checkpoint: into wallentx/termux-target from release/0.144.4 @ db6e2ea32bf3 - #308
Merged
unemployabot[bot] merged 4 commits intoJul 18, 2026
Conversation
- No user-facing changes in this patch release. ## Changelog Full Changelog: openai/codex@rust-v0.144.3...rust-v0.144.4
* Initialize Copyberry export baseline
GitOrigin-RevId: 313afeef691aff7819ccd4bdb1e351438c8b40e4
* Remove the legacy exec policy engine (#32093)
## What changed
- Delete the `codex-execpolicy-legacy` crate, its default policy, and its tests.
- Remove the crate from the Cargo and Bazel workspaces and clean up its unused dependencies.
- Remove the legacy matcher reference from the current exec policy documentation.
GitOrigin-RevId: ee756958b46bf759ad43dec8aa1379c1cd4d8b0d
* Reduce startup latency for ancestor discovery (#32106)
## Why
Serial metadata probes add remote round trips while Codex discovers project
instructions, repository skills, and project-root markers during startup.
## What changed
- Probe ancestor directories concurrently while preserving discovery order.
- Raise the shared find-up probe window to cover typical project hierarchies.
- Refresh project instructions in parallel with plugin and skill warmup.
## Testing
Add coverage that blocks one metadata request and verifies all expected project-root
and `AGENTS.md` ancestor probes have started before it is released.
GitOrigin-RevId: 11449837c7a212ec8ed385e7290476e926d93531
* Bound streamed exec-server HTTP response bodies (#32112)
## Why
Frame-count backpressure does not bound the amount of executor-controlled data
retained in streamed HTTP response queues, and a single body delta could exceed
the intended wire size.
## What changed
- Limit each decoded `http/request/bodyDelta` payload to 1 MiB, split locally
produced response chunks at that boundary, and reject oversized incoming
deltas.
- Apply a shared 16 MiB byte budget across queued HTTP response streams. Release
capacity as deltas are consumed and fail a stream when the budget is
exhausted.
## Testing
Added coverage for rejecting an oversized delta and for failing a stream after
its queued deltas exhaust the shared byte budget.
GitOrigin-RevId: be9205fef44b0ec96b84b31a8e059b1cb9cd3f3b
* Test the shared exec-server HTTP response byte budget (#32122)
## Testing
Add a concurrent-stream regression test that fills the connection-wide queued
body budget across two HTTP responses. Verify that the overflowing stream
reports the byte-budget error while the other stream still drains successfully.
GitOrigin-RevId: 65efacb15f1368b1de3b98e7ef65ebca66a3840b
* Bound exec-server stdio JSON-RPC messages (#32123)
## Why
Newline-delimited stdio input could buffer an unterminated JSON-RPC message without a per-message limit. Apply the same 64 MiB ceiling used by the other exec-server transports.
## What changed
- Read stdio messages with bounded lookahead and disconnect when a message exceeds the limit.
- Preserve LF and CRLF framing, including messages whose payload is exactly at the limit.
## Testing
Added tests for accepting a limit-sized CRLF message and rejecting an unterminated overlong message.
GitOrigin-RevId: 73eaf883324a7777960725037cc5b9c34720084f
* Test bounded concurrency in ancestor discovery (#32126)
## What changed
Add regression coverage that verifies ancestor metadata searches:
- keep at most 256 project-root marker or repository skill-root probes in flight;
- start the next probe as capacity becomes available; and
- preserve `AGENTS.md` and repository skill-root discovery order.
GitOrigin-RevId: e7ac90bbeb94573d01e67705001af85ce59165b6
* Test stdio JSON-RPC size limits with LF and CRLF (#32134)
## What changed
Update the exact-size-limit stdio connection test to exercise both `\n` and
`\r\n` line endings, sizing the duplex buffer for each delimiter.
GitOrigin-RevId: 949e28bef3f1a34d379f3623f6aa7d99c0ecea80
* Propagate tracing subscribers to exec start tasks (#32135)
## Why
The process-start background task can move to a Tokio worker thread, where the
caller's thread-local tracing subscriber is otherwise unavailable. This can
break propagation of the caller's trace context to the exec-server request.
## What changed
- Attach both the current span and current tracing subscriber to spawned
process-start tasks.
- Run exec-server Bazel unit tests serially because their tracing setup uses
process-global state.
## Testing
Run the trace-context regression test on a multi-thread Tokio runtime so it
exercises propagation across the background task.
GitOrigin-RevId: a586eefd6983916d670fc5a90f0decd0468d273b
* Keep unified exec output collection bounded (#32150)
## Why
Unified exec can drain process output multiple times while waiting for a command. Collecting those drains into an uncapped buffer allows large commands to exceed the output collection limit.
## What changed
- Accumulate drained output through the capped head/tail buffer so collection remains bounded while preserving the beginning and end of the stream.
- Include a `... N bytes omitted ...` marker when the collection cap drops output.
- Calculate the original token estimate from all observed bytes and preserve omission metadata through truncation and sandbox-denial responses.
## Testing
- Cover repeated drains, previously omitted output, omission markers, and large-output summaries.
GitOrigin-RevId: c6e2efeb875ed8f35914365eab7431f25fd3484c
* Validate memory consolidation artifacts before succeeding (#32193)
## Why
A completed Phase 2 agent run does not guarantee that its required outputs were
created correctly. Treating a clean workspace as success can also preserve a
state where those outputs are missing.
## What changed
- Require `MEMORY.md` to be a file and `memory_summary.md` to start with `v1`
before marking consolidation successful.
- Fail completed runs with invalid artifacts without resetting the workspace
baseline, allowing the job to be retried.
- Run consolidation for a clean workspace when its required artifacts are
invalid instead of taking the no-change success path.
## Testing
Added coverage for rejecting an invalid summary and retrying a clean workspace
whose consolidation artifacts are missing.
GitOrigin-RevId: ac57b2ba9d062c5203ca51afd716795a91814bb3
* Rebind memory consolidation workspace roots (#32197)
## Why
The memory consolidation agent changes its working directory to the memory
root, but applying its sandbox policy directly to the permissions object can
leave workspace roots inherited from the parent configuration.
## What changed
Apply the consolidation sandbox policy through `Config` so its workspace roots
are synchronized with the memory root. Add a test covering the working
directory, workspace roots, and effective legacy sandbox policy.
GitOrigin-RevId: dc6e75aef1ffa84a2f66fec6ed3a6fedcf9aa672
* Add a skill invocation extension contributor (#32200)
## What changed
- Add `SkillInvocationContributor` and registration support to the extension API.
- Provide invocation callbacks with session-, thread-, and turn-scoped extension data, the turn ID, skill resource, and explicit or implicit invocation kind.
- Notify registered contributors when Codex observes a deduplicated implicit skill invocation.
## Testing
- Extend the extension registry round-trip test to cover skill invocation contributors.
GitOrigin-RevId: f428336728889d9bf4fba41a7dd8d3a6f9b9728c
* Always send reasoning parameters in Responses requests (#32206)
## What changed
- Build a reasoning payload for every Responses request and always include `reasoning.encrypted_content`.
- Remove `supports_reasoning_summaries` from model metadata and retire the `model_supports_reasoning_summaries` configuration override.
- Use configured or model-default reasoning effort without a capability gate, including for guardian reviews and tracing.
GitOrigin-RevId: 2c9f194a5d2d4d688a2235299e6358f82ab8e1ea
* Generate unique IDs for review rollout messages (#32213)
## What changed
Assign a fresh UUIDv7 to each synthesized user and assistant message recorded
when exiting review mode, instead of reusing fixed IDs across review runs.
