## What changed

- Add a stable `sleep_tool` feature that can enable or disable registration of the built-in sleep tool independently of the clock tool.
- Support structured `features.sleep_tool` configuration with `model_driven` and `always_on` modes. The default `model_driven` mode preserves the existing model and `current_time_reminder` behavior, while `always_on` registers sleep whenever the feature is enabled.
- Preserve nested sleep-tool configuration across CLI overrides, config merges, and feature toggles, and expose the settings in the generated config schema.

## Testing

- Cover feature-map overrides, both selection modes, legacy clock settings, config merging and editing, and invalid mode rejection.

GitOrigin-RevId: 18eadc582f8a4445958c29d063e5be495276703e

## Why

Realtime voice calls can span zero or many backing turns, so they need the
saved thread source to identify their origin consistently.

## What changed

- Add `thread_source` to `x-codex-turn-metadata` when starting realtime
  WebSocket, existing-call, and WebRTC transports.
- Encode the metadata as header-safe ASCII and omit absent, invalid, or
  larger-than-256-byte source values.

## Testing

- Cover source propagation, escaping, and size limits across realtime
  transports, including child threads that share a parent session.

GitOrigin-RevId: b5a9eef8dfdbb83387bd0e364a4922b15030f4d6

## Why

History and notes results are already limited by the backend using the requested
output budget before encryption. Applying another client-side limit can reject
or truncate an already bounded response.

## What changed

- Return encrypted history and notes results without an additional size check.
- Preserve fallback JSON results instead of truncating them again when building
  the tool response.

GitOrigin-RevId: 97e7a59a13e8d485cc3c613d0fdf8073f6eb67ab

## What changed

- Build per-context conflict checks from the shared runtime action registry instead of maintaining separate action lists.
- Preserve the existing context validation order and error messages.
- Add regression coverage for the first reported conflict across editor, Vim, pager, list, agents, and approval contexts.

GitOrigin-RevId: 665839bb9094ac573ab1494248c69c4000998483

## What changed

- Convert history backend `images` into `input_image` function-call output items alongside encrypted or plaintext history content.
- Keep image data out of logged output and post-tool-use hook responses.
- Reject malformed image attachments instead of silently dropping them.

## Testing

- Cover encrypted and plaintext outputs, supported image detail values, malformed attachments, and propagation into the next model request.

GitOrigin-RevId: a8eee10eb09c637bcfb06a759dd6313caf707e51

## What changed

- Share the root thread's current service tier across its agent tree.
- Apply that tier to each subagent request when the selected child model supports it, including remote compaction requests.
- Propagate root service-tier updates to existing and newly spawned subagents without rewriting child-owned settings.
- Remove per-spawn and role-level service-tier overrides so routing remains controlled by the root thread.

## Testing

- Cover supported and unsupported child models, full-history forks, live tier changes, remote compaction, new subagents, and reloaded subagents.

GitOrigin-RevId: 6c299e224e90b41a558788fb7aa4d5f336fa383a

## Why

After switching a thread to a model that requires automatic review, a
standard-scope approval could reuse a cached low-risk score for an action that
skipped classification. This allowed the action to bypass the required full
review.

## What changed

Check the thread's current model requirements before making a fast Guardian
decision. Defer required models to the full review path instead of approving
from cached scoring state.

## Testing

Add coverage for switching to a required model and reviewing a sandboxed
command without running another classification.

GitOrigin-RevId: e79e6a5df19c46acd5c4176f522a859793177639

…#41313)

## Why

The overload integration test coupled terminal error behavior to live retry timing and tracing events.

## What changed

- Verify retry attempts and exponential backoff directly with `run_with_retry` under paused Tokio time.
- Keep the overload integration test focused on request count and terminal error events.
- Add timeouts while waiting for retry telemetry, resumed requests, and turn completion so failures cannot hang the test.

GitOrigin-RevId: 571a6a6a36a6aded038000a63bff1958c7209913

## What changed

Update the Guardian v2 required-model-switch test to continue the thread with
empty input. This keeps authorization unchanged, so the test specifically
verifies that the required-model check prevents reuse of a cached approval for
the sandboxed command.

