chore: upgrade Codez to rust-v0.146.1 - #1

## Why

Mid-turn auto-compaction queued `SessionStart` hooks but continued sampling
before running them. This delayed hook-provided context and ignored requests to
stop the continuation.

## What changed

Drain pending session-start hooks immediately after successful mid-turn
auto-compaction. End the turn when a hook requests a stop; otherwise include
its additional context in the next sampling request.

## Testing

Added coverage for repeated compactions in one turn, context delivery without
leaking hooks into the next user turn, and stop requests that block sampling.

GitOrigin-RevId: c57708a792fb47d98d95c38d7d91bcd9f235be84

## What changed

- Change `ReviewDecision::Denied` to carry a rejection string and update the generated protocol schemas.
- Preserve specific rejection reasons through command, patch, network, MCP, delegated, and automatic approval flows so tool results can return them to the model.
- Distinguish invalid approval responses from user declines and truncate oversized rejection messages before adding them to model context.

## Testing

- Add coverage for denial serialization, invalid app-server approval responses, dropped automatic reviews, network rejection propagation, and rejection-message truncation.

GitOrigin-RevId: d48a55643aa03c7ecfa08a8e4b669913eec5464a

## What changed

- Assert truncated audio history through `ContextManager::raw_items()`.
- Initialize `additional_context_limit` in the quoted Windows hook command test.

GitOrigin-RevId: 43c19804e558b7a11fc17590506ec6ec7f3a9897

## What changed

- Add a shared local thread-store resolver that follows `history_base` links into ordered, bounded rollout segments, including archived ancestors.
- Support resolving a lineage at an explicit `HistoryPosition`.
- Reject malformed lineages with cycles, missing or mismatched source rollouts, non-paginated sources, or invalid cutoff bounds.

## Testing

- Add unit coverage for nested and archived lineages, explicit history positions, cycles, missing sources, and out-of-bounds offsets.

GitOrigin-RevId: a9063ad87e81d9865bd17fc588ea5d8e9ac74c0a

## What changed

- Make the MCP connection manager's event sender optional.
- Skip startup notifications when a caller has no session event stream.
- Decline interactive MCP elicitations in that mode while allowing the
  underlying operation to continue.
- Update threadless resource reads, status snapshots, and connector discovery
  to use the channel-free path.

## Testing

- Extend the app-server MCP resource test to verify that a threadless resource
  read declines an elicitation and still returns the resource contents.

GitOrigin-RevId: 65fea152adbc02a78e09a40cae4134b6dccffd34

## What changed

- Run the bubblewrap `/proc` mount probe with the minimal read-only filesystem policy instead of the command's filesystem policy and working directory.
- Preserve the requested network namespace mode during the probe.
- Add coverage that the probe mounts a temporary root and `/proc` without binding the full filesystem.

GitOrigin-RevId: e3bc4352f510980aeebe81dedf3f9211947982ed

## Why

`SqliteConfig` stores its home as an `AbsolutePathBuf`, but its test constructor
previously accepted a `PathBuf` and checked the absolute-path invariant at
runtime.

## What changed

- Make `SqliteConfig::new_for_testing` accept an `AbsolutePathBuf` directly,
  removing its fallible conversion and `expect`.
- Update SQLite test setup to convert temporary directory paths with
  `PathExt::abs` at each call site.

GitOrigin-RevId: 93585b9aea805e2449b3465ac20eeb39417ed555

## What changed

- Remove the `spawn_agents_on_csv` and `report_agent_job_result` tools and their agent-job runtime and state models.
- Drop the legacy `agent_jobs` and `agent_job_items` tables during state database migration.
- Keep `features.enable_fanout` and `agents.job_max_runtime_seconds` accepted as no-op compatibility settings while omitting them from the generated configuration schema.

## Testing

- Verify upgrades remove both legacy agent-job tables.
- Verify the removed feature and configuration keys still parse without taking effect.

GitOrigin-RevId: 8cc3337da78c67162229f02f40a747f503542646

## What changed

- Render the first line of a completed hook warning in the hook header using
  `says:`, with any remaining lines indented below it.
- Keep the existing hook header when no warning is present and avoid rendering
  warning entries a second time in the output body.
- Update hook event snapshots and the multiline warning test for the new layout.

