- Open `/config` to search preferences across categories, change supported settings immediately, and see which changes require a restart. (#52990, #53429)
- Send a follow-up while Codex is responding to steer it immediately. Interrupting a turn also stops active Code Mode cells and their nested tool calls. (#51812, #51835)
- Configure a leader key in `/keymap`. The default is `Ctrl+X`, shortcut hints stay open until you choose or cancel, and voice mute moves to `F9`. (#52273)
- Restart a managed background server from `/daemon`. Codex warns about work the restart could interrupt, then reconnects automatically. (#53173)
- Codex can run independent read-only tools in parallel, including skill, memory, and conversation-history lookups. (#52245)
- Daybreak is enabled by default for eligible accounts. `codex exec` can also select it with an OpenAI API key when the server offers access. (#53701, #53717)
## Bug Fixes
- Resuming a saved thread restores its permissions and network approvals, while respecting explicit overrides and current managed policy. (#53150, #53419, #53424)
- The network proxy now checks permission before a DNS lookup, rejects duplicate `Host` headers, and prevents credential aliases from bypassing inspection hooks. (#51650, #52661, #53506)
- Return to an existing side conversation with `/side` after switching threads. Answers to pending prompts also go back to the thread that asked. (#52184, #53436)
- On Windows, `Ctrl+V` and `Shift+Insert` paste text as well as images. On WSL, repeated pastes reuse the clipboard reader, and copy attempts time out instead of hanging. (#53224, #52967, #53453)
- Local commands finish promptly when a child keeps an output pipe open. Remote commands preserve late-arriving output so the final poll can still collect it. (#52652, #53331, #53622)
- `codex exec` no longer prints the same file diff again after an unrelated command. (#53444)
## Documentation
- Updated the bundled OpenAI Docs guidance for migrations to the GPT-6 family, including model-specific reasoning, tool use, and data residency considerations. (#51768)
- Clarified how the Linux sandbox uses bubblewrap for filesystem isolation and seccomp for syscall filtering. (#52610)
## Chores
- Codex now uses its standard shell executor and no longer bundles a patched `zsh`. Configurations using the retired shell flags receive a migration notice. (#52160, #52213)
- Reduced Linux and macOS release package size by stripping symbols from packaged binaries while preserving them in the original build outputs. (#52178)
## Changelog
Full Changelog: https://github.com/openai/codex/compare/rust-v0.162.0...rust-v0.163.0
- #51539 Add completion-aware realtime attachment and session-scoped detach @zahan-oai
- #51547 Add a Windows MXC sandbox opt-out @iceweasel-oai
- #51556 Complete dynamic tool lifecycles on cancellation @mikelam-oai
- #51575 Expose package assembly helpers and support gzip DotSlash artifacts @bolinfest
- #51595 Add thread ID exclusions to `thread/list` @btraut-openai
- #51602 Distinguish thread listing failures from exhausted history @btraut-openai
- #51611 Signal abandonment of unanswered MCP elicitations @nicksteele-oai
- #51627 Stabilize Guardian snapshot prefixes by separating assistant context @jif-oai
- #51642 Fix retained context handling for typed section content @jif-oai
- #51650 Require hostname authorization before proxy DNS lookups @jif-oai
- #51651 Persist Guardian review failures for reports across restarts @jif-oai
- #51652 Record telemetry for AGENTS.md changes made by apply_patch @jif-oai
- #51678 Move Windows sandbox tests into a dedicated integration binary @jif-oai
- #51683 Roll back stale Guardian reviews before reusing reviewer history @olliem-oai
- #51689 Wait for helper completion in HTTP header cancellation tests @jif-oai
- #51690 Add a feature flag for Code Mode tool description ordering @swastik-oai
- #51704 Honor tool-description-first ordering in Code Mode @swastik-oai
- #51710 Fix a discovery race in the external auth refresh test @jgershen-oai
- #51734 Load persisted sender context for Guardian reviews @jif-oai
- #51755 Reuse MCP handler metadata for cache comparisons @owenlin0
- #51761 Reduce tool metadata cloning in the code-mode runtime @akira-oai
- #51768 Expand OpenAI Docs migration guidance to the GPT-6 model family @kkahadze-oai
- #51775 Prevent recursive Tokio tracing in telemetry and SQLite logs @zbarsky-openai
- #51786 Preserve sandbox overrides across execution requests @iceweasel-oai
- #51794 Advertise Ultrafast for GPT-6.1 Sol on Amazon Bedrock @celia-oai
- #51800 Remove duplicate field initializers in extension registry tests @anp-oai
- #51808 Preserve diagnostic reasons for MCP user verification failures @berkdeniz-oai
- #51812 Enable instant interrupts by default @pakrym-oai
- #51819 Migrate the MXC sandbox to the 1.0.0 SDK @iceweasel-oai
- #51822 Avoid sharing violations when repairing Windows runtime ACLs @johnl-oai
- #51823 Share MCP binding tool metadata with prepared calls @owenlin0
- #51828 Add policy-based file contents integrity checks @iceweasel-oai
- #51831 Add MXC sandbox integrity dependency and policy preparation @iceweasel-oai
- #51835 Enable code mode interruption by default @won-openai
- #51840 Add a bubblewrap backend for sandbox integrity checks @iceweasel-oai
- #51841 Add a macOS Seatbelt backend for sandbox integrity @iceweasel-oai
- #51842 Add a sandbox integrity runner with outcome and timing metrics @iceweasel-oai
- #51843 Run sandbox integrity checks before commands and filesystem operations @iceweasel-oai
- #51847 Preserve Cargo package names in Bazel Rust builds @dkovalenko-oai
- #51848 Align Bazel release builds with Cargo and fix platform compatibility @dkovalenko-oai
- #51849 Fix package smoke tests for Cargo and Bazel debug symbols @dkovalenko-oai
- #51850 Add Bazel release staging archives @dkovalenko-oai
- #51855 Add Bazel support to the Codex package build action @dkovalenko-oai
- #51856 Build Bazel release artifacts alongside Cargo artifacts @dkovalenko-oai
- #51857 Add an app-server prompt prefix compatibility test @jif-oai
- #51865 Use readable plugin mentions without suppressing same-name skills @canvrno-oai
- #51866 Preserve line breaks and links in multiline async questions @pash-openai
- #51868 Record tool registration metrics for each sampling request @akira-oai
- #51872 Keep global app-server config independent of the launch directory @etraut-openai
- #51884 Add experimental prediction forks that inherit parent context @liame-oai
- #51890 Add the missing `mxc-sdk` UTF-8 resource patch for Bazel @iceweasel-oai
- #51892 Preserve tool call completeness when recorded arguments are truncated @ningyi-oai
- #51893 Record metrics for incremental tool updates @akira-oai