GitOrigin-RevId: 8524176895e2d8c750760554f515f397728a8554
* Propagate workspace roots to exec-server sandboxes (#32214)
## What changed
- Pass configured workspace roots from core to the exec server so filesystem and process sandbox permissions are materialized against the intended roots.
- Preserve an explicitly empty workspace-root list instead of treating the sandbox working directory as an implicit root.
- Initialize filesystem sandbox contexts with their working directory as the default workspace root.
## Testing
- Add end-to-end coverage for patch and command writes inside and outside workspace roots.
- Verify remote filesystem and process sandboxes do not grant access through an empty workspace-root list.
GitOrigin-RevId: 6684c8f7de50970b45a29e2a6323df954c96f9f6
* Serialize MCP OAuth credential refreshes (#32229)
## Why
Concurrent Codex processes can otherwise refresh the same rotating token, and a
cancelled or partially persisted refresh can leave durable and in-memory MCP
credentials out of sync.
## What changed
- Serialize each credential's read-refresh-write transaction across processes,
reread the authoritative store after locking, and adopt credentials refreshed
by another process.
- Keep refresh persistence running after caller cancellation, bound lock and
provider waits independently, and preserve omitted refresh tokens and scopes.
- Fail MCP startup and operations when refresh or persistence fails instead of
continuing with stale credentials, while requiring reauthorization for
missing, unusable, or rejected refresh tokens.
- Exclude OAuth refresh time from the MCP initialization timeout.
## Testing
Add coverage for lock contention, concurrent refreshes, rejected and missing
credentials, storage failures, caller cancellation, and provider timeouts.
GitOrigin-RevId: 4d29b879bec646d2ceb922b526dc793b1a1f5423
* Support pending remote environment registration (#32231)
## Why
Remote environment provisioning can finish after a thread starts, before an
exec-server WebSocket URL is available.
## What changed
- Add `EnvironmentManager::register_pending_environment` and a one-shot
`PendingEnvironmentRegistration` handle that resolves to either a validated
WebSocket URL or a terminal provisioning error.
- Let lazy remote exec-server clients wait for that result, while preserving
reconnection behavior after a successful registration.
- Keep replacement registrations isolated so completing an older handle does
not resolve the current environment with the same ID.
## Testing
Add coverage for successful connection and reconnection, provisioning and
dropped-registration failures, invalid URLs, replacement isolation, and the
deferred-executor startup flow.
GitOrigin-RevId: 5c05be2b72291b77a1f71176d7075b1ad63332a5
* Let permission hooks resolve strict auto-review requests (#32232)
## What changed
- Run permission-request hooks before routing approvals to the automated reviewer or user, including when `strict_auto_review` is enabled.
- Centralize approval resolution so hook, automated-reviewer, and user decisions share rejection handling and report the correct telemetry source.
## Testing
- Add an integration test showing that an allow hook can approve a shell command during strict auto-review without invoking the automated reviewer.
GitOrigin-RevId: 18e9d76baee6cbae9d35ae517250f2f82270a9d2
* Add dedicated storage for paginated thread history (#32234)
## Why
Paginated thread history needs its own SQLite database to avoid adding lock
contention to the main state store.
## What changed
- Add the `thread_history_1.sqlite` path and migration scaffolding.
- Create tables and pagination indexes for projected turns and items, plus a
per-thread projection checkpoint.
- Register the database with runtime diagnostics, Bazel inputs, and database
telemetry.
GitOrigin-RevId: d194310835f1df2a2a29c7827d77ca37eabbd0a3
* Extract reverse JSONL scanning from session indexing (#32246)
## What changed
- Add a generic `ReverseJsonlScanner` that reads seekable JSONL data from the
end in bounded chunks, skips blank records, and reports malformed records
without stopping the scan.
- Use the scanner for reverse session-index lookups while preserving the
existing behavior of ignoring invalid entries.
## Testing
- Add coverage for unterminated final records, malformed JSON, blank lines,
chunk boundaries, and records spanning multiple chunks.
- Verify session-index lookup can skip an invalid record and still find valid
entries on either side of it.
GitOrigin-RevId: 66255f48492f74726d4ac4831cdc82f748de17d6
* Improve Responses WebSocket timing telemetry (#32256)
## What changed
- Emit `responsesapi.websocket_timing` payloads as opt-in trace events with request context, while excluding them from diagnostic uploads and persisted logs by default.
- Preserve fractional-millisecond TBT values in telemetry histograms and runtime summaries, rounding only when formatting the TUI label.
## Testing
- Cover timing-log filtering, fractional TBT collection and display, and existing whole-millisecond duration behavior.
GitOrigin-RevId: 5f0a1c60c237abed17cc8b2d569ca77fbbc6ec41
* Preserve local path conventions in automatic approvals (#32261)
## Why
Drive-shaped POSIX paths such as `/C:/workspace` can be mistaken for Windows
paths when an automatic approval request converts them from `PathUri`.
## What changed
- Keep approval paths as `PathUri` values together with their environment ID
until the automatic review request is built.
- Recover host-native paths for local working directories when strict
conversion cannot determine the path convention.
- Continue rejecting incompatible paths from remote environments.
## Testing
Add coverage for drive-shaped local POSIX paths, foreign remote paths, and
preserving apply-patch path URIs while building approval actions.
GitOrigin-RevId: 3fd31cfb4e8b46f9968ff66d5e986ca777430185
* Include start times in terminal turn events (#32263)
## What changed
- Add an optional `started_at` Unix timestamp to `TurnCompleteEvent` and
`TurnAbortedEvent`.
- Populate the timestamp from turn timing state when a turn completes or is
aborted.
- Preserve the timestamp when synthesizing interrupted fork history and when
importing external sessions.
## Testing
- Verify that interrupting a turn emits a `TurnAbortedEvent` with a start
timestamp.
GitOrigin-RevId: 75b3911b95c060e5fc1843a5e293d8fe47377186
* Expose scheduled tasks in plugin details (#32272)
## What changed
- Add optional `scheduledTasks` metadata to `plugin/read` responses for remote
plugins, including hourly, daily, weekday, and weekly schedules.
- Preserve the distinction between unavailable metadata (`null`) and a catalog
response containing no scheduled tasks (`[]`). Local plugin details return
`null`.
- Export the corresponding Rust, JSON Schema, and TypeScript protocol types.
## Testing
- Cover scheduled-task deserialization and propagation through `plugin/read`.
- Verify missing and empty remote metadata remain distinct.
GitOrigin-RevId: 7af223ed0a1bf6d8f054293084a73f34c6d0332d
* Remove the personality migration (#32274)
## What changed
- Stop the TUI and app server from inspecting existing sessions at startup to
set `personality = "pragmatic"` automatically.
- Remove the migration marker, helper APIs, and associated tests.
GitOrigin-RevId: 9e963bf113aff21651696bbc463f2749ac0f510a
* Repair unterminated rollout files before appending (#32276)
## Why
Appending directly to a non-empty rollout that lacks a trailing newline joins the
next JSON object to the existing record, producing invalid JSONL.
## What changed
- Ensure non-empty rollout files end with a newline before opening them for
append, including resumed, compressed, and direct append paths.
- Perform the synchronous tail inspection outside the async runtime.
## Testing
- Add a regression test covering newline repair and repeated opens.
