## What changed

Add an end-to-end core test that compresses a parent and forked child rollout,
then resumes the child through paginated history loading. Verify that the
resumed model input:

- retains the persisted compaction checkpoint and inherited history;
- includes child history through the fork boundary;
- excludes obsolete pre-checkpoint and post-fork parent messages; and
- reads the compressed ancestor without materializing its JSONL file.

GitOrigin-RevId: 1624c4d844345fe2671436f37bc39b3e59fb3dea

## What changed

Update the `send_user_message_async` tool guidance to reserve it for questions
that require missing information, preferences, constraints, clarification, or
approval. Ask models to keep these questions concise, understandable, and at
an appropriate level of abstraction for the user and task.

GitOrigin-RevId: 4a16754401fb5fc106bbf65759ac4a7a78b6c7b3

## What changed

- Include Windows safety guidance in the `exec_command` tool description when a
  single ready environment reports Windows as its executor platform.
- Omit that guidance when the selected executor reports a non-Windows platform.
- Preserve the host-based behavior when platform information is unavailable or
  the tool can target multiple environments.

## Testing

- Cover Windows, non-Windows, unknown-platform, and multi-environment tool plans.
- Verify remote environments expose guidance that matches their target OS.

GitOrigin-RevId: 95e09790446c684ffaff2a0be077db426fff4618

## Why

Fetching plugin recommendations while building the first-turn context delays that
context when the recommendation catalog is not already cached.

## What changed

- Start fetching recommendations during session initialization, in parallel with
  MCP and plugin setup, and reuse the in-flight request when building context.
- Centralize the feature checks that enable plugin recommendations.
- Prevent an invalidated recommendation request from repopulating the cache after
  a newer request has completed.

## Testing

Added coverage for startup feature gating, reuse of the in-flight fetch, legacy
behavior when recommendations are unavailable, and cache invalidation races.

GitOrigin-RevId: 708774b9bfc472c9847973ae8b2774b66e7321e4

## What changed

- Limit the proactive-mode override to earlier developer instructions that require an explicit delegation request.
- Preserve user requests as higher-priority guidance.
- Encourage root agents and subagents to delegate parallel work when doing so could improve speed or quality.

## Testing

- Update the multi-agent world-state snapshot for the revised proactive-mode message.

GitOrigin-RevId: 0b61701980e0306dd37a925aceb23c75bf3c1af7

## What changed

- Add an optional `timeoutMs` parameter to `thread/shellCommand` and propagate it to user shell execution.
- Preserve the one-hour default when the parameter is omitted or `null`, allow longer deadlines, and treat `0` as an immediate timeout.
- Reject negative or otherwise invalid values before execution. Timing out an auxiliary shell command leaves its active turn running.

## Testing

- Cover default, extended, immediate, invalid, standalone, active-turn, and interruption behavior.

GitOrigin-RevId: d72f67793d9766b7383f28d30140270a4a76a495

## What changed

- Generate a UUIDv7 turn ID for each Guardian classification and preserve it across retries.
- Record the owning turn as `parent_turn_id` and propagate its trusted `root_turn_id` when known, including through the tool lifecycle extension API.
- Omit ambiguous or unknown root lineage and keep classification identities distinct when reusing Guardian sessions and WebSocket connections.

## Testing

- Cover classification metadata across retries, connection reuse, concurrent samples, auth refresh, and consecutive owning turns.

GitOrigin-RevId: 78757f2ad031844e4b545802f634c678a9ee2298

## What changed

- Add the `codex-guardian-context` crate for assembling structured context shared by synchronous Guardian review and asynchronous scoring.
- Preserve transcript entry roles and original byte counts, and let section contributors declare shared or consumer-specific scope.
- Collect applicable sections in registration order, skip optional sections, and fail the collection when required evidence is missing.
- Provide UTF-8-safe prefix/suffix truncation with approximate omitted-token accounting.

## Testing

- Cover scoped registry collection, ordering, optional sections, required-evidence failures, truncation markers, and UTF-8 boundaries.

