Test hook rejection for explicitly started queue items ## What changed - Add dedicated coverage for explicitly starting a queued item that a prompt hook rejects. - Verify the rejected item is consumed and no model request is sent. - Keep the automatic queue dispatch test focused on consuming a rejected item while allowing later queued input to proceed. <!--
Stabilize exec-server byte-budget tests ## What changed - Send the scripted HTTP response before queuing body deltas in the single-stream byte-budget test. - Allow 30 seconds for barrier requests in both byte-budget tests while retaining the default timeout for other operations. <!-- copyberry-projection-id: 528b7c5bf3d350af36a170200b21ca34b78d1466357297dad0
Preserve user message styling when wrapping long URLs ## Why Terminal autowrap for oversized URL tokens can drop the user-message gutter and background on continuation rows. ## What changed - Explicitly wrap long URLs within the available message width. - Preserve the complete OSC 8 hyperlink destination on every wrapped fragment. - Keep the user-message gut
Refresh tracing interest in the token estimate test ## What changed Rebuild the tracing callsite interest cache after installing the test-local subscriber so the `event_enabled!` assertion uses that subscriber's filters. <!-- copyberry-projection-id: e3e6cb65100deeff6178eeb39a90e70cb03ef987acce80474668851b1fa2ce11 -->
Expose conversation history to tool lifecycle extensions ## What changed - Add a shared, read-only `ConversationHistorySnapshot` capability to the extension API. - Include the snapshot in `ToolStartInput`, preserving conversation order while excluding contextual user messages. - Avoid acquiring a history snapshot when no tool lifecycle contributors are regis
Pool Guardian sampling WebSocket connections ## What changed - Prewarm two Responses WebSocket connections and grow the pool on demand, up to eight connections, so overlapping samples can run concurrently. - Lease each connection to a single sample and return healthy connections to the idle pool after completion. - Replace closed or 55-minute-old connections
## Why The proxy-owned credential broker introduced in #28034 can replace real credentials with per-child dummy values, but Codex core still needs to opt into that behavior and carry it across the command lifecycle. Without this integration, a managed child can lose its brokered values when a shell snapshot restores the environment. Conversely, an escalated
Integrate workload identity with Codex authentication ## What changed - Select workload identity authentication from `OPENAI_FEDERATION_RULE_ID` and `OPENAI_IDENTITY_TOKEN_FILE`, while preserving explicit API key and access token precedence. - Adapt workload identity exchanges to the shared authentication manager and reuse a compatible process-scoped session
Start required cached MCP servers lazily for subagents ## Why Subagents can reuse cached MCP tool definitions without opening another server connection immediately, but marking a server as required previously forced eager startup even when its cached tools were available. ## What changed - Allow required MCP servers with usable cached tools to remain dormant
Detect implicit skill invocations from PowerShell reads ## What changed - Recognize `Get-Content` reads of indexed `SKILL.md` files as implicit skill invocations. - Support the optional `-Raw` flag, quoted paths containing spaces, and Windows paths without stripping backslashes. ## Testing - Add unit coverage for the supported `Get-Content` forms and Windows
Track root turns across delegated Codex requests ## Why `parent_turn_id` identifies the immediate caller of a nested request, but not the top-level turn that initiated a multi-level chain of work. ## What changed - Add `root_turn_id` to turn state, submissions, and Responses API metadata. - Propagate the root through spawned agents, delegated work, review se
Include Node REPL policy in turn metadata ## What changed - Parse `node_repl_auto_review_required` and `node_repl_disabled` from model catalog entries and include their values in each turn's Responses API metadata. - Treat both fields as reserved metadata so client-provided values cannot override the selected model's policy. - Use the selected review model's
Track client-authored developer messages in rollout history ## What changed - Mark developer messages received from clients with `client_authored` harness metadata when `retain_client_developer_messages` is enabled. - Carry that provenance through pending input and persist it alongside rollout response items without adding it to provider requests or the seri
Resolve paginated thread history by rollout ID ## Why `thread/revert` keeps the logical thread ID while selecting a new immutable rollout. Using the thread ID for persisted history can therefore read or update the wrong rollout. ## What changed - Centralize resolution of a thread's current rollout across live writers, SQLite metadata, and filesystem fallback
Add dynamic HTTP header helpers for MCP servers ## What changed - Add `http_headers_helper` configuration for local streamable HTTP MCP servers. The configured shell command runs once per connection and returns a JSON object of headers that is cached across requests. - Apply helper headers to MCP startup and OAuth flows while restricting them to the server o
Read model ETags from WebSocket metadata events ## What changed - Extract `x-models-etag` from `codex.response.metadata` events and emit it as a `ModelsEtag` response event. - Stop reading or reporting the model ETag from WebSocket upgrade headers. ## Testing - Update the WebSocket response-stream test to deliver the ETag through a metadata event and verify
