, classifier requests, and both memory startup phases.
GitOrigin-RevId: 2dc3c173ede6563b942b8099ad9901c32967b969
## Why
Initial history replay and rollback before the first turn could clear the reasoning-effort baseline established by startup prewarm, preventing the first request from preserving that baseline when the selected effort changes.
## What changed
Preserve the reasoning-effort pin during history reconstruction. Clear it on rollback only after startup prewarm has been consumed. With reasoning-effort overrides enabled, a prewarmed `medium` baseline remains on the request while a subsequent `high` selection is sent as a `configuration_update`.
## Testing
Add regression coverage for prewarm completing before initial replay on resume and fork. Expand WebSocket tests to cover resumed and forked threads with overrides enabled and disabled, plus rollback before the first turn.
GitOrigin-RevId: 2e2d0e8a06b24f01b717458ca0576d63107c7697
## What changed
Probe the default Windows system config namespace at session start and record `codex.windows_system_config.namespace_squatting_probe` once per process when metrics are available.
When `config.toml` or `requirements.toml` exists, check the containing directories for expected ownership and broad standard-user mutation allow ACEs, including permissions inherited by child files. Report coarse results for missing files, expected directories, unexpected types or owners, mutation permissions, and check errors.
The probe is observational: it does not change configuration loading or enforce a trust decision.
GitOrigin-RevId: e1c79dca5548e16e83c7b84b44ab0de4e2643d0d
## Why
Review evidence can fit its own limits while exceeding the reviewer context window once history, tools, output format, and reminders are included. Tool continuations can also push an existing review over budget.
## What changed
- Select evidence after tools and turn context are resolved, reserving request overhead and a 256-token margin. Omit optional evidence while preserving required sections, and reject required evidence that cannot fit.
- Keep incoming evidence pending until budget selection succeeds so cancellation and compaction cannot record unselected input in reusable history.
- Check the assembled prompt before sampling, including retries and tool continuations. Retry budget failures with summary compaction once per model step, and retire reviewers whose budgets remain exhausted. Avoid history-resetting token-budget compaction for this recovery.
- Record section costs after budget selection.
## Testing
Add unit and integration coverage for required-evidence rejection, optional-evidence omission, reminder overhead, cancellation safety, incoming-review and tool-continuation compaction, and reviewer retirement after ineffective compaction.
GitOrigin-RevId: 2f7ef191b3f46032d295ad363eb7debf9d7a9684
## Why
Failed environments were omitted from environment context, and `wait_for_environment` returned a generic failure or treated an already-failed environment as unselected. The model needs the failure reason to explain problems such as an empty repository.
## What changed
- Preserve the selected environment and error when startup or configuration fails.
- Include failed status and XML-escaped error details in environment context, and return the reason from `wait_for_environment` for failures detected before or during a wait.
- Limit error details to 256 bytes per environment and 512 bytes total in context, preserving UTF-8 boundaries. Limit wait failure details to 256 bytes.
## Testing
Add coverage for failures before a turn and while waiting, verifying that the model receives the reason and the turn completes. Add unit tests for XML escaping, incremental context updates, clearing errors on recovery, and UTF-8-safe truncation.
GitOrigin-RevId: 093ab9b447c7b3243fbb53b665180db95479f2a7
## Why
Recovering a suspended turn can append a duplicate reasoning effort update when history already ends with a matching trusted update but the runtime has not established its effort pin.
## What changed
Reuse a matching harness-authored `ConfigurationUpdate` at the end of history even when the runtime effort pin is unset.
## Testing
Add a regression test that suspends and recovers a turn without WebSocket prewarming, then verifies the recovered request contains exactly one effort update and retains `high` reasoning effort.
GitOrigin-RevId: 2e49073eb5e8d4fae39a8dc1d9d2b07f77802adb
## Why
Remote compaction already uses the normal Responses API, leaving the legacy `/responses/compact` runner unused.
## What changed
- Remove the legacy runner, endpoint client, request types, analytics variant, and obsolete test helpers and snapshots.
- Move tool-output trimming and its metadata tests into `compact_remote_history` for reuse by remote compaction v2.
- Consolidate retained-history filtering in the v2 implementation and remove redundant `RemoteCompactionV2` settings from tests.
## Testing
Extend the retained-history unit test to explicitly check that hook prompts survive compaction.
