- GPT-6.1 Sol is now the default model in the bundled and Amazon Bedrock catalogs. (#49318, #49339)
- Amazon Bedrock supports multi-agent V2 and Ultra reasoning on compatible models; Bedrock Mantle also accepts AWS GovCloud regions. (#49345, #49813)
- Sign in to MCP servers from an active terminal session with `/mcp login <name>`. (#49290)
- Choose your microphone, speaker, and microphone input channels for voice conversations, with preferences saved locally. (#49437, #49836)
- Daybreak is opt-in through `--enable cli_daybreak` or `features.cli_daybreak=true`; `daybreak=true` alone is insufficient. By default, controls and indicators are hidden, `/daybreak` is unavailable, and automatic Cyber routing is omitted—even for saved Daybreak threads. Saved preferences remain intact. Opt-in routing requires eligible ChatGPT sign-in, the OpenAI provider, and advertised model/program support. (#49856, #49858, #49859, #49861, #51207)
- Select a Cyber access program per turn with `codex exec --cyber-access-program` or the TypeScript SDK’s `cyberAccessProgram` option. The explicit exec override remains available with `cli_daybreak` disabled and leaves the saved choice unchanged. (#49939, #51207)
## Bug Fixes
- Approved filesystem escalation can now grant broader write access while preserving denied reads and network restrictions. Background tasks retain their originating turn’s permissions. (#49353, #49880)
- Explicit launch permissions survive terminal reconnects and new sessions, while implicit client settings no longer overwrite server or saved-thread web-search settings. (#49809, #49799)
- Elevated Windows terminal sessions can start using an embedded server, and sandboxed PowerShell preserves relative paths beneath protected user profiles. (#49855, #49690)
- Enter correctly submits buffered input after paste detection expires, including in Vim insert mode. (#49810)
- Thread resume includes the latest committed history. Startup detects recoverable SQLite corruption earlier and preserves damaged databases as backups. (#49599, #49701)
- Responses retries and WebSocket-to-HTTP fallback honor server retry guidance, reducing premature failures during overload. (#49441)
## Documentation
- Authentication guidance now accounts for keyring storage instead of implying credentials always reside in `auth.json`. (#49361)
## Chores
- Publishing an older alpha or hotfix no longer moves npm alpha tags backward. (#49704)
## Changelog
Full Changelog: https://github.com/openai/codex/compare/rust-v0.160.0...rust-v0.161.0
- #49246 Use executable fixture copying in the bundled bwrap test @felixxia-oai
- #49257 Allow Guardian cached approvals with incomplete root context @felixxia-oai
- #49260 Restrict enterprise MCP auth and fail closed on config refresh @nicksteele-oai
- #49261 Preserve Windows sandbox runner launch errors @zm-oai
- #49262 Trace turn phases and correlate accepted input with turns @jif-oai
- #49266 Remove the remote agent message board client README @jif-oai
- #49267 Support remote agent message boards in multi-agent sessions @jif-oai
- #49269 Preserve thread overrides and cloud policy validity during config reloads @nicksteele-oai
- #49275 Isolate realtime conversation tests from Responses prewarm connections @felixxia-oai
- #49276 Enable enterprise MCP sign-in and account-scoped grant cleanup @nicksteele-oai
- #49277 Avoid a turn teardown race in the Guardian agent message test @felixxia-oai
- #49280 Restrict capability roots to captured turn environments @miz-openai
- #49286 Model exec-server session attachment state as an enum @jif-oai
- #49290 Add `/mcp login <name>` to the TUI @nicksteele-oai
- #49294 Record Guardian context mode in review and classification telemetry @felixxia-oai
- #49295 Simplify configuration fingerprint canonicalization @jif-oai
- #49297 Scan the session index backwards for batch thread name lookups @jif-oai
- #49300 Compact the inline hidden tag buffer once per chunk @jif-oai
- #49305 Batch metadata reads when resolving thread names @jif-oai
- #49308 Run piped legacy Windows sandbox processes without a console @etraut-openai
- #49312 Notify parent agents when Guardian stops a subagent @jif-oai
- #49316 Bump taiki-e/install-action to v2.87.21 in CI setup @jgershen-oai
- #49318 Add GPT-6.1 Sol as the default catalog model @andrewgu-oai
- #49325 Retry Windows sandbox runner logon once on error 1056 @zm-oai
- #49330 Keep remote control reconnect backoff capped during sustained failures @yansenzhou-oai
- #49332 Clean up canceled exec-server RPC requests immediately @jif-oai
- #49339 Add GPT-6.1 Sol to Bedrock catalogs and make it the default @celia-oai
- #49345 Enable multi-agent V2 and Ultra reasoning on Amazon Bedrock @celia-oai
- #49353 Allow approved filesystem escalation while preserving denied reads @viyatb-oai
- #49357 Continue Markdown blockquotes when pasting multiline text @bc-openai
- #49360 Carry shell invocation metadata and report executor PATH directories @anp-oai
- #49361 Clarify credential storage wording across authentication UI and docs @celia-oai
- #49369 Update Bedrock GPT-6 Sol catalog tests to expect multi-agent V2 @celia-oai
- #49379 Compile hook matchers during discovery @jif-oai
- #49384 Track credential storage outcomes and redact sensitive errors @celia-oai
- #49388 Fix Windows path inference for opaque URIs with slash prefixes @dkovalenko-oai
- #49389 Serialize tests that share Windows sandbox accounts @jgershen-oai
- #49392 Add attributed MCP OAuth credential storage telemetry @celia-oai
- #49395 Remove randomized greetings from TUI session headers @etraut-openai
- #49401 Preserve live tool-call metadata across request windows @ningyi-oai
- #49403 Add an experimental flag for bundled tools in login shells @anp-oai