GitOrigin-RevId: 19d8458403c470c9b413992dbff925a12259c3c5

## Why

Managed configuration can disable resumable unified execution while leaving shell tools enabled. This should not remove command execution entirely or grant access to retained processes.

## What changed

- Keep `exec_command` available in completion-only mode when `unified_exec` is disabled.
- Remove `tty`, `yield_time_ms`, `session_id`, and `write_stdin` from that mode, and add a `timeout_ms` argument.
- Terminate one-shot commands on timeout or turn cancellation, reporting timed-out commands with exit code 124.

## Testing

Added integration coverage for tool availability, timeout cleanup, and interruption cleanup under managed configuration.

GitOrigin-RevId: a382d34f922fdc4ba52889272c6db985abd42e47

## Why

Enabling, disabling, or reinstalling a cached remote plugin can change its
effective MCP servers, hooks, and skills without materializing a new bundle.
These transitions need to invalidate plugin consumers just like bundle updates
and removals do.

## What changed

- Report a unified set of changed remote plugins and their affected
  capabilities for materializations, removals, and installed-state changes.
- Derive enablement and reinstall changes by comparing installed snapshots,
  while keeping materialization metadata separate for hook trust handling.
- Preserve removal notifications even when stale cache cleanup fails, and use
  all reported changes to refresh loaded plugin state and runtime consumers.

## Testing

Added coverage for cached plugin enablement, disablement, removal, and
reinstallation, including removal when cache cleanup cannot complete.

GitOrigin-RevId: 86d9c1356f7cf70b3c85effebc3e5986b931bdba

…41400)

## What changed

- Re-run the HTTP headers helper after a same-origin `POST` receives a `401` or `403`, and retry the request once when the effective headers changed.
- Share refreshes across concurrent rejected requests, retain the previous headers when refresh fails, and keep the retry within the original timeout.
- Allow helpers to supply `Authorization` while preserving explicit OAuth or bearer credentials, OAuth insufficient-scope challenges, and redirect safety checks.

## Testing

- Cover rotating helper headers for MCP tool calls and same-origin OAuth token refreshes.
- Cover concurrent rejections, failed and unchanged refreshes, retry limits, timeouts, and redirects.

GitOrigin-RevId: c662edefdb1cd2876d9d02545a72d5bd6739864f

## Why

Cloud task requests can use saved ChatGPT credentials, so their destination must be constrained before authentication is loaded or any request is made.

## What changed

- Validate `CODEX_CLOUD_TASKS_BASE_URL` against trusted ChatGPT HTTPS origins on port 443 and reject URLs containing user information, queries, or fragments.
- Disable redirects for cloud task backend and environment-discovery clients so credentials are never forwarded to a redirect destination.
- Normalize the validated base URL before configuring authentication and HTTP clients.

## Testing

Add a CLI integration test that verifies a custom cloud backend is rejected without receiving a request, while the staging origin continues to use explicit token authentication.

GitOrigin-RevId: f0dddf363b4e44ea3530f81d9a817e978c15ead2

## What changed

- Lazily index items in larger thread-history turns so late updates can reuse
  their positions after turn completion and rollback.
- Map reverse-history search matches back to Unicode byte ranges with a linear
  scan.
- Preserve first-occurrence semantics for duplicate item IDs and Unicode match
  boundaries.

## Testing

- Cover indexed duplicate updates before and after the indexing threshold.
- Cover retained-turn updates after rollback and Unicode history-search ranges.

GitOrigin-RevId: 3a9c819966d90d833c4183cf6523b6ea4f7be7e7

## What changed

- Add the disabled-by-default `omit_app_server_notification_media` feature.
- When enabled, remove inline image and audio content from `item/started`,
  `item/completed`, and `rawResponseItem/completed` notifications, including
  tool output and image-generation results.
- Keep the media in model input; the filter only changes app-server
  notifications.

## Testing

- Verify that image content is absent from all three notification types while
  the model request still receives it.

GitOrigin-RevId: 9a4434d18a3dac6d67c2e0c3723ff4595a9b3797

## What changed

- Add a positive `output_token_limit` setting to each entry under an MCP server's `tools` configuration.
- Apply the most restrictive limit when plugin and user policies overlap, while keeping approval policy independent.
- Carry the effective MCP output budget in conversation history so tool output, post-tool hook responses, and resumed sessions use the same truncation limit.