Continue asserting that a Guardian review starts and that the command skips a
second classification.

GitOrigin-RevId: 5ce914cb6e66f0527d9ec154331cc356104bfb72

## Why

An existing terminal keeps the sandbox, network settings, and grants it had at launch. Later `write_stdin` calls must account for that retained authority, including when permissions change between turns.

## What changed

- Capture each terminal's effective launch permissions and compare them with the current environment before accepting non-empty input.
- Request approval when the terminal bypassed the sandbox, retains additional grants, strict auto-review is active, or its sandbox or network settings differ from the current policy.
- Reject input when current denied-read or environment-owned network restrictions cannot be enforced by the existing terminal, while keeping empty polls and non-TTY interrupts available without review.
- Include the effective sandbox mode and user-visible additional grants in `write_stdin` approval actions without exposing host-owned grant paths.

## Testing

Added unit and end-to-end coverage for retained cross-turn grants, strict auto-review, sandbox and network policy changes, denied reads, Windows sandbox backends, and private grant redaction.

GitOrigin-RevId: e2d71daf9358474c885998786c4928069100711c

## What changed

- Mark `clock.curr_time` and `clock.sleep` as built-in control tools so their calls emit control-tool analytics.
- Cover completed, failed, and interrupted calls, verify analytics omit tool arguments and output, and keep the calls out of the dynamic-tool count.

GitOrigin-RevId: 489c8015f836be146ccc2c7e96ef7243b0599e16

## Why

Binding capture can wait for multiple MCP servers concurrently. During that wait, a tool catalog may be published by another connection or expire after it has already allowed a server to remain dormant. Re-reading only the current cache could omit those tools or trigger unnecessary startup.

## What changed

- Retain the cached catalog that permits lazy startup for the duration of binding capture.
- Recheck the cache after the optional startup grace so catalogs published while waiting are included.
- Add regression coverage for catalogs published during startup and catalogs that expire while another server is resolving.

GitOrigin-RevId: b5c66831db8f9ebecc79ff25c5b4b0182ad68a2f

## Why

An MCP binding can wait for one server while another connection updates a
shared tool catalog. Preferring the catalog captured before that wait can omit
newly available tools from the first model request.

## What changed

- Recheck the current MCP tool catalog before using the captured fallback.
- Keep the captured catalog when it expires during the wait, while honoring a
  server that disables catalog caching.

## Testing

- Cover a shared Apps cache populated by a peer while binding capture waits.
- Cover cache opt-out while capture waits for another server.

GitOrigin-RevId: e4389c7ba23e4d8397dbae0930c9e36ba0a172fb

## What changed

- Assign type-prefixed IDs to Guardian classifier input items before sending the request, preserving existing IDs and reusing generated IDs across WebSocket retries.
- Add a prefixed ID to the memory phase-one user message.

## Testing

- Verify retried Guardian requests contain the same unique, prefixed item IDs.
- Verify the memory phase-one request includes a prefixed user-message ID.

GitOrigin-RevId: e01da49d9a661b6bfd2088f091a3ddf69d601e40

## Why

Manual terminal-input approvals shell-quote the proposed input, which cannot
preserve NUL bytes for an accurate review.

## What changed

Reject terminal input containing a NUL byte before creating an approval request
or sending any of the input to the terminal.

## Testing

Extend the unreviewable-input integration test to cover both oversized input
and NUL-containing input, and verify that rejected input is not executed.

GitOrigin-RevId: e738c59ba5570012663bf6168ad052be237ca226

## Why

Rollout compression skips files that participate in paginated fork lineages because lineage readers rely on byte offsets into the original JSONL. This prevents shared rollout history from being compressed.

## What changed

- Add a seekable rollout reader that preserves logical JSONL offsets for plain and zstd-compressed files without materializing compressed data beside the rollout.
- Use the reader for lineage validation, model-context replay, and SQLite history projection, including when compression races with a read.
- Add the opt-in `local_thread_store_shared_compression` feature. The default mode continues to leave shared lineages uncompressed for compatibility, while the new mode includes referenced sources and fork pointers.
- Record the uncompressed size in new zstd frames so common prefix-bound checks can avoid decoding the full file.