GitOrigin-RevId: a3ca84cc1fd3b811caa9f4c5c8761a4b5b791357
* Honor `personality = "none"` in model instructions (#32277)
## Why
Model catalog instructions can include a baked-in `# Personality` section. An
explicit `none` setting should omit that section instead of sending it as part
of the model's base instructions.
## What changed
- Pass the configured personality into the models manager.
- When personality support is enabled and the setting is explicitly `none`,
remove the `# Personality` section through the next level-one heading from
catalog base instructions and instruction templates.
- Preserve explicit `base_instructions` overrides and avoid warning when no
personality was requested.
## Testing
Added unit and integration coverage for section removal, heading boundaries,
CRLF input, preserved configurations, and explicit base instructions.
GitOrigin-RevId: 452c88d3ac6001c2ac7d4fef269cd75dc239fa61
* Include terminal errors in turn completion events (#32280)
## What changed
- Add an optional `error` payload to `TurnCompleteEvent` and omit it when a turn completes without an error.
- Preserve the full terminal `ErrorEvent` through the turn lifecycle so the completion event includes the same error details emitted separately by `EventMsg::Error`.
## Testing
- Extend the stream-error integration test to verify that `TurnCompleteEvent` contains the emitted error and that the next turn can still proceed.
GitOrigin-RevId: 8d32942a44132763076130102d8b89ab356d59d0
* Clarify waiting behavior in safety buffering prompts (#32286)
## What changed
- Rename `Keep waiting` to `Dismiss and keep waiting`.
- Explain that no action is required, waiting continues, and the menu closes when the response is ready.
- Replace the generic confirmation hint with the new explanatory footer.
## Testing
- Update snapshots for safety-buffering prompts with and without the retry option.
GitOrigin-RevId: 2d336c59066e2689f291c5098ecc300921f39977
* Make GPT-5.6 Sol the default Bedrock model (#32288)
## What changed
- Prioritize the GPT-5.6 Sol, Terra, and Luna variants ahead of GPT-5.5 and GPT-5.4 in the static Amazon Bedrock catalog, making Sol the default.
- Use each GPT-5.6 variant's bundled description and default reasoning level while retaining Bedrock's `max` reasoning support.
## Testing
- Update model-provider and app-server tests to cover catalog ordering, variant metadata, and provider-aware fallback to GPT-5.6 Sol.
GitOrigin-RevId: 1761390254deae47b62c043b1ba707c384cde5e9
* Persist paginated items in the local thread store (#32289)
## What changed
- Allow the local thread store to create paginated threads while keeping them unsupported through the app-server API.
- Filter live append items using the history mode recorded with the thread's live recorder, so paginated threads persist canonical `ItemCompleted` events instead of legacy history events.
## Testing
- Add a local-store test that creates a paginated thread and verifies that a paginated item is persisted while a legacy user-message event is omitted.
GitOrigin-RevId: 83d93660afd5f0217213d4f21b5bf2a97745ff19
* Respect model support for reasoning summaries (#32290)
## What changed
- Add `supports_reasoning_summary_parameter` to model metadata, defaulting to
`true` for backward compatibility.
- Omit `reasoning.summary` and its summary-delivery stream option when the
selected model does not support the parameter.
- Apply the capability of the final selected model when a spawned agent uses a
different model.
## Testing
- Cover unsupported models in regular requests and spawned-agent model
overrides.
GitOrigin-RevId: 72b783799fc0685cef1501ef2dbf62d1308ceead
* Trust hooks from materialized workspace plugins (#32301)
## What changed
- Carry newly installed or updated remote plugin metadata through effective-plugin refresh callbacks, including coalesced refreshes.
- After a successful refresh, record the current hook hashes for listed workspace plugins associated with the active account while preserving existing hook settings and unrelated state.
- Serialize the background trust write with config mutations, and leave hooks untrusted if the write fails or the active account changes.
## Testing
- Cover eligible plugin selection and escaped hook config keys.
- Verify end-to-end trust for newly materialized plugin hooks, preservation of existing config, and fail-closed behavior when config cannot be written.
GitOrigin-RevId: 0b150766415be6fccc117f7856a241e10ad456f2
* Prefer the Codex home socket for Unix IDE context (#32302)
## What changed
- Look for the Unix IDE context socket at `CODEX_HOME/ipc/ipc.sock` first.
- Fall back to the existing per-user temp-directory socket paths, including both legacy paths for UID 0.
- Apply one request deadline across all connection attempts, and stop fallback after a timeout or a protocol error on a connected socket.
## Testing
- Added coverage for socket path selection, primary preference, legacy fallbacks, and timeout and protocol-error behavior.
GitOrigin-RevId: 560c827ad3d446a82ec503779995757096ac33e0
* Improve file blob upload diagnostics (#32305)
## Why
Blob upload failures previously surfaced the full signed upload URL and offered limited information for diagnosing transport and service errors.
## What changed
- Add a unique `x-ms-client-request-id` to each blob upload.
- Report transport failures with the upload host, elapsed time, error category, and client request ID, while stripping the signed URL from the underlying error.
- Report unsuccessful responses with Azure request and error IDs, and emit structured warning events with upload metadata and available Azure and Cloudflare identifiers.
## Testing
- Verify successful uploads include the client request ID header.
- Verify response and transport errors expose diagnostic fields without leaking signed URL parameters or response bodies.
GitOrigin-RevId: 9ae2cb2a9aacec4df237b3ee79a6467a6b9107e7
* Require prefixes for outbound response item IDs (#32312)
## What changed
- Add a `ResponseItemId` type that generates item-specific prefixes with UUIDv7 suffixes and use it across response items.
- Keep deserialization permissive for legacy histories, but omit empty or unprefixed item IDs from HTTP and WebSocket requests.
- Export the new type in the generated TypeScript protocol schema.
## Testing
- Cover prefixed ID generation, legacy deserialization, prefix recognition, and outbound request filtering.
GitOrigin-RevId: 0209fe430c826d0ae88bc4648652c4ebf390c4a4
* Stop falling back to older model availability announcements (#32316)
## What changed
Select the first model availability announcement in catalog order before
checking its display count. Once that announcement reaches its display limit,
show no announcement instead of falling back to a lower-priority model.
## Testing
- Update the model catalog test to verify that an exhausted higher-priority
announcement does not expose an older announcement.
GitOrigin-RevId: 65f23b34e1ecb38934effd5305704d7ab2353492
* Use canonical links in the moved config notice (#32326)
## What changed
Update the links in `codex-rs/config.md` to point directly to the configuration documentation on GitHub, including the MCP servers section.
GitOrigin-RevId: 8bf830b7062f83e44b5121dd11b1f1a20bb68e43
* Add ordinals to paginated rollout records (#32332)
## Why
Paginated thread history needs durable ordering so consumers can process a rollout suffix without rebuilding all earlier history.
## What changed
- Add optional, zero-based ordinals to `RolloutLine` records in paginated rollouts while leaving legacy rollout serialization unchanged.
- Continue ordinals from the last valid record when appending or resuming, including after gaps or an incomplete tail, and reject overflow without appending.
- Add a stateless `project_rollout_line` helper that maps canonical turn lifecycle and completed-item records into thread-history change sets.
## Testing
- Cover ordinal assignment, legacy compatibility, resume and tail recovery, overflow handling, and thread-history projection for completed, failed, and interrupted turns.
GitOrigin-RevId: 3a9bb6cd2a1f674a9f154342e96e9aa3d8330781
* Preserve parent sandbox enforcement for memory consolidation (#32441)
## What changed
- Pass the parent turn's effective permission profile to the memory consolidation agent, including thread-level permission and legacy sandbox overrides.