- #49406 Support explicit cyber access programs with OpenAI API keys @julee-oai
- #49407 Recover exec-server sessions after environment info timeouts @vivi
- #49408 Compare tool call metadata in the recorder refresh test @euroelessar
- #49411 Bind the app-server time provider to a local variable @euroelessar
- #49414 Filter graceful shutdown guard and trigger traces from SQLite logs @dkovalenko-oai
- #49415 Truncate input text in protocol debug output @dkovalenko-oai
- #49416 Omit payloads from multiline ANSI warnings @dkovalenko-oai
- #49424 Infer Windows UNC paths with forward and mixed slashes @dkovalenko-oai
- #49425 Prune diagnostic logs periodically by age and database size @dkovalenko-oai
- #49426 Enable analytics by default for daemon-launched app servers @bc-openai
- #49432 Preserve bootstrap discovery across authentication changes @cooper-oai
- #49437 Add local audio device selection to TUI voice settings @bc-openai
- #49441 Honor server retry advice across Responses retries and fallback @anp-oai
- #49444 Use `memrchr` to find newlines in reverse JSONL scans @btraut-openai
- #49467 Restore executor tool paths after login shell startup @anp-oai
- #49472 Use server-authoritative permissions in the TUI @etraut-openai
- #49473 Use the rmcp SDK for enterprise-managed token exchanges @nicksteele-oai
- #49475 Complete turn abort callbacks before emitting terminal events @euroelessar
- #49478 Discover and validate MCP authorization servers before ID-JAG exchange @nicksteele-oai
- #49480 Add experimental thread prediction protocol types @keyz
- #49489 Add regression coverage for account switches between analytics batches @anp-oai
- #49517 Add a fork shortcut to the TUI command center @etraut-openai
- #49560 Add an opt-in model catalog to multi-agent context @jif-oai
- #49564 Copy selected file paths as plain text in the TUI @fcoury-oai
- #49584 Skip host skill discovery for Guardian reviews @jif-oai
- #49595 Make the strict network approval test independent of request order @jif-oai
- #49598 Persist explicit user goal edits in model history @felixxia-oai
- #49599 Return authoritative replay history when resuming a thread @felixxia-oai
- #49600 Reuse unchanged history snapshots when resuming threads @felixxia-oai
- #49624 Use server authentication for explicit remote session commands @cooper-oai
- #49642 Allow managed requirements to disable the Windows MXC sandbox @iceweasel-oai
- #49675 Serialize Responses routing fields before large inputs @jbeckwith-oai
- #49678 Escape command drafts when recovering question answers @imac-oai
- #49683 Add a managed feature gate for in-app voice @vishnu-oai
- #49686 Deliver remote message board notifications to active turns @jif-oai
- #49689 Export skill invocation events through OpenTelemetry @jif-oai
- #49690 Preserve PowerShell relative paths in the elevated Windows sandbox @johnl-oai
- #49692 Keep compressed rollout snippet searches on one blocking worker @npancha-openai
- #49693 Move thread history projection into one blocking task @charliemarsh-oai
- #49694 Batch rollout listing scans on cancellable blocking workers @charliemarsh-oai
- #49696 Make exec-server file reads cancellable between chunks @charliemarsh-oai
- #49701 Detect SQLite corruption during startup and preserve recovery backups @dkovalenko-oai
- #49702 Rename exec-server file handle management identifiers @anp-oai
- #49704 Prevent npm alpha dist-tags from moving backward @imac-oai
- #49706 Upgrade the argument comment lint toolchain and Dylint @tamird
- #49708 Move session index I/O off async runtime threads @charliemarsh-oai
- #49710 Classify SQLite corruption using typed error codes @dkovalenko-oai
- #49712 Avoid full-string scans in token-budget truncation @jif-oai
- #49713 Remove repository-local Codex guidance, skills, and environment config @anp-oai
- #49714 Decouple API-key cyber access programs from model discovery @julee-oai
- #49715 Add account security setup reminders to the TUI @dennyku
- #49778 Define exec-server protocol types for streamed file writes @anp-oai
- #49781 Include the environment's MXC backend in MCP sandbox metadata @zm-oai
- #49782 Clean up process groups for failed shell snapshot captures @jif-oai
- #49783 Preserve background thread requests when forking in the TUI @etraut-openai
- #49784 Add a requirements feature gate for the browser annotation API @tepman-oai
- #49785 Persist empty paginated threads when naming them @rd-oai
- #49786 Clarify V2 spawn model override guidance for context catalogs @jif-oai
- #49787 Remove `AGENTS.md` from Bazel core test data @andrewgu-oai
- #49792 Add retained conversation support to Guardian async sampling @felixxia-oai
- #49793 Add conversation mode to Guardian v2 async classification @felixxia-oai
- #49795 Avoid duplicate sync reviews in Guardian classifier continuations @felixxia-oai
- #49796 Deduplicate Guardian retained-context omission notices @felixxia-oai
- #49798 Share cached exec-server environment info with Arc @anp-oai
- #49799 Preserve server web-search settings in the TUI @etraut-openai
- #49800 Allow cleanup of replay-only side conversations with missing threads @bc-openai
- #49801 Update the Rust toolchain action for argument-comment linting @andrewgu-oai
- #49804 Use platform-specific modifier labels in TUI shortcut hints @bc-openai
- #49805 Add capability-gated writable file streams to the exec-server client @anp-oai
- #49806 Accept unknown Codex error variants in the app-server protocol @anp-oai
- #49807 Enable API-key model discovery by default @andrewgu-oai
- #49809 Preserve local launch permissions across TUI sessions and reconnects @etraut-openai
- #49810 Flush expired paste bursts before handling Enter @bc-openai
- #49811 Handle unsupported `fs/writeBlock` requests in exec-server @anp-oai
- #49812 Move shadow skill ranking off the turn preparation path @vkg-oai