GitOrigin-RevId: 291b556daf3b6fb64a99b090a6df1a222a18a736

## What changed

- Add `iconUrlDark`, `distributionChannel`, `installUrl`, and
  `pluginDisplayNames` to the experimental `app/read` connector metadata.
- Populate plugin display names from enabled plugins without starting their MCP
  servers.
- Accept both dark-icon field spellings from the batch API and keep the new
  upstream fields optional for compatibility with older responses.

## Testing

- Cover the serialized response fields, legacy batch responses, and plugin
  display-name lookup without MCP startup.

GitOrigin-RevId: 68601a104de839c0f4f4621d33b0e4d08ad88c64

## Why

Sandboxed process launch through the exec server was unsupported on Windows.

## What changed

- Add a shared native process launcher that selects the Windows sandbox session backend when required and otherwise launches PTY or pipe-based processes.
- Pass Windows permission, workspace-root, proxy, filesystem-override, and desktop settings through exec-server process preparation.
- Preserve piped stdin and inherited file descriptors across the shared launch path.

## Testing

- Verify that a remote Windows sandbox process accepts stdin while blocking a write under a read-only policy.
- Enable workspace-root sandbox tests on native Windows while continuing to skip environments that cannot emulate Windows sandbox semantics.

GitOrigin-RevId: 6719ccbe87ad0d5a57af56503e3f23f894c60a71

## What changed

- Define and export skill metadata, policy, dependency, interface, and configuration rule types from `codex-skills`.
- Update core, plugin, and extension consumers to use the shared models while retaining compatibility re-exports from `codex-core-skills`.
- Share product-restriction handling between host and environment skill metadata.

## Testing

- Add unit coverage for default and explicit implicit-invocation and product policies.

GitOrigin-RevId: 9093469f8fff8e2d902dc9781235f64709827a87

## Why

Remote compaction can process large histories. Repeatedly estimating and replacing the full history, and cloning it when tracing is disabled, adds avoidable CPU and memory overhead.

## What changed

- Estimate each history item's token count once, update the total as trailing tool outputs are rewritten, and replace history only after all rewrites are selected.
- Preserve unclamped token totals while calculating removed tokens so saturated estimates do not hide overflow.
- Snapshot compaction input history only when rollout tracing is enabled.
- Reuse the v2 request input instead of cloning it before adding the compaction trigger.

## Testing

- Cover enabled and disabled compaction trace contexts through `is_enabled()` assertions.

GitOrigin-RevId: 8de9c9704ba29532fba05430eb204bbae2e8bf83

)

## What changed

- Add model-catalog approval message variants for `never` and `unless_trusted`.
- Select the catalog message that matches the active approval policy, while retaining the existing built-in text when that variant is absent.
- Treat an explicitly empty variant as an instruction to suppress the built-in approval text, consistent with `on_request` messages.

## Testing

- Cover variant selection, fallback and empty-message behavior, catalog deserialization, and the initial permissions message sent to the model.

GitOrigin-RevId: a0f8d41a08645f39b80093be53f200eeee18ca25

## Why

System proxy discovery can block, and delegating fallback to each transport can repeat discovery or apply inconsistent environment proxy behavior.

## What changed

- Resolve unavailable system proxy decisions to an explicit environment proxy or direct route, including `NO_PROXY` settings and WebSocket-specific fallbacks.
- Add asynchronous system proxy resolution that uses cached decisions first and serializes blocking platform lookups on Windows and macOS.
- Preserve `NO_PROXY` handling for WebSocket connections, including HTTP and HTTPS proxies, and hash proxy cache keys on every platform.

## Testing

- Add coverage for explicit environment fallback, cached asynchronous resolution, and proxied or bypassed WebSocket connections.

GitOrigin-RevId: 3b7cf170dcfe639eec53c3c1514f92bfcf13e7e9

…#34436)

## Why

Permission profiles defined by `requirements.toml` can be selected as active,
but their network configuration was not included when resolving the network
proxy specification for that selection.

## What changed

Merge managed permission profiles from `requirements.toml` with configured
profiles before looking up the active profile's network proxy settings.

## Testing

- Verify config loading retains the proxy settings of an active managed
  profile.
- Verify `turn/start` accepts a managed profile with network settings.

GitOrigin-RevId: 3374f82a8fb0ce8f338fa2cea77c28ea2eb89636

## Why

Patch approval events can take longer than the default test event timeout.