GitOrigin-RevId: 999bb1391aa22c3c281d6a96f98817d6c9e46ed9
## What changed
- Route manual and automatic remote compaction through the v2 implementation.
- Retire the `remote_compaction_v2` feature toggle while continuing to advertise it in the model client beta features header.
- Migrate compaction tests from `/responses/compact` to streamed `/responses` requests with `compaction_trigger` items and remove legacy parity coverage.
## Testing
Add streamed compaction coverage for tool search output trimming and session base instruction token estimates. Update app-server tests to verify started/completed notifications for both local and streamed remote compaction.
GitOrigin-RevId: cea392a6166a9b116ff83708fd9126d5546476e4
## What changed
Move the synchronous review loop, outcome mapping, deadline helpers, and session pool into `codex-guardian-reviewer`. Core supplies adapters for evidence capture, authorization checks, session creation, and event publication through the new host interfaces.
Have `guardian-v2` initialize the reviewer pool and host separately, with the pool managing prewarming, session reuse, concurrent forks, invalidation, and shutdown.
## Testing
Extend the app-server reviewer lifecycle test to cover interrupted concurrent reviews as well as completed reviews, including resuming a reviewer after parent shutdown. Adapt core reviewer tests to use the pool and factory interfaces.
GitOrigin-RevId: 2d69bd20c169b20534764b98cbdb63f38564a530
## Why
Saved model selections can outlive their bundled catalog entries and still need migration guidance.
## What changed
- Remove `gpt-5.2` and `gpt-5.4-mini` from the bundled model catalog.
- Preserve migration from saved `gpt-5.4-mini` selections to `gpt-5.6-luna` when the old model is absent, while respecting catalog-provided migration metadata.
- Update tests and snapshots to use current models or explicit test fixtures, and remove the obsolete prompt fixture.
## Testing
Extend migration tests to cover catalog metadata precedence, saved selections, replacement model and reasoning-effort persistence, acknowledged prompts, and missing or hidden migration targets.
GitOrigin-RevId: 82beea504cc4a15699677c28a61ec0939af3069c
## Why
Switching models can send images from conversation history with `detail: original` to a model that does not support it.
## What changed
Normalize image details on request copies using the receiving model's capabilities. Downgrade `original` to `high` when unsupported, covering user messages and function and custom tool outputs. Preserve stored image details so switching back to a supporting model retains `original`, and continue stripping details for Responses Lite.
## Testing
Expand unit coverage across image detail values and model capabilities. Extend integration coverage for model switches within and between turns, text-only models, and resumed and forked threads, including assertions that persisted tool outputs remain unchanged.
GitOrigin-RevId: 2561651ea74f045e00f708ae53771a41dcd49c94
## Why
Replaying tool outputs under a different model can expand or shrink the history shown to the model if truncation uses the new model's budget.
## What changed
Save the originating history truncation budget on function and custom tool outputs and reuse it during replay, preserving existing tool-specific overrides. Include the existing 20% serialization allowance once, before converting byte budgets to tokens.
Rename the metadata field to `history_truncation_token_limit` while retaining `fallback_token_limit_override` as its serialized name for compatibility.
## Testing
Add regression coverage for resume and fork with different model budgets, including custom tool outputs. Extend unit coverage for existing overrides and byte-budget conversion.
GitOrigin-RevId: a62c8fd3e43198e2252b150fba72f022939c1070
## Why
History recording used the model captured at turn start, so switching models within a turn could apply stale image preparation and tool-output truncation rules.
## What changed
Pass explicit model metadata through conversation recording. Record model responses and tool results using their originating step's settings, and capture the current model for pending input recorded during startup interruption or task completion.
## Testing
Add regression coverage for tool results across a model switch, explicit model selection for plain and annotated history, and image input retained during interruption and completion. Extend model-switching tests to verify that prepared media and item identity survive switching back to a multimodal model in live, resumed, and forked threads.
GitOrigin-RevId: 5bc750c30c334acb9b802cb80fdea01daffa84a1
## Why
After a model change within a turn, tools could still use the turn's original model capabilities, output limits, and telemetry attribution.
## What changed
- Build each step's tool plan from its captured model settings.
- Use those settings for image support and detail, command and MCP output truncation, extension metadata, and tool telemetry.
- Preserve the issuing step's model for delayed command completion events while allowing later `write_stdin` calls to use their own step's output limits.