- #49813 Support AWS GovCloud regions for Amazon Bedrock Mantle @alexsong-oai
- #49814 Add coordinated shutdown for local agent trees @owenlin0
- #49816 Remove browser-open success messages from the TUI @bc-openai
- #49817 Add an advisory Bedrock GovCloud requirements check @alexsong-oai
- #49818 Use dedicated parameters for sandboxed file opens @anp-oai
- #49819 Recover daemon startup and updater re-exec after cwd deletion @etraut-openai
- #49822 Box the resume future in the agents overview permissions test @sayan-oai
- #49835 Clarify service tier default save errors in the TUI @etraut-openai
- #49836 Allow microphone channel selection for voice conversations @bc-openai
- #49843 Preserve daemon diagnostics and include updater logs in reports @etraut-openai
- #49846 Capture host-supplied extension data for each turn @sayan-oai
- #49847 Persist world-state snapshots alongside rendered context @pakrym-oai
- #49850 Launch Windows daemon children in a dedicated working directory @etraut-openai
- #49852 Improve diagnostics for report attachment failures @dkovalenko-oai
- #49855 Use embedded mode for elevated Windows TUI sessions @etraut-openai
- #49856 Support Daybreak selection in `codex exec` @etraut-openai
- #49857 Use the model catalog to select TUI cyber refusal guidance @etraut-openai
- #49858 Add a persistent `/daybreak` toggle to the TUI @etraut-openai
- #49859 Honor Daybreak settings in TUI continuations and background tasks @etraut-openai
- #49861 Add Daybreak state to the status line and terminal title @etraut-openai
- #49867 Update elevated-launch warning snapshot to use `⌃o` for copy @etraut-openai
- #49874 Point usage and credit links to ChatGPT settings @etraut-openai
- #49875 Decouple TUI startup presentation from execution configuration @etraut-openai
- #49876 Remove personality plumbing from the TUI @etraut-openai
- #49880 Bind permission grants to the originating turn @anp-oai
- #49894 Return world-state snapshots and context updates together @pakrym-oai
- #49898 Scope extension filesystem access to callback permissions @anp-oai
- #49910 Preserve validation errors for invalid TUI keybindings @etraut-openai
- #49912 Respect approval policies in temporary structured threads @etraut-openai
- #49939 Add per-turn Cyber access program selection to exec and the SDK @mldangelo-oai
- #49946 Prevent stale file search results from being labeled with a new query @jif-oai
- #49951 Include preceding assistant context in Guardian sender reviews @jif-oai
- #49956 Cache the placeholder regex for MCP hook argument expansion @jif-oai
- #49959 Test session index thread-name append and removal @jif-oai
- #49972 Share byte buffers across exec-server output chunks @jif-oai
- #49987 Add renewable EMA HTTP authentication and credential versioning @nicksteele-oai
- #49993 Preserve the async Guardian history prefix as retained context changes @felixxia-oai
Add `features.cli_daybreak`, disabled by default, to gate Daybreak controls and automatic access-program selection in the TUI and `codex exec`. Apply the gate to resumed sessions and background task turns, and hide `/daybreak` when disabled. Explicit `--cyber-access-program` overrides remain available.
Extend tests to cover disabled controls, history replay, foreground and background turn requests, exec resume/fork behavior, and explicit access-program overrides with the feature disabled.
GitOrigin-RevId: ae96a4a8c7ab97c619716b9f39ea9f295df6e5a6
(cherry picked from commit 5ad6891696)
## Why
The rolling retained-context window can change as assistant messages are added or evicted. Placing it before the transcript invalidates the reusable history prefix.
## What changed
Move retained user instructions and context after the transcript and action-specific attestations, immediately before the planned action in asynchronous Guardian requests. Keep synchronous section ordering unchanged.
## Testing
Extend the cache-prefix regression test to cover retained assistant message growth and eviction alongside changing attestations. Update app-server and async scorer assertions to verify the new request ordering.
GitOrigin-RevId: 59953d582d4b174ce3e083606626c7532ce0776d
## What changed
- Add `EmaAuthenticatedHttpClient` to cache and renew resource bearers, serialize concurrent renewals, and include authentication time in the request deadline. Confine bearers to the configured MCP endpoint and reject redirects.
- Return authentication-required errors for `401` responses without replaying MCP operations. Preserve a newer cached bearer when a delayed response rejects an older one.
- Add revocable request authority that cancels pending requests and ends response streams.
- Pin enterprise credentials to a persistent version advanced on save or deletion. Use short credential locks and invalidate rejected grants only when their record and version are still current, preserving newer logins.
- Hide keyring account identifiers from enterprise credential errors and traces while preserving authentication failure classification.
## Testing
Add tests for token expiry and renewal, endpoint confinement, redirects, request deadlines, revocation during renewal and streaming, delayed `401` responses, credential replacement and logout races, and credential error privacy.
GitOrigin-RevId: ee3e5cf7ecbba3d09e1ab29ed4fbb2a35eacc60d
## Why
Retaining process output, publishing events, and serving reads cloned the underlying byte buffers. Sharing those buffers avoids copying output bytes when chunks are cloned.
## What changed
Store `ByteChunk` bytes in `Arc<Vec<u8>>` and retain `ProcessOutputChunk` values directly. Add borrowed byte access for the MCP process transport while preserving base64 serialization and owned byte extraction through `into_inner()`.
