Sync upstream/main into fork/main (WI-3327) - #37

…58717)

## Why

The BuildBuddy key is revoked. Temporarily keep Bazel-dependent checks from blocking CI and release only Cargo artifacts.

## What changed

- Remove Bazel from the `blocking-ci` required dependencies.
- Make the Bazel-backed argument comment lint and SDK jobs advisory, and stop requiring the lint job to succeed in the Rust CI results check.
- Restrict release build and packaging matrices to Cargo, including Windows and provisioned macOS packages, and exclude Bazel binaries and symbols from release artifact downloads.

GitOrigin-RevId: 2c0d23471bbd0ab2eb4d90d318b518d0b33db97f

## What changed

Split conversation rendering into preparation, painting, and post-draw steps. Use the supplied conversation bounds for transcript wrapping, composer layout, suggestion overlays, cursor placement, and the empty-state animation.

Preserve surrounding text and image placements during input-triggered redraws. Keep centered dialogs relative to the full viewport and restore neighboring content when they close.

## Testing

Extend regression tests and add a snapshot for conversations rendered at an offset, covering selection, link hit testing, cursor placement, scroll preservation, neighboring images, and dialog dismissal.

GitOrigin-RevId: 0dbca3f8d1064f2d58856c3bc77a4dab1c099cdd

## What changed

- Build native voice SDK and runtime artifacts with Bazel for Linux GNU, macOS, and Windows on x64 and ARM64, then configure Cargo jobs to consume them. Keep musl builds in a separate job without these inputs.
- Validate artifact receipts against the target, source commit, and source manifest; verify SDK file hashes and relocate pkg-config metadata. Package the runtime and plugins with nextest archives and restore `CODEX_TEST_VOICE_RUNTIME` when running shards.
- Prepare native Windows voice tools for argument-comment linting and install ARM64 DotSlash on Windows ARM64. Reduce archive disk usage, bound Linux ARM64 build concurrency, and correct the JUnit artifact path.
- Recognize TLS errors wrapped directly in `io::Error`. Make TLS fallback fixtures select the native backend explicitly, allow the MCP test server's non-loopback address, and isolate skill-root tests from ancestor Git markers. Install `git` in remote test containers and filter MCP discovery assertions to POST requests.

## Testing

Add tests for relocated voice inputs, Windows ARM64 import libraries with host-native pkgconf, and rejection of mismatched receipts or corrupt SDK files. Extend untrusted-certificate coverage to an explicitly selected rustls backend.

GitOrigin-RevId: da3ff690b94906edc1f8f60a3c7feda1bf66134a

## What changed

- Group threads needing approval first in `/subagents`, mark them with `(needs approval)`, and initially select the first waiting thread.
- Refresh the open picker and approval notice as requests and agent metadata change, preserving the selected thread when rows move.
- Use consistent agent labels across the picker and approval notice, preferring agent paths and using UUID suffixes to distinguish unnamed agents.
- Track approval requests that arrive before thread metadata and refresh pending approvals after reconnecting.

## Testing

Extend the picker test and snapshots to cover approvals arriving while the picker is open, agent paths arriving later, and selection staying on the same thread after reordering.

GitOrigin-RevId: b7dd943d151ce98d1978f7c6b9f5e16903b9075b

)

## What changed

Add `BackendSessions` helpers to name the displayed listening backend, find the first listening backend, and cycle through listening backends in registration order. Cycling wraps around, skips closed streams, and excludes the current backend. Display names use `Local` for the initial session and `Backend N` for additional sessions; a closed displayed stream has no name.

## Testing

Extend backend session tests to cover cycling with a single backend, wraparound across three backends, and skipping a closed stream.

GitOrigin-RevId: e8f3fcc38a178b6b91d385d65d899fdd042062c5

## Why

BuildBuddy credentials are unavailable for voice release builds.

## What changed

Set `BUILDBUDDY_API_KEY` to an empty string in the Linux, macOS, and Windows voice release build steps so the Bazel wrappers use their local configuration.

GitOrigin-RevId: 69e47d6b6077fbb74b5895eacbe587766345b7ec

…#58751)

## Why

Live paginated history retains completed assistant text even when summaries only need the latest message. Release older text for threads with persisted history while preserving full resume responses.

## What changed

- Evict superseded assistant text from live turn state while preserving corrected items and the latest assistant message.
- Restore evicted text for full resume responses from prepared history pages, fetching remaining items by ID in bounded batches. Return an error if saved text is missing.
- Only load the active turn when it belongs in the requested initial page, and use the item ID index for targeted history reads.

## Testing

Add reducer coverage for text eviction and corrected messages. Extend running-thread resume coverage to compare full and summary items with live notifications, exercise restoration when the prepared page lacks the active turn, and check missing-text errors.

GitOrigin-RevId: 3229c0cea820f117dc6331312f1e6056a8d1d52c

## Why

The DotSlash configs require Bazel assets that are absent from the Cargo-only release asset fixture for `0.167.0-alpha.2`.