## Testing
Add regression coverage for model changes within a turn, including tool replanning, Code Mode execution, image handling, MCP tool and resource output limits, extension settings, and delayed command completion.
GitOrigin-RevId: ef991598e89a846889baf770a0c9e12e56886d5d
## What changed
Move assessment parsing and schema, model selection, review outcomes, retry handling, and rejection circuit breakers into `codex-guardian-reviewer`. Update core to use the extracted APIs while retaining session execution and decision enforcement in the host.
## Testing
Move existing assessment, circuit breaker, and retry tests into the new crate, including coverage for transient errors, cancellation, and deadlines.
GitOrigin-RevId: 96ec9989a0066acb012bf3bec0b9f7d8bf11a4ef
## Why
Model switches within a turn can leave extension context using stale model metadata. Skill catalogs, context windows, and metric attribution need to match the model captured for each sampling step.
## What changed
- Pass captured model metadata and step-specific telemetry to world-state contributors.
- Use that metadata for skill catalog budgets and usage instructions, preserving configured budget overrides.
- Supply the captured model's usable context window to turn-context contributors, including when rebuilding context.
## Testing
Add regression coverage for model switches during skill discovery, catalog budgets and metric attribution, and extension context windows after `new_context` and retained-step context rebuilds.
GitOrigin-RevId: c51b40b739a380b9767a54ea8c8ee6de45bf01c8
## Why
Model changes during an active turn could leave context using the turn's initial model and settings, even after requests switched to the new model.
## What changed
- Build model, personality, approval, collaboration, app, plugin, and multi-agent instructions from captured step settings.
- Resolve multi-agent policy from the step's effective reasoning effort.
- Use the captured step's context window for full-context metadata and retain that step when rebuilding initial context for compaction.
## Testing
Add regression coverage for model switches updating context without duplicating updates, delegation policy following selected or model-default reasoning effort, and compaction preserving retained context after a model change.
GitOrigin-RevId: 3615c7a3f13f15fdcce9ad13d23311340e0aea88
## Why
Cancelling a session after persistence opens but while MCP startup is still pending can leave its writer held, blocking a subsequent resume.
## What changed
Create `LiveThreadInitGuard` inside the persistence startup future so it protects the live thread while `tokio::join!` waits for other startup work. Dropping the startup future then schedules writer cleanup.
## Testing
Add a regression test that cancels a resume while MCP startup is blocked, verifies the local writer is released, and resumes the same thread successfully.
GitOrigin-RevId: 57d8624e783a7b993579a6386aea35ba845da0e3
## Why
Guardian request and section cost distributions need shared bucket boundaries across synchronous and asynchronous reviewers so their measurements align.
## What changed
- Add `histogram_with_boundaries` to session telemetry and extension metrics while preserving session attribution.
- Use shared request-token buckets up to 2,000,000 tokens and section-cost buckets up to 16,777,216 for both review paths.
## Testing
Extend telemetry tests to verify explicit bucket boundaries and sample counts, and Guardian integration coverage to check exported request and section metric bounds for both synchronous and asynchronous reviews.
GitOrigin-RevId: e34f6972b3418bac3b061939b62eeeccaec5a299
## What changed
Add `ComposedContext::enforce_budget` to fit evidence within the input token allowance after reserving existing context. Preserve required content and message boundaries, reserve an omission notice, and return an error if required evidence cannot fit.
Carry retention policies through transcript rendering and composition. Protect user messages, protected messages, and the newest five tool entries. Remove oversized optional items first, then evict commentary, older tool evidence, and images in priority order. Add image admission support and record omitted content in truncation observations.
## Testing
Add tests for existing-context reservations, required-message preservation, image omission, framing costs, and protection of the newest five tool entries in both context profiles.
GitOrigin-RevId: 8a0f245bad82f562323b4533442385ddbcb6e541
## What changed
- Record per-section text bytes, estimated text tokens, image bytes, and image counts for synchronous reviews and asynchronous scoring without logging evidence payloads.
- Emit estimated request tokens through `codex.guardian.context.request_tokens`. Synchronous estimates include assembled history, instructions, tool definitions, and output format, and measure the full logical request before WebSocket delta generation. Asynchronous estimates cover the assembled input.
- Add shared context budgeting helpers, including conservative image token reservations independent of encoded payload size and model-aware input limit calculation.