## Testing

Add coverage for seekable compressed reads, prefix validation across zstd frame shapes, compressed lineage replay and projection, concurrent forks, and compression-mode behavior.

GitOrigin-RevId: 83e519f7eabf7448977eff37c55899858cc17a07

## What changed

- Scan regular files under `CODEX_HOME` in a background blocking task when
  standalone app-server metrics are enabled.
- Record `codex.app_server.codex_home.size_bytes` for the entire home and the
  `sessions` and `archived_sessions` subdirectories.
- Avoid following symlinks, discard incomplete scans, and cancel scanning during
  shutdown.

GitOrigin-RevId: 236fc0a5c156dbd4a99e9835135de194809b4a7b

## What changed

Add an end-to-end core test that compresses a parent and forked child rollout,
then resumes the child through paginated history loading. Verify that the
resumed model input:

- retains the persisted compaction checkpoint and inherited history;
- includes child history through the fork boundary;
- excludes obsolete pre-checkpoint and post-fork parent messages; and
- reads the compressed ancestor without materializing its JSONL file.

GitOrigin-RevId: 1624c4d844345fe2671436f37bc39b3e59fb3dea

## What changed

Update the `send_user_message_async` tool guidance to reserve it for questions
that require missing information, preferences, constraints, clarification, or
approval. Ask models to keep these questions concise, understandable, and at
an appropriate level of abstraction for the user and task.

GitOrigin-RevId: 4a16754401fb5fc106bbf65759ac4a7a78b6c7b3

## What changed

- Include Windows safety guidance in the `exec_command` tool description when a
  single ready environment reports Windows as its executor platform.
- Omit that guidance when the selected executor reports a non-Windows platform.
- Preserve the host-based behavior when platform information is unavailable or
  the tool can target multiple environments.

## Testing

- Cover Windows, non-Windows, unknown-platform, and multi-environment tool plans.
- Verify remote environments expose guidance that matches their target OS.

GitOrigin-RevId: 95e09790446c684ffaff2a0be077db426fff4618

## Why

Fetching plugin recommendations while building the first-turn context delays that
context when the recommendation catalog is not already cached.

## What changed

- Start fetching recommendations during session initialization, in parallel with
  MCP and plugin setup, and reuse the in-flight request when building context.
- Centralize the feature checks that enable plugin recommendations.
- Prevent an invalidated recommendation request from repopulating the cache after
  a newer request has completed.

## Testing

Added coverage for startup feature gating, reuse of the in-flight fetch, legacy
behavior when recommendations are unavailable, and cache invalidation races.

GitOrigin-RevId: 708774b9bfc472c9847973ae8b2774b66e7321e4

## What changed

- Limit the proactive-mode override to earlier developer instructions that require an explicit delegation request.
- Preserve user requests as higher-priority guidance.
- Encourage root agents and subagents to delegate parallel work when doing so could improve speed or quality.

## Testing

- Update the multi-agent world-state snapshot for the revised proactive-mode message.

GitOrigin-RevId: 0b61701980e0306dd37a925aceb23c75bf3c1af7

## What changed

- Add an optional `timeoutMs` parameter to `thread/shellCommand` and propagate it to user shell execution.
- Preserve the one-hour default when the parameter is omitted or `null`, allow longer deadlines, and treat `0` as an immediate timeout.
- Reject negative or otherwise invalid values before execution. Timing out an auxiliary shell command leaves its active turn running.

## Testing

- Cover default, extended, immediate, invalid, standalone, active-turn, and interruption behavior.

GitOrigin-RevId: d72f67793d9766b7383f28d30140270a4a76a495

## What changed

- Generate a UUIDv7 turn ID for each Guardian classification and preserve it across retries.
- Record the owning turn as `parent_turn_id` and propagate its trusted `root_turn_id` when known, including through the tool lifecycle extension API.
- Omit ambiguous or unknown root lineage and keep classification identities distinct when reusing Guardian sessions and WebSocket connections.