## What changed

Remove the Bazel outputs for Codex, the Windows command runner and sandbox setup, and provisioned macOS packages from the release configs.

## Testing

Add regression tests using the release asset fixture to verify that every configured output has a matching asset and that missing Codex and provisioned macOS package assets are detected.

GitOrigin-RevId: ed10a56717e0a7c6c566087b64621bd3ff042412

## Why

Accepting the startup update prompt exits before connecting to an app server, so launch telemetry previously reported `unconfirmed`.

## What changed

Record `app_server_mode=update_requested` when handing off to the updater. Continue recording `in_process`, `local_daemon`, or `remote` after a successful connection, and use `unconfirmed` for other early exits.

## Testing

Extend the launch telemetry test to verify exactly one recording for a connection, an update handoff, or an early return.

GitOrigin-RevId: 10dd29246218e1a86a396ab073305402a0b44d38

## Why

MCP startup alone should not block `/fork`, and rejecting a fork while foreground work is pending should preserve the draft and its image attachments.

## What changed

- Defer `/fork` draft consumption until dispatch validates the thread state, as for `/review`.
- Allow `/fork` during MCP startup when no user turn or review is pending or running, and clear the composer after validation succeeds.
- Preserve drafts and attachments when these commands are rejected in side conversations.

## Testing

Extend regression coverage for `/fork` and `/review` draft preservation during MCP startup, successful fork dispatch and composer clearing, rejection during an active review, and attachment preservation in side conversations.

GitOrigin-RevId: d152ba6659e4507d8750cb6bd3073d9f8b293538

)

## Why

`start_or_steer_turn` rejected agent messages, preventing callers from submitting follow-up work through the turn input API.

## What changed

Route `TurnInput::InterAgentCommunication` through native agent message delivery and return `TurnInputSubmission::Accepted`, without implying an immediate turn ID. These submissions request work regardless of `trigger_turn`, retain the recipient's settings, and forward turn-start options.

Wrap plaintext messages with agent context while preserving encrypted content. Reject submissions to idle recipients when the host is draining.

## Testing

Add scenario tests and snapshots covering queued-message ordering, encrypted follow-ups, preemption at reasoning boundaries, and follow-ups arriving before or after a final answer. Extend drain-gate coverage to agent submissions with parent-turn lineage.

GitOrigin-RevId: 92d49465f97bb366babbf1b1bc18a1e8a6c6ed1c

## What changed

- Add `modelProvider/list` to return OpenAI and explicitly configured providers, provider-specific settings, and the selected default provider.
- Report `canEdit` and `canChangeDefault` based on configuration requirements, layer precedence, and whether user configuration is enabled.
- Describe gateway authentication without resolving credentials, and omit endpoint URLs that are unsuitable for display.
- Document the API and update generated JSON schemas, TypeScript types, and Python models.

## Testing

Add app-server tests for provider discovery, authentication modes, unsafe URL suppression, and configuration editability, plus a Python wire-format round-trip test.

GitOrigin-RevId: 8ba26637cd6bdd075e0e815e88aeeb04c53a2364

## What changed

Add `modelProvider/config/write` to create custom gateways and patch existing custom gateway, Bedrock, and GCP settings. Return the saved provider using the same safe summary as `modelProvider/list`.

Omitted fields retain their values; explicit `null` clears nullable user overrides. Apply patches through the shared configuration queue with last-write-wins semantics, enforce field editability and validation, and preserve unexposed authentication settings.

Saving leaves provider selection and authentication unchanged. Saving the provider used by `model/list` invalidates its catalog for the next access. Include documentation and generated JSON, TypeScript, and Python protocol types.

## Testing

Add coverage for gateway creation and ID allocation, patch and null semantics, configuration policy enforcement, authentication preservation, and catalog refresh after active-provider edits. Extend Python protocol tests to verify wire round trips and reject mismatched provider IDs or fields.

GitOrigin-RevId: 850fe2c48ef5274944400efb5a859d720179c923

## Why

Input accepted while a regular turn was flushing its transcript could miss the final pending-input check and remain unprocessed when the turn completed.

## What changed

Check pending input atomically with closing steer admission. If input was accepted, resume sampling in the same turn while preserving MCP startup requirements, and complete the turn with the updated answer.

## Testing

Add a regression test that pauses the final flush, submits a steer, and verifies that the model receives it exactly once before the same turn completes with the answer to the steer.

GitOrigin-RevId: 193db3ab6916a86e97c3845590598fd8fbe47081

## Why

Timestamp-only cursors can skip threads that share the last result's timestamp, including rollout files created in the same second.

## What changed

- Include thread IDs as tie-breakers in time-sorted listing and search cursors, and use them when resuming filesystem scans and database queries.
- Share filesystem sort-key and cursor construction so continuation cursors match the listing order, including filename-based creation times.
- Preserve support for legacy timestamp-only cursors and their existing behavior of skipping ties.