- #51895 Report specific reasons for WebSocket continuation failures @pakrym-oai
- #51896 Preserve native errors in Windows sandbox ACL diagnostics @alishobeiri-oai
- #51897 Use a dedicated matcher for network domain policies @rafael-oai
- #51908 Honor the user input setting for asynchronous questions @mandal-OAI
- #51930 Support model-specific function description prefixes @tz-openai
- #51963 Attribute compaction analytics to the correct voice session @reia-oai
- #51974 Log Windows sandbox availability and backend selection @iceweasel-oai
- #52034 Preserve agent state when unloading idle multi-agent v2 children @jif-oai
- #52040 Add regression coverage for cancelled agent reloads @jif-oai
- #52048 Cover instant interruption in steered-input persistence tests @jif-oai
- #52061 Run Guardian conversation classifiers concurrently and preserve action order @felixxia-oai
- #52062 Add scenario coverage for worker context across idle eviction @jif-oai
- #52065 Require assessment text in the Guardian parser @ioanbudea-OAI
- #52081 Fix idle cleanup for disconnected multi-agent v2 children @jif-oai
- #52119 Expose originating tool call metadata in command environments @leo-oai
- #52160 Remove the patched zsh shell execution backend @jif-oai
- #52164 Make environment context date and timezone configurable @surajs-oai
- #52176 Show AWS GovCloud guidance at startup and remember acknowledgment @jackz100
- #52177 Set a User-Agent for package archive downloads @bolinfest
- #52178 Strip symbols from source-built release package binaries @bolinfest
- #52182 Expose a verified sandbox launcher to local MCP servers @bolinfest
- #52183 Add optional descriptions to agent message board channels @jif-oai
- #52184 Preserve side conversations across thread navigation @etraut-openai
- #52193 Enforce managed MXC requirements on Windows @iceweasel-oai
- #52195 Track source attribution for individual context parts @tz-openai
- #52200 Allow plugin toggles while searching and preserve filters on refresh @fcoury-oai
- #52203 Expose Codex lifecycle status in iTerm2 sessions @fcoury-oai
- #52213 Stop bundling patched zsh in Codex packages @jif-oai
- #52215 Enforce application network policy in standalone MCP commands @lsingh-oai
- #52220 Add configurable default plugin activation policy @stevenlee-oai
- #52223 Enforce application network policy for daemon updates @jackz100
- #52225 Fix config rebuild call in the Windows MXC preference test @virajrai-oai
- #52226 Include foreground activity in iTerm2 session status @fcoury-oai
- #52228 Honor API-key feature gates in TUI Daybreak selection @julee-oai
- #52234 Support request IDs in exec-server WebSocket handshakes @mattj-openai
- #52235 Recover gRPC code-mode sessions after missing-session errors @surajs-oai
- #52241 Preserve subagent capabilities independently of forked history @anp-oai
- #52245 Enable parallel execution for read-only tools @zamoshchin-openai
- #52250 Add opt-in Guardian trust for orchestrator connector identities @ankushg
- #52256 Normalize formatting in docs, web assets, and sample scripts @anp-oai
- #52268 Preserve large arguments in executed tool call metadata @ningyi-oai
- #52270 Enable text selection in the fullscreen TUI footer @fcoury-oai
- #52273 Add configurable persistent leader shortcuts to the TUI @fcoury-oai
- #52274 Add structured tracing for Guardian reviews and background scoring @ioanbudea-OAI
- #52277 Preserve UTF-8 byte semantics in network domain matching @rafael-oai
- #52278 Honor custom OTLP metrics exporters when analytics is disabled @jackz100
- #52288 Remove duplicate field initializers from extension registry tests @anp-oai
- #52295 Emit one developer notice per incremental namespace update batch @akira-oai
- #52299 Make Bazel release jobs advisory @anp-oai
- #52302 Add opt-in credential masking for proxied sandboxed sessions @winston-openai
- #52304 Persist remote-control RPC preferences in managed daemon settings @etraut-openai
- #52325 Track history initialization in Responses turn metadata @anp-oai
- #52329 Remove per-content source attribution metadata @anp-oai
- #52330 Clamp wrapped source ranges before remapping terminal hyperlinks @bc-openai
- #52337 Add durable thread read state with revision-checked updates @btraut-openai
- #52350 Expose experimental durable thread read state in the app server @btraut-openai
- #52363 Expand realtime v3 voice support @jacksonmoody-oai
- #52381 Preserve per-session routing for gRPC code mode @cassirer-openai
- #52384 Notify subscribers when thread read state changes @btraut-openai
- #52395 Add experimental app-server thread read-state updates @btraut-openai
- #52418 Avoid an extra blank quote line when pasting text with a trailing newline @bc-openai
- #52535 Add opt-in history prefix preservation for full agent forks @jif-oai
- #52557 Forward clipboard copies to the terminal in Herdr sessions @fcoury-oai
- #52568 Expose message board permissions and structured denials @jif-oai
- #52591 Fix races in remote environment and session replacement tests @jif-oai
- #52608 Upgrade `hyper` to 1.11.1 and test connection closure @jif-oai
- #52610 Align Linux sandbox names and docs with bubblewrap and seccomp @bolinfest
- #52621 Add template setup for local agent message boards @jif-oai
- #52629 Consolidate local message board storage helpers @jif-oai
- #52635 Skip background workspace routing reads without ChatGPT auth @joesavona
- #52637 Add experimental thread item lookup by ID @btraut-openai
- #52640 Count interrupted goal continuations toward the no-activity limit @etraut-openai
- #52648 Limit daemon feature compatibility checks to explicit CLI overrides @etraut-openai
- #52652 Bound local exec-server output draining after process exit @jif-oai
- #52659 Add an opt-in feature for subagent model context defaults @hlevy-openai
- #52660 Handle completion events in either order in shell snapshot tests @jif-oai
- #52661 Prevent brokered credential aliases from bypassing MITM hooks @viyatb-oai
- #52671 Add retention annotations to submitted tool outputs @won-openai
- #52674 Move the exec-server test fixture into shared test support @anp-oai
- #52676 Refresh persisted capability roots from owner-provided configuration @teddywyly-oai
- #52679 Add timeout-aware exec-server configuration reads @hlevy-openai
- #52681 Reject reserved Serde JSON keys in code mode @cassirer-openai
- #52682 Validate Windows sandbox accounts before password repair @zm-oai
- #52685 Preserve code mode cancellation during output serialization @cassirer-openai
- #52686 Add opt-in retention for turn tool outputs @won-openai
- #52689 Forward per-turn Cyber access programs to Guardian @daneschneider-oai
- #52696 Fix marketplace path matching for Windows junctions @zm-oai
- #52700 Update the exec-server stable compatibility baseline to Codex 0.162.1 @iceweasel-oai