## What changed

Wait up to 15 seconds for a patch approval request or turn completion in the
approval test helper, while preserving the existing event checks and assertions.

GitOrigin-RevId: 73a50538482b5a88ccf0be07f8fad21000e54699

## What changed

- Add the experimental `code_mode_buffered_exec` feature.
- When enabled, default code-mode `exec` calls without an explicit
  `yield_time_ms` to 30 seconds instead of 10 seconds.
- Report the effective default in the model-visible `exec` tool description.

## Testing

- Verify that the generated tool description advertises the 30-second default
  when the feature is enabled.

GitOrigin-RevId: 0eea4d0105137f09050ce31aad18c25c79df6b2a

## Why

PAC and system-proxy resolution can select a different outbound route for each
request URL. Request creation and route selection must use the same URL while
still allowing transport clients to be reused.

## What changed

- Add `RouteAwareClientPool` and a request builder that resolve the outbound
  proxy route when sending each request.
- Reuse HTTP clients by resolved route, with a bounded cache of 16 routes.
- Preserve request tracing, optional diagnostic logging, custom CA settings,
  Cloudflare cookies, and default transport redirect behavior.
- Export route-aware response and error types, including status, timeout, and
  connection-error helpers.

## Testing

Add tests for exact URL routing, client reuse and eviction, default redirects,
and redaction of URL secrets from debug output.

GitOrigin-RevId: a1688b64305a0bb276c371df63a039ccbe821b76

## What changed

- Add `maxSessionAgeDays` and `maxSessions` to the external-agent config detection request.
- Apply the requested limits when discovering sessions from supported migration sources.
- Preserve the existing defaults of a 30-day maximum age and 50 sessions when either option is omitted.

GitOrigin-RevId: 46376e94b64f1f61d8776e34d82cdd2cdeb36ca0

## What changed

- Add an optional opaque `providerId` to `externalAgentConfig/import` for analytics attribution, independently of the `migrationSource` selector.
- Include the provider ID in completed-import and import-failure analytics events.
- Have TUI imports identify their selected migration source as the provider.

## Testing

- Cover provider attribution in app-server import completion and failure tests and analytics serialization tests.

GitOrigin-RevId: 0ee7313a43652e5305939c526bf6b903a79334ad

## What changed

- Map Python `aN.postM` versions to Codex `-alpha.N.M` release tags through shared release-version helpers.
- Accept alpha hotfix versions in Python runtime workflows, Rust release validation, npm publishing, and the shell and PowerShell installers.

## Testing

- Cover version conversion, workflow output, runtime setup, artifact staging, and installer handling for alpha hotfix releases.

GitOrigin-RevId: b95edb56f7c93b435a8050c10f0202dc117e6669

)

## Why

Goal-first and forked threads could create rollouts without recording their
effective thread settings. Resuming those threads after a restart could then
use current configuration instead of the settings selected when the thread was
created.

## What changed

- Persist a `thread_settings_applied` item when a goal first materializes a
  rollout, including a follow-up snapshot if settings changed concurrently.
- Append each fork's effective settings after its copied history so they take
  precedence over inherited settings during resume.
- Centralize conversion from `ThreadConfigSnapshot` to
  `ThreadSettingsSnapshot`.

## Testing

Added coverage that restarts the app server and verifies goal-first and forked
threads retain their respective `approvals_reviewer` settings.

GitOrigin-RevId: 6cb9aaae73bbe9ca432831cff7e826f95ffd6d01

## What changed

- Add an execution path that injects trace headers and sends a request without
  logging its result.
- Extract response and error logging into reusable helpers while preserving the
  existing behavior of `HttpClient::execute`.

GitOrigin-RevId: 3feebe3da041dd08f5033dd319233d8afe9054ec

## What changed

Add `CARGO_HTTP_CAINFO` to the curated custom CA environment variables so
Cargo inherits the managed MITM trust bundle. Preserve any startup Cargo CA
bundle in the generated trust bundle alongside the other supported overrides.

GitOrigin-RevId: 207847aa556d3a4f667ddb9e52d99e87ef984cae

## Why

Route-aware clients select a direct or proxy route from the complete request
URL. Letting `reqwest` follow redirects internally reuses the client chosen for
the original URL, so the redirect destination cannot receive its own PAC or
system proxy decision.