## Testing
Add coverage for separate text and image accounting, image estimates independent of encoded size, and section estimates that bound delivered messages. Extend asynchronous scorer and app-server tests to verify cost metric emission.
GitOrigin-RevId: aed45ecd9c23706f88caa51f2a4f2c77872d3bdb
## Why
Credential brokerage must retain trusted destination hints even when shell environment policy hides them from child processes. Snapshot replay also needs to preserve credential aliases when tokens are short or captured dummy values change.
## What changed
- Add `features.network_proxy.credentials` and preserve provider settings when toggling the proxy. Prevent project configuration from overriding providers or their credential and destination environment variables.
- Use provider metadata throughout snapshot capture and replay, and pass hidden destination context to the broker without exposing it in the child environment.
- Rewrite aliases containing short credentials or previously captured dummies, respecting environment filters and explicit overrides.
- Preserve case-distinct `shell_environment_policy.set` keys so Windows credential ambiguity checks survive configuration merging and permission profile changes.
- Restore independent MITM settings when credential brokerage is disabled.
## Testing
Add regression coverage for custom providers, hidden destination hints, Bash and Zsh alias replay, configuration edits and merging, Windows ambiguity handling, and credential protection during approved execution.
GitOrigin-RevId: b2bd935d2d8555be56baf8feb1a8e5b3a0c666bc
## What changed
Increase `GUARDIAN_MAX_ACTION_BYTES` from 8,000 to 200,000 bytes to allow larger actions to be reviewed. Keep unified exec stdin approvals capped at 8,000 bytes with a separate `MAX_STDIN_APPROVAL_BYTES` constant.
## Testing
Update aggregate payload rejection coverage for the new limit and exercise MCP elicitation reviews with tool descriptions exceeding the previous 8,000-byte limit.
GitOrigin-RevId: fd4b97980803a7a687449043931e6f1e57e260d3
## What changed
Pass `StartThreadOptions` through rollout, loaded-history, and prepared forks instead of separate configuration and startup arguments. Replace `options.initial_history` with the fork snapshot while preserving the other supplied startup options, and update app-server and test callers.
Box the app-server's `thread_fork_inner` future to keep the large fork future out of the shared request dispatcher's stack frame.
GitOrigin-RevId: d54eb8b212dedabaf2c5d99d155637cefd7deb7a
## Why
Shell quoting can hide credentials from raw-text checks, and startup files can restore real credentials after the broker replaces them with dummy values.
## What changed
- Decode shell literals without evaluating them and reject snapshots containing credentials in executable source, including aliases, functions, and heredocs.
- Preserve credential policy overrides, explicit unsets, and aliases whose source variables were removed. Support credential aliases in Zsh tied arrays while rejecting credentials that span array elements.
- Guard snapshot replay against credential restoration through shell startup files and preserve unrelated `ENV` settings.
- Apply Windows environment-key casing rules to credential overrides, suppress unredacted sandbox diagnostics during snapshot capture, and clear inherited environment variables before launching escalated commands.
## Testing
Add regression coverage for shell quoting and escaped credentials, Zsh tied arrays, startup-file replay, readonly credentials, policy overrides, and sensitive capture timeout and cancellation handling.
GitOrigin-RevId: 58274c07c715423241d26ce6dd2c2b4230cf0f64
## What changed
Support `model_providers.amazon-bedrock.aws.credential_export` with `command`, `args`, and `timeout_ms` to supply SigV4 signing credentials from a command's JSON output. Accept both flat credential-process output and nested STS `Credentials` objects.
Cache credentials in memory, refresh before expiration, and share exports across sessions with matching AWS configuration. On recoverable authentication failures, run the optional `aws.auth_refresh` command before exporting fresh credentials, coalescing concurrent recovery attempts.
Bound command execution time and output size, and keep credential values out of errors. Reject combining `aws.credential_export` with `aws.profile`. Bedrock setup and login reject changes while an exporter is configured, preserving configuration and saved credentials.
## Testing
Add coverage for output formats, expiration, credential precedence, caching, concurrent recovery, command failures, and secret redaction. Integration tests verify request signing with rotated credentials, bounded recovery attempts, and setup/login rejection across configuration layers.
GitOrigin-RevId: 4ef799f88ab5e3b2578f8f41a5e56e4f30e2cd81
## What changed
Introduce `ExecutedToolCalls` to own optional shared recorder state and centralize feature checks, call recording, and accepted result source lookup. Update session, tool runtime, MCP, and Code Mode callers to use this interface.