## Testing

- Cover configuration parsing, serialization, schema validation, and plugin policy merging.
- Cover MCP output below and above the configured limit, post-tool hook responses, and session resume.

GitOrigin-RevId: d0beb4fca9ba6055d9e1d31c137373b465d50d61

## What changed

- Add a reusable transcript contributor for synchronous and asynchronous Guardian context, with borrowed conversation history and request-specific configuration.
- Preserve conversation order and role or tool attribution while applying separate per-entry limits for messages, ordinary tools, and Node REPL-backed outputs.
- Make tool calls, tool outputs, and reasoning independently configurable, and expose transcript collection without requiring section composition.
- Register the transcript contributor in a process-wide default registry that retains no request state.

## Testing

- Add unit coverage for role and tool attribution, optional evidence sources, orphaned and named tool outputs, registry reuse, and request-specific entry limits.

GitOrigin-RevId: 2b60f8db4618de8a7175f8ee0183375a526a87db

## What changed

- Treat a surviving full world-state snapshot as a context baseline when a fork removes the associated user message.
- Restore the previous turn settings and reference context from that baseline, without treating the segment as a user turn for rollback.
- Ignore partial snapshots and full snapshots superseded by compaction.

## Testing

- Cover resumed rollout reconstruction with removed task messages, partial snapshots, and compaction.
- Verify nested agents inherit developer instructions and environment context exactly once across history modes and compacted histories.

GitOrigin-RevId: 9f9f6992d7ea8cff9ac82a7fcdf0c8fb764db81c

## What changed

Strip inline image and audio content from function call output thread items when
filtering app-server notifications. Preserve text and encrypted content, and
leave text-only function call outputs unchanged.

GitOrigin-RevId: ca3ad70e843aafbed49c693aa8963bea86cf95dc

## What changed

- Store the most recently captured execution `StepContext` in the active turn state.
- Keep speculative model-fallback captures from replacing that context, and update it only when the fallback is selected for remote compaction.
- Preserve the retained context when a turn completes or is interrupted.

## Testing

- Add coverage for completed and interrupted turns, successful primary compaction, fallback compaction, and interruption while a fallback is running.

GitOrigin-RevId: c7dee36ec8e88ba2f4fb4a9c0322e5c86a0caf0e

## Why

Executor-scoped cleanup hooks need to observe an interrupted turn as well as a
normally completed one.

## What changed

- Allow bundled executor plugins to register the allowlisted `Interrupt` hook
  alongside `Stop`, while preserving multiple allowed hook entries from the
  selected executor environment.
- Run interrupt hooks with the interrupted turn's last step discovery and turn
  metadata. Turns without a step context do not reuse discovery from an earlier
  turn.
- Keep executor-scoped interrupt hooks asynchronous and omit public hook
  lifecycle events for them, matching executor `Stop` hook behavior.

## Testing

Added coverage for hook filtering and registration, interrupt execution and
metadata propagation, environment selection, and turns without a step context.

GitOrigin-RevId: f0c536b3382a37cf3bf693c4573d21f6f66ace4e

## What changed

Allow bundled browser and computer-use plugins to invoke the existing
`node_repl.turn_ended` cleanup hook for `SubagentStop` events, matching the
allowlist behavior for `Stop` and `Interrupt` events.

GitOrigin-RevId: 0fe1784321e793e9861e728b40a48662625b7dca

## Why

Programs running in a PTY can block while waiting for replies to terminal
queries.

## What changed

- Intercept device-status, window-size, cursor-position, and DEC private-mode
  queries from TTY subprocess output and write bounded responses to the
  subprocess input.
- Remove handled queries from the output stream while preserving other escape
  sequences and output, including queries split across chunks.
- Apply the responder to both direct and driver-backed TTY process spawning.

## Testing

Added tests for driver-backed query handling and for a PTY subprocess that
waits for a cursor-position response before exiting.