## Testing
Add a unit test covering base64 serialization, deserialization, and independent owned bytes extracted from shared chunks.
GitOrigin-RevId: 6bba114af48424aa844487aa75163cfc604e0575
## What changed
Add a test that appends an original and updated name for one thread alongside another thread's entry. Verify that lookup returns the updated name and that removing the first thread's name entries leaves only the other thread's entry.
GitOrigin-RevId: cedf260a639f0c0e76aeda0d446559c3821bd911
Use `LazyLock` to compile the placeholder regex once and reuse it across
argument strings, avoiding repeated compilation during template expansion.
Preserve regex error propagation and placeholder substitution behavior.
GitOrigin-RevId: 2ac8aec86de3430335c068e47d09422dcd276f7c
## Why
Short sender replies such as `👍` need preceding assistant context to be understood during a delegation review. User messages alone omit that context.
## What changed
- Capture preceding assistant context alongside up to three recent sender user messages at delivery, for Guardian only. Label assistant messages as untrusted context rather than authorization or verified questions.
- Share the existing 900-byte budget per exchange, prioritize user evidence, and report unavailable assistant context.
- Recognize `cloud_threads.send_message` deliveries and accept both compact and indented delegation envelopes.
## Testing
Expand integration coverage for app, TUI, and cloud-thread deliveries, contextual replies, and budget-driven omissions. Assert that sender user and assistant context stays out of the delegated agent's prompt.
GitOrigin-RevId: 4eca369cbb30241635273f729dec81b78ea57faf
## Why
The asynchronous matcher can return results for the previous query while a new query is still running. Labeling those results with the latest query produces a mismatched search snapshot.
## What changed
Only report a file search snapshot when its pattern atoms match the currently requested pattern. Extract snapshot conversion into `snapshot::for_query`, which skips pending results from an older pattern.
## Testing
Add a regression test that changes the query from empty to `bet`, verifies that the old snapshot is withheld, and checks that the completed snapshot contains `beta.txt` with the expected match indices and counts.
GitOrigin-RevId: 01b62b822db69e15480d3233b66ec55c45646fad
## Why
`codex exec` and the TypeScript SDK need a way to request a Cyber access program for an individual turn. Resuming with an API key can also leave compaction using a saved program that the current credentials cannot access.
## What changed
- Add `--cyber-access-program` with `standard`, `daybreak_blue`, and `daybreak_red`, and expose the equivalent `cyberAccessProgram` turn option and `CyberAccessProgram` type in the TypeScript SDK.
- Apply explicit selections to new, resumed, and prompted fork turns. Override automatic Daybreak selection for that turn without changing the saved choice. Reject the flag for review and forks without a prompt.
- Filter Cyber programs by the built-in OpenAI provider when starting turns and restoring previous-turn settings for compaction.
- Allow previous-model compaction fallback with API-key authentication, comparing both model and program so a program change can trigger a retry with the current pair even when the model is unchanged.
## Testing
Add CLI help, argument parsing, exec, and SDK coverage for per-turn selection and unsupported commands. Extend core tests for API-key compaction retries, denied explicit selections, custom-provider filtering, remote compaction, and WebSocket response reuse.
GitOrigin-RevId: 586f25b621924f3bc509c9a39b39fe2020ff9cd2
## Why
Forcing `approval_policy` to `never` on temporary structured threads can trigger configuration warnings when managed requirements allow only `on-request`. These hidden threads also need to reject unexpected interaction requests without prompting the user.
## What changed
Inherit the app server's approval policy when starting temporary structured threads. Reject their server requests before dynamic tool handling or interactive TUI routing.
## Testing
Extend regression tests to verify inherited `on-request` approval without approval-policy warnings, and error responses for recap-thread approval and user-input requests even when the thread is marked active and primary.
GitOrigin-RevId: 2d0a071d3687742c83ba933a7ef1357feea53403
## Why
Deserializing keybindings through an untagged enum hides the specific validation error, making invalid `tui.keymap` settings harder to diagnose.
## What changed
Deserialize single keybinding strings and lists by value type so validation errors reach the user. Errors now retain the reason a binding is invalid and the affected configuration key, including when loading configuration for `codex mcp list`.
## Testing
Add TOML regression tests for unknown keys, invalid chord strokes, and overly long chords in both string and list forms. Add a CLI snapshot test verifying that `codex mcp list` reports the invalid keybinding reason and configuration key.
GitOrigin-RevId: 26e3dea93fc43db21e993ea5cf93df53ce93a43e
## Why
Executor skill reads need to use the environments and permissions captured for the current step, including newly approved grants. Cached continuation pages must remain bound to the filesystem and permissions that produced them.
## What changed
- Supply borrowed `EnvironmentAccess` to turn-input contributors and extension tools, with session and originating-turn grants already applied.
- Require executor skill reads to use filesystem access from an environment available to the callback, and replace separate optional read contexts with `SkillReadContext`.
- Bind skill pagination snapshots to `EnvironmentAccessKey`, which identifies the source filesystem and callback permissions.
- Route image-generation filesystem operations through the same accessor.
## Testing
Extend skill-read integration coverage to verify that a denied reference becomes readable after a turn-scoped grant is captured by the next model step. Update Windows coverage to verify that restricted reads fail when the executor cannot enforce a sandbox, and add a test requiring turn environment selection before exposing capability roots.
GitOrigin-RevId: 825b49302319965835d61c77fc5bcdb951e10543
## What changed
Replace the separate `WorldStateSection::snapshot` method with a typed `SectionTransition` returned by `render_diff`. Snapshot updates and model-context fragments are independently optional; omitting a snapshot preserves the stored comparison state.