## Testing

Update regression coverage for pagination through filesystem timestamp ties, legacy cursors, thread IDs in database fallback cursors, and search cursors for all time-based sort keys.

GitOrigin-RevId: 455b95452849e6ffe20a27d7bdcec864f2e8135a

## What changed

Add the disabled-by-default `cli_resume_account_check` feature. When enabled for `codex-tui` and `codex_exec`, reject resuming or attaching to a local thread if its recorded creator user or workspace differs from the current ChatGPT account. Return an error directing the user to sign in with the original account.

Carry creator IDs through stored thread metadata and check them before loading resume history. Preserve existing behavior for untagged threads, other clients, and authentication modes without a comparable ChatGPT account.

## Testing

Add integration coverage for account and workspace mismatches, matching accounts, legacy and paginated history, ID and path lookup, and the feature's default and bypass behavior. Verify that switching back to the original account permits attachment to a loaded thread and that creator metadata remains unchanged.

GitOrigin-RevId: a3ab089254703417dde0890a5f8d6326c4cbb75a

## What changed

- Add `model_messages.plugins` overrides for generic usage guidance, selected-plugin hints, and recommendation introductions, with independent fallback to bundled wording for missing or invalid fields.
- Validate text limits and required template placeholders while keeping plugin identities, available capabilities, and eligibility controlled by the client.
- Track generic guidance changes across model switches and session resume, emitting replacement or retirement notices and supporting legacy snapshots and retained history.

## Testing

Add unit and scenario coverage for sparse overrides, literal text preservation, template validation, UTF-8 size bounds, capability filtering, recommendation fallback, and guidance recovery after resume.

GitOrigin-RevId: 148b658c2d8490c9d0dc208addbee1be5342a5f5

## What changed

Allow `guardian_review` to assess recorded native `apply_patch` calls alongside `exec_command` calls. Use the existing patch preparation and approval logic without applying the patch, and skip assessment when approval is unnecessary.

## Testing

Add coverage that compares direct and live patch review inputs, verifies that an allow decision leaves files unchanged, and checks that writable files skip review without writes or model requests.

GitOrigin-RevId: 8634ad8c00a67bcac9e7930ebf89c02707c3a6f7

## What changed

Allow `guardian_review` to assess a final recorded `request_permissions` call without granting permissions. Build the review action using the same permission request preparation as live review, while continuing to reject earlier permission requests in the recorded history.

Return no assessment when the approval policy is `never` or granular policy disables permission requests.

## Testing

Add coverage comparing live and direct permission review inputs, plus tests that disallowed requests return no assessment without contacting the reviewer.

GitOrigin-RevId: cb5935202b0980e657b023f840a0186cea5e0b74

…58904)

## What changed

- Add `codex-message-board-mcp` to serve discussion tools at `/mcp` through ordinary MCP configuration, backed by the existing SQLite board and a read-only Codex registry.
- Require bearer authentication and validate `threadId` and `sessionId` metadata against persisted agent membership. Support additional allowed HTTP hosts with `--allowed-host`.
- Expose a reusable `serve_http` library entry point and scope retry deduplication to the caller within an MCP session.

## Testing

Add integration coverage for a child posting and its restarted parent reading the persisted board, including reads while a database writer lock is held. Cover invalid tokens, disallowed hosts, missing caller metadata, invalid membership, and startup without an existing registry.

GitOrigin-RevId: 5e3d71eaaf120169e2585acd0b5f84df1b402f00

## What changed

Add a `message-board` plugin with connection metadata for the HTTP MCP server. It defaults to `http://127.0.0.1:7777/mcp`, uses `CODEX_MESSAGE_BOARD_TOKEN` for bearer authentication, and marks the server as required.

Document installation and endpoint overrides through `mcp_servers.codex_message_board`. Installing the plugin does not start the server.

## Testing

Extend the HTTP board integration scenario to cover both direct configuration and plugin installation, verifying that a child can post a decision and its restarted parent can discover the same board and read it. Add a plugin context snapshot and include the plugin resources in Bazel test data.

GitOrigin-RevId: d6cf797caaa4dbdcd45114c2ad0a6bd695cf056f

)

## What changed

Expose `launch_in_memory()` and `LocalServer` to run a loopback HTTP endpoint with generated bearer credentials. Runners register a shared in-memory board per session through `add_board(session_id, host)`, using `MessageBoardHost` for membership, clocks, and notifications without a SQLite registry.

The handle exposes the endpoint and authorization header for MCP configuration, including plugin endpoint overrides. Dropping it cancels HTTP and MCP sessions; `shutdown().await` also waits for completion.

## Testing

Extend the parent/child HTTP integration scenario to cover the in-memory launcher, plugin endpoint overrides, host-provided timestamps, authentication and invalid identity rejection, and operation without creating a SQLite board database.