- Preserve disabled and externally enforced permission profiles instead of replacing them with a managed sandbox.
- Continue restricting consolidation to the memory root without network access when the parent uses Codex-managed permissions.
## Testing
- Add coverage for disabled, external, and managed parent permission profiles.
GitOrigin-RevId: 9ca3be0e41dc14d858053f6f70e33f4ae7c578e1
* Emit thread-idle lifecycle after guardian interrupts (#32460)
## What changed
- Emit the thread-idle extension lifecycle when the guardian successfully aborts an active turn after repeated automatic review denials.
- Keep user-initiated interrupt behavior unchanged.
- Add a regression test that waits for the thread-idle callback after a guardian interrupt.
GitOrigin-RevId: 6622c35361a3da9126c11bd6ca49a532c1bd6e27
* Expand tabs when rendering TUI diffs (#32461)
## What changed
- Replace tab characters in rendered diff spans with four spaces while keeping
their wrapping width and style intact.
- Ensure diff buffers never contain literal tab characters.
## Testing
- Cover tab expansion and wrapping in `wrap_styled_spans`.
- Update diff gallery snapshots at multiple terminal sizes.
GitOrigin-RevId: 2159e84991b844ea8c4c57dfad52bc3fe7a9059f
* Use available width for skill names in the toggle view (#32485)
## Why
The skill toggle view truncated every display name to 21 characters, even when
the popup had enough room to show more. This could hide the part that
distinguishes similarly named skills.
## What changed
- Pass full skill display names to the shared row renderer so it can fit them
to the available width alongside descriptions.
- Keep narrow layouts bounded by the renderer's width-aware truncation.
## Testing
Added coverage for preserving and filtering full display names, plus snapshots
for wide and narrow popup layouts.
GitOrigin-RevId: c434237e00440f920d8aa9c365b6bda5e68e0941
* Improve composer completion target resolution (#32628)
## What changed
- Resolve `@` and `$` completion targets on either side of the cursor while treating atomic text elements and line breaks as boundaries.
- Prefer the nearest editable mention when file, skill, and plugin candidates compete, and avoid treating common uppercase environment variables as skill queries.
- Insert a separator before completions adjacent to atomic elements and keep dismissed popup state scoped to the matching editable token occurrence.
## Testing
- Add unit and snapshot coverage for adjacent and partially bound mentions, whitespace boundaries, shell variables, popup dismissal, and file, image, skill, and plugin insertion.
GitOrigin-RevId: 352a42c7bcdbf4f6cd35368ced25f71926fdbc1b
* Extract connector runtime snapshot management (#32698)
## What changed
- Move the Codex Apps tool cache into a reusable `codex-connectors` runtime manager keyed by account and workspace.
- Represent cached tools as atomically published snapshots with refresh timestamps while preserving the newest accepted fetch generation.
- Harden disk persistence with bounded reads, atomic file replacement, and serialized writes so an older fetch cannot overwrite newer state.
## Testing
Add coverage for identity isolation, snapshot timestamps, oversized cache files, atomic replacement, and concurrent persistence ordering.
GitOrigin-RevId: 5ea2234469daae3abf54b030244c3251de62ca5a
* Log missing personality messages at trace level (#32744)
## What changed
Emit the diagnostic for a requested personality without model-specific messages
at `trace` instead of `warn`. The existing fallback to `base_instructions` is
unchanged.
GitOrigin-RevId: f7a00d28b57d4a6513df5d43c9456ae9b16c738b
* Make advanced reasoning selection explicit in the TUI (#32746)
## Why
`Max` and `Ultra` consume usage limits faster than standard reasoning levels, so they should not be selected accidentally while navigating the normal effort scale.
## What changed
- Move `Max` and `Ultra` behind a `More reasoning…` entry with a dedicated warning and descriptions.
- Keep the reasoning shortcuts from silently increasing into advanced efforts.
- Apply `Ultra` to the active conversation without changing defaults for new threads, while preserving it across mode switches and thread resumes.
- Record applied thread settings in thread metadata, including explicit clearing of reasoning effort, so resumed threads restore their latest model settings unless the user supplied an override.
## Testing
- Add TUI coverage for the advanced picker, shortcuts, Plan mode, configuration defaults, and resumed conversations.
- Add app-server and thread-store coverage for persisting, clearing, and restoring model and reasoning settings.
GitOrigin-RevId: 6708c7c2e8d38f491bf63000ea34f83476afdfe6
* Align Guardian reviews with session configuration (#32747)
## What changed
- Include permission instructions in Guardian review requests and let the review model use its configured tool mode and standard tool plan instead of a Guardian-specific direct-tool override.
- Refine the Guardian policy for tenant policy precedence, authorization scoring, prompt-injection handling, read-only investigation, and post-denial user approval.
- Simplify low-risk allow responses to `{"outcome":"allow"}` regardless of authorization scoring.
## Testing
- Update Guardian request-layout snapshots to cover the permission instructions included in initial and follow-up reviews.
GitOrigin-RevId: eb83571ef61f7b4e854c12e13e7163c6fab43f00
* Expose model overrides for multi-agent v2 spawns (#32749)
## What changed
- Add the `features.multi_agent_v2.expose_spawn_agent_model_overrides` setting, enabled by default, to expose `model` and `reasoning_effort` on the v2 `spawn_agent` tool.
- Keep these controls available when other spawn metadata is hidden, while allowing them to be disabled independently.
- Add root-agent and subagent guidance that overrides require a partial or context-free fork and should only be used when explicitly authorized.
## Testing
- Cover configuration parsing and defaults, usage-hint preservation, and tool-schema behavior with override exposure enabled and disabled.
GitOrigin-RevId: 92370498108c96fbd51f32965624ce531e991d9a
* Restrict spawned-agent models to the active backend (#32751)
## Why
Model overrides for `spawn_agent` must be compatible with the multi-agent backend used by the current turn.
## What changed
- Carry each model's multi-agent backend metadata into `ModelPreset`.
- Filter the advertised `spawn_agent` model overrides for multi-agent v2 and reject overrides assigned to another backend.
- Limit error suggestions to picker-visible, backend-compatible models.
## Testing
Added coverage for hiding incompatible models from the tool description and rejecting them during spawn validation.
GitOrigin-RevId: 22c12aba67df46e9743a74f019b72a1b8b76b308
* Add shadow metrics for lexical skill selection (#32761)
## What changed
- Add an opt-in `skill_search` feature that ranks prompt-visible skills against each turn's user input with a bounded weighted lexical selector.
- Keep the ranked selection out of model-visible context and record metrics for selection cost, catalog reduction, and whether later implicit or `skills.read` invocations matched the ranked candidates.
- Include host-provided skills in the experiment catalog without changing the rendered skill catalog.
## Testing
- Add selector unit tests covering ranking, limits, truncation, stop words, and deterministic tie-breaking.
- Add extension tests covering turn-local invocation recording and host-skill shadow selection.
GitOrigin-RevId: 4d00a1c805ea8b391d6c6ac6a8450afa88ca3e25
* Align shadow skill selection with observable sources (#32768)
## Why
Shadow selection can observe invocations from host and orchestrator skills, but
including executor skills in its candidates can skew the resulting metrics.
## What changed
Limit eligible shadow-selection candidates to enabled, prompt-visible skills
from host or orchestrator sources.
## Testing
Extend the implicit-invocation test to add matching executor candidates and
verify that the host skill remains the selected invocation hit.