- #52702 Retry bootstrap GETs through the system proxy after request failures @abhinav-oai
- #52707 Migrate the Windows MXC sandbox to split MXC crates @iceweasel-oai
- #52721 Explain session creation failures during server shutdown @etraut-openai
- #52723 Add opt-in gRPC over stdio for the code-mode host @cconger
- #52724 Add observers for initial exec-server connection attempts @aaronl-openai
- #52725 Report terminal program status with OSC 7501 @fcoury-oai
- #52736 Allow model catalogs to override incremental tool notices @akira-oai
- #52742 Add opt-in output token replay for OpenAI requests @pakrym-oai
- #52748 Make code-mode `exit()` stop the entire cell @cconger
- #52756 Classify voice session failures and record terminal outcomes @bc-openai
- #52778 Make pinned transcript prompts clickable @fcoury-oai
- #52825 Report exec runtime resets before accepting further requests @JenZhao
- #52923 Stabilize the realtime steering timeline test @anp-oai
- #52937 Retain client-marked tool outputs across compaction @won-openai
- #52946 Keep agent command center rows stable across progress updates @fcoury-oai
- #52952 Verify reset notification during code-mode host recovery @etraut-openai
- #52959 Reduce stack usage in async TUI tests @jif-oai
- #52964 Defer owned transcript redraws during raw paste bursts @etraut-openai
- #52967 Reuse and prewarm the WSL clipboard text reader @etraut-openai
- #52968 Keep startup modals protected when terminal input draining times out @etraut-openai
- #52972 Upgrade `rmcp` to `3.5.1` and harden lifecycle tests @alishobeiri-oai
- #52990 Add a searchable `/config` preferences panel to the TUI @fcoury-oai
- #53049 Add connection-bound reply handles for app-server requests @bc-openai
- #53109 Handle broken pipes gracefully in plugin list output @fcoury-oai
- #53148 Fix startup draft recovery for pending Vim Replace keys @etraut-openai
- #53150 Restore thread-owned permissions on cold resume @etraut-openai
- #53152 Allow selecting and copying TUI turn tips @etraut-openai
- #53153 Show subagent navigation shortcuts in TUI help @etraut-openai
- #53155 Keep remote app-server events deliverable during shutdown @etraut-openai
- #53156 Simplify the custom terminal drawing API @bc-openai
- #53173 Allow restarting managed background servers from the TUI @etraut-openai
- #53201 Keep agents navigation available after a thread is archived @etraut-openai
- #53224 Support Windows clipboard text paste shortcuts in the TUI @etraut-openai
- #53331 Finish remote exec cleanup when output streams remain open @jif-oai
- #53339 Test final polling of remote processes with open output streams @jif-oai
- #53358 Remove selected protocol, apply-patch, MCP, and TUI tests @vb-openai
- #53369 Allow turns when the agent message board is unavailable @jif-oai
- #53382 Ignore the unsafe-libyaml advisory in dependency audits @swastik-oai
- #53389 Use cached login credentials for Guardian decisions @swastik-oai
- #53393 Distinguish Guardian parent-compaction failure reasons @ioanbudea-OAI
- #53400 Add explicit local board connections with fixed runtime access @jif-oai
- #53412 Isolate arg0 helper directories by operating system @jif-oai
- #53419 Restore saved thread permissions during configuration loading @jif-oai
- #53424 Add regression coverage for network grants on cold thread resume @jif-oai
- #53426 Preserve Windows runtime registration failure diagnostics @zm-oai
- #53429 Apply configuration toggles live and improve settings navigation @fcoury-oai
- #53436 Route TUI request replies to their originating connection and thread @bc-openai
- #53438 Stop identifying Apple Terminal from `TERM_SESSION_ID` @etraut-openai
- #53440 Preserve status line accents on 16-color terminals @etraut-openai
- #53443 Use local MSVC toolchains for native Windows Bazel tests @etraut-openai
- #53444 Suppress repeated turn diffs in `codex exec` human output @fcoury-oai
- #53451 Treat incomplete responses as terminal errors @jif-oai
- #53452 Close input admission while a turn finishes recording @etraut-openai
- #53453 Prefer the Windows clipboard and bound copy attempts on WSL @etraut-openai
- #53485 Update `quinn-proto` to 0.11.18 @smurching-oai
- #53496 Preserve pending Effects toggles across save refreshes @fcoury-oai
- #53506 Reject duplicate Host headers in the network proxy @jfoo-oai
- #53556 Deduplicate TUI modifier handling and terminal color caching @bc-openai
- #53595 Add async compaction feature configuration @rka-oai
- #53606 Prepare compaction helpers for background requests @rka-oai
- #53614 Add infrastructure for speculative remote V2 compaction @rka-oai
- #53617 Allow hiding native tools while retaining the multi-agent V2 runtime @jif-oai
- #53620 Reuse background results for remote V2 compaction @rka-oai
- #53622 Preserve remote exec output until it is collected @jif-oai
- #53628 Record truncation metrics for accepted Guardian review inputs @ioanbudea-OAI
- #53631 Materialize the thread before testing a discovered daemon restart @jif-oai
- #53632 Stabilize write ordering in the shared message board scenario @jif-oai
- #53633 Add an environment API key fallback for Guardian Decisions @swastik-oai
- #53654 Keep spawned children provisional until the spawn result returns @jif-oai
- #53657 Share hook configuration across cloned hook views @jif-oai
- #53660 Extract shared multi-agent v2 thread spawning @jif-oai
- #53668 Improve remote exec-server test startup diagnostics @jif-oai
- #53670 Account for token usage from incomplete responses @jif-oai
- #53672 Keep discovered Apps tools available during startup recovery @jif-oai
- #53673 Publish Rust releases with the GitHub CLI @jif-oai
- #53678 Preserve inherited context in prediction forks @keyz
- #53689 Constrain API-key model access programs to server support @julee-oai
- #53691 Account for replay caches in encrypted compaction budgets @ioanbudea-OAI
- #53693 Add keyboard selection support to the transcript view @fcoury-oai
- #53698 Interrupt and drain canceled classifier responses before socket reuse @felixxia-oai
- #53699 Cancel Guardian V2 classifications that exceed the tool-call lag window @felixxia-oai
- #53701 Enable CLI Daybreak by default and enforce background-turn eligibility @julee-oai
- #53706 Preserve URLs and email addresses during external agent migration @jif-oai
- #53709 Separate MCP sandbox policy from launcher metadata @bolinfest
- #53717 Enable Cyber access programs for API-key sessions by default @julee-oai
- #53723 Wire V2 capability discovery through exec-server RPC @TAFOYA-OAI
## Why
MCP servers at `https://gov.chatgpt.com` were treated as untrusted for ChatGPT authentication and switched to OAuth, preventing local Gov Apps from retaining the ChatGPT auth provider.