GitOrigin-RevId: e1cae295724a35f4eded290ba8a4e19926b98c13

…58918)

## What changed

- Add `currentAccountOnly` to `thread/list` and `thread/search`, defaulting to `false`, and enable it for TUI history discovery, resume pickers, and task mentions.
- Mark newly created threads as account-scoped and require each recorded creator user or account ID to match the current login. Older threads and threads without creator IDs remain shared; API-key logins continue to see all local history.
- Preserve account scope through resume and revert, including fallback to original rollout metadata when an older binary drops the marker. Forks receive new-thread scope.
- Skip unreadable rollout headers in scoped discovery and filter search candidates before reading snippets. Direct access by thread ID remains available.

## Testing

Add coverage for account matching, shared legacy history, list page refilling, search pagination, API-key visibility, and scope preservation across reverts. Extend rollout lookup coverage to compressed active and archived files.

GitOrigin-RevId: aa374f5e69165be5a71c0716ded1b105f5fb51e0

)

## Why

Streaming answers and plans need to wrap to the conversation's allocated width, which can differ from the terminal width. Resizing while reading earlier output should not report new activity unless new output has arrived.

## What changed

Reflow live streams when preparing the owned conversation layout, using its allocated width. Update the observed live revision after presentation-only reflow so it does not trigger `New activity`, while preserving notifications for unseen output.

## Testing

Add regression coverage for streaming answer and plan tables across width changes, including a narrow-layout snapshot, preservation of the reading position, and activity notifications when new output arrives before a resize.

GitOrigin-RevId: a9831c5a1a5ffb7477e7868d4ecca430d6ee50f3

openai#58931)

## Why

Direct Guardian review rejected recorded `exec_command` calls intercepted as `apply_patch`, even though normal execution could review those patches.

## What changed

Share intercepted patch preparation between execution and direct review so Guardian assesses the verified patch and its approval requirement without applying it.

## Testing

Extend the direct patch review scenario to cover `exec_command` heredocs alongside native `apply_patch` calls, asserting identical live and direct review inputs and no file writes after direct approval.

GitOrigin-RevId: af62cf66a3f01c65a65c15cfad3fc9cdd1f2bf19

## Why

Connected legacy MCP sessions and HTTP keep-alive connections can retain message-board state after shutdown. Pending board bindings also need cancellation before they can dispatch a tool call.

## What changed

Explicitly close MCP sessions after HTTP drains and track binding factories and handlers until they release their state. Cancel pending bindings during shutdown while allowing already-dispatched board operations to finish. Clarify that `LocalServer::shutdown` waits for cleanup, while dropping the server initiates it.

## Testing

Add regression coverage for shutdown with a connected legacy client, a paused board binding, and an unauthenticated keep-alive connection. Assert that shutdown releases the board host before returning.

GitOrigin-RevId: 7fbc9415e579a21f0c0fcf7bbb7db239b3aea886

## What changed

- Thread `ContextBudgeting` through synchronous context and image preparation. Elastic mode preserves candidates for later entry capping and allocation; existing reviewer callers continue to use `Fixed`.
- Defer transcript selection, supporting-text caps, and image budget admission in elastic mode while preserving exact planned actions. Mark host framing as protected and distinguish optional user messages from required manual approvals.
- Add `ElasticBudgetConfig` validation requiring section minimums, including fallback policies, to sum to `DEFAULT_MAX_INPUT_TOKENS`.

## Testing

Extend tests for elastic transcript preservation, deferred native tool-call limits, oversized planned actions, image allocation, and section minimum totals above and below the required budget.

GitOrigin-RevId: 46a4605e12e2bab5973097eb1caf5fd99f6640aa

## What changed

Move inline tests for authentication, bearer auth, model endpoints, and providers into dedicated `*_tests.rs` files. Register workspace-routing tests under the `workspace_routing` module and keep test-only imports with the tests.

GitOrigin-RevId: 9ba043c82814e27be63432a0e13a4929dc3ea372

…8937)

## What changed

Strengthen the execution cancellation test to verify that a session approval wakes a queued request before it is polled again. Assert that the request remains unwoken while the session policy commit lock is held, then receives a wakeup after the grant completes.

Wait for the second request to hold a prompt queue reference and install a counting waker on its semaphore. Share `WakeCount` with the existing manual prompt wakeup tests.

GitOrigin-RevId: c559a7c31385000347cd1c7dace25e84d1099db9

## Why

Reasoning summaries can arrive with item start or completion events rather than streamed deltas. The TUI can miss or truncate these summaries, and replay after a voice handoff can hide reasoning that started before the handoff.

## What changed

- Initialize reasoning from item start payloads and reconcile live and replayed completions with their full summaries. Preserve streamed text when completion payloads are empty, and continue honoring `show_raw_agent_reasoning`.
- Retain active reasoning payloads across refreshes without resetting an already active item when its start event is replayed.
- Preserve the typed origin of reasoning started before a voice handoff and filter later delegated reasoning starts from buffered replay.