GitOrigin-RevId: fd444fe27254b5a880ef5c03c29b5e195127cd97
* Enable skill search shadow selection by default (#32780)
## What changed
Mark `skill_search` as stable and enable it by default so the app server runs
shadow skill selection and emits its experiment metrics.
GitOrigin-RevId: ea9da3b71bfb3be2093aac89ad3d3e388931901d
* Apply MCP startup timeouts during client creation (#32781)
## What changed
- Apply each server's `startup_timeout_sec` (or the default) while creating the
MCP client, so the deadline also covers transport setup.
- Launch local stdio servers on a blocking task so synchronous command
resolution and process creation do not prevent the deadline from firing.
- Recognize the new client-startup timeout error and show the existing
`startup_timeout_sec` configuration hint.
## Testing
- Extend the timeout error display test to cover the client-startup timeout.
GitOrigin-RevId: 1967c62f943d55f6aa18792d4488e52c22f1e717
* Refactor OAuth store lock contention tests (#32801)
## What changed
- Extend the lock-contention test helper with a callback that runs while the
aggregate store lock is held.
- Use a scoped worker thread and return its result directly after releasing the
lock.
- Reuse the helper for concurrent update tests covering both file and secrets
credential stores.
GitOrigin-RevId: 74b8b5370456e90ecd39fc2af2f0853594ca4f60
* Make explicit multi-agent mode override proactive delegation (#32822)
## Why
After switching from proactive delegation to explicit-request-only mode, an
earlier proactive instruction can remain in the conversation context. The new
mode must clearly supersede that instruction.
## What changed
Update the explicit-request-only developer message to cancel earlier proactive
delegation instructions before requiring delegation to be explicitly requested
by the user, `AGENTS.md`, or a skill.
## Testing
Update the multi-agent mode integration test expectation for the explicit-mode
instruction emitted after a cold resume.
GitOrigin-RevId: 0a6d18f38ef82d29cf4f3bfcfd4ac84738a39598
* Avoid blocking thread startup on MCP OAuth discovery (#32825)
## Why
OAuth metadata discovery for an optional HTTP MCP server can stall, delaying
`thread/start` even though that server is not required.
## What changed
- Remove eager MCP authentication-status discovery from session and connection
manager startup.
- When an MCP connection reports an authentication error, inspect configured and
stored credentials locally to preserve login and reauthentication failure
reasons without making another discovery request.
- Continue using server configuration directly for startup error messages and
timeout hints.
## Testing
Add an app-server regression test with an optional HTTP MCP endpoint that accepts
a connection but never responds, and verify that `thread/start` completes without
waiting for its configured startup timeout.
GitOrigin-RevId: 56fe0188cc1ceaf746b0b65e8b7dd1fd2e13420d
* Forward turn metadata in standalone web search (#32835)
## What changed
- Add optional serialized Codex turn metadata to extension tool calls.
- Populate it from the current turn context and send it as the
`x-codex-turn-metadata` header on standalone web search requests.
## Testing
- Extend the app-server web search integration test to verify that client
metadata, including the model ID, reaches the standalone search request.
GitOrigin-RevId: c0950108d89a1d317ac94ccd23efcee72fffc6f0
* Restore V2 agent identities on root thread resume (#32837)
## Why
After a cold resume, a Multi-Agent V2 root thread must still be able to
address its persisted descendants even though their runtimes are not reopened
eagerly.
## What changed
- Restore metadata for open descendant agents when resuming a V2 root thread.
- Preserve each descendant's path, nickname, and role while leaving its runtime
unloaded until a message targets it.
- Reuse the spawn metadata preparation path so restored identities retain the
same reservation and naming checks as newly spawned agents.
## Testing
Added an end-to-end cold-resume test that follows up with a persisted agent by
name and verifies that the original agent thread is loaded on demand.
GitOrigin-RevId: a1663c1ae60eefadb948cd39f933cd3bbb49a492
* Reap exited PID-managed app-server children (#32838)
## Why
An app-server child started by a previous updater can remain as a zombie after
termination. Its PID then still appears active, causing daemon shutdown to wait
until its timeout instead of removing the stale PID file.
## What changed
- Poll `waitpid` with `WNOHANG` while waiting for a PID-managed process to stop.
- Check process state before enforcing the stop deadline so an exit at the
deadline can still be observed and cleaned up.
## Testing
Added a regression test that stops an untracked child and verifies that shutdown
finishes promptly and removes its PID file.
GitOrigin-RevId: b203cf860e4207716a6cfc36015f8ee77918d13a
* Expand millisecond duration histogram boundaries (#32844)
## What changed
Add finer-grained buckets from 1 to 10 seconds and extend millisecond duration histograms with buckets up to 120 seconds.
GitOrigin-RevId: dee492de08db058444926d22281ef7bc4ba1cdeb
* Hide Windows filesystem helper console windows (#32849)
## What changed
- Add a console mode to the Windows sandbox process launcher.
- Launch `--codex-run-as-fs-helper` subprocesses with `CREATE_NO_WINDOW`.
- Preserve inherited-console behavior for regular sandboxed commands.
GitOrigin-RevId: 927be36b82903b6a5fb1a243ba7f406f9ed85f3f
* Require the elevated Windows sandbox for network proxies (#32857)
## Why
Network proxy enforcement on Windows requires the elevated sandbox backend. Silently selecting that backend for an unelevated configuration makes the effective sandbox differ from the configured mode.
## What changed
- Reject enabled network proxy configurations on Windows unless managed requirements allow only the elevated sandbox and `windows.sandbox` resolves to `"elevated"`.
- Preserve the configured sandbox backend during execution and validate proxy compatibility at config loading, sandbox setup, and process launch boundaries.
- Defer this validation during cloud-config bootstrap so authoritative managed requirements can be loaded first.
- Do not start or expose disabled Windows proxies, and render transitions to disabled networking as `<network enabled="false"></network>`.
## Testing
- Cover Windows requirement and sandbox compatibility matrices, bootstrap behavior, backend selection, disabled proxy handling, and environment-context updates.
GitOrigin-RevId: bfa1dda98594e0db61883f8e7f65bd560e3453e6
* Persist slash-command popup dismissal (#32858)
## What changed
- Make `Esc` dismiss the slash-command popup immediately without changing the draft or interrupting a running task.
- Keep the popup closed while the first-line command token is unchanged, and reopen it after the token is edited.
## Testing
- Cover dismissal while idle and while a task is running.
- Add a snapshot confirming that the dismissed popup remains hidden.
GitOrigin-RevId: f0ee84af080181e8d92c435f474ded1c8cb5b457
* Coalesce concurrent Windows sandbox setup requests (#32864)
## Why
Concurrent callers can submit the same Windows sandbox setup payload while an
identical helper invocation is already running.
## What changed
- Share one in-flight helper invocation among setup and refresh requests with
identical serialized payloads.
- Return the shared success or failure to every waiter while preserving
structured setup error codes, then allow subsequent requests to run again.
## Testing
- Add a concurrency test that verifies identical requests execute the setup
operation once.
GitOrigin-RevId: 18ebbcb9b36de3eb5912b8bbbe153d39328b5e48
* Allow responses after image generation (#32866)
## What changed
Remove the image generation instruction that prohibited any response after an
image was generated.
GitOrigin-RevId: c779055da3142ba84cdbb9312e5f66b132f24b29
* Include connector IDs in MCP tool call analytics (#32867)
## What changed
- Add the optional `connector_id` to `codex_mcp_tool_call_event` parameters.
- Populate it from the MCP tool call's `app_context` when available.
## Testing
- Extend the completed tool item analytics test to verify the connector ID is serialized.