Update all section implementations to use this contract, skip snapshot updates for unchanged sections where applicable, and cache the multi-agent usage-hint fingerprint.
## Testing
Adapt world-state and context-history tests to the combined return value, including an assertion that unchanged permissions return neither a snapshot nor a context fragment.
GitOrigin-RevId: 79c1977a87481009ff193ea4cce4546be87458fe
## Why
Background code-mode cells can continue running after a new turn starts. Looking up grants and strict review requirements through the active turn can make those cells lose their approved access or use another turn's permissions.
## What changed
- Keep turn-scoped grants and strict review state in `TurnContext`, retained by captured steps and background cells.
- Record permission responses against the requesting turn, including requests made after a later turn starts.
- Share live session-scoped grants across turns while keeping turn-scoped grants isolated.
- Use the originating turn's permissions and review requirements for tool execution, patches, MCP calls, file uploads, and terminal input.
## Testing
Add regression coverage for background cells retaining grants across turn changes, turn versus session scope, permission requests after the next turn starts, and strict review enabled while `write_stdin` is queued.
GitOrigin-RevId: 641502fbfd43553c2c42424d4aaa53ae8020c850
## What changed
Remove personality from TUI turn commands and cached thread session state, and stop applying personality from thread settings notifications. Send no personality override in `turn/start` requests.
Forward `personality` through session configuration only when explicitly supplied as a CLI override, rather than deriving it from the effective local configuration.
## Testing
Extend configuration override coverage to verify that `personality = "none"` is forwarded only when supplied through CLI overrides.
GitOrigin-RevId: bd3c3bacc90e0561016c0cac557eb1b0e50d32c0
## Why
Startup presentation needs client preferences before thread initialization establishes effective execution permissions. The startup header should not infer permission state from local configuration.
## What changed
- Load `LocalSettings` directly from bootstrap TOML, preserving preference defaults and overrides, accessibility settings, and audio settings that exclude project layers.
- Use those settings for first-frame presentation and pass `LocalSettings` plus the working directory to the startup draft instead of a full `Config`.
- Stop showing the YOLO indicator in the startup header while execution permissions are unknown.
## Testing
Update tests to compare bootstrap settings with resolved configuration, verify first-frame keybindings and paste preferences with an unresolved permission-profile parent, and snapshot the configured startup header. Adapt startup editor tests to the settings-based interface.
GitOrigin-RevId: f33cf8f42c53a9ddcbe0273491b5a849da9e6808
## What changed
Replace `https://chatgpt.com/codex/settings/usage` with
`https://chatgpt.com/settings/usage` in usage-limit errors, the `/status`
card, and backend banner actions. Credit purchase actions retain
`?credits_modal=true`.
## Testing
Update error-message assertions, banner action tests, status hyperlink
assertions, and TUI snapshots to expect the new URL.
GitOrigin-RevId: 1e1db971284a25a781120da30a6dea5ff9c3d957
## What changed
Add a selectable `daybreak` item to the status line and terminal title, including setup previews and terminal-title validation. Display `Daybreak on` when enabled for the thread and `Daybreak off` otherwise, including during side conversations.
## Testing
Add coverage for on/off rendering and side conversations, update setup preview snapshots, and verify that terminal-title diagnostics accept `daybreak`.
GitOrigin-RevId: b0b7a6f0ee0a107ba4ee2d56113a5b9b6ebd1d41
## Why
Cyber-policy refusal guidance did not distinguish whether Daybreak was on or off, and policy continuations and background task turns omitted `cyberAccessProgram`.
## What changed
- Show refusal guidance for the current Daybreak setting and offer eligible users an “Enable Daybreak” picker for their next request. Persist the selection without automatically retrying the refused request, and suppress the picker during history replay and when viewing parent-owned threads.
- Select and validate the cyber access program for policy continuations and background task turns using account eligibility, model support, and the thread's Daybreak setting.
- Resolve new background threads' Daybreak defaults from effective configuration unless launch flags or a selected profile explicitly override them. Use the target thread's saved setting for follow-up messages.
## Testing
Add unit, snapshot, and request-recording coverage for refusal guidance, picker behavior, continuation access programs, and background tasks retaining Daybreak after configuration changes.
GitOrigin-RevId: 94dee39c067e8eea5791cb31d5fe65fc600e5a18
## What changed
- Add `/daybreak` with account-aware help and availability messages for broader access for cybersecurity work.
- Save the selection in thread metadata and the `daybreak` default for new threads, restore it on resume, and confirm that it applies to new turns.
- Select `cyberAccessProgram` from the connected server's model catalog. Require a signed-in ChatGPT account, the OpenAI provider, and confirmed model support when Daybreak is enabled, including for faster-model retries. Keep Daybreak disabled for side conversations.
## Testing
Add tests for toggle persistence, turn access-program selection, unsupported-model rejection, side-conversation behavior, command help, and the resumed-thread banner.
GitOrigin-RevId: e3c028b0a6a8e0a862c16fdc766f374aae618ef1
## What changed
Select cyber refusal notices from the current model's `available_access_programs` for ChatGPT accounts using the OpenAI provider. Show Astra-specific guidance only when an Astra model offers standard cyber access without Daybreak access, and use the limited notice when Daybreak access is available. Otherwise, show application guidance.
Remove the separate account eligibility request, background prefetching, and notice cache.
## Testing
Update tests to cover catalog-based notice selection, missing model metadata, isolation from other models' access programs, and rendering the application notice for a cyber policy error.