Collect metrics from plugin shell commands ## What changed - Provide matching local plugin commands with a sandbox-writable temporary output file through `CODEX_PLUGIN_METRICS_OUTPUT` when analytics is enabled. - Validate successful command output against the plugin's `analytics.yaml` declaration, including measurement names, enum dimensions, finite values,
Collect plugin metrics from unified exec commands ## What changed - Create a metrics sidecar for attributed local plugin commands launched through unified exec, and grant the sandbox access to its output file. - Publish valid measurements when the initial command exits, while discarding the sidecar when the process remains live for later polling. - Strip inh
Report the latest rejection from multiple network reviews ## Why A single execution can trigger multiple network approval reviews. Its tool result should reflect the latest specific rejection. ## What changed - Let each explicit network review outcome replace the previously recorded outcome for the execution. - Keep generic blocked-request messages as fallba
Reconnect gRPC code-mode sessions after host restarts ## What changed - Reopen a cached code-mode session when its gRPC host stops, while serializing concurrent reconnection attempts and coordinating shutdown. - Scope cell IDs to the new host generation so callbacks remain consistent and stale `wait` or `terminate` requests are rejected. - Accept both `unix:
Unify external authentication provider handling ## What changed - Use each `ExternalAuth` provider's error classification for resolve, refresh, and validation failures. - Allow runtime providers to be replaced, clearing any recorded permanent refresh failure after the replacement resolves successfully. - Preserve workload identity as immutable, host-managed
Resolve skill package aliases in `skills.read` ## Why Skill catalogs can present shortened package locators, but callers previously had to expand those aliases before reading a skill. ## What changed - Resolve catalog aliases automatically when `skills.read` looks up a model-visible executor or orchestrator skill package. - Update skill prompts and tool docu
Use bounded fallback ports for Windows managed proxies ## What changed - Try the explicitly configured Windows HTTP or SOCKS5 proxy port first, then scan the protocol's preferred port range when that port is unavailable. - Reserve HTTP and SOCKS5 listeners independently so a SOCKS5 collision does not replace an already available HTTP listener. - Retain ephem
Expose executor skill roots from `skills.read` ## Why Executor-backed skills can include bundled scripts, so skill readers need the skill directory in the executor filesystem to locate them. ## What changed - Add `skill_root` to `skills.read` responses for executor-backed skills. - Derive the root from the parent directory of the skill's main resource and om
Stamp conversation history items with creation times ## What changed - Add fractional Unix creation times to locally authored user, developer, agent, and tool-output items when they enter durable conversation history. - Preserve any creation time already supplied with an item across subsequent requests, remote compaction, and resumed history. ## Testing - Co
Unify turn input submission and routing ## What changed - Add `TurnInputRequest` and typed submission results for atomically starting a turn, steering the active turn, or declining input with a specific reason. - Expose `start_or_steer_turn`, `start_turn_if_idle`, and `steer_turn` on `CodexThread`, and migrate Core consumers to these APIs. - Make app-server
Track plugin metrics for background unified exec commands ## Why Unified exec can yield while a command is still running. Plugin measurement collection must remain active until that background command exits, including when its item completion arrives after the turn has completed. ## What changed - Keep the plugin metrics sidecar with the stored process and l
Show estimated thread usage in `/status` ## What changed - Extend `account/usage/read` with an optional `threadId` request and a backward-compatible `threadUsage` response containing estimated credits, optional USD cost, and model, reasoning, speed, and token breakdowns. - Fetch thread usage for eligible Business and Enterprise plans when `/status` is opened
Add thread usage to TUI status surfaces ## What changed - Add `thread-credits` and `estimated-thread-cost` items to the configurable status line and terminal title for Enterprise workspaces. - Fetch one shared thread usage estimate only when either item is selected, omit unavailable values, and refresh the display after turns complete. - Preserve the last no
Collect plugin metrics from remote executors ## What changed - Resolve manifest-declared metric operations against the executor filesystem for remote plugin commands. - Create the measurement sidecar in an executor-native, owner-private temporary directory, stream its bounded output back for validation, and clean up the directory afterward. - Extend the exec
Support gRPC code-mode hosts in app server ## What changed - Accept root `http://` and `https://` URLs in `--code-mode-host` and use the shared gRPC session provider for those endpoints. - Keep `ws://` and `wss://` URLs on the existing WebSocket transport. - Reject paths, queries, fragments, and credentials where unsupported, without exposing gRPC URL creden
Add durable reverts for paginated threads ## What changed - Add `ThreadStore::revert_thread` to retain history before a selected turn by creating a new immutable rollout and atomically switching the thread's stored rollout path. - Preserve the logical thread ID and session metadata across repeated reverts. - Track every rollout owned by a thread so archive,