## What changed

- Follow redirects through `RouteAwareClientPool` when respecting the system
  proxy, resolving and caching a route for every hop.
- Preserve standard redirect method and body behavior, enforce one timeout
  across the request chain, and cap redirects at 10 hops.
- Strip origin-sensitive credentials and stale proxy authorization when the
  destination or selected route changes, and apply safe `Referer` handling.
- Log one final request outcome instead of intermediate redirect responses.

## Testing

Added an integration test covering a redirect from a direct route to a proxy
route, credential handling, and final-outcome logging.

GitOrigin-RevId: e5cb2cc962e99d33df61ef649465e956b92279bb

## What changed

- Cover redirect method and body handling, `Referer` behavior, and credential
  stripping across origins.
- Exercise request deadlines across route selection and redirect hops, along
  with redirect limits and unsupported schemes.
- Verify that disabling pool request logging does not expose request or
  response data.

GitOrigin-RevId: a683956c468b45304d0bdc25081f5f4e03836ccd

## What changed

- Add end-to-end coverage that exact-URL system proxy decisions select the expected route, including when a redirect switches routes.
- Verify redirects strip credential headers across origins while retaining them for the same origin and route.
- Check that redirect chains emit only the final request outcome, omit sensitive redirect details from logs, and honor disabled request logging.
- Share local HTTP listener helpers across the outbound proxy tests.

GitOrigin-RevId: afd1640e1910442d71fa1dc77b20b4fb1a6f1b6a

## Why

Backend-backed features need to use the same outbound routing configuration as the rest of Codex.

## What changed

- Build the backend client on a route-aware client pool supplied by `HttpClientFactory`.
- Pass the configured factory through app-server account requests, cloud config loading, cloud tasks, and memory rate-limit checks.
- Preserve task query encoding, authentication headers, JSON request bodies, and ChatGPT cookie handling during the migration.

## Testing

- Add backend-client tests for proxy-policy propagation, task query encoding, bearer authentication, and JSON request bodies.

GitOrigin-RevId: c17d162e0dce9cec758df7cdeecf982207c6512b

## What changed

- Scope pending network approvals to a turn and execution while still coalescing duplicate requests within one execution.
- Fail abandoned approval owners closed, cancel denied executions, resolve any waiting requests, and cancel in-flight Guardian reviews when their owner is dropped.
- Serialize session policy updates with approval caches so concurrent allow and deny decisions cannot leave enforcement and cached decisions inconsistent.
- Give user approval requests and permission hooks unique per-execution identifiers.

## Testing

- Cover approval deduplication boundaries, abandoned-owner cleanup, cancellation outcomes, replacement requests, and Guardian cancellation events.

GitOrigin-RevId: 11e184dd1c70294a99581b6ff0d4b6607d9ea1d9

## What changed

- Add `code_mode_tool_names` to Responses Lite turn metadata, mapping each normalized code-mode identifier to its structured `ToolName`.
- Reserve the metadata key against client overrides and omit it from metadata exposed to external MCP servers.
- Keep non-Lite requests and the legacy top-level client metadata unchanged.

## Testing

- Cover HTTP and WebSocket Responses Lite requests, including switching from a non-Lite model.
- Verify reserved-key handling and external MCP metadata filtering.

GitOrigin-RevId: b678afba13d57a91e26f5895aa37238fbb4cb276

## What changed

- Preserve the current tracing span and subscriber when lazy remote environment
  startup runs in a background task.
- Add spans for the remote connection, environment registry, Noise, and
  rendezvous WebSocket stages, including relevant environment and registration
  identifiers.
- Propagate the current trace context to environment registry connection and
  harness-key validation requests.

GitOrigin-RevId: 0044c3eb94d59c6a6b92752d3d372195be4adb81

…5280)

## What changed

- Leave plugin MCP servers unchanged when every plugin requirement omits
  `mcp_servers`.
- Continue treating an explicitly empty `mcp_servers` allowlist as deny-all.

## Testing

Added coverage for both absent and explicitly empty plugin MCP allowlists.