GitOrigin-RevId: 88e9522bd6ece2d2b9caa6cff01a4178768babb7
## What changed
- Add the `daybreak` configuration key, defaulting to `false`, with per-invocation overrides such as `-c daybreak=true`.
- Resolve access programs from the model catalog, preferring `daybreak_blue` over `daybreak_red` when enabled and selecting advertised `standard` access when disabled for signed-in ChatGPT accounts. Require the OpenAI provider, a signed-in ChatGPT account, and a compatible model to enable Daybreak.
- Save the choice for new persistent threads and inherit it on resume and fork, including ephemeral forks. Explicit CLI overrides apply only to the current invocation.
## Testing
Add protocol tests for advertised-program selection and exec integration tests for account and provider restrictions, saved choices, ephemeral forks, and invocation-only overrides.
GitOrigin-RevId: ac955f08b5a891e720cfc5f67fabb7b0f6d32bb8
## Why
The Windows shared daemon rejects elevated launches so shared clients cannot inherit administrator privileges. Local TUI sessions launched as administrator should still be able to start.
## What changed
Select embedded mode before daemon discovery or startup for elevated local Windows sessions. Show a startup warning explaining that the shared background server is disabled and that restarting Codex in a non-elevated terminal enables it. Record `elevated_windows` as the server selection reason.
## Testing
Add Windows integration coverage for elevated normal, `resume`, and `fork` launches without creating daemon directories, and verify that explicit daemon `start` and `restart` still reject elevation. Add a snapshot test for the startup warning in the warning center.
GitOrigin-RevId: 89594e86d6ee19b080dfb11553cee8676395f188
## Why
Skipped report attachments lacked diagnostic logs, and upload failures logged only the HTTP status. Transport error strings can also contain credential-bearing URLs.
## What changed
- Log why attachments are skipped, including missing rollout files, non-regular files, size limits, rate limits, and upload deadlines.
- Log attachment failures at error level with the error chain and available HTTP status.
- Replace `RouteAwareRequestError` details with the failure class and timeout, connection, request, and body flags before logging, avoiding credential-bearing transport URLs.
GitOrigin-RevId: 1bfd1cc74137ea83d05098e9dbf58ed7b62385cc
## Why
Windows processes hold their working directory open for their lifetime, and sandbox setup may broaden its ACL. Managed children should avoid pinning the launching project's directory or changing permissions on the private daemon state directory.
## What changed
Create a `workdir` subdirectory alongside the PID files and use it as the working directory for both the managed app-server and updater on Windows.
## Testing
Add a Windows regression test covering both managed children. It verifies that relative files land in `workdir`, the state directory still passes private-directory validation, and stopping each child removes its PID file.
GitOrigin-RevId: 12ca95463ff3c80899a5b1a8800fead849f48017
## What changed
Return snapshots and model-visible fragments together from world-state rendering, and use those snapshots for history baselines, step updates, compaction, and new context windows.
Update `WorldStateSectionContribution` so its renderer returns an optional replacement snapshot and an optional fragment. A missing snapshot preserves stored section state, even when retained history requires a fresh render; a null snapshot removes the section. Derive step patches from the history baseline rather than a separately captured live world state.
Adapt skills and Git attribution contributors to the new contract.
## Testing
Add coverage for skipped snapshot updates, explicit section removal, changed-state patch replay, unchanged-state deduplication, and matching live and persisted checkpoints when starting a new context window.
GitOrigin-RevId: af71606a278358ae937853cb76e8a019a501408e
## What changed
Add `turn_extension_init` to thread startup and settings, and expose `WithTurnExtensionData` for turn input, recovery, and settings requests. Accept or reject data updates together with the request that supplies them.
Each new turn captures the configured data, including automatically started turns. Accepted steering updates the data for future turns while preserving the running turn's capture. Plain requests preserve the configured data; an empty initializer clears it. The data is not persisted and must be supplied again on cold resume.
Expose `current_turn_extension_data` to retrieve typed data only when the requested turn is still running and has not been cancelled.
## Testing
Add an integration test covering initial capture, accepted and rejected steering, inheritance by an automatic turn, clearing future data without changing the active capture, and rejection of lookups for an earlier turn.
GitOrigin-RevId: dd81eda3e32c7b62d783c772221858f4c0e68264
## Why
Detached launches truncate stderr logs, losing details from previous failures. Updater handoffs can also leave existing writers with stale offsets after truncation.
## What changed
- Record daemon lifecycle and update stages with timings, outcomes, and typed OS errors, omitting error messages and context.
- Preserve the last 256 KiB of nonempty stderr logs before truncation and use append handles to prevent gaps during handoff. Preservation failures do not block launch.
- Attach current and previous updater log tails when log inclusion is enabled for a report, with a 512 KiB total limit and legacy filename fallback. Skip missing, empty, and nonregular files.
## Testing
Add regression coverage for diagnostic error redaction, bounded log preservation, append behavior during handoff, attachment selection, and updater logs in captured report uploads.
GitOrigin-RevId: 918317022ab9dcfd1b13d676872706c77e9ffbb2
## Why
Mixing every input on a multichannel audio device can include playback channels in microphone capture. Selecting only microphone inputs keeps those playback channels out of the captured audio.
## What changed
- Add `audio.microphone_channel` with one-based channel numbers, accepting a single value or an array such as `[1, 2]`. Leaving it unset preserves mixing of all inputs.
- Add an input-channel picker for the selected microphone when it has at least three channels. Require a nonempty selection and save it locally for the next voice conversation.
- Average only the selected channels, deduplicate selections, and reject empty or unavailable selections without falling back to other inputs.