## Testing

- Cover classification metadata across retries, connection reuse, concurrent samples, auth refresh, and consecutive owning turns.

GitOrigin-RevId: 78757f2ad031844e4b545802f634c678a9ee2298

## What changed

- Add the `codex-guardian-context` crate for assembling structured context shared by synchronous Guardian review and asynchronous scoring.
- Preserve transcript entry roles and original byte counts, and let section contributors declare shared or consumer-specific scope.
- Collect applicable sections in registration order, skip optional sections, and fail the collection when required evidence is missing.
- Provide UTF-8-safe prefix/suffix truncation with approximate omitted-token accounting.

## Testing

- Cover scoped registry collection, ordering, optional sections, required-evidence failures, truncation markers, and UTF-8 boundaries.

GitOrigin-RevId: 19d8458403c470c9b413992dbff925a12259c3c5

## Why

Managed configuration can disable resumable unified execution while leaving shell tools enabled. This should not remove command execution entirely or grant access to retained processes.

## What changed

- Keep `exec_command` available in completion-only mode when `unified_exec` is disabled.
- Remove `tty`, `yield_time_ms`, `session_id`, and `write_stdin` from that mode, and add a `timeout_ms` argument.
- Terminate one-shot commands on timeout or turn cancellation, reporting timed-out commands with exit code 124.

## Testing

Added integration coverage for tool availability, timeout cleanup, and interruption cleanup under managed configuration.

GitOrigin-RevId: a382d34f922fdc4ba52889272c6db985abd42e47

## Why

Enabling, disabling, or reinstalling a cached remote plugin can change its
effective MCP servers, hooks, and skills without materializing a new bundle.
These transitions need to invalidate plugin consumers just like bundle updates
and removals do.

## What changed

- Report a unified set of changed remote plugins and their affected
  capabilities for materializations, removals, and installed-state changes.
- Derive enablement and reinstall changes by comparing installed snapshots,
  while keeping materialization metadata separate for hook trust handling.
- Preserve removal notifications even when stale cache cleanup fails, and use
  all reported changes to refresh loaded plugin state and runtime consumers.

## Testing

Added coverage for cached plugin enablement, disablement, removal, and
reinstallation, including removal when cache cleanup cannot complete.

GitOrigin-RevId: 86d9c1356f7cf70b3c85effebc3e5986b931bdba

…41400)

## What changed

- Re-run the HTTP headers helper after a same-origin `POST` receives a `401` or `403`, and retry the request once when the effective headers changed.
- Share refreshes across concurrent rejected requests, retain the previous headers when refresh fails, and keep the retry within the original timeout.
- Allow helpers to supply `Authorization` while preserving explicit OAuth or bearer credentials, OAuth insufficient-scope challenges, and redirect safety checks.

## Testing

- Cover rotating helper headers for MCP tool calls and same-origin OAuth token refreshes.
- Cover concurrent rejections, failed and unchanged refreshes, retry limits, timeouts, and redirects.

GitOrigin-RevId: c662edefdb1cd2876d9d02545a72d5bd6739864f

## Why

Cloud task requests can use saved ChatGPT credentials, so their destination must be constrained before authentication is loaded or any request is made.

## What changed

- Validate `CODEX_CLOUD_TASKS_BASE_URL` against trusted ChatGPT HTTPS origins on port 443 and reject URLs containing user information, queries, or fragments.
- Disable redirects for cloud task backend and environment-discovery clients so credentials are never forwarded to a redirect destination.
- Normalize the validated base URL before configuring authentication and HTTP clients.

## Testing

Add a CLI integration test that verifies a custom cloud backend is rejected without receiving a request, while the staging origin continues to use explicit token authentication.

GitOrigin-RevId: f0dddf363b4e44ea3530f81d9a817e978c15ead2

## Why

Directly deserializing the flattened `RolloutLine` envelope can reject nested
decimal values, preventing affected paginated sessions from resuming.

## What changed

- Add canonical string, byte, and reverse-scanner helpers that decode rollout
  records through `serde_json::Value` before decoding the flattened item.
- Route rollout readers across session discovery, history, migration, search,
  thread storage, and transcript previews through those helpers.
- Remove `Deserialize` from `RolloutLine` so new readers cannot bypass the
  canonical persistence decoder.