Move prompt attachment, retry handling, and metadata budgeting into the `request_metadata` module, preserving existing recording and request behavior.
## Testing
Add coverage for all session and turn feature combinations, lazy result source lookup, and unchanged prompts when recording is disabled. Retain the existing metadata budget and cell completeness tests in the new module.
GitOrigin-RevId: bc19f34317232b6599c7ec71c15db4a80123ff6f
## Why
Credential-brokered commands rebuild shell snapshots on every invocation. Snapshot capture failures can also include credential-bearing startup output, and descendants holding output pipes need cleanup even after the shell exits.
## What changed
- Cache successful protected snapshots per environment, keyed by working directory, shell, login mode, and sandbox configuration. Rebuild missing or stale snapshots while keeping concurrent captures independently cancellable.
- Invalidate snapshots when shell settings or credential broker configuration change, and retry capture once if broker configuration changes during startup.
- Restore credentials and associated provider context while respecting environment policy filters and explicit overrides.
- Keep full-buffer capture subject to timeout and cancellation through output draining, clean up descendants on capture expiration or drain failure, and omit startup output from snapshot errors.
## Testing
Add regression coverage for snapshot reuse, invalidation, recovery after storage failure, concurrent cancellation, credential-safe errors, and descendant cleanup. Verify that successful background startup and output beyond the shell output cap remain supported.
GitOrigin-RevId: 7c7c8455bf6e3b9ca173dbb4277783469f0b45e6
## What changed
Parse optional `generation_id` values from image API responses and carry the selected image's ID through the image generation tool into analytics events. Keep the ID out of serialized extension items, JSON schemas, and TypeScript types. Responses without an ID remain supported.
## Testing
Add coverage for distinct IDs in multi-image responses and responses without IDs. Extend analytics and app-server tests to verify that the selected image's ID reaches analytics, and item tests to verify that it is omitted from serialization and TypeScript types.
GitOrigin-RevId: 70a600856990140b76fdbda51a0d73b3414338b1
## Why
Hosts need to stop new turn-input work during shutdown without consuming pending input or preventing already-running delegated work from finishing.
## What changed
- Add an optional `TurnStartAdmission` extension gate, checked before reserving or starting a new turn. Hosts without a gate retain existing behavior.
- Return `NotSubmittedReason::ServerDraining` for refused starts and surface an app-server error instructing clients to reconnect and retry.
- Keep steering, parent-delegated subagent input, and memory-only mailbox wakeups available during drain, while gating automatic starts.
- Close realtime conversations with an ordered handoff, error, and close event sequence when a handoff is refused during drain.
## Testing
Add regression coverage for rejected input staying out of subsequent requests, persisted queue items remaining available for later starts, delegated agent and review work completing during drain, mailbox wakeups, and realtime handoff error ordering.
GitOrigin-RevId: 03dbdcd71eab200e597c0649e6eb39bd92dbc82f
## Why
Filesystem policies for remote execution need to interpret paths, home directories, and temporary directories using the execution host's context.
## What changed
- Add context-based read-denial matching, read-access checks, glob resolution, and `PathUri` workspace-write constructors without consulting local paths or environment variables.
- Share managed read-denial validation through `DenyReadValidator` and use it in core configuration, preserving required-entry checks, concrete grant validation, and constraint diagnostics.
- Reject invalid or unresolvable denial paths when constructing a context-based matcher, and apply `/tmp` denials according to the execution host's path convention.
- Preserve workspace-root symbols and protected metadata entries when materializing URI-based writable roots.
## Testing
Add regression tests for POSIX, Windows, and UNC path matching; conflicting read and write grants; malformed or unresolvable denials; `/tmp` handling; and workspace metadata protection.
GitOrigin-RevId: aa2b174288d1172ab52ff485f58d306236d27652
## What changed
- Update the status heading from the latest usable reasoning line and retain it through tool activity and empty reasoning items. Keep completed reasoning in the expanded transcript only.
- Restore active reasoning after resume, thread switches, and session refreshes, including when earlier events have left the replay buffer.
- Default new embedded TUI threads to `model_reasoning_summary = "detailed"`, honoring explicit summary settings. Keep `concurrent_reasoning_summaries` opt-in and disable it when summaries are `none`.