Route network access through the shared approval pipeline ## What changed - Represent blocked network requests as approval actions so permission hooks, automatic review, and user review use the common approval flow. - Route network requests using the active turn's review settings, including for background terminals started by an earlier turn. - Record the fi
Add interrupted turn recovery ## What changed - Add `RecoverTurnRequest` and `CodexThread::recover_turn_if_idle` to resume an interrupted regular turn with its existing turn ID and updated thread settings. - Treat recovery separately from automatic idle work so it can resume in Plan mode without injecting an empty user message. - Reject recovery while anothe
Protect inline visualization viewers from sandbox writes ## Why Inline visualization viewer documents must remain outside locations that a sandboxed session can modify before they are opened in a browser. ## What changed - Materialize viewer documents in a dedicated cache under `CODEX_HOME`, keyed by the source and artifact thread IDs, instead of alongside v
Make gRPC code-mode yield tests deterministic ## What changed - Use a never-resolving promise when verifying that a session continues to enforce its yield limit after terminating a cell. - Use `yield_control()` to create the yielded cell in the notification-draining test instead of relying on timer scheduling. <!-- copyberry-projection-id: 7c60a0ca2045fc5d94
Support sandboxed file streaming in exec-server ## Why Streaming reads previously rejected requests that used a platform filesystem sandbox. ## What changed - Open streamed files in the sandbox helper and return the open file to the exec-server by passing a file descriptor on Unix or duplicating a file handle on Windows. - Advertise support through the `sand
Persist security risk scores in rollout history ## What changed - Add a `SecurityRiskScore` rollout item containing a category and numeric score. - Persist the item in both thread history modes while excluding it from model context, user-visible thread history, search text, forks, and reconstructed conversation history. - Re-export the score type from the ex
Add the Guardian V2 Luna sampler ## What changed - Add a `LunaSampler` that opens an authenticated Responses WebSocket and reuses it for structured, tool-free `gpt-5.6-luna` requests. - Carry the host's provider, authentication, proxy, attribution, and service-tier configuration into the connection and requests. - Require strict JSON schemas, preserve per-re
Constrain Guardian reviews to parent filesystem permissions ## Why Guardian review sessions must not gain access to paths that the parent turn is not allowed to read. ## What changed - Derive Guardian permissions by intersecting managed parent filesystem rules with read-only access, preserving denied paths and restricting network access. - Offer Guardian exe
Prevent unread events from blocking in-process requests ## Why Awaiting a bounded consumer event queue can stall the in-process app-server worker when notifications are not being drained, preventing it from delivering a request response queued behind them. ## What changed - Use an unbounded queue for caller-facing in-process events while keeping command and
Return Luna samples when streamed JSON completes ## Why Structured output can be complete before the Responses stream emits its terminal events. Waiting for those events unnecessarily delays the sampler and can leave it waiting after usable output has arrived. ## What changed - Return a Luna sample as soon as accumulated text deltas parse as a complete JSON
Refine skill creation guidance and validation ## What changed - Rework the bundled `skill-creator` guidance around concise, scoped instructions, progressive disclosure, optional resources, invocation policy, and risk-based forward-testing. - Simplify generated skill and reference templates so new skills start with only the placeholders and resources they nee
Use effective permissions when trusting app-server projects ## Why Project-local configuration can launch host processes. Requested write access may be reduced to read-only by managed constraints or platform support, so the request alone must not cause the app server to trust a project and load its configuration. ## What changed - Base automatic project trus
Reject sessions with unloadable required managed hooks ## Why Hooks supplied as managed requirements must not be silently skipped when their handlers cannot be loaded. ## What changed - Fail session and app-server thread startup when an enabled managed requirement contains an invalid matcher, an empty command, or an unsupported handler type. - Keep load fail
Reap orphaned processes in Linux sandboxes ## Why Sandboxed descendants can outlive their immediate parent and must be collected by PID 1 in the Bubblewrap namespace. ## What changed - Launch `codex-linux-sandbox` with Bubblewrap's `--as-pid-1` option, and fall back to the bundled Bubblewrap when the system version does not support it. - Run the sandboxed co
Include Node REPL results in Guardian reviews ## What changed - Capture accepted, successful `node_repl` results from Code Mode and include them as bounded, untrusted evidence in Guardian review prompts. - Enable the enhanced transcript through `guardian_enhanced_node_repl_transcripts` or when the selected model requires automatic Node REPL review. - Keep th
Preserve floating-point values when decoding rollout lines ## Why Serde's generic buffering for flattened and internally tagged fields is incompatible with `serde_json`'s `arbitrary_precision` representation. As a result, persisted rollout items containing nested floating-point values can fail to decode. ## What changed - Decode the rollout envelope at the J