GitOrigin-RevId: de92e06d183647271ef49024da9c30f01699f886

## What changed

- Advertise `openai/elicitation` form support when the client declares an
  object-valued `form` capability, without deriving it from the legacy
  `openai/form` capability.
- Handle `openai/elicitation/create` requests in `form` mode and forward their
  metadata and opaque schema through app-server as `openaiForm`, preserving
  `x-openai-*` annotations.
- Keep legacy form handling independent and have the TUI automatically decline
  the new form requests it cannot render.

## Testing

- Add an app-server round-trip test for capability negotiation, request
  forwarding, and accepted responses.
- Extend MCP capability filtering coverage for `openai/elicitation.form`.

GitOrigin-RevId: 88f39257bffafe4ee98a9c910e38507843cd7eeb

## What changed

- Allow `request_user_input` for optional questions that materially improve work quality.
- Continue with best judgment when the tool returns no answers.
- Keep permission requests, escalations, and other required input out of the tool; ask one concise plain-text question when progress cannot safely continue.
- Update the collaboration-mode preset test for the revised direct-question guidance.

GitOrigin-RevId: 8393621f0d8b59d8b164368ab7f2c8f4f6b3b14e

GitOrigin-RevId: b0c22d9bf9e276023d2ddd943489e51ee8bb200f

## Why

Code mode wall time should measure the host operation itself, without including
client-side response delays or idle time between requests.

## What changed

- Measure each execute, wait, and terminate request in the code mode host.
- Carry the duration through the stdio and gRPC protocols and use it for
  model-visible wall time.
- Emit a structured `codex.code_mode.host_timing` event correlated with the
  conversation, turn, tool call, and cell.

## Testing

- Cover successful and failed execution timing, delayed response reads,
  repeated waits, termination, and missing cells across stdio and gRPC.
- Verify timing survives protocol serialization and is reflected in app-server
  model output and structured telemetry.

GitOrigin-RevId: d24af30c3fc5820521b4beba1f9970714dad6482

## What changed

- Track failed `exec` attempts whose handler ran for each active goal.
- Mark the goal as blocked after three qualifying failure turns.
- Reset the failure streak when any tool succeeds, and keep failures from carrying over to a replacement goal.

## Testing

- Cover failure classification, streak resets, goal replacement, and end-to-end goal blocking through the app server.

GitOrigin-RevId: 14dac7f4eb35507f12df3b2a82ab97bdafe7b897

## What changed

- Admit the curated remote Browser plugin's `Stop` and `SubagentStop` hooks when its listed `browser.turn_ended` tool matches the expected connector and is enabled by app policy.
- Carry trusted app routing metadata and the MCP environment through hook registration and execution.
- Register hooks from multiple executor environments, while deduplicating cleanup calls that share an event, MCP environment, server, and tool.

## Testing

- Cover Browser and Computer Use cleanup through separate MCP routes, including user- and managed-policy disablement.
- Verify routing metadata, environment selection, multi-environment registration, and target deduplication.

GitOrigin-RevId: 66de088fd201b9ed0db8b97c23d33de88135120d

…nai#41457)

## What changed

- Add an optional `proactive` multi-agent mode message to model metadata.
- Use the catalog's proactive message for `Ultra` reasoning when no general mode hint is configured. A missing value falls back to the built-in proactive instructions, while an empty value suppresses the mode message.
- Keep explicit mode behavior for other reasoning efforts and refresh the applicable catalog message when the model changes.

## Testing

- Cover proactive overrides, built-in fallback, empty-value suppression, mode-hint precedence, non-`Ultra` behavior, and model switches.

GitOrigin-RevId: da0a9ebd9b58cf04ef13a703c210e5da2eed0884

## Why

Selected plugin MCP servers may be skipped after the optional startup grace
period. When a user explicitly mentions a plugin or MCP server, the turn should
continue waiting so the requested tools are available to the model.

## What changed

- Track explicitly mentioned plugin IDs and MCP servers across later samples,
  steered input, and same-turn restarts.
- Require matching selected-plugin MCP servers to finish startup before
  capturing the tool catalog, while leaving unmentioned servers optional.
- Match `plugin://` identities independently of display names and ignore
  targeting query parameters such as `app` and `browserFamily`.