- Persist the request's captured reasoning summary setting in context updates and local and remote compaction checkpoints.
- Animate status text with a smooth, grapheme-aware shimmer that respects terminal colors and reduced motion.
## Testing
Add regression coverage for reasoning status updates, transcript visibility, resume and buffered replay, outbound summary configuration, and summary settings across all three compaction modes. Add shimmer snapshots and checks for smooth brightness changes and Unicode grapheme preservation.
GitOrigin-RevId: 725c7de20f23166d7a3da6daeca617add5cbc600
Add `CodexThread::queued_event_count()` to support a finite event drain
before transferring the receiver. Callers must remain the sole event reader
until they consume the snapshot count, leaving later events for the next reader.
GitOrigin-RevId: 55f9dd1cf8ebd396fdb60a1dc3d1428ed28cc2d2
## What changed
Add tracing spans for `AGENTS.md` discovery and loading, local file reads and metadata lookups, and filesystem sandbox request preparation and execution. Record the instruction byte limit, whether file operations use the sandbox, and the permission entry count during sandbox preparation, while skipping automatic argument capture.
GitOrigin-RevId: a6aab1cbac975f8042ce48d6a238c48816f7bd77
## Why
Guardian reviewers can inherit token-budget mode from the parent session or model defaults, causing context rollover instead of summary-based compaction.
## What changed
Clear inherited token-budget startup activation, set an explicit default `TokenBudgetConfig`, and disable `Feature::TokenBudget` and `Feature::ContextManagement` for Guardian review sessions.
## Testing
Update regression coverage to verify that reviewers compact with a summary even when the parent and model enable token budgets. Cover both transcript modes and browser evidence, checking that review requests omit `token_budget.context_window` and retain the compaction summary.
GitOrigin-RevId: e1a84f9c7752a712399cd749c3834b2a7bb4a7e6
## Why
Shell startup files can introduce credentials or overwrite brokered dummy values. Snapshot capture and replay need to respect the command's sandbox and environment policy without persisting real credentials.
## What changed
- Capture and validate brokered snapshots per command using its requested shell, working directory, login mode, sandbox, and environment policy.
- Discover shell-initialized credentials and prepare snapshot exports for brokered replay. Preserve shell functions and aliases while preventing startup files from overwriting dummy credentials during replay.
- Rebuild snapshots as credential broker state changes and retain each command's snapshot for the lifetime of its process.
- Reject brokered POSIX shell execution when a protected snapshot cannot be created, and reject brokerage with `shell_zsh_fork`. Restore real credentials and remove brokerage markers for unsupported PowerShell and Cmd execution; escalated commands bypass protected snapshots.
## Testing
Add regression coverage for credential discovery and redaction, environment filtering, readonly exports, shell function and heredoc replay, command working directories and login modes, sandbox enforcement, and missing or disabled snapshots.
GitOrigin-RevId: 685356cb9e80f11cf69d053e4d239ee6ccf43a9e
## Why
Line-based export parsing can truncate multiline values or mistake their contents for declarations. Snapshot replay also needs to restore Bash options before parsing functions that use extended glob syntax.
## What changed
- Capture shell state, aliases, and complete export records with NUL-delimited boundaries, separating capture, credential preparation, and rendering.
- Apply credential and environment policy to whole exports, preserving multiline values and making credential aliases follow allowed overrides.
- Restore Bash `shopt` options before functions, including for Bash running as `sh`.
- Support non-evaluating POSIX `ENV` path expansion and preserve native environment metadata and unset exports.
- Move core and exec-server snapshot consumers to the shared capture parser. Allow capture overhead while enforcing the exec-server's 512 KiB state-and-environment limit before filtering.
## Testing
Add regression coverage for complete capture records, multiline export filtering and replay, credential alias overrides, `ENV` expansion, and `PATH` export state. Extend exec-server tests to cover Bash-backed `sh`, `extglob`, `nocasematch`, `set -u`, and large environments.
GitOrigin-RevId: 7589ab4d137529a395dcee10b5162718de24a621
## Why
Code-mode callbacks can resume outside the turn's local span ancestry, leaving tool dispatch traces without the thread identity inherited from a turn span.
## What changed
Record `thread.id` directly on the `dispatch_tool_call_with_code_mode_result` span using the session's thread ID.