## Testing

Add coverage that resumes a paginated rollout after a token-count record with
a decimal rate-limit value and verifies that ordinal sequencing continues.

GitOrigin-RevId: 49abac1e0751c073daa5a93a840d8a483fd2d013

## What changed

- Show a confirmation before stopping a safety-buffered attempt and retrying
  with the server-selected faster model.
- Explain that the retry starts a new thread, preserves actions already taken,
  and may use a less capable model; allow the user to keep waiting instead.
- Dismiss the buffering or confirmation view when the response starts or the
  turn is no longer eligible for retry.
- Refresh the buffering copy and wrap confirmation text correctly in narrow
  terminals.

## Testing

- Cover retry confirmation, cancellation, turn completion, response startup,
  stale updates, and narrow-terminal rendering.

GitOrigin-RevId: 013bc47174811dd104b421774577c2808c732bfa

## Why

The PID-managed app-server lifecycle previously supported Unix only, leaving Windows unable to start and stop the managed daemon.

## What changed

- Launch the Windows daemon as a detached process and fail clearly when the host Job Object prevents detachment.
- Add Windows file locking and process creation-time checks so stale or reused PIDs cannot cause an unrelated process to be terminated.
- Request graceful shutdown through a shutdown file, then terminate the verified process after the grace period.
- Prepare private daemon state directories consistently and pin the executable path across installer junction updates.

## Testing

Add Windows tests for process-query permissions, reused and inaccessible PIDs, and stale-record cleanup.

GitOrigin-RevId: 5ea579a7c3dc8bb6122ec3a02513836ccaacc41c

## What changed

- Upgrade `rmcp` and `rmcp-macros` from 3.1.3 to 3.2.0.
- Refresh the Cargo and Bazel lockfiles for the new versions.

GitOrigin-RevId: a1d7696eafe6a150c6e09c3cc9c3663a8fd68679

## What changed

- Add a test-only `CredentialStore` adapter that maps RMCP refreshes onto Codex's pinned OAuth credential backend.
- Require refresh transaction guards for mutations, preserve the pinned backend, and update the runtime credential snapshot only after persistence succeeds.
- Preserve scopes and token expiry metadata while rejecting credentials that no longer match the connection's client or issuer.

## Testing

- Cover guarded save and clear operations, persistence failures, pinned-store read failures, replacement and removal handling, and expiry round trips.

GitOrigin-RevId: eb1b98024322c03af94f5ab2e88c7dc4ae54893a

## What changed

- Add the under-development `features.context_management.experimental_mode` configuration and schema.
- For eligible ChatGPT Plus, Pro, and Pro Lite sessions using the Codex backend, enable token-budget context, history notes, and the `new_context` tool when experimental context management is configured.
- Keep the feature disabled for custom providers, provider credentials, non-Codex endpoints, and temporary structured threads.

## Testing

- Cover subscription eligibility, backend restrictions, configuration resolution, token-budget guidance, and temporary-thread overrides.

GitOrigin-RevId: 19402af19c4d69e09a7cdb3687ee7d233f6a562a

## What changed

- Add the experimental `Thread.environments` field with each selected environment's ID, working directory, and runtime workspace roots.
- Populate the field from live thread state in start, resume, read, list, and unarchive responses. Use `null` for unloaded threads and an empty list when a loaded thread has no environment selection.
- Document that the field reports selection rather than connection status and does not affect executor selection or resume behavior.

## Testing

- Cover selection updates, unloaded and resumed threads, loaded pathless unarchives, and clients that subscribe after environment connection notifications.

GitOrigin-RevId: a6daa06aff7089d7c5a1e4c7d03109b41f12fa3c

## What changed

- Allow a valid Ready report to replace a deferred environment's provisioning failure while preserving the same environment instance.
- Treat provisioning failures as retryable and reconnect when a completed or concurrently publishing startup attempt contains a stale failure.
- Report provisioning failures from `status()` without starting a connection, and retain Ready state when a late failure arrives.