## What changed
Trust the `https://gov.chatgpt.com` origin alongside the existing ChatGPT origin when resolving MCP server authentication. Origin matching preserves scheme, host, and port restrictions.
## Testing
Add regression coverage for Gov Apps URL construction, trusted origin normalization, rejection of lookalike hosts and nonstandard schemes or ports, and retention of the local ChatGPT auth provider. Verify that explicit OAuth servers and servers in remote environments do not receive the host provider.
GitOrigin-RevId: 7ceaf7c524d963005d9f23204489bbde269f0dd5
(cherry picked from commit 160b2b1ef6)
## What changed
- Launch background compaction at eligible pre-turn, mid-turn, and post-turn checkpoints when `AsyncCompaction` is enabled, capturing the current world state and client routing state.
- Adopt ready results at compaction checkpoints while preserving newer messages, tool outputs, and world-state updates. Continue normally if an optional result is rejected.
- Run one foreground compaction if an adopted result still exceeds the context limit.
- Prevent cancelled turns from launching new background work while preserving already-running work for later reuse.
## Testing
Add unit and scenario coverage for stale history and account changes, cancellation, pending-result reuse and fallback, retained tool outputs, compaction event pairing, and token usage accounting. Add a context snapshot covering a collaboration-mode change while compaction runs.
GitOrigin-RevId: 04ac028d9fe2e3ea64aacaaeb351c3c776cf3940
(cherry picked from commit 9e03960cf8)
## Why
Remote MCP environment filtering could drop `SystemDrive` and `LocalAppData`. Explicit overrides also need Windows-aware merging to replace inherited variables with differently cased names.
## What changed
- Preserve `SYSTEMDRIVE` and `LOCALAPPDATA` when remote environment variables activate the allowlist.
- Apply explicit environment overrides through the executor environment policy, while retaining the final overlay for variables excluded by the allowlist.
## Testing
Extend environment-policy tests to cover the additional Windows variables, overrides with differently cased names, and the final overlay used by older executors.
GitOrigin-RevId: 36df69117f248536e47cf7e1d855b99a138fe698
(cherry picked from commit 0fd85b0752)
## Why
Windows MXC needs valid host startup variables, while an empty child environment must remain empty for the SDK to select Windows user-profile defaults.
## What changed
- Replace caller overrides of `SystemDrive` and `LOCALAPPDATA` case-insensitively with nonempty Unicode host values, failing before launch if either is unavailable.
- Track whether the original child environment was empty, ignoring launcher transport keys. Supply host `SystemRoot` for launcher bootstrap in that case, then clear the bootstrap environment before the SDK selects defaults.
## Testing
Extend transport tests to cover host-value replacement and preservation of empty child environments. Strengthen the PowerShell fallback RPC test to require `SystemDrive`, `LOCALAPPDATA`, `USERPROFILE`, and `PATH` in the child.
GitOrigin-RevId: a097e1079069ef897ebb5ba5e63546328c5faeaa
(cherry picked from commit 81aee8c86b)
## What changed
- Register `capabilities/discoverV2` for initialized sessions and expose it through `ExecServerClient` and remote `Environment` APIs, checking executor support before calling it.
- Reuse startup discovery locations and retry failed prewarming on demand. Replay discovery once after executor recovery while preserving the request parameters.
- Track whether all required filesystem watches registered successfully and reload locations and metadata on each request when registration fails.
## Testing
Add coverage for RPC metadata refresh, omission of skill instruction bodies, sandbox isolation, startup scan recovery, disconnect replay, and successful or failed watch registration.
GitOrigin-RevId: 726e8f7e8b4d835b877f31d1d8a9f8eea1ad9c8b
## What changed
- Default `features.api_key_cyber_access_programs` to `true` and allow `codex exec` to select Daybreak with an OpenAI API key. Select the advertised standard program when `daybreak=false`, while respecting explicit feature opt-outs.
- Resolve API-key eligibility for TUI background turns from the target thread's feature settings, including project opt-outs. Omit access-program overrides when the server cannot report those settings.
- Preserve automatic server treatment for unlisted models and missing or empty Cyber program metadata in exec and TUI. Continue rejecting Daybreak when a nonempty program list does not offer it.
## Testing
Update regression coverage for API-key Daybreak selection, the off override, explicit opt-outs, resumed sessions, target-thread settings, and missing model metadata.
GitOrigin-RevId: f3cf7bd95a2754d4b4281bc70b18c7da4b177552
## Why
MCP servers must forward sandbox policy unchanged to `codex sandbox --sandbox-state-json`, while interpreting launcher information to find the Codex CLI. Keep those contracts separate so consumers can preserve unknown policy fields.
## What changed
- Accept the experimental `codex/sandbox-state` capability alongside the deprecated `codex/sandbox-state-meta` capability, and send identical policy values under both `_meta` keys.
- Move `codexExecutable` out of the policy into `codex/sandbox-launcher`, supplied only when a verified CLI path is available for a local stdio server.
- Replace stale sandbox metadata while retaining unrelated entries, and remove stale launcher metadata when no launcher is available.
- Document the metadata contract and how servers should forward policy and retain authority for long-lived subprocesses.
## Testing
Update unit and integration coverage for policy serialization, identical state aliases, launcher availability across execution environments, and stale metadata replacement.
GitOrigin-RevId: e544c06e6e023953b1fc8069b7b1affa065262d1
## Why
Rewriting source agent names and instruction filenames inside URLs and email addresses can change their destinations when importing external agent content.
## What changed
Use `linkify` to preserve recognized URLs and email addresses while rewriting surrounding text, including Markdown link labels and titles. Continue migrating instruction filename references to `AGENTS.md`, including relative links and references with line or column suffixes.
## Testing
Add rewrite coverage for URLs, email addresses, Markdown links, and surrounding Unicode text. Extend skill import and app-server configuration import tests to verify that link labels migrate while URL destinations remain unchanged.