## Testing
Add a regression test that dispatches a code-mode tool callback from a fresh task without a turn span and verifies that the dispatch span records the thread ID, tool name, and an `exec-` call ID with a valid UUID.
GitOrigin-RevId: a25a0d8fcaf1b6501473151c486fc9940065df91
## Why
Resuming a thread should retain its selected workspace folders, including additional roots and explicit empty selections. Resume overrides also need to survive a subsequent resume when no turn has run.
## What changed
- Persist `runtime_workspace_roots` in startup metadata and thread settings snapshots, separately from explicit environment selections and permission-profile roots.
- Restore roots from the latest snapshot owned by the resumed thread, falling back to owned startup metadata only when no snapshot exists. Honor explicit `runtimeWorkspaceRoots` overrides, retarget the old `cwd` root when `cwd` changes, deduplicate roots, and validate restored paths for the current host.
- Checkpoint effective settings on resume and restored settings after revert. Reload resume configuration if saved workspace roots change during loading.
- Normalize Windows rollout path spellings when matching thread search results, preserving selection of the correct rollout after revert, including compressed rollouts.
## Testing
Add regression coverage for workspace restoration, empty and explicit overrides, foreign paths, compaction and revert, resume checkpoints without recency changes, concurrent settings persistence, and rollout search path matching.
GitOrigin-RevId: d98d9d34dd63934d441120916c61c12b69e7f062
## Why
Enterprise sign-in needs to keep browser completion separate from credential storage so callers can recheck the active account and configuration before saving a grant. Logout must also prevent an earlier sign-in from restoring credentials, including from another process sharing `CODEX_HOME`.
## What changed
- Add enterprise login APIs in `rmcp-client` that return an authorization URL and stage validated credentials for an explicit `commit_if` call. Store grants only in the keyring after rechecking caller authority under the credential lock.
- Require a registered client ID, published metadata matching the configured issuer, HTTP loopback callbacks, a refresh token, and a valid OIDC identity assertion. Request `openid` and `offline_access` with `prompt=consent`, and omit MCP resource indicators from authorization and code exchange.
- Persist a login generation under the credential lock so logout invalidates pending and staged sign-ins across processes, even when no grant is stored.
- Keep credentials and account identifiers out of enterprise error chains and logs, and avoid logging callback payloads when the receiver has closed.
## Testing
Add coverage for discovery validation, loopback callbacks, PKCE, staged keyring storage, cancellation, stale attempts, cross-process logout, and error/log privacy. Preserve ordinary MCP OAuth login without a refresh token, and adjust the terminal polling test deadline to include the minimum empty-poll wait.
GitOrigin-RevId: 2a27b9a26505a2f6fdecce8877f6e2c21e148f72
## Why
Allow v2 memories to build in the background while the selected memory version continues supplying context, and let clients check whether v2 has enough consolidated data and a valid summary to use.
## What changed
- Add `memories.dual_write`, disabled by default, to run v1 and v2 extraction and consolidation concurrently with separate stores and directories.
- Add the experimental `memory/status` endpoint, returning `v2ConsolidatedThreads` and `v2Ready`. Readiness requires a valid v2 summary and a consolidation thread count meeting `minConsolidatedThreads` (default 20, supported range 1–4096).
- Persist the largest thread count from a successful consolidation across pruning and clear it on memory reset.
- Share v2 summary validation between consolidation and status reporting, and tag memory metrics with `memory_version`.
## Testing
Add tests for independent dual-write outputs, preserving existing notes without importing them into v2, and readiness behavior across consolidation ownership checks, missing summaries, configurable thresholds, thread deletion, and memory reset.
GitOrigin-RevId: 54417cc60bf419062401355c0da8c79119995f61
## What changed
- Consolidate v2 rollout summaries into `memory_summary.md` without generating `raw_memories.md` or requiring `MEMORY.md`. Validate the summary's required sections and size below 10,000 UTF-8 bytes.
- Add v2 read instructions for selective history retrieval, evidence-grounded preferences, citations, and explicit memory edits. Split injected instructions into fragments to preserve the complete summary within fragment byte limits.
- Record memory citation usage in the store selected by `memories.version`.
## Testing
Add coverage for v2 consolidation without a handbook, summary validation, version-isolated memory reads, and resetting both memory versions while preserving threads.
GitOrigin-RevId: 1d895fb4a23a973f1a45ba03be07a1f480c10227
andrewgu-oai