## Testing

Extend regression coverage for summaries supplied at start or completion, partial streamed summaries, active reasoning after refresh, and replay that retains pre-handoff summaries while hiding delegated reasoning even after the handoff marker is evicted.

GitOrigin-RevId: 724b9fc58e10f4d87dabd3d9930e252270855a4f

## Why

A tool can start before an assistant message finishes streaming. The TUI needs to incorporate the completed text without duplicating the reply or leaving Markdown split across interrupted fragments. Some streams also include initial text in `item/started` before sending deltas.

## What changed

- Display initial assistant text from `item/started`, avoiding duplicate starts for the same message.
- Track interrupted replies by turn and item ID, then replace their flushed fragments with the completed message at the reply's original position, preserving intervening tool order.
- Re-render the completed Markdown and update transcript views and scrollback.

## Testing

Extend streaming tests to cover initial text, resumed deltas, Markdown spanning a tool interruption, and matching live and replayed transcripts. Expand completion-repair cases to cover missing text and resumed fragments.

GitOrigin-RevId: 7f35e52d0bca2100baf722d7ef4922cd127bbc45

## Why

Matches in parent directory names can crowd matching filenames out of limited search results. For example, searching for `ViewModel` should keep `ChatViewModel.kt` visible even when many directories are named `viewmodel`.

## What changed

- Rank basename matches before applying the result limit for single positive fuzzy queries without path separators.
- Prefer exact filenames, then the strongest exact directory match, then other matching filenames. Leave additional directory matches ranked by their paths.
- Compute highlight indices from the basename for promoted results and return scores that reflect the new ranking.
- Rank snapshots in resumable time slices so new queries and cancellation can interrupt the work.

## Testing

Add regression coverage for filename matches surviving the result limit, exact file and directory priority, path queries, and resuming partial rankings. Update app-server score expectations while preserving highlight indices.

GitOrigin-RevId: 41b3420581b4f6490859e809245370b737889544

## What changed

Replace external `rg` scans and the fallback walker with an in-process `ignore` walker for bubblewrap deny-glob expansion. Remove scanner lookup and dependency tracking from sandbox integrity checks.

Include hidden and ignored files, respect scan depth limits, and fail closed on traversal errors. Anchor patterns to their static search roots and preserve literal leading `#`, leading `!`, trailing spaces, and unclosed character classes. Follow explicit symlink roots while skipping child symlinks, and mask canonical targets of matched paths.

## Testing

Extend unit and sandbox integration coverage for glob syntax, depth limits, traversal failures, symlink handling, commands launched from `/`, and operation without executing `rg`.

GitOrigin-RevId: 1767d7f37acb149457642bf24ee5971a28696438

Document that `AgentMessageBoard` notification delivery follows the host's
scheduling and wake policy and may buffer notifications for idle recipients.
Link to `MessageBoardHost` for the delivery contract.

GitOrigin-RevId: fb085fe2c43c74b85b4e6fe471e7d4ae216bf3db

GitOrigin-RevId: d7f7c2db52349797c0063526c1ad8e35d4217252

…59722)

## What changed

- Add Space to set the default provider from Model providers settings, persisting `model_provider` on the connected server. Keep provider details available and disable selection when server configuration or client launch settings fix the provider.
- Apply the choice to `/new` while preserving the current chat. Refresh account details for new chats and reject account data that does not match the started provider.
- Block stale `/model` choices during saves and after confirmed or uncertain provider changes, including across reconnects. Tell users to restart the app server and TUI to refresh the model list, and discard queued picker actions from another backend or chat.

## Testing

Add coverage for provider saves, retry after disconnection, concurrent-save prevention, stale model choices, and account/provider matching, with updated provider-picker snapshots.

GitOrigin-RevId: af6d149f7de7a2eaa09a31935f7088faa64d6a59

## What changed

Expose `AgentTurnOutcomeReporter` for hosts to install through `StartThreadOptions::thread_extension_init`. Await its callback after emitting the terminal turn event, independently of native parent notifications, so hosts can handle result delivery and retries.

Track outstanding outcome handoffs and wait for them during graceful shutdown before running thread-stop hooks. Prevent new turns from starting once handoff registration closes.

## Testing

Add integration coverage for completed and errored outcomes, turn lineage, queued follow-up turns, and shutdown waiting for handoffs. Extend Guardian tests to verify that strict safety stops reach the reporter while default interruptions remain silent.

GitOrigin-RevId: 0d825f6208f0250969734488881f32fd1dcd7509

)

## Why

Idle reads from local MCP servers on Windows can occupy Tokio's blocking threads and delay unrelated filesystem operations.

## What changed

Use IOCP-backed named pipes for local MCP server stdin, stdout, and stderr on Windows. Connect child endpoints before launch, restrict pipe access to the owner and SYSTEM, and reject remote clients. Preserve the shared legacy and modern protocol framing.