## Testing

Added coverage for linked and structured plugin mentions, direct and batched
capability discovery, delayed environment attachment, steering, and same-turn
restarts.

GitOrigin-RevId: c509ef8df45df1a7edb0da6afdb2682dc53a4de8

## What changed

- Keep `!`, `/`, and `?` prefixes literal in plain-text composers instead of activating command modes or shortcuts.
- Preserve buffered characters when changing Vim mode, cancelling a draft, or pressing Enter during a paste burst.
- Show over-limit errors in embedded composer footers, retain the rejected draft, and schedule redraws when the message expires.
- Clear stale validation errors when replacing a draft or switching form fields.

## Testing

- Add coverage for literal prefixes, buffered typing, single-character paste lines, retained over-limit drafts, and clearing validation errors between fields.

GitOrigin-RevId: ed9d5b2c087abdfefd92d93033ea1c20211d56d7

## Why

Misalignment policy failures pause the current chat. When the server provides findings and a continuation request, users should be able to inspect them and explicitly decide whether to proceed.

## What changed

- Add a `Review findings` flow that shows the detailed explanation and quoted continuation request in an overlay.
- Require explicit acknowledgement before starting a continuation turn, while preserving the active approval and sandbox settings.
- Keep ordinary input blocked and reject stale, replaced, invalid, or duplicate continuation attempts.
- Label the overlay shortcut as `q close` to match its behavior.

## Testing

- Add TUI tests covering findings review, explicit confirmation, successful and failed continuation, stale findings, duplicate events, and invalid continuation data.

GitOrigin-RevId: 36a738adf272f95db92eaee5712fb00061d0fa52

## What changed

- Honor `McpOAuthRefreshMode::Coordinated` for streamable HTTP MCP connections by letting RMCP refresh and persist credentials through the pinned credential store.
- Reread credentials while holding the refresh lock, persist refreshed tokens before retrying requests, and serialize login and logout writes with in-flight refreshes.
- Keep OAuth preparation outside MCP operation and handshake deadlines, and allow refresh persistence to finish if the initiating caller is cancelled.

## Testing

- Cover coordinated startup refresh, concurrent refreshes, `401` retries, credential mutation races, provider timeouts, and caller cancellation.

GitOrigin-RevId: 100ae788048087be23e26bb43f868b1fcebb007a

## What changed

- Add `application.network` managed requirements with exact-domain allow/deny
  rules, default-enabled behavior, domain normalization, and normal managed TOML
  precedence.
- Return the policy separately from agent network requirements through the
  experimental `configRequirements/read` API. The endpoint reports the policy
  but does not enforce it.
- Export the new protocol types and schemas, and document the TOML format.

## Testing

- Cover parsing, validation, normalization, layered precedence, and cloud
  requirement composition.
- Verify app-server responses, defaults, separation from agent policy, and
  rejection of invalid domains.

GitOrigin-RevId: 563eeed296d9748430b819797204a44a8db92f3b

## What changed

- Add a configurable `agents.resume` action, bound to `Ctrl+O` by default, that opens the session resume picker from the agent command center.
- Preserve command-center state when the picker is cancelled, and preserve per-thread composer and queued-input state when switching sessions.
- Keep resume failures within the command-center flow and wrap footer shortcuts on narrow terminals.

## Testing

- Add coverage for picker cancellation, active-session selection, resume failures, per-thread input restoration, custom keybindings, and narrow footer layout.

GitOrigin-RevId: 59159f838a0c642200cd164e3af45b0971d29bf8

## Why

Computer-use-only Guardian scoring should follow the active model's REPL
auto-review requirement, including when the model changes within a live thread.

## What changed

- Run computer-use scoring and fast approval decisions only when the active
  model sets `node_repl_auto_review_required`.
- Invalidate prior or in-flight scores when a model switch skips scoring, so
  switching back to a reviewed model cannot revive a stale decision.

## Testing

- Cover model switches for both `node_repl` and `cua_repl` MCP servers.
- Verify skipped scoring and stale-score rejection across requirement changes.