## Testing

- Cover recovery after failed and invalid provisioning reports, capability-root resolution after recovery, and the race between Ready and publication of an earlier startup failure.

GitOrigin-RevId: cce419403248168da81bc5a6ab20f919aed81142

## Why

Patch targets can use a different path convention from the Codex host, so
host-native path conversion can misclassify writable roots and requested
permissions.

## What changed

- Evaluate patch targets as `PathUri` values with the active filesystem policy
  context, including workspace roots and the executor's path convention.
- Distinguish executor-managed sandboxing from local platform sandboxing when
  deciding whether a patch can be auto-approved and how to normalize additional
  write permissions.
- Make full-disk and special-path policy checks honor the selected executor's
  Windows or POSIX convention.

## Testing

Add coverage for Windows executor URIs, full-disk policy aliases, remote patch
permission requests, sandbox availability, and owner-provided workspace roots.

GitOrigin-RevId: 1a054ea443efd342623c67432762f85c53d20c15

## What changed

- Run the daemon update loop on Windows using the non-interactive PowerShell installer.
- Restart the managed app server after updates and hand updater ownership to a changed managed executable through a readiness handshake.
- Contain installer descendants in a Windows job while allowing app-server and successor updater processes to break away.
- Preserve or restore PID ownership when successor startup fails, without terminating a process that reused the PID.

## Testing

- Cover non-interactive installer success and script failure on Windows.
- Cover updater handoff, readiness, rollback, inaccessible processes, and PID reuse.

GitOrigin-RevId: 5178c01124b4dd86b507b53f5093ec9a9d48e12c

## What changed

- Set `CODEX_VERSION` to the running package version in user shell and unified
  exec environments, overriding stale shell-policy or snapshot values.
- Add the reserved `codex_version` field to MCP turn metadata.

## Testing

- Cover version propagation through shell policies, shell snapshots, unified
  exec, and MCP metadata.

GitOrigin-RevId: 7846c70d668176530b1f467293b749dc9ddd79a0

## What changed

- Move `AgentsOverviewView` rendering and cursor placement into
  `agents_overview_render.rs`.
- Extract paste-burst Enter handling from the main chat composer into the
  reconnect module while preserving the existing submission behavior.

GitOrigin-RevId: 641daf9ad6cba79d805a9ae100f63ef81470757d

)

## Why

Replaying a thread after a later turn has continued can treat an earlier
misalignment policy violation as still active, clearing the restored draft and
queued follow-up input.

## What changed

- Track the latest turn independently of the bounded replay buffer.
- Omit misalignment errors from older turns during snapshot and stored-turn
  replay while preserving an error on the latest turn.
- Keep interrupted tool calls from the older turn visible in history.

## Testing

Added buffered replay coverage for restored drafts and queued messages, buffer
eviction, current-turn violations, and interrupted tool rendering.

GitOrigin-RevId: d6c223d9c5a1905fe1b48dc5f9514a7ccbf61d92

## What changed

- Fetch `collaborationMode/list` during TUI startup and reconnect, and use the
  returned catalog for visible collaboration-mode selection.
- Keep collaboration-mode discovery optional with a two-second timeout so an
  unavailable, invalid, or unsupported response does not block bootstrap.
- Preserve discovered modes when the model catalog refreshes, clear restored
  developer-instruction overrides when selecting a server mode, and retain a
  `/plan` draft when plan mode is unavailable.

## Testing

- Cover optional discovery failures and catalog refresh on reconnect.
- Cover server mode selection, model refreshes, restored settings, and
  unavailable plan mode.

GitOrigin-RevId: a6e35c14aab2e38526606164091ac64c500151bb

## What changed

- Add `Environment::last_ready_info()` to return a snapshot of the most recently accepted `EnvironmentReadyInfo`.
- Preserve the distinction between no accepted report and an accepted report with no capability roots.

## Testing

- Cover pending, ordinary, failed, recovered, replaced, empty, and invalid readiness reports.
- Verify that previously returned snapshots remain unchanged after later reports.