## Testing

Add Windows regression tests to verify that idle MCP reads leave blocking I/O available in both protocol modes and that child output handles support querying the pipe mode.

GitOrigin-RevId: ca39b940a54427a2cd7bab5291011b0b09143b3f

…ai#59728)

GitOrigin-RevId: f332fd4f86e08c6a5e9bfe08966f9b30c82113ff

…ai#59732)

## Why

Multi-agent V2 still supplied native tool usage guidance when native tools were disabled, leaving instructions for unavailable tools in model requests.

## What changed

Skip bundled and model catalog role guidance for both root agents and subagents when `disable_native_tools` is enabled. Preserve explicitly configured usage hints.

## Testing

Add coverage for omitted bundled and catalog guidance and preserved configured hints with native tools disabled. Update the request snapshot and assert that spawned agents do not receive native tool call guidance.

GitOrigin-RevId: 6f2facabc95e78cbf64af19636a4daf488bbcc51

## What changed

Extend `guardian_review` to assess recorded MCP tool calls using the current tool catalog, bindings, and approval policy without executing the call or remembering an approval. Return no assessment when policy or a remembered approval skips review, and reject tools blocked by app configuration.

## Testing

Add a scenario test that compares direct and live MCP review inputs, verifies that neither dispatches the tool, and checks that the current app approval policy can skip review.

GitOrigin-RevId: 05746dd0804a0f96d7946468701d5222171ff64f

## Why

Versions of `ignore` differ in whether parallel walks report traversal errors at the depth boundary, making the test's expectation depend on the walker implementation.

## What changed

Keep the denied directory within the bounded scan depth in `unreadable_glob_traversal_errors_fail_closed`. Require both bounded and unbounded scans to fail with the denied path and permission error, replacing the CPU-count-dependent assertion.

GitOrigin-RevId: 4ed97253247e0c032648ebc6d4be2a97c3ab261a

…penai#59737)

## What changed

Require the `openai` provider ID as well as `GuardianNativeMultiAgentHistory` to enable native agent history and review of multi-agent calls. Apply the same check to Guardian prompt construction, collaboration tool registration, and Guardian v2 configuration.

## Testing

Add coverage for fresh and resumed sessions with the feature enabled and disabled on OpenAI, and enabled on Bedrock and LiteLLM. Verify that only OpenAI sessions with the feature enabled request native review and include the agent call as evidence.

GitOrigin-RevId: bfbe547b0544e66763dca7d1e1376f805994bcb2

…59739)

## What changed

- Open a sidebar chooser when no side chat exists, with keyboard and mouse controls to start a new side chat while preserving the parent draft.
- Animate sidebar opening and closing, including reversing an unfinished transition, when animations are enabled.
- Show context-aware workspace shortcuts in a floating panel after a short delay, and render presets in the same overlay without moving the composer.
- Prevent chooser input from accepting an approval dialog before it has been painted.

## Testing

Add coverage for chooser activation and draft preservation, sidebar animation reversal, shortcut and preset snapshots, and approval input handling.

GitOrigin-RevId: 014112622a94798f4e611756c55112dfd8016051

…enai#59743)

## Why

Explicit cyber access program selections were dropped for requests using `CodexAuth::Headers`, preventing the server from evaluating the requested program.

## What changed

Forward explicit program selections for header-authenticated requests, leaving entitlement decisions to the server.

## Testing

Add integration tests covering explicit selections and omission over HTTP and a reused WebSocket connection, preservation of actor and account headers, and propagation of backend HTTP 403 denials without dropping the selected program.

GitOrigin-RevId: 5e549e87a1420ce8a5f1ce5c704cc6b7630af3ba

## Why

Legacy `.sandbox-bin` ACLs grant `SYSTEM` Modify access without `WRITE_DAC`, preventing the provisioning service from reapplying the bin policy.

## What changed

- Grant `SYSTEM` inheritable `WRITE_DAC` access when protecting the sandbox bin so it can update permissions on the directory and its children.
- Before legacy provisioning, repair the old ACL through an authenticated owner handle when `SYSTEM` is denied access. Upgrade only the expected SYSTEM entry in a protected, allow-only ACL, reject unexpected permissions, and verify that `SYSTEM` can reopen the directory with `WRITE_DAC`.

## Testing

Extend ACL coverage to check `SYSTEM` permissions on the bin and existing and newly created runner files. Add an ignored Windows integration test requiring LocalSystem and user-owned legacy homes to cover successful repair, repeated repair, and rejection of an explicit SYSTEM deny entry.

GitOrigin-RevId: 2303cdf5182947c2d044c79ac7027a16f0373c7d

## What changed

Add `CloudRequestHandle::submit_user_message` to submit a message with a stable ID using `SubmissionMode::Steer`. Return a `CloudUserMessageReceipt` that distinguishes started, steered, and duplicate admissions while preserving server-provided turn status and duplicate identity.