GitOrigin-RevId: c4d210a287c99b6440438c99527364d379c568bd
## What changed
- Mark `cli_daybreak` as stable and enable it by default.
- Apply Daybreak to background turns only for eligible OpenAI accounts, allowing API-key accounts when `api_key_cyber_access_programs` is enabled. Preserve saved settings for ineligible accounts and report account lookup failures when Daybreak is enabled for the OpenAI provider.
- Skip inheriting Daybreak configuration when the app server does not support reading effective configuration.
## Testing
Expand dynamic-tool request tests to cover the feature toggle, ChatGPT and API-key authentication, API-key program eligibility, and unsupported configuration reads.
GitOrigin-RevId: 55a57315c9f527f977dd8305ea62d4096ed7dae9
## Why
Pending classifications can outlive the `max_tool_call_lag` window in which their scores are reusable, keeping metadata waits or classifier transports active after the result becomes stale.
## What changed
- Expire pending classifications when tool-call progress exceeds the configured lag allowance, preserving the wrapper discount while nested code-mode actions remain active.
- Cancel metadata waits and sampling in snapshot and conversation modes, including snapshot response drains after an early score.
- Treat expiry as supersession, preserving cached scores and the last completed conversation checkpoint and transcript cursor.
## Testing
Add regression coverage for lag boundaries, active wrapper discounts, transport cancellation before and after early scores, expired requests skipping preparation, and conversation history and transcript deltas surviving cancellation.
GitOrigin-RevId: 892ff13a05fd2b1573cef9842b934d1fc865d951
## Why
Canceled classifier requests need bounded cleanup that preserves received token usage and returns only safe WebSocket connections to the pool.
## What changed
- Own classifier response streams and connection leases together, interrupting dropped responses with a one-second cleanup deadline.
- Require a matching interruption acknowledgement and response completion before reusing a canceled response's socket. Retire sockets on rejection, invalid acknowledgements, or timeout while preserving any received completion and token usage.
- Skip requests canceled before dispatch and return their unused sockets to the pool.
- Distinguish cancellation from ordinary steering, which continues draining without requiring an interruption acknowledgement.
## Testing
Add regression coverage for cancellation, acknowledgement ordering and failures, cleanup timeouts, socket reuse, and token accounting under backpressure. Extend steering tests to cover rejected and missing acknowledgements.
GitOrigin-RevId: c4e7aac49d36cea2c2d0e9f2ba5f6147f67471dd
## What changed
Add transcript select-mode state with an underlined cursor, grapheme-aware movement via arrow keys or `h`/`j`/`k`/`l`, and vertical movement that preserves the preferred display column. Support marking with `v`, Space, or Shift-arrow keys and copying through the existing selection machinery.
Keep the displayed transcript snapshot and reading position paused during selection and after exiting the mode. Add entry and exit methods; this change does not yet bind mode entry to a user-facing key.
## Testing
Add unit tests for initial cursor placement, movement across empty lines and entry boundaries, wrapped text, preferred-column preservation, and Enter behavior with and without a marked range.
GitOrigin-RevId: e5bc380ea0eb6e2c6157ba73ac063d548a7de145
## Why
Encrypted compaction payloads can include sampled-token replay caches that increase their size roughly threefold. Budgeting them as ordinary text can reject checkpoints that fit the model context budget.
## What changed
Use a shared estimate of one token per twelve ciphertext bytes, rounded up, for encrypted `Compaction` and `ContextCompaction` items in history and Guardian context budgeting. Guardian continues to count framing and metadata separately.
Check parent compactions against the configured token budget and a separate hard wire-size limit. Preserve the complete encrypted checkpoint when it fits. The token estimate remains a heuristic and can underestimate legacy checkpoints without replay caches.
## Testing
Add coverage for token-estimate rounding, parent compaction token and wire-size limits, and reviewer continuation with a cached compaction preserved intact.
GitOrigin-RevId: cc18ca29802491865167eef992830efcf93d97da
## Why
Servers can advertise cyber access programs without accepting them for API-key accounts. The TUI must account for server support before exposing those programs.
## What changed
- Check `features.api_key_cyber_access_programs` at startup and when loading models for API-key accounts, clearing `available_access_programs` when forwarding is unavailable.
- Use thread-scoped feature settings after thread creation and honor feature requirements and CLI overrides at startup.
- Refresh account-scoped models when switching to or from API-key authentication or changing API-key thread context, clearing cached access programs while the refresh is pending.
## Testing
Extend session tests to cover enabled and disabled server settings, CLI overrides, and catalog filtering before and after thread creation. Update account-change tests to handle the model refresh.
GitOrigin-RevId: c80de30a0063b84949098d137715d8678bd70587
## Why
Prediction forks need to retain their parent's context even when it exceeds the automatic compaction threshold. Compaction or context resets can otherwise replace the history used for the prediction.
## What changed
- Apply a thread-local `AutoCompactionDisabled` policy to experimental prediction forks without changing model or skill budgets.
- Skip automatic compaction before, during, and after turns, including context-limit recovery, and suppress new token-budget reminders.
- Reject `new_context` requests for these threads and report context-limit failures without compacting their history.
## Testing
Add regression tests for legacy and paginated prediction forks across compaction thresholds, unchanged parent compaction and skill/tool inputs, context-limit failures, and rejected context resets. Add a request-history snapshot verifying inherited context and reminders survive without compaction or additional reminders after a tool call.
GitOrigin-RevId: 7df374287f4142f776981bb6c22e5caa564d74a5
## What changed
Replace `softprops/action-gh-release` in `.github/workflows/rust-release.yml` with explicit `gh` commands:
- Look up the release by tag, including drafts, and fail on API errors.
- Create stable releases as drafts until assets are uploaded. Create prereleases directly to preserve prerelease events.
- Upload sorted assets with `--clobber`, then publish the release with the configured title, notes, prerelease status, and latest status.
- Cap release notes at 124,999 characters, including a trailing newline.
GitOrigin-RevId: f343e4f265b06e047d85fe5a2b89a92690c7a7fb
## Why
A transient Apps MCP startup failure can remove cached tools that the model has already discovered, preventing a later Code Mode invocation from using them.
## What changed
Keep cached Apps tools in the model's tool catalog while startup recovery runs. Let invocation readiness start or join a shared retry before acquiring the tool execution lock, while tool discovery remains nonblocking. Keep recovery running if a waiting invocation is cancelled.
## Testing
Extend connection-manager tests to cover cached tool bindings and shared recovery. Add a Code Mode regression test that discovers a cached Calendar tool, invokes it after startup fails, and verifies that it succeeds after recovery while unrelated tools remain able to execute.