GitOrigin-RevId: cd051a56e7ad54a673c851eb58238c5837335c03

## Why

Pipe output chunks can split one protocol frame or contain several frames. A
timed-out read must also retain any partial frame it already consumed so the next
exchange can continue decoding it.

## What changed

Add a stateful `MessageReader` that buffers partial input, preserves unread bytes
from coalesced chunks, and validates frame bounds before reading the payload. Use
it for voice helper handshake and shutdown responses.

## Testing

Add async tests for fragmented and coalesced frames, cancelled reads, oversized
headers, truncated and malformed input, and invalid pipe chunk sizes.

GitOrigin-RevId: 274d9698e05f2de2147235b6e4e1bd38dbb7c23b

## Why

The managed app-server daemon and automatic TUI attachment were limited to
Unix, so Windows users could not share a background server across Codex
sessions.

## What changed

- Enable daemon lifecycle commands, `codex agents` startup, and AF_UNIX daemon
  discovery on Windows.
- Require Windows daemons to start non-elevated and verify the discovered
  socket directory and peer before connecting.
- Preflight detached process support, preserve path-based environment settings,
  and keep daemon processes out of the launching project's working directory.
- Fall back to an embedded server when an implicitly discovered daemon cannot
  connect, while preserving errors for explicit remote endpoints and bypassing
  daemon reuse when `CODEX_EXEC_SERVER_URL` is set.

## Testing

Add coverage for Windows launch restrictions and socket validation, implicit
connection fallback, executor selection, daemon discovery, and the agents
dashboard startup result.

GitOrigin-RevId: e7fd63cf8690bcca8b5155266416f31f2f792aa2

## Why

Selected plugin MCP servers may be skipped after the optional startup grace
period. When a user explicitly mentions a plugin or MCP server, the turn should
continue waiting so the requested tools are available to the model.

## What changed

- Track explicitly mentioned plugin IDs and MCP servers across later samples,
  steered input, and same-turn restarts.
- Require matching selected-plugin MCP servers to finish startup before
  capturing the tool catalog, while leaving unmentioned servers optional.
- Match `plugin://` identities independently of display names and ignore
  targeting query parameters such as `app` and `browserFamily`.

## Testing

Added coverage for linked and structured plugin mentions, direct and batched
capability discovery, delayed environment attachment, steering, and same-turn
restarts.

GitOrigin-RevId: c509ef8df45df1a7edb0da6afdb2682dc53a4de8

## What changed

- Keep `!`, `/`, and `?` prefixes literal in plain-text composers instead of activating command modes or shortcuts.
- Preserve buffered characters when changing Vim mode, cancelling a draft, or pressing Enter during a paste burst.
- Show over-limit errors in embedded composer footers, retain the rejected draft, and schedule redraws when the message expires.
- Clear stale validation errors when replacing a draft or switching form fields.

## Testing

- Add coverage for literal prefixes, buffered typing, single-character paste lines, retained over-limit drafts, and clearing validation errors between fields.

GitOrigin-RevId: ed9d5b2c087abdfefd92d93033ea1c20211d56d7

## Why

Misalignment policy failures pause the current chat. When the server provides findings and a continuation request, users should be able to inspect them and explicitly decide whether to proceed.

## What changed

- Add a `Review findings` flow that shows the detailed explanation and quoted continuation request in an overlay.
- Require explicit acknowledgement before starting a continuation turn, while preserving the active approval and sandbox settings.
- Keep ordinary input blocked and reject stale, replaced, invalid, or duplicate continuation attempts.
- Label the overlay shortcut as `q close` to match its behavior.

## Testing

- Add TUI tests covering findings review, explicit confirmation, successful and failed continuation, stale findings, duplicate events, and invalid continuation data.

GitOrigin-RevId: 36a738adf272f95db92eaee5712fb00061d0fa52

## What changed

- Honor `McpOAuthRefreshMode::Coordinated` for streamable HTTP MCP connections by letting RMCP refresh and persist credentials through the pinned credential store.
- Reread credentials while holding the refresh lock, persist refreshed tokens before retrying requests, and serialize login and logout writes with in-flight refreshes.
- Keep OAuth preparation outside MCP operation and handshake deadlines, and allow refresh persistence to finish if the initiating caller is cancelled.