Report preflight rejections and invalid requests as `-32602`, while preserving uncertain admission outcomes as errors without automatic retries. Keep existing `turn/start` callers on `StartIfIdle` with their existing response and error behavior.

## Testing

Add receipt mapping tests and a mock-server worker test covering submission modes, single admission attempts, uncertain outcomes, input validation, and disconnected reply streams.

GitOrigin-RevId: eba120cf47cf0297b072ea373341ead663fb9bc9

)

## What changed

- Select fresh authentication for each HTTP operation on eligible OpenAI MCP connections while preserving the connection's credential source and account network policy. Stop redirects when requests carry runtime assertions.
- Pass the owning thread's authentication and runtime context through app discovery, connector metadata, and trusted-access requests. Include the runtime authentication mode in MCP connection and tool-cache identities.
- Give resumed actors analytics clients bound to their own authentication context, and serialize stored-credential reloads with token refresh while preserving host-provided credentials.

## Testing

Add coverage for fresh request assertions, revoked account policies, redirect handling, resumed-actor isolation, and MCP uploads in dual-header and assertion-only modes.

GitOrigin-RevId: f06900a6db61cd6cf53c3aa8075afeec4d5706d9

)

## Why

Registry `401` responses during harness key validation previously produced generic relay resets, causing recovery to retry rejected executor credentials instead of surfacing the authentication failure.

## What changed

- Send an authenticated Noise handshake rejection for registry `401` responses without opening an application transport.
- Propagate the rejection as `EnvironmentRegistryAuth` and preserve it in the terminal connection state so recovery stops with a specific authentication error.
- Preserve registry HTTP status codes so `403` responses for stale harness grants and transient service failures can continue through recovery.

## Testing

Add tests that reject tampered authentication rejections and exercise session recovery: `401` stops after one rejected recovery attempt, while `403`, `502`, and `503` retry with fresh harness grants and reconnect successfully.

GitOrigin-RevId: 9a55412e583146c094948618c7c9aeb4fb4b953e

## What changed

- Configure Bazel to apply `opusic_sys_install_headers.patch` to `opusic-sys` with `-p1`.
- Run the cloud-managed MCP OAuth test with `--no-browser` and keep stdin open until the child exits so EOF cannot race the HTTP callback.
- Serialize the cancelled-refresh test with other auth environment tests and temporarily clear the access-token environment variable.

GitOrigin-RevId: ad76b72ae98320bd0e3ff3231e1ed874332ce38c

## What changed

- Expose `RequiredCyberAccessPrograms` so hosts can require an explicit allowed program on a thread. Snapshot the requirement before extension callbacks; hosts must reapply it on cold resume.
- Validate resolved `access_programs` before HTTP and WebSocket model requests, rejecting omitted or disallowed programs. Explicit `Standard` remains distinct from omission. Reject memory summarization and realtime requests when a requirement is present.
- Keep required programs scoped to the parent thread by preventing Guardian reviewers from inheriting its program, including Guardian v2 reviews.

## Testing

Add HTTP and WebSocket coverage for allowed programs, omission, disallowed programs, unsupported providers, and connection reuse. Extend Guardian tests to verify parent-only program scope and that removing the public attachment does not erase the startup snapshot.

GitOrigin-RevId: 9306a9af0e03e7a1728dfeb610cd7ec7517367fd

## What changed

- Advance the pinned `tokio-tungstenite` and `tungstenite` fork revisions and update the Cargo and Bazel lockfiles.
- Use `OAuthCredentialsStore::File` in the gateway credential test to avoid spending the model discovery deadline on keyring-backed decryption.

GitOrigin-RevId: 2862850215abce478136137b9b68a37f3caaeed4

## Why

Starting a side chat waits for fork and setup requests. Keep the workspace responsive during those requests and let users return to an existing side chat through the sidebar chooser.

## What changed

- Add a clickable `Side chat` tab and `+` chooser, plus the configurable `focus_sidebar_tabs` action bound to `leader t` by default.
- Create workspace side chats in the background, showing loading and failure states with `Enter` to retry and `Esc` to go back. Preserve opening prompts and avoid taking focus when the user has moved away.
- Retain inherited permission profiles and defer startup notifications until the side chat is registered on its owning backend.
- Quiet the parent composer while the chooser has focus and prevent completion popups or repeated activation keys from consuming chooser input.

## Testing

Extend tests and snapshots for loading and failure states, returning to an existing chat, draft preservation, inherited permissions, focus transitions, and deferred MCP startup notifications.

GitOrigin-RevId: 244bcd3f170819e2260f21dc1041cf8899fe048c

## What changed

- Remove startup prefetching of remote catalogs, featured plugins, and recommendations while retaining installed-plugin refreshes and bundle downloads.
- Fetch featured plugin IDs on demand, concurrently with marketplace fetching when listing the remote global catalog, and reuse the cached results.
- Retire `plugin_discovery_prefetch` as an ignored compatibility flag and remove forced background catalog refreshes.