GitOrigin-RevId: ea62202318dd492fa0ffd4ff1d48a66d1cc37e96
* Use model catalog policies for Guardian auto review (#32875)
## What changed
- Add an `auto_review.policy` field to model catalog messages.
- Use the selected Guardian model's catalog policy for review-session instructions, while preserving the precedence of `guardian_policy_config` and falling back to the built-in policy when neither is present.
- Preserve auto-review messages when model instruction overrides remove catalog instruction templates.
## Testing
- Cover configured-policy precedence, explicit empty catalog policies, catalog-message preservation, and propagation of the catalog policy into a prewarmed Guardian session.
GitOrigin-RevId: 26b61ae2958ea8325a64834dcf91f47e140d74b3
* Broaden remote compaction model fallback (#32881)
## Why
Compacting a resumed conversation can fail when its previous model is no longer
available. Some model-specific failures, such as a model-not-found response, are
not represented as invalid requests and therefore did not trigger the existing
fallback to the currently selected model.
## What changed
- Share a retry predicate between both remote compaction implementations.
- Fall back to the current model for invalid requests, unexpected statuses,
context-window and usage-limit errors, server failures, and exhausted retries.
## Testing
Add an integration test that resumes a conversation whose previous model returns
model-not-found and verifies that compaction and the next turn use the renamed
model.
GitOrigin-RevId: c3857beae2ce79b50589deb13c2e59710ce14725
* Prepare external agent migration for source adapters (#32884)
## What changed
- Add an optional `source` selector to `externalAgentConfig/detect`, while preserving the existing behavior for omitted, `null`, and unrecognized values.
- Pass `claude-code` as the source for TUI detection and import requests.
- Move source-specific migration behavior behind an adapter boundary and consolidate session migration into `codex-external-agent-migration`.
## Testing
- Cover explicit, omitted, and unknown detection source values with app-server protocol tests.
- Add unit coverage for the extracted migration and hook helpers.
GitOrigin-RevId: 63bd3dcb485f3ad7bd996022db4e351506aeea77
* Tag shell tool telemetry by command category (#32887)
## What changed
Add a `command_category` tag to tool result telemetry for `exec_command` and
`shell_command` invocations. Classify parsed commands as `read`, `list_files`,
`search`, or `unknown`; use `mixed` when a script contains multiple categories.
GitOrigin-RevId: 1edacb38c7be9b03af4f2fc86746184f19067592
* Attach connector caches to diagnostic uploads (#32891)
## What changed
- Include the active Codex Apps tools cache and connector directory cache, when available, in diagnostic uploads that include logs.
- Resolve cache paths from the current authentication context and use stable attachment filenames.
- List both optional cache files in the upload consent dialog.
## Testing
- Add coverage for selecting existing active cache files, including a directory cache without an account ID.
- Update consent dialog snapshots to include the optional attachments.
GitOrigin-RevId: 1d4ffbf2bcb96653f03dc25f91d80dd65038d585
* Serialize plugin install requests (#32894)
## What changed
- Mark `request_plugin_install` as not supporting parallel tool calls so install requests execute serially.
- Add a unit test covering the handler's parallel-call capability.
GitOrigin-RevId: 5f2c8184562bd776b0e527e5e258c61c604a0910
* Load model context from a bounded rollout suffix (#32896)
## Why
Reconstructing the latest model-visible context does not require replaying an
entire paginated rollout when a usable compaction checkpoint and the associated
completed-turn metadata are available.
## What changed
- Add `ThreadStore::load_latest_model_context` and `StoredModelContext` for
loading replay-ready model context independently of full thread history.
- Reverse-scan plain paginated JSONL rollouts until the newest safe bounded
suffix is found, while preserving canonical session metadata and chronological
replay order.
- Fall back to complete history for legacy or compressed rollouts and whenever
compaction or rollback records make a bounded cutoff unsafe.
## Testing
- Cover checkpoint selection, turn-metadata boundaries, agent messages,
contextual user fragments, and full-history fallbacks.
GitOrigin-RevId: 3572f4ecc7aa4099a6d9f0d3e72d0ef432cd9497
* Route blocked network requests to their owning calls (#32897)
## Why
Policy-blocked proxy requests must terminate the corresponding active tool call and preserve the correct approval result, including when multiple calls are running concurrently.
## What changed
- Resolve a blocked request's execution ID to its registered active network call before recording the policy denial.
- Preserve an outcome already recorded for that call, and cancel the owning call after storing a new denial.
## Testing
Expand network approval integration coverage for Guardian and user decisions, permission hooks, persisted policy amendments, concurrent calls, timeouts, cancellations, and unattributed proxy requests.
GitOrigin-RevId: 961901bbc07cc498309453ec78cda1a56ab00a4b
* Expose structured standalone web search results (#32898)
## Why
Standalone web search can return structured result DTOs separately from its
model-facing text output. App-server clients need access to that data without
coupling Codex to every result type or field.
## What changed
- Preserve the optional `results` array from `/v1/alpha/search` as opaque JSON
through web-search completion events, thread history, and app-server
`webSearch` items.
- Keep responses from older endpoints compatible when `results` is absent, and
allow clients to ignore result types and fields they do not understand.
- Regenerate the protocol schemas and TypeScript definitions for the optional
field.
## Testing
- Cover responses with missing, empty, and forward-compatible result payloads.
- Verify standalone web-search results round-trip through app-server item
notifications and thread-item conversion.
GitOrigin-RevId: 739ef5694ece5733f7b8749ec41d6bfa3f33c8c5
* Add exec-server environment status checks (#32899)
## What changed
- Add the initialized `environment/status` RPC, which reports `ready` when the exec server can handle requests.
- Expose environment IDs and `ready`, `pending`, or `disconnected` status through `EnvironmentManager` and `Environment`.
- Keep status checks non-mutating: they do not start or recover lazy remote environments, and probe only an existing connection.
## Testing
- Cover the status RPC over WebSocket and the in-process request processor.
- Verify that checking an unstarted stdio environment leaves it pending and that failed connections report as disconnected.
GitOrigin-RevId: 22febeb6a3457849292128a8991c6400c22b3fd8
* Derive collaboration settings from turn context (#32900)
## Why
`TurnContext` stored model and reasoning settings both as resolved turn fields and inside `CollaborationMode`, requiring the copies to stay synchronized when the model changed.
## What changed
- Store the mode and collaboration-mode developer instructions directly on `TurnContext`.
- Reconstruct `CollaborationMode` from those values plus the turn's current model and reasoning effort when callers need it.
- Read the mode directly for plan-mode checks, lifecycle events, and telemetry.
GitOrigin-RevId: b8fccafdd5d5cbccc84bc70d542588087ddf0093
* Include session IDs in tool item analytics events (#32903)
## What changed
- Add `session_id` to the shared tool item event payload, sourced from the
thread metadata.
- Preserve the parent session ID on tool events emitted by subagent threads.
## Testing
- Cover serialization of the session ID for command execution events,
subagent tool events, and every supported completed tool item type.
GitOrigin-RevId: 73afc0e1be1ddec4fb5a42f43a23f1e87360e68f
* Timestamp app-server notifications at emission (#32905)
## What changed
- Add an optional `emittedAtMs` field to server notification envelopes and expose the envelope in the generated JSON and TypeScript schemas.
- Populate the Unix timestamp when app-server emits a notification, before transport routing, so every connection in a fan-out receives the same value.
- Keep the field optional for clients decoding notifications from older app-server versions.
## Testing
- Verify notification serialization includes `emittedAtMs`.