GitOrigin-RevId: e888501a1050884a50a473e71b893cf6672fe256
## Why
Terminal `response.incomplete` errors discard reported token usage. Counting that usage as a new context baseline can also double-count input and trigger unnecessary compaction on the next turn.
## What changed
- Carry the response ID and valid reported usage with incomplete-response errors.
- Record usage for sampling and foreground compaction in cumulative totals, rollout records, budgets, and token-usage contributors without replacing the context baseline. Preserve the original terminal error, including when accounting exhausts the budget or cancellation races the error.
- Charge incomplete background compaction requests to the rollout budget without publishing foreground token usage.
- Ignore missing or malformed usage rather than estimating it.
## Testing
Extend coverage for SSE and WebSocket incomplete responses, rollout usage records, compaction accounting, deferred token-count events, and token-usage contributors. Add regressions for unnecessary compaction on the next turn and background compaction publishing foreground usage.
GitOrigin-RevId: bf1ee6df3912052ab7c19e1c6af8ad3dc4b07675
## Why
The remote exec-server parent-lifetime test can hide an early process exit behind a connection timeout, making startup failures harder to diagnose.
## What changed
- Race the WebSocket connection against the child process exiting so startup exits are reported immediately.
- Include the registration request count and child status when attachment fails, without inspecting request headers or bodies containing authentication data.
- Enable remote exec-server info logging in the test while keeping other logs at error level.
GitOrigin-RevId: 75739fc93d7f28ba0a3f447a14d4d20b2dbdfd14
## What changed
Move child configuration, task path construction, fork usage hints, and backend spawning into `core::thread_spawn`. Add request, result, and error types that distinguish preparation failures from backend errors.
Route the v2 `spawn_agent` handler through the shared helper while retaining tool-specific telemetry, activity events, and response formatting in the handler.
GitOrigin-RevId: a09a8f66beb41c1403220750d236a12717dbfc6c
## Why
`with_executor_hooks` clones the hook registry to create an executor-specific view. Copying the configured handlers, plugin sources, and diagnostics on every clone is unnecessary when that configuration is unchanged.
## What changed
Store hook configuration in `Arc`-backed collections and use copy-on-write when replacing executor-scoped handlers. Skip handler mutation when there are no executor hooks to add or remove.
## Testing
Extend the executor hook registration test to verify that updating a cloned engine leaves the previous engine's handlers unchanged.
GitOrigin-RevId: 6b188ca6ca21772ccd7336344d98c023f769834e
## Why
Cancellation after initial input admission could leave a child registered even though the spawn caller had not received its result.
## What changed
Resolve the child's status and configuration before committing reservations and releasing provisional ownership. This keeps cancellation cleanup active through the final awaits and lets the spawn result return without yielding after commitment. Cancellation after the result returns does not retract the accepted child.
## Testing
Add a regression test that cancels spawn during the final status lookup after input admission and verifies that the child is unregistered, terminated, and unloaded, and that shutdown completes. Extend the provisional-child cancellation test to cover both native V1 and V2 callers.
GitOrigin-RevId: 028b873ad4c1fac2c4b5d1dc823b4561ff19e6bf
## What changed
Allow Guardian Decisions to use `OPENAI_API_KEY` when the default `openai` provider has no custom base URL and neither `CODEX_GUARDIAN_DECISIONS_API_KEY` nor a cached API key is available. Preserve cached API key precedence over the environment fallback.
Report missing credentials as `credentials_unavailable` instead of `provider_error` in Decisions failure metrics.
## Testing
Add tests for cached API key precedence and the environment fallback with ChatGPT authentication. Run each test in a child process to isolate environment changes.
GitOrigin-RevId: fbb772dcb9287d9e1be1b34292ad9bdffeb3d6b3
## Why
Non-parallel tool calls can acquire their lock in either order, making the shared board scenario's `last_message_id` snapshot nondeterministic.
## What changed
Send each `collaboration.post` call in a separate mocked response to order the writes before snapshotting. Update the `board_connections` snapshot and expected request count from 15 to 17 to reflect the additional responses.
GitOrigin-RevId: a290a01f5071a2081d4d0b1531b1b31bfbb8a6e6
Empty drafts need not survive a daemon restart. Update the `discovered`
scenario in `codex-rs/cli/tests/daemon_startup.rs` to rename the thread before
restarting the daemon and include `thread-name` in the status line. Wait for
the confirmed footer name before issuing `/daemon` so the test proceeds only
after the thread is materialized.
GitOrigin-RevId: a91508582826fa1bd0cc7b89d9a1af7e8b4e1999
## What changed
Emit `codex.guardian.review.truncation` counts and `codex.guardian.review.truncation.bytes` histograms after successful input finalization. Aggregate observations across reduction stages by component and disposition (`truncated` or `omitted`), recording original, retained, and omitted byte totals. Exclude feasibility checks and failed retries from loss telemetry.
Keep blocking command-hook cancellation fixtures in the local environment and use double quotes for the Python command.
## Testing
Add metric-export tests covering aggregation across multiple reductions, separate truncation and omission totals, no loss metrics for rejected inputs, and no duplicate reporting on repeated finalization.
GitOrigin-RevId: 69182fc7afe230be69dd2469caedb5ae4494947b
## Why
Remote process exit can arrive before the final output, and inherited pipes can keep the output stream open after exit. Removing the session at exit can lose output that should remain available to `write_stdin` polls.
## What changed
- Retain remote sessions with open or unread output after exit, including early exits and cancelled initial collection.
- Collect pending output when `write_stdin` races with exit, skipping stdin writes once remote exit is known.
- After initial collection finishes and the process exits, allow a five-second grace period before a final background read. Respect active polling deadlines and keep later polls available while that read recovers retained output.
- Let explicit termination stop output collection even when the process has already exited, and install the exit watcher before cancellable cleanup.
## Testing
Extend remote process event tests to cover output arriving after the initial yield, polling during a delayed final read, active polls exceeding the background grace period, resumable cancellation, and termination before the initial yield.
GitOrigin-RevId: b1671fad8b61a2cdecf7cf9fdf92e57c028c7af8
## What changed
- Await a compatible pending background request when foreground compaction is needed, and share the result installation path with foreground requests.
- Validate the captured history generation, prefix length, model, and authentication owner before installing a prepared result. Fall back to foreground compaction when required if the result is rejected.
- Replace only the captured history prefix, preserving later messages, retained tool outputs, goal edits, and the current world-state baseline. Record installation analytics and completion events only after a result is installed.