- Clear saved channel selections when saving an input device and report configuration overrides that prevent the reset from taking effect.
## Testing
Add regression coverage for excluding playback channels, sample conversion, subset mixing, invalid selections, configuration loading, local persistence and overrides, and picker selection and cancellation. Update UI snapshots and verify channel selections are passed to the voice helper.
GitOrigin-RevId: 99960dcfa7b10cf38270768a90bb84a4be95a406
## Why
When saving the default service tier fails, users need the underlying configuration error and guidance on how to retry without interrupting their task.
## What changed
Format the error with `format_config_error` and explain that the task can continue. Tell users to resolve the error, then switch to a different tier and back to the desired tier to retry saving the default.
## Testing
Add a snapshot assertion for a rejected service tier save caused by malformed configuration, covering the detailed error and recovery guidance.
GitOrigin-RevId: d666f7915f185d219396d24034412b175c49173e
## Why
Managed daemons and updaters can outlive their launching directory. Restarts and updater replacement need to keep working after that directory is removed.
## What changed
- Share working-directory preparation between background launches and Unix updater re-execution. Fall back to the daemon state directory when the Unix working directory is missing, while retaining usable working directories and the existing Windows state-directory behavior.
- Preserve configured `CODEX_HOME` paths and valid symlink aliases, and make certificate and AWS environment paths absolute before launching children. Handle both `npm_config_cafile` and `NPM_CONFIG_CAFILE`, preserving supported home-relative values.
- Log warnings when scheduled daemon updates fail.
## Testing
Add Unix regression coverage for restarting the daemon and updater from a deleted working directory, and for updater re-execution with preserved environment paths, `CODEX_HOME` symlink aliases, and a Linux non-Unicode home path.
GitOrigin-RevId: f45aefd8ff060adc6e025badf0bb8c81f842bf88
## What changed
Add `FsHelperOpenParams` with only a `path` field and use it for the exec-server filesystem helper's `fs/open` requests. Replace reuse of `FsReadFileParams`, removing unused read-file options from the open request type.
GitOrigin-RevId: ca84447d06fbf391cc5ad189ac6c46e6aeaa1f63
## What changed
Add the experimental `account/bedrock/checkGovCloudRequirements` RPC so clients can check the active Bedrock configuration after login or setup. It returns `isGovCloud` and `shouldWarn`, warning for GovCloud when managed requirements lack API-only login or enabled application network restrictions with an explicit allow entry for the active endpoint domain.
Reload configuration and requirements on each check while preserving the current session's authentication. Official Bedrock endpoint hostnames determine the region; otherwise, resolve it using the current authentication state. Non-Bedrock providers and commercial regions return both fields as `false`; configuration and region resolution failures return RPC errors. The check is advisory and does not block login or certify the entire network configuration.
## Testing
Add integration coverage for configuration and requirements updates without a restart, login changes, unreadable saved credentials, Mantle and Runtime endpoints, custom proxies, official endpoint region precedence, and invalid requirements.
GitOrigin-RevId: 24bfa91326cf5c73ada176c47351445de91b60a0
Stop adding an informational message to chat history when `open_url_in_browser` succeeds. Continue displaying an error when opening the browser fails.
GitOrigin-RevId: 28d33917c1a2e354017470e785e44aa0032c3b46
## What changed
Expose `ThreadManager::request_agent_tree_shutdown` and an `AgentTreeShutdown::wait` handle. Requests reject new starts in the shared runtime, cancel pending startup, and signal every session in that tree, including delegates outside the thread registry. Waiting covers admitted operations and session teardown, and reports cleanup or persistence writer failures. Other root trees remain unaffected; registry removal and persistence handoff remain caller responsibilities.
Retain tree membership through startup, cancelled spawn cleanup, residency eviction, and completion watchers. Release persistence resources before returning startup failures, and stop completion watchers during tree shutdown without reporting shutdown as a child result.
## Testing
Add coverage for tree isolation, children removed from the registry, delegate teardown, cancellation during required MCP initialization, aborted teardown, persistence writer failures, and successful retry after a failed resume releases its writer.
GitOrigin-RevId: a109e25adf23d20baf7595891099947050c6b6b5
## Why
Codex rejected `us-gov-east-1` and `us-gov-west-1` as unsupported Amazon Bedrock regions.
## What changed
Accept both GovCloud regions and construct their regional Bedrock Mantle endpoint URLs.
## Testing
Extend the endpoint URL unit test to cover both GovCloud regions alongside the existing `ap-northeast-1` case.
GitOrigin-RevId: ef9ca83fa7b73af1df100fcae722e24edac38643
## Why
Shadow skill selection runs synchronously during turn input construction, making turn preparation wait for experimental rankings.
## What changed
Run ranking on background blocking workers with a process-wide limit of two concurrent rankings. Wait for capacity in the background and hold each slot until its blocking worker finishes, even if the async evaluation is cancelled.
Freeze catalog, query, and relevance history at turn start. Record eligible invocations immediately for future turns, then score queued observations against the frozen rankings once they are ready, including observations queued before the turn state is dropped.
## Testing
Add tests for turn preparation and history updates while ranking is blocked, deferred invocation scoring against each turn's history, and shared ranking capacity that remains occupied until cancelled workers finish. Update existing metric assertions to collect asynchronous observations across snapshots.
GitOrigin-RevId: f7776e9aaeb45d3a792de167abbe35f7ec5a513e
## What changed
Register `fs/writeBlock` and require filesystem initialization before handling it. Validate the file handle ID, then return an invalid-request error stating that writable file streams are unsupported.