- Verify targeted fan-out reuses one timestamp across connections.
GitOrigin-RevId: b379cb11e8e91c558bcd3d46ce459311a6e81e54
* Allow injecting the models manager into `ThreadManager` (#32911)
## Why
Embedding callers need to control whether model catalogs are persisted to disk.
## What changed
- Accept a shared models manager when constructing `ThreadManager` instead of always creating a cached manager internally.
- Add provider APIs for creating uncached model managers. OpenAI-compatible providers fetch on each `OnlineIfUncached` refresh without reading or writing `models_cache.json`.
- Keep existing app server, MCP server, sample, and test callers on the standard cached manager.
## Testing
- Verify an uncached manager fetches on every refresh.
- Verify an injected uncached manager controls thread refresh behavior and does not create `models_cache.json`.
GitOrigin-RevId: 8bb646054ecec4ccb865b2bf56249384916ea9db
* Expose environment status through app-server (#32920)
## What changed
- Add the experimental `environment/status` request for inspecting a configured environment without starting or reconnecting it.
- Report `ready`, `pending`, `disconnected`, or `unknown`, including error details for disconnected and unknown environments.
- Probe ready remote environments over their existing exec-server connection.
## Testing
- Add an app-server integration test covering local and remote ready, pending, disconnected, and unknown environments.
GitOrigin-RevId: 397bba603aa9e0b59008ee6cb7cbde46e357652c
* Materialize paginated thread history in SQLite (#32923)
## What changed
- Project durable paginated rollout records into rebuildable SQLite tables for turns, items, and projection progress while keeping JSONL as the source of truth.
- Add cursor-based local reads for turn summaries and thread or per-turn items, including archived-thread and history-mode validation.
- Serialize writes, shutdown, and deletion per thread so projection updates cannot race cleanup, and remove projected rows when a thread is deleted.
- Preserve stable item ordering while updating repeated snapshots and expose structured turn error details.
## Testing
- Cover projection, snapshot updates, summary recovery, pagination, failure handling, shutdown flushing, legacy-mode rejection, and deletion races.
GitOrigin-RevId: 34533185ece7f1f5690004c7f12b0f1f34dc2640
* Resume thread history projection from its SQLite checkpoint (#32928)
## Why
Thread history JSONL is the durable source of truth, while SQLite is a rebuildable view. If a SQLite projection fails after a durable append, the next write must catch up the unprojected suffix instead of skipping it.
## What changed
- Start materialization at the byte offset stored in `thread_history_projection_state`.
- Project only complete newline-terminated rollout records, leaving a trailing partial record for a later pass.
- Preserve validation for missing files, invalid offsets, and missing or out-of-order ordinals without advancing projection state.
## Testing
Add coverage for catching up after projection failure, avoiding replay when already synchronized, retaining partial lines, and rejecting invalid suffixes without changing SQLite state.
GitOrigin-RevId: 8a7200a77edd5411ddf5fe31ab6af5ee287ed7d7
* Restrict Guardian reviewer tools (#32945)
## What changed
- Limit Guardian reviewer sessions with an environment to `exec_command`,
`write_stdin`, and `view_image`.
- Exclude general tool sources from Guardian reviewer tool planning.
## Testing
- Extend the Guardian request snapshot test to assert the exact model-visible
tool list.
GitOrigin-RevId: 80ba7011c23c32d163aaad906087fac396cc70fa
* Tighten recommended plugin install suggestions (#32949)
## What changed
- Limit `request_plugin_install` guidance to explicitly requested plugins after tool search has been exhausted.
- Exclude adjacent capabilities, broad recommendations, and plugins that only seem potentially useful.
- Clarify that `plugin_id` is the parenthesized ID from `<recommended_plugins>` and prohibit parallel tool calls.
- Keep the recommendation context focused on listing available plugins while the tool specification owns the installation criteria.
## Testing
- Update tool specification tests to verify the stricter eligibility and serialization guidance.
GitOrigin-RevId: 6ebfdd864a76316ab59a0624dc4d7d3abda39a98
* Scope runtime workspace roots to execution environments (#32952)
## Why
Multi-environment turns can run against different filesystems, so a single
thread-wide workspace-root list cannot accurately describe every selected
environment.
## What changed
- Add optional `runtimeWorkspaceRoots` to each app-server environment selection.
Omitted roots default to that environment's `cwd`, while an empty list selects
no roots.
- Carry environment-native roots through turn selection, model-visible context,
permission materialization, and tool sandboxing.
- Keep the top-level `runtimeWorkspaceRoots` field as a compatibility input when
constructing default environment selections; explicit selections use their
own roots.
## Testing
- Cover thread and turn API defaults, overrides, empty roots, and schema
round-tripping.
- Verify foreign roots remain model-visible and remote execution applies the
target environment's roots before sandbox selection.
GitOrigin-RevId: c6e7a62883c45c676c153055f46a55ee15a323a4
* Expose exact per-response usage in raw app-server events (#32985)
## Why
Clients that account for individual upstream Responses API calls need the exact
usage for each completion rather than accumulated or estimated thread usage.
## What changed
- Add the opt-in `rawResponse/completed` app-server notification with the
`threadId`, `turnId`, `responseId`, and upstream `usage` payload.
- Emit the transient event for normal turns and compaction requests when
`experimentalRawEvents` is enabled. The event is not persisted or replayed,
and `usage` is `null` when the upstream response omits it.
- Export the notification in the app-server schemas and document its behavior.
## Testing
- Cover exact token breakdowns for turn and compaction completions.
GitOrigin-RevId: 49040a060bf1784c1ff1dd62112efb4a778428c4
* Always confirm before enabling full access (#32989)
## Why
Full access significantly increases the risk of data loss, leaks, or unexpected behavior, so users should explicitly confirm each time they select it.
## What changed
- Always open the full access confirmation when user-reviewed approvals are active, regardless of `notices.hide_full_access_warning`.
- Remove the persistent "don't ask again" option and its acknowledgement events.
## Testing
- Update the TUI permission tests and confirmation popup snapshot to cover repeated confirmation.
GitOrigin-RevId: 0ee827332441e13d9445349ed6a5a92dc8fef4b2
* Bound exec-server JSON-RPC decoding complexity (#33013)
## Why
Compact JSON arrays can expand into millions of heap values during decoding, and duplicate object keys make a message ambiguous.
## What changed
- Limit exec-server JSON-RPC messages to 256K JSON values and reject duplicate object keys.
- Cap `fs/read_directory` results and retained `process/read` output at 50,000 entries or chunks so locally produced responses remain within the decoder budget.
## Testing
Add coverage for all JSON-RPC variants, large scalar payloads, duplicate keys, compact array amplification, and retained process output at the chunk limit.
GitOrigin-RevId: e31d1f25ab0a7e2272015c98174fd2b7cdd669d7
* Include raw response completions in TypeScript envelopes (#33026)
## What changed
Add `rawResponse/completed` and its `RawResponseCompletedNotification` payload
to the generated `ServerNotificationEnvelope` union, keeping the envelope type
aligned with the supported server notifications.
GitOrigin-RevId: 25a8b5e05a146a66ea65928eb6f0c3bd7b80f082
* Remove task messages from `list_agents` output (#33030)
## What changed
- Return only each live agent's name and status from `list_agents`.
- Stop tracking the most recent task message in agent metadata.