GitOrigin-RevId: 798963f2fc603c3febba2c21eafa1bcb094b3ebf
## What changed
Add `features.multi_agent_v2.disable_native_tools` to hide native multi-agent tools while keeping the V2 runtime and its instructions enabled for host-provided tools. The option defaults to `false`, preserving existing tool exposure.
## Testing
Extend configuration parsing tests for the new option and parameterize the multi-agent catalog scenario to cover both settings. Add a snapshot showing native tools are absent while the V2 runtime and instructions remain enabled.
GitOrigin-RevId: 21a53584d2395bb678813c876a8b7927bea61c90
## What changed
- Capture history, prompt metadata, routing state, authentication ownership, and context-window identity for background compaction requests.
- Send background requests over HTTP while preserving foreground routing, and retain the latest candidate in session memory.
- Add feature and threshold eligibility checks and deduplicate attempts by history version, model, compaction hash, and authentication ownership.
- Cancel and drain background tasks during session shutdown, preserving completed usage accounting.
The background launch helper is not yet connected to the turn loop.
GitOrigin-RevId: 0e5e6ab7dac4d98a836733668a775ac48b5a59f1
## What changed
- Extract an HTTP Responses executor that can run without owning a turn's WebSocket state, with optional authentication-owner checks.
- Add cancellation-aware compaction output collection that records background token usage against the rollout budget.
- Support installing a compacted history prefix while preserving later history items and placing initial context around real user or agent messages.
- Allow callers to supply a context window for history trimming and a captured window for compaction request metadata.
GitOrigin-RevId: 29f3ca0ae8841f295058feb207e3a225af9a1487
## What changed
Register the disabled-by-default `async_compaction` feature and accept either a boolean or a `[features.async_compaction]` table. Add `model_async_compact_threshold_percent` with a default of 65 and a valid range of 1–100, validated even when the feature is disabled. Setting a threshold alone does not enable the feature.
Expose the threshold in the runtime configuration and update the JSON schema for both configuration forms.
## Testing
Add configuration loader tests covering boolean and table forms, default and custom thresholds, explicit enablement, and rejection of out-of-range values.
GitOrigin-RevId: cf33de76878e7044bc8cf5d146375a07ea9eb078
## What changed
- Reuse `custom_terminal::ModifierDiff` when writing history spans.
- Share the terminal default-color probe and cache implementation between Unix and Windows.
Both changes remove duplicate implementations while preserving existing behavior.
GitOrigin-RevId: 35f8d77ade972b791c6beac0678d2fe2be3aa763
## Why
Policy evaluation and upstream parsers must not select different `Host` field lines from the same request.
## What changed
Return `400 Bad Request` for multiple `Host` headers, including identical values, before policy evaluation, upstream forwarding, or Unix socket routing. Apply the check to both plain HTTP requests and `CONNECT` requests.
## Testing
Add regression tests covering identical and conflicting headers in origin-form, absolute-form, and `CONNECT` requests, verifying rejection without an upstream connection. Also cover single-header forwarding and rejection before Unix socket routing.
GitOrigin-RevId: 8ec95171e120f784629d3121b9a1bedbaf88e7cd
## Why
Saving an Effects preference refreshes the picker. When users toggle repeatedly before saves finish, that refresh can discard newer choices and cause subsequent toggles to use stale values.
## What changed
- Update Effects checkboxes immediately and track pending saves per row, preserving newer choices when an earlier save takes effect.
- Preserve pending Composer stars choices while Animations disables the row, and clear pending state on a regular panel refresh.
- Use the shared list toggle handling for Effects, including Space support, while giving configured key bindings precedence over Space toggling.
## Testing
Add regression tests for repeated toggles across save refreshes, pending Composer stars choices while disabled, clearing pending state, and a Space cancel binding taking precedence over toggling. Update the Effects picker snapshot.
GitOrigin-RevId: 847dcc2dfd40448c7adc56c8c40879db28b1fc39
## What changed
Update `codex-rs/Cargo.lock` and `MODULE.bazel.lock` for `quinn-proto` 0.11.18, replacing 0.11.15. Refresh its resolved dependencies to use `rand` 0.10.1 and `getrandom` 0.4.2, and add `rand_pcg` 0.10.2.
GitOrigin-RevId: 642bdeccbff8017f2f97b640a2b2c48294c97bba
## Why
WSLg clipboard initialization can block indefinitely, and PowerShell clipboard writes can stall while receiving input or exiting. These stalls can prevent subsequent TUI copy requests from completing.
## What changed
- Try the Windows clipboard first for `/copy` and `Ctrl+O` on WSL, falling back to the native clipboard and terminal delivery when needed.
- Give Windows executable discovery and writing a shared five-second deadline, with a separate one-second deadline for native clipboard setup. Reuse pending setup tasks after timeouts to avoid accumulating blocked threads.
- Launch PowerShell through a native shell and stop its process group on write failures or timeouts. Reap the writer before returning so an older copy cannot overwrite a newer one, and suppress stderr that could expose clipboard contents.
## Testing
Add tests for command compatibility, large Unicode input, expired requests, and cleanup of stalled writers and subprocesses. Update routing tests to cover Windows-first copying and native fallback with HTML and clipboard leases.
GitOrigin-RevId: 218c8541a169a16536db0370455e076a31a42b1f
## Why
Inputs arriving during turn finalization could be queued after the final batch had already been drained, or recorded ahead of that batch.
## What changed
Mark active turns as finishing before draining pending input. Reject injection into finishing turns and make late client responses and notifications wait until the final batch is recorded before appending to history. Continue accepting input into turns reserved but not yet started.
## Testing
Extend the task-completion test to block final recording, verify that input admission is closed, and confirm that a late notification is recorded after queued input while preserving the notification truncation budget. Strengthen the retained-tool-output scenario to assert tool output names and ordering.
GitOrigin-RevId: a57e44bd974e60e134183dab989795e2c3538596
## Why
Incomplete responses such as `max_output_tokens` were classified as stream errors, allowing retries and compaction model fallback after the response had hit its output limit.
## What changed
Introduce `ResponseIncomplete` errors that preserve the server-provided reason and stop stream processing immediately. Make these errors non-retryable and stop compaction without falling back to the selected model. Record incomplete responses separately in sampler failure metrics.
## Testing
Add regression tests that verify incomplete responses surface a terminal error without retries over SSE and WebSocket, and that compaction stops without retrying or switching models for both local and remote compaction.