GitOrigin-RevId: 46aec4d017bea8f135b435bcd769b87369b8ce95

## What changed

- Load the `/experimental` catalog from the running server for the active thread, with loading, empty, and failure states in the popup.
- Show beta features in server order and preserve server-reported names, descriptions, and configured values. Mark features as read-only when the local config writer cannot safely update them.
- Persist only changed, writable feature flags. Bound discovery with page-size and page-count limits, repeated-cursor detection, deduplication, cancellation, and a timeout.

## Testing

- Cover paginated discovery, malformed or unresponsive servers, popup cancellation, read-only controls, selective writes, and the new popup states.

GitOrigin-RevId: 1f49eb961c8ab220a466e15f032c1dc61ed86d38

## What changed

- Replace the command center's single-line new-task input with the shared chat composer, including multiline editing, paste handling, Vim mode, configured keybindings, cursor behavior, and input validation.
- Keep task drafts and editor state across dashboard refreshes and reconnects while separating composer focus from list, search, and rename actions.
- Preserve whitespace in dispatched task prompts, block submission while offline, and restore unsent prompts after dispatch failures when the composer is still available.

## Testing

- Add coverage for focus routing, draft retention, multiline pastes, custom keybindings, Vim mode, offline editing, failed-dispatch recovery, and responsive rendering.

GitOrigin-RevId: a609ae95d497cbae0ebcac4cdcc50fe49d74832a

GitOrigin-RevId: 1b53bc2d7a4015330fb39e29e9092b37153d9fa3

## What changed

- Add `originator` to plugin measurement inputs and emitted analytics events.
- Populate it from the turn originator when recording plugin measurements.
- Extend analytics tests to verify the originator is preserved in event payloads.

GitOrigin-RevId: 9998f829760222fc690dc8a10324794b5da27220

## Why

Completion receipts for identical user messages could acknowledge the wrong
pending steer. When the receipt arrived while another thread was displayed,
the stale pending state could later be restored and resubmitted.

## What changed

- Assign each TUI submission a client message ID and pass it through turn start
  and steer requests.
- Preserve pending steer IDs across thread input snapshots and match completion
  receipts by ID, while retaining content-based matching for older app servers
  that do not echo IDs.
- Acknowledge matching receipts for inactive threads before their notifications
  can be discarded, including threads stored in the agents overview.

## Testing

Added coverage for identical steer receipts and for switching within and
between tasks before interrupting an active turn.

GitOrigin-RevId: 28bd80a735ff86cd7bf836f24b448e7499f0a902

## Why

The permissions menu needs to reflect the profiles and configuration requirements available in the active app-server scope, including remote workspaces.

## What changed

- Load permission profiles and configuration requirements asynchronously when opening the permissions menu, using the active thread working directory.
- Render loading, retry, empty-catalog, and unsupported-server states, and fall back to the legacy permissions menu when explicit profiles are not configured.
- Disable profiles rejected by server requirements or unavailable in the catalog. Remote custom profiles remain visible but cannot yet be selected.
- Bound pagination and request time, reject malformed catalogs, and ignore responses made stale by account, thread, or modal changes.

## Testing

- Cover local, session-only, remote, legacy, empty, unsupported, pagination, malformed-response, and timeout discovery paths.
- Add TUI tests for loading, failures, retries, empty results, remote catalogs, stale responses, and working-directory changes.

GitOrigin-RevId: 3e2ab53a4eae1179587d064f9a4c605765ea7880

## What changed

- Add bounded detail previews for the selected task, including pending approval or user-input requests, live reasoning headings, and the latest agent message.
- Prefer the most urgent child task with useful detail while keeping the task list compact.
- Populate historical last messages from existing thread reads and update live details from already-delivered events without attaching to additional threads.
- Clear stale previews after reverts, event-stream gaps, reconnects, and thread lifecycle changes.

## Testing

- Add coverage and snapshots for attention requests, live activity, historical messages, stale refreshes, and attachment changes.