## Testing

- Cover coordinated startup refresh, concurrent refreshes, `401` retries, credential mutation races, provider timeouts, and caller cancellation.

GitOrigin-RevId: 100ae788048087be23e26bb43f868b1fcebb007a

## What changed

- Add `application.network` managed requirements with exact-domain allow/deny
  rules, default-enabled behavior, domain normalization, and normal managed TOML
  precedence.
- Return the policy separately from agent network requirements through the
  experimental `configRequirements/read` API. The endpoint reports the policy
  but does not enforce it.
- Export the new protocol types and schemas, and document the TOML format.

## Testing

- Cover parsing, validation, normalization, layered precedence, and cloud
  requirement composition.
- Verify app-server responses, defaults, separation from agent policy, and
  rejection of invalid domains.

GitOrigin-RevId: 563eeed296d9748430b819797204a44a8db92f3b

## What changed

- Add a configurable `agents.resume` action, bound to `Ctrl+O` by default, that opens the session resume picker from the agent command center.
- Preserve command-center state when the picker is cancelled, and preserve per-thread composer and queued-input state when switching sessions.
- Keep resume failures within the command-center flow and wrap footer shortcuts on narrow terminals.

## Testing

- Add coverage for picker cancellation, active-session selection, resume failures, per-thread input restoration, custom keybindings, and narrow footer layout.

GitOrigin-RevId: 59159f838a0c642200cd164e3af45b0971d29bf8

## Why

Computer-use-only Guardian scoring should follow the active model's REPL
auto-review requirement, including when the model changes within a live thread.

## What changed

- Run computer-use scoring and fast approval decisions only when the active
  model sets `node_repl_auto_review_required`.
- Invalidate prior or in-flight scores when a model switch skips scoring, so
  switching back to a reviewed model cannot revive a stale decision.

## Testing

- Cover model switches for both `node_repl` and `cua_repl` MCP servers.
- Verify skipped scoring and stale-score rejection across requirement changes.

GitOrigin-RevId: 46aec4d017bea8f135b435bcd769b87369b8ce95

## What changed

- Load the `/experimental` catalog from the running server for the active thread, with loading, empty, and failure states in the popup.
- Show beta features in server order and preserve server-reported names, descriptions, and configured values. Mark features as read-only when the local config writer cannot safely update them.
- Persist only changed, writable feature flags. Bound discovery with page-size and page-count limits, repeated-cursor detection, deduplication, cancellation, and a timeout.

## Testing

- Cover paginated discovery, malformed or unresponsive servers, popup cancellation, read-only controls, selective writes, and the new popup states.

GitOrigin-RevId: 1f49eb961c8ab220a466e15f032c1dc61ed86d38

## What changed

- Replace the command center's single-line new-task input with the shared chat composer, including multiline editing, paste handling, Vim mode, configured keybindings, cursor behavior, and input validation.
- Keep task drafts and editor state across dashboard refreshes and reconnects while separating composer focus from list, search, and rename actions.
- Preserve whitespace in dispatched task prompts, block submission while offline, and restore unsent prompts after dispatch failures when the composer is still available.

## Testing

- Add coverage for focus routing, draft retention, multiline pastes, custom keybindings, Vim mode, offline editing, failed-dispatch recovery, and responsive rendering.

GitOrigin-RevId: a609ae95d497cbae0ebcac4cdcc50fe49d74832a

GitOrigin-RevId: 1b53bc2d7a4015330fb39e29e9092b37153d9fa3

Opening the installation_id file read-write at startup fails with EPERM
inside an enclosing sandbox that allows reading the id but denies writing
it, even though the file already holds a valid UUID.

Add a read-only fast path that reuses an existing, valid installation id
without requesting write access; missing, unreadable, or invalid ids fall
through to the existing locked create/repair path unchanged.

Fixes a startup blocker for nested `codex exec` under a read-only codex
home. Adds a regression test that makes an existing valid id read-only and
asserts reuse still succeeds.