GitOrigin-RevId: 6e107d441b9bf03fa47ea47b88eeb94b71a9f729
## Why
Repeated turn diff notifications can print the same file changes multiple times, including after an unrelated command.
## What changed
Track the last diff and print nonempty updates only when they differ from the previous notification. Remember empty updates so a restored diff prints again, and reset the tracked diff when a new turn starts.
## Testing
Add a stderr snapshot test covering repeated, changed, empty, restored, and new-turn diffs. Add an integration test that applies one edit, runs an unrelated command, and verifies that the diff appears exactly once.
GitOrigin-RevId: db0a2aa8b77b800ca661e7d1314ed1e571743e74
## Why
Hermetic LLVM targets the GNU ABI on Windows even when an MSVC platform is selected. Native MSVC builds need the runner's MSVC toolchains and SDK environment.
## What changed
- Register the local x64 and ARM64 C++ toolchains in `ci-windows-msvc`.
- Apply `--config=ci-windows-msvc` to the native Windows Bazel test job.
- Allow the native Windows test job to run on `workflow_dispatch` as well as pushes to `main` so toolchain changes can be tested manually.
GitOrigin-RevId: b9fbd3f2bba8a3a8bf226cafda19a921c8738acd
## Why
RGB and extended indexed theme colors cannot be displayed directly on 16-color terminals, causing status line items to lose their color accents.
## What changed
Use each status line item's existing ANSI fallback accent when its theme foreground requires RGB or an indexed color beyond the first 16 colors.
## Testing
Add regression coverage for uncolored output with `FORCE_COLOR=0` and ANSI status line accents with `FORCE_COLOR=1`. Give the RGB styling test explicit terminal colors so it consistently exercises true-color behavior.
GitOrigin-RevId: 213ca5c6c366f0a3c696aab256a0b146558a2837
## Why
`TERM_SESSION_ID` is not specific to Apple Terminal. Treating it as an Apple Terminal identifier can mask Windows Terminal detection and the `TERM` fallback.
## What changed
Remove the `TERM_SESSION_ID` detection heuristic. Apple Terminal remains detectable through `TERM_PROGRAM=Apple_Terminal`.
## Testing
Update tests to cover Windows Terminal detection and the `TERM` fallback when `TERM_SESSION_ID` is present, and Apple Terminal detection with its version and user-agent token.
GitOrigin-RevId: 27db11cb7bcca8f94888f9e21a6cdfcf31561b1b
## Why
Pending requests can outlive a session switch, and different threads or connections can reuse request IDs. Replies and resolution notifications must stay associated with the request that prompted them.
## What changed
- Retain the original app-server reply handle for pending and buffered requests, including requests replayed after thread attachment or session reset.
- Scope user input, MCP elicitation, and user verification bookkeeping by thread, and send user input answers to the requesting thread.
- Keep background resolution notifications from dismissing foreground prompts.
- Consume failed replies to closed connections and clear pending replay state without falling through to another request route.
## Testing
Add WebSocket regression tests for direct and buffered approvals with colliding request IDs and replies to closed connections. Extend coverage for foreground prompt preservation and thread-scoped user verification cancellation.
GitOrigin-RevId: 541acb9910e92f6f2e83c27d2a2384185d4f8fec
## Why
Several configuration toggles required restarting Codex, and settings search only filtered the current group. Narrow terminals also truncated setting values and descriptions.
## What changed
- Apply animations, composer stars, paste detection, automatic recaps, and tips without restarting Codex. Update active motion effects and paste detection when their preferences change.
- Group animations and composer stars in an Effects picker that refreshes after saving and requires animations for composer stars.
- Search across all configuration groups, show each result's group, and preserve the query when switching groups.
- Keep setting values visible in narrow terminals and show the selected description below the list. Reserve space to keep the panel height stable and tailor footer hints to the selected action.
- Simplify configuration notices and omit routine save confirmations.
## Testing
Add and update tests and snapshots for live preference saves while offline, paste detection updates, Effects picker refreshes, global search, and stable panel height at narrow widths.
GitOrigin-RevId: 83773da2f6457ce461ef16f0cddde0df640a36c3
## Why
Managed runtime package registration errors lacked the terminal status, separate async and deployment error codes, and deployment activity ID needed to diagnose failures.
## What changed
Include these diagnostics in registration errors and distinguish failures in `GetResults`, the `ExtendedErrorCode` getter, and deployment itself. Preserve the original completion error; failures to read diagnostic fields do not turn successful registration into failure. Keep free-form Windows error text out of diagnostic summaries.
## Testing
Add unit tests for distinct async and deployment errors, failed or canceled result retrieval, and diagnostic getter failures, including preservation of native error codes and omission of free-form diagnostic text.
GitOrigin-RevId: 7f3a46741304ef04f5c3e2aa575bcfc4392dff62
## What changed
Add a Linux app-server integration test that resumes a saved read-only thread after the default permissions change to `:danger-full-access`. Verify that the live network proxy honors restored grants, requests approval for a new host, persists the approved rule, and reuses it without another approval.
The test also verifies that proxied requests succeed while direct access remains blocked.
GitOrigin-RevId: 08f63efb8752d738df0ee97e4e98c3366ae54f56
## Why
Restoring unnamed thread permissions after configuration loading leaves network proxy initialization and permission validation using the configured default. A saved read-only thread should also resume when that default is incompatible with current managed requirements.
## What changed
Apply eligible saved permission profiles during configuration loading, before network preparation and final validation. Keep explicit permission overrides and managed requirements authoritative, preserve managed deny-read restrictions, and reject saved external enforcement or materialized filesystem grants. Include the saved profile in the app-server's prepared resume configuration state.
## Testing
Add regression coverage for resuming saved read-only permissions with an incompatible full-access default and for retaining managed, remembered, and newly approved network domains in the restored profile's proxy allowlist.
GitOrigin-RevId: 73e32b0a31ac678fd3f60a8ccf8fa9df627f16c3
## Why
Windows and WSL can share `CODEX_HOME` without sharing a lock namespace, allowing cleanup to remove another platform's live helpers. Older clients can also clean helpers stored under the shared `tmp/arg0` root.
## What changed
Create helpers under `CODEX_HOME/tmp/arg0-<os>` and limit stale-directory cleanup to that operating system's root. Keep permission discovery compatible with both the current platform's root and legacy `tmp/arg0` directories, while ignoring other platforms' aliases.
## Testing
Add regression coverage for cleanup isolation, live helper preservation during legacy cleanup, and selection of the first session alias directory from either supported root.
GitOrigin-RevId: f34292748b5b1d3c25629604d849db4b133dfa3a
Adam Perry @ OpenAI