GitOrigin-RevId: 5de4b8aa3bc5bf9653a40c44b827f7aa85c8cf89

## What changed

- Add the creation-time `originator` to app-server thread responses and `thread/started` notifications.
- Persist originators in thread metadata and preserve the first recorded value across list, read, resume, rollout, and SQLite paths.
- Add an `originators` allowlist to `thread/list` for hosted backends. The local app-server accepts omitted or empty values but rejects nonempty filters.

## Testing

- Cover originator persistence across server restarts and list, read, and resume requests.
- Verify local `thread/list` handling for nonempty, omitted, null, and empty originator filters.
- Heap-allocate large TUI dispatcher futures in affected tests to keep them within the Windows test-thread stack.

GitOrigin-RevId: 73ad6e61b8fdd2d93a22d1f971723a19ec7be3fc

## What changed

- Add the disabled, under-development `guardian_thread_context` feature flag for selecting thread-owned context for Guardian reviewers.
- Expose the boolean setting in the generated configuration schema.
- Verify default, base configuration, and profile override resolution.

GitOrigin-RevId: c4878be96d12f4ccd84356df15d3e55f13ac141f

## Why

When silent OAuth refresh cannot recover a rejected MCP tool call, the caller
needs the server's authentication challenge to initiate interactive login. The
rejected call must not be replayed automatically after refresh has failed.

## What changed

- Convert `401 Unauthorized` responses with `WWW-Authenticate` headers into an
  MCP tool error containing `mcp/www_authenticate` metadata.
- Preserve multiple authentication challenges by combining all
  `WWW-Authenticate` header values.
- Keep successful silent refresh behavior while avoiding replay when refresh
  fails.

## Testing

Added coverage for successful and failed refresh, multiple authentication
headers, propagation through agent tool-call events, and no-replay behavior.

GitOrigin-RevId: c560cff6286d7ab09b1f5c6cf3618d4650cde47d

## What changed

- Pass the selected executor's `PathUri` through user command approval requests instead of converting the working directory to a host-native path.
- Make native-path permission helpers explicitly local and require executor-aware permission transforms to receive a `FileSystemSandboxPolicyContext`.
- Cover approved remote commands to verify that the approval request reports the selected remote working directory and execution resumes after approval.

GitOrigin-RevId: 0aa3042f2d7594af6c7d0abf31d7f99cf67d5556

## Why

Guardian authorization reviews need host-verified `request_user_input` answers to
remain aligned with thread history across compaction, resume, and rollback.

## What changed

- Record verified question-and-answer pairs in retained thread context when
  `GuardianThreadContext` is enabled, and source both local and delegated Guardian
  review evidence from that context.
- Preserve complete answer records within the evidence budget. Mark authorization
  context incomplete when records are unavailable or oversized, and defer cached
  fast approvals in that case.
- Keep the existing runtime-only answer path for threads that do not enable the
  thread-owned context.

## Testing

- Cover answer retention through compaction and resume, removal after rollback,
  source-call eviction, oversized answers, delegated review evidence, and legacy
  behavior.

GitOrigin-RevId: 01f6f4541515434a0d00fdde318ff59f2f8bd2eb

## Why

Legacy terminals encode `Alt` plus a character the same way as `Esc` followed
by that character. In Vim insert or replace mode, typing a command immediately
after `Esc` could therefore leave the composer in the wrong mode.

## What changed

Recover ambiguous input as separate `Esc` and character events when Vim mode
can consume the escape. Preserve active `Alt` bindings, key chords, image
paste, agent navigation, enhanced-key terminals, and AltGr input.

## Testing

Add coverage for recovered Vim commands and for each shortcut and terminal
case that must retain its existing behavior.

GitOrigin-RevId: 3d8464d805f95f677cce5c46ae00338e611d776a

…ai#42588)

## Why

Guardian can reuse an opaque parent compaction only when the checkpoint's
recorded producer hash matches the scoring model. Missing or incompatible
provenance must not allow an asynchronous score or cached approval to omit
compacted context.