## Testing

Update app-server tests to verify that startup downloads installed bundles without discovery requests and that two `plugin/list` calls share one featured-plugin fetch.

GitOrigin-RevId: aa10474f3429102d624c83472e81ec85e3b470ae

## Why

WebSocket telemetry reparses text frames to extract event kinds that the transport already decodes.

## What changed

Pass decoded event kinds to telemetry and report receive failures separately. Keep JSON parsing for timing metrics and as a fallback when stream event decoding fails. Remove the `tokio-tungstenite` dependency from `codex-otel` and restrict it to tests in `codex-core`.

Limit wrapped error parsing to error events or failed stream decoding, preserving HTTP error forwarding when unrelated stream fields are malformed.

## Testing

Update runtime summary coverage to include receive failures and extend the WebSocket error forwarding test with a malformed stream field.

GitOrigin-RevId: e1f9d200fd6d30ec124a2354bdbc01f3082ddde3

## What changed

- Expose an optional `AgentServiceTier` provider so host-owned children, including detached children, inherit the root's committed tier during spawn preparation, startup prewarm, and each inference step.
- Reject per-turn tier overrides for children using the shared provider. Root updates apply to subsequent requests without changing requests already in flight.
- Preserve independent configured tiers and role overrides when no provider is installed, including across eviction and reload. Spawned children inherit the parent's thread preference rather than its per-turn override.
- Publish the latest committed root tier only after successful runtime registration, preventing failed duplicate starts from changing shared settings.

## Testing

Add coverage for detached-child WebSocket prewarm and between-step tier changes, shared-child override rejection, independent-tier inheritance and reload, and settings updates before registration.

GitOrigin-RevId: f0f3676813a1c59bd77baf95121e2d13e0163a8e

## What changed

Remove `FileSystemSandboxContext::from_legacy_sandbox_policy` and migrate its test callers to `from_permission_profile`. Construct read-only, disabled, and externally enforced sandbox contexts directly with `PermissionProfile`.

GitOrigin-RevId: e330b89d060061eda106232eab554be5ccd06149

…11-06

# Conflicts:
#	codex-rs/app-server-protocol/schema/precomputed/app-server-exports-experimental.json.zst
#	codex-rs/app-server-protocol/schema/precomputed/app-server-exports-stable.json.zst
#	codex-rs/app-server/src/mcp_refresh.rs
#	codex-rs/app-server/src/message_processor.rs
#	codex-rs/config/src/hook_config.rs
#	codex-rs/core/src/agents_md.rs
#	codex-rs/core/src/client.rs
#	codex-rs/core/src/tools/handlers/multi_agents_v2/spawn.rs
#	codex-rs/core/src/tools/handlers/unified_exec/write_stdin.rs
#	codex-rs/core/src/tools/handlers/unified_exec_tests.rs
#	codex-rs/core/src/tools/registry.rs
#	codex-rs/core/tests/suite/scenarios.rs
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__astra_active_environment_selection.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__astra_async_question_and_answer.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__astra_code_mode_call_timing.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__astra_disabled_executor_skills.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__astra_input_interrupts_response.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__astra_input_yields_code_mode_cell.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__astra_kickoff_remote_compaction_windows.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__astra_plugin_refresh_simplified_selection_hints_off.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__astra_settings_release_check_tool_shapes.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__code_mode_catalog_messages.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__code_mode_catalog_messages_ranked_search.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__code_mode_mcp_schema_limits.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__code_mode_settled_helpers__code_mode_settled_helpers.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__compaction__remote_slash_compact.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__incremental_tools__incremental_tool_removals.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__indirect_namespace_prefixes__catalog_indirect_namespace_prefixes.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__mcp_resource_messages__mcp_resource_messages.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__multi_agent_catalog_parameters.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__provider_capabilities__custom_provider_capabilities.snap
#	codex-rs/core/tests/suite/snapshots/all__suite__scenarios__skill_catalog_dedup__dedup_before_budgeting.snap
#	codex-rs/ext/skills/src/host_roots.rs
#	codex-rs/ext/skills/src/host_roots_tests.rs
#	codex-rs/features/src/lib.rs
#	codex-rs/hooks/src/events/pre_tool_use.rs
#	codex-rs/tui/src/bottom_pane/async_questions/mod.rs
#	codex-rs/tui/src/bottom_pane/async_questions/snapshots/codex_tui__bottom_pane__async_questions__tests__question_multiline.snap
#	codex-rs/tui/src/bottom_pane/async_questions/state_tests.rs
#	codex-rs/tui/src/chatwidget/tests/terminal_title.rs
#	codex-rs/tui/src/daemon_recovery.rs
#	codex-rs/tui/src/daemon_startup.rs
#	codex-rs/tui/src/daemon_startup_tests.rs
#	codex-rs/tui/src/startup_orchestration.rs
#	codex-rs/tui/tests/suite/daemon_compatibility.rs