GitOrigin-RevId: 91836fe8efad7ea6b7305f0b409081ec77419cfd
* Preserve JSON number precision in exec-server RPC messages (#33031)
## Why
Exec-server JSON-RPC payloads can contain decimals, exponent notation, and
integers outside the native 64-bit range. Decoding these values should preserve
their original JSON representation without weakening the existing message
complexity limit.
## What changed
- Enable `serde_json` arbitrary-precision number and raw-value support for the
exec-server protocol.
- Decode serde's number and raw-value wrappers in the bounded JSON visitor,
charging nested raw values against the 256K-value limit.
- Select the JSON-RPC envelope variant from its fields after bounded decoding so
arbitrary-precision values survive message deserialization.
## Testing
Add coverage for exact arbitrary-precision number round trips and for enforcing
the value limit inside raw-value wrappers.
GitOrigin-RevId: a6e0a3fba6f88e4e8a6ff414832f078beb2d2a70
* Use session IDs for prompt cache keys (#33035)
## What changed
- Default `prompt_cache_key` to the session ID from response metadata instead of the thread ID.
- Preserve explicit prompt cache key overrides.
- Verify that API-key-authenticated root and subagent requests use the same session-based cache key even though they have different thread IDs.
GitOrigin-RevId: cb1bf21a3cb8fa2c5083c5c6afd4829ff2adcf1f
* Send plugin analytics with API key authentication (#33040)
## What changed
Allow API key sessions to send plugin-attributed `codex_plugin_used`,
`skill_invocation`, and `codex_mcp_tool_call_event` events. Continue to drop
events without a plugin ID and all other analytics events for these sessions.
## Testing
Add coverage that mixes plugin and non-plugin events and verifies that only the
three plugin-attributed event types are delivered without server-owned auth
fields.
GitOrigin-RevId: 1f47af5e9516723154f566ad032dba3ebd98abf9
* Add an agent extension runner (#33076)
## What changed
- Add `codex-agent-extension` with an `AgentRunner` that starts a resolved agent prompt in a thread forked from its parent.
- Propagate the invocation's trace context, select the configured execution environments, submit the initial prompt, and return the spawned thread and turn identifiers.
- Reject empty agent prompts and report when the owning thread manager is no longer available.
## Testing
- Add an integration test that verifies the agent runs in a forked thread, returns the started turn identifier, completes the turn, and sends the resolved prompt to the model.
GitOrigin-RevId: ffb805efabadf758969d6611a6867db6fa9f059a
* Preserve streamed output during capped history replay (#33093)
## Why
Stream consolidation can replace transcript cells while initial history replay is buffering capped display rows, leaving those rows stale and omitting the finalized output.
## What changed
- Discard buffered rows when required stream reflow occurs during capped initial replay and rebuild the capped tail from the canonical transcript after replay finishes.
- Schedule the rebuild through the resize reflow path so it waits for an active transcript overlay to close.
## Testing
Added coverage for consolidated Markdown output during capped initial replay, both with and without an active transcript overlay.
GitOrigin-RevId: 1c184ff561a50362daf11c1c629be59882f27a4a
* Fix TUI status visibility around streamed output (#33105)
## What changed
- Hide the working-status indicator when finalized assistant output is committed to the transcript, including single-line final answers.
- Restore the indicator when image generation begins during a running task after its streamed preamble has been flushed.
## Testing
- Add snapshot coverage for a single-line final answer and for image generation following a single-line preamble.
GitOrigin-RevId: e294a11cda3f0ce46f2bbed1be2a1380c9c73085
* Preserve special filesystem subpaths as wire strings (#33107)
## Why
Special filesystem subpaths can contain relative or foreign-platform path
spellings. Treating this wire text as a host-native path can reinterpret it.
## What changed
- Store special filesystem subpaths as strings in the core permissions model.
- Represent app-server subpaths as `LegacyAppPathString` and convert them at
the protocol boundary without changing their spelling.
- Add `LegacyAppPathString::from_string` for callers that already own legacy
app-server path text.
GitOrigin-RevId: 2214f03aa997fd0e6eb2ab60d425304bb4bd6132
* Reject forks of paginated threads (#33109)
## What changed
- Check the source thread's `history_mode` before loading its history for
`thread/fork`.
- Return the existing `paginated_threads is not supported yet` method-not-found
error for paginated source threads.
## Testing
- Add an app-server integration test covering rejection of a paginated source
thread.
GitOrigin-RevId: 49b4b8aef7c9488eec93c24e831cea6382f8c995
* Allow injecting the Codex Apps tools cache (#33113)
## What changed
- Accept a caller-provided `CodexAppsToolsCache` when constructing a `ThreadManager` and pass it through to the MCP manager.
- Add `ConnectorRuntimeManager::new_without_cache()` for an in-memory runtime that neither loads nor persists connector state on disk.
- Re-export `CodexAppsToolsCache` from `codex-core` and `codex-core-api` for embedders.
## Testing
- Verify that a cache-disabled connector runtime ignores existing disk state and publishes live tools without creating cache files.
GitOrigin-RevId: f52f4f27c425a8d84ad0d0987b30a6fc3c14d702
* Refine GPT-5.6 prompting and migration guidance (#33121)
## What changed
- Recommend simplifying prompts incrementally and evaluating each change while preserving product requirements.
- Document `text.verbosity` as the default response-detail control and clarify how prompts should specify task-specific content and tone.
- Clarify autonomy and approval boundaries for multi-step work.
- Narrow Programmatic Tool Calling guidance to bounded reduction workflows and call out validation of both `program_output` and the final assistant `message`.
GitOrigin-RevId: 2334a1cfba9ead53d2002a097920d1306bcae0d4
* Support model catalog permission messages (#33147)
## What changed
- Add per-sandbox-mode permission messages to `ModelMessages` and preserve them when applying model configuration overrides.
- Use the selected catalog message in permission instructions, substituting `{{ network_access }}` with the active network policy. Fall back to the existing sandbox text when no override is provided, and allow an empty override to omit only the sandbox section.
- Apply catalog permission messages when a session starts and when its model changes.
## Testing
- Cover catalog deserialization, mode selection, network substitution, fallback and empty-message behavior, remote model catalogs, and model changes.
GitOrigin-RevId: cd5ed3aee3155dca0e7b2358c0f09bae73236856
* Build MCP tool runtimes before router planning (#33149)
## What changed
- Convert filtered MCP tool metadata into `CoreToolRuntime` instances before constructing the tool router.
- Pass those runtimes through the shared tool-planning path instead of maintaining separate direct and deferred MCP tool lists.
- Preserve MCP visibility, app policy filtering, and direct versus deferred exposure behavior.
GitOrigin-RevId: 67f7fbeecc2992318c859e038cd97938833911db
* Clarify exec yield timing on Windows (#33150)
## Why
The generic `yield_time_ms` description does not explain the Windows-specific
initial wait behavior or when callers should choose a shorter value.
## What changed
- Describe `yield_time_ms` on Windows as the maximum wait before a running
command returns a session ID, while commands that finish sooner still return
…
…nt/wallentx_termux-target_from_release_0.144.4_db6e2ea32bf3 # Conflicts: # .github/workflows/rust-release.yml # codex-rs/Cargo.toml
unemployabot
Bot
deleted the
checkpoint/wallentx_termux-target_from_release_0.144.4_db6e2ea32bf3
branch
July 18, 2026 08:57
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Termux release checkpoint
release/0.144.4db6e2ea32bf37bd3daf8357723d819fd6700f697wallentx/termux-targetThis PR carries release-train conflict fixes and follow-up changes back into the reusable Termux patch branch.
Release-only workflow files and metadata under
.githubwere restored to the destination branch versions before opening this PR.