## What changed

- Record the producing model's compatibility hash on compaction history items
  and expose the latest checkpoint hash through conversation snapshots.
- In thread-owned context mode, fail closed and require synchronous review when
  checkpoint reuse is enabled but the latest checkpoint is incompatible or has
  unknown provenance.
- Reject incompatible checkpoints in the sampler while preserving the legacy
  context behavior.

## Testing

Add coverage for local, remote, resumed, compacted, and rolled-back histories,
including matching, mismatched, missing, and empty compatibility hashes.

GitOrigin-RevId: 1ce959cb276edc602fd7dfa442133c7fe5e53857

## Why

Sandboxed commands inherit the user's controlling terminal. Without an explicit
restriction, a child can use `TIOCSTI` to queue input for the unsandboxed shell
that resumes after Codex exits.

## What changed

Append a `file-ioctl` denial for `TIOCSTI` after the shared Seatbelt policy
allowances used by `codex sandbox`.

## Testing

Add a macOS PTY integration test that first proves terminal input injection
works without the sandbox, then verifies Seatbelt rejects it with `EPERM`.

GitOrigin-RevId: 5a8b0a5b4fd980cc406ad184d04ceae9b0ea90e4

## Why

Loaded threads can retain their previous configuration after a local plugin is
installed, preventing the plugin's bundled MCP servers and pending user-config
changes from taking effect in the current session.

## What changed

- Reload user configuration for loaded threads after installing a local plugin.
- Refresh MCP and hook runtimes only after the new configuration is applied.
- Keep installation successful if configuration reload fails, while logging the
  failure.

## Testing

- Verify an installed plugin's MCP tool can be called from a thread that was
  started before installation.
- Update the hook runtime test to verify installation applies a staged hook
  configuration change to the loaded session.

GitOrigin-RevId: 63f5a5c7f16303e51cf940e8d9dc3b45c50ae2a9

## What changed

Increment the `codex.windows_sandbox.private_desktop` counter when preparing a
Windows restricted-token sandbox execution, tagging it with whether private
desktop isolation is enabled.

GitOrigin-RevId: 1eb5e183b57e19753dc133dbe152eabe23dd2a23

## Why

An empty tool map does not distinguish a successfully returned empty catalog from a server whose startup or tool discovery failed.

## What changed

- Add nullable `toolsError` to each `mcpServerStatus/list` entry when no catalog is available because startup or tool discovery failed.
- Keep `toolsError` null for returned catalogs, including cached and empty catalogs, and continue returning healthy servers when another server fails.
- Update the protocol schemas and generated TypeScript type.

## Testing

- Extend the app-server status integration test with a broken MCP server and verify its error without losing the healthy server's inventory.

GitOrigin-RevId: 30b4ca4d9a45cec6998f5f626d3fddbee90a525d

## What changed

- Emit a connection-scoped `deprecationNotice` when `review/start` uses
  `delivery: "detached"`, including when validation later rejects the request.
- Preserve detached review behavior while directing callers to use `thread/start`
  followed by an inline review for a separate review thread.
- Document the deprecation and migration options in the app-server protocol and
  README.

## Testing

- Cover the notice for accepted and rejected detached reviews.
- Verify that omitted, null, and inline delivery do not emit the notice.

GitOrigin-RevId: 4234a09d2bb7ef8053091580175dc8cbe8d7512c

## What changed

Add `install_global_metrics` as the public entry point for installing an
externally managed, non-Statsig `MetricsClient` during single-threaded startup.
The returned handle retains ownership of the installed exporter so callers can
flush and shut it down.

GitOrigin-RevId: 1108a0468588046e5cc8266d2af6143f14456d82

In code mode, the size of a tool result the model receives is bounded only
by what the script's @exec pragma requests: truncate_code_mode_result uses
resolve_max_tokens(max_output_tokens) with no clamp, so a script that raises
its max_output_tokens can push a shell result (up to the unified-exec buffer
limit) straight into context.

Mirror the function-mode clamp in ExecCommandToolOutput::model_output_policy:
thread the model's truncation policy into truncate_code_mode_result and clamp
the requested budget to it, so a model can never receive a tool result larger
than its own output policy allows.

Adds a regression test asserting a high max_output_tokens pragma is clamped
to the model's truncation policy.