GitOrigin-RevId: 13440e497a88ca6505ee60d95bbb771d3cae06b8
## Why
Without a UI flush tick, expired paste detection can cause Enter to be treated as part of a paste instead of submitting buffered input.
## What changed
Flush due characters and paste buffers before classifying Enter during submission, including in Vim insert mode. Preserve the buffered text when submission is blocked for a parent-owned thread.
## Testing
Add regression tests for held characters and buffered bursts with and without Vim mode and parent-owned threads, plus a snapshot test for Enter submitting expired input in Vim insert mode.
GitOrigin-RevId: 1d0d309b57e9d2151e0d9c1774a3401d05413d3c
## Why
Explicit launch permissions such as `--yolo` can be lost during reconnect recovery, causing subsequent input to use different approval and sandbox settings.
## What changed
Remember explicit local launch approval policies, approvals reviewers, and permission profiles at startup and when creating new sessions. Restore the approvals reviewer independently of profile overrides during reconnect recovery. Keep constrained profiles that cannot be expressed through legacy turn parameters under server control.
## Testing
Add regression coverage for `--yolo` across new sessions and reconnects, later permission-picker choices, reviewer-only overrides, and server-owned constrained profiles. Extend the reconnect integration test to submit the preserved draft and verify its approval and sandbox settings.
GitOrigin-RevId: 7a77dc41b2a357ab17fec9ba6cb2361f4a8f4aa5
## What changed
- Mark `api_key_model_discovery` as stable and enable it by default, while preserving explicit user opt-outs and provider catalog requirements.
- Fall back to bundled models when discovery is disabled at runtime, including when a remote catalog has already been loaded.
## Testing
Extend model-list coverage for default enablement, app overrides, and user configuration precedence. Add a regression assertion that runtime opt-outs hide loaded catalogs without additional fetches, and update daemon compatibility tests for the new default.
GitOrigin-RevId: feaf732757792cc58063f21a5327d0e633f079f4
## Why
New error variants should not prevent older clients from handling app-server errors.
## What changed
- Deserialize unknown `CodexErrorInfo` strings and objects as `Other` in Rust, while preserving known variants and the `"other"` serialization.
- Allow arbitrary strings and objects in the exported JSON schemas and TypeScript type.
- Update Python SDK generation and generated models to accept unknown error strings and object payloads.
## Testing
Add Rust tests for `"other"` round trips, unknown string and object fallbacks, known structured variants, and rejection of null, boolean, numeric, and array values.
GitOrigin-RevId: 40c17896019924b2ef7970ee2205ea0154d0d1b3
## Why
Older executors can ignore the file open mode and silently return a read-only handle for a writable open.
## What changed
Add `ExecServerClient::fs_write_block` and require the `file_write_streaming` capability for both block writes and `FsOpenMode::Replace` opens. Return a protocol error before sending either request when the executor lacks support, while allowing read-only opens.
## Testing
Add a WebSocket regression test verifying that unsupported writable opens and block writes are rejected locally and read-only opens still reach the executor.
GitOrigin-RevId: f206e1da80c12af76ead14c75f8ffe71f82cce89
## What changed
Render Control, Shift, and Alt as `⌃`, `⇧`, and `⌥` on macOS, and Control as `^` on Linux. Keep textual modifier labels on other platforms.
Route hard-coded shortcut hints through the shared key-label formatter so footers, overlays, pickers, and transcript notices use consistent notation.
## Testing
Update modifier-combination and chord label assertions, along with rendering snapshots and narrow-layout expectations for the shorter hints.
GitOrigin-RevId: 0d20fa218e4a11dfe7a81c8de64f8d25e093af03
## Why
A saved side conversation transcript can outlive its ephemeral server thread. The resulting `turn/interrupt` error prevented side conversation cleanup and blocked archiving the parent thread.
## What changed
Treat the specific `thread not found` interrupt error as successful interruption for replay-only side conversations, allowing unsubscribe and local cleanup to finish. Continue sending interrupt requests because replay-only conversations may still be running after reconnect.
## Testing
Expand archive lifecycle coverage for local daemon and remote server connections to include live side conversations, replay-only conversations with existing threads, and replay-only conversations whose threads are gone. Assert that interruption, unsubscribe, archiving, and local cleanup occur.
GitOrigin-RevId: 0528c9f5b5278931fd3a7941073071117f2f3612
## Why
The TUI unconditionally forwarded its resolved `web_search` mode, allowing implicit client settings to replace server defaults or saved thread settings.
## What changed
- Forward `web_search` on thread start, resume, and fork only when the winning choice comes from session flags or a selected profile.
- Translate legacy search feature flags into a canonical `web_search` override while preserving precedence, and remove those flags from forwarded feature overrides.
- Honor shared feature requirements for embedded sessions while letting remote servers enforce their own requirements on explicit search choices.
## Testing
Add coverage for configuration origins, canonical and legacy search precedence, and embedded versus remote feature requirements. Extend the Responses integration test to verify that a remote server's live search setting survives thread start and resume when the client's configuration disables search.
GitOrigin-RevId: c714f9cf0321aca9a5fa292a350720af5a2d02d4
## What changed
Return `Arc<EnvironmentInfo>` from `ExecServerClient::environment_info()` so repeated reads and cloned clients share cached metadata without cloning its contents. Wrap metadata from initialization and lazy RPC fetches in `Arc`, while preserving the owned return value in `LazyRemoteExecServerClient`.
## Testing
Extend the cache test to assert pointer identity across cloned clients for both initialization-provided metadata and lazy fetching after connecting to a legacy server.
GitOrigin-RevId: 3f56f4d51a4aebc0c4821c0b128a70efb23933d4
iceweasel-oai