GitOrigin-RevId: 80bb9aa6bbd779d669c573f63681dc46019b668c

## What changed

- Add client-side handling for exec-server network policy requests, including request validation, per-process decision routing, and allow, deny, or ask responses.
- Bound concurrent callbacks and fail closed when requests are invalid, exceed capacity, time out, or outlive their process session.
- Replace the callback opt-in flag with a launch-level `policyDecisionTimeoutMs` value and include transport overhead in the executor timeout.
- Preserve callback admission limits across connection recovery and clean up policy state when process startup is abandoned or a session ends.

## Testing

- Cover decision forwarding, invalid and excess requests, cancellation during process cleanup, abandoned starts, timeout propagation, and launch-config serialization.

GitOrigin-RevId: 6ee2a0139e0f8170cf1a5cdd646bd811b7d3c1f6

## What changed

- Add an optional `started_at_ms` field to `ItemCompletedEvent`, retaining
  compatibility with older persisted events that lack it.
- Track the first start timestamp for each in-flight item and attach it when
  emitting and persisting the completion event. If no start was recorded, use
  the completion timestamp as a fallback.
- Emit a complete start/completion lifecycle for subagent activity items.

## Testing

- Cover concurrent item timing, repeated starts, turn-boundary cleanup, the
  missing-start fallback, subagent activity, and persisted web-search events.

GitOrigin-RevId: e7cec9c4f1ef6ba67f287e81fb4d7d856fcf87a7

## Why

The Code Mode tool-name mapping is unbounded and can make HTTP and WebSocket
headers grow without limit.

## What changed

Omit `code_mode_tool_names` from the direct `x-codex-turn-metadata`
compatibility header while retaining it in the canonical
`client_metadata["x-codex-turn-metadata"]` payload.

GitOrigin-RevId: 494a30b6846e32ab44eb79b08dfec63360f563a7

## What changed

- Restart file search whenever a unified mention popup opens so restored or repeated queries receive results instead of inheriting stale search state.
- Cache the popup's filtered rows and refresh them when the query, file matches, search mode, skills, or plugins change.

## Testing

- Add regression tests for bare, reopened, and restored unified mention searches.

GitOrigin-RevId: 9d38438fade01a0552e03cb05e023ee64af60a4c

## What changed

- Stack action descriptions below their labels when the keymap action menu is too narrow for a readable description column.
- Keep descriptions column-aligned at wider terminal widths.
- Show a dash instead of a number beside the disabled remove-binding action.

## Testing

- Add snapshot coverage for the action menu at 48, 64, and 96 columns.

GitOrigin-RevId: 25b97fd2d8764563e0a0c36d436711f2429093c4

## What changed

- Exclude `SkillScope::System` roots from watcher registration because generated
  system skills are installed before the watcher starts.
- Ignore events under the system skill cache that arrive through the recursively
  watched legacy user-skills root, avoiding unnecessary cache clears and
  `SkillsChanged` notifications.

GitOrigin-RevId: ce8ba28ba873372b638950b676e4d09172a5c688

## What changed

- Set the Rust recursion limit to 256 for both the MCP server library and binary crates.
- Populate `started_at_ms` in the thread-fork test's completed-item fixture.

GitOrigin-RevId: b25eeaeecaf94265fe3be8f23cb3c395595afc2a

## Why

Detached processor work can retain outgoing message senders, so waiting for
channel closure can keep the in-process app-server's outbound router alive
during shutdown.

## What changed

Add an explicit shutdown signal for the outbound router and prioritize it over
pending outgoing messages. Send that signal after processor tasks are stopped
so runtime shutdown no longer depends on every sender being dropped.

## Testing

Add a paused-time test that verifies the router exits and closes its channel
even when an outgoing sender is still retained.

GitOrigin-RevId: a8f88d88a0950f50339b1c56909fedb781f178d4

## Why

When rebuilding a thread from rollout events, errors embedded in turn completion
events were ignored. Failed retries could therefore be restored as completed
turns, causing warnings such as model-overload errors to disappear from the TUI
transcript.

## What changed

- Mark turns with terminal completion errors as failed and retain their message
  and structured error information.
- Apply late completion errors to their matching historical turn without
  interrupting the active turn.

## Testing

Added history-builder coverage for current and late completion errors, plus a
TUI replay snapshot covering repeated overload failures.

GitOrigin-RevId: 5c474baa0fd5c73368b444d79fb850cbd4c8023a

)

## What changed

Only collect buffered requests from inactive threads whose event store reports
pending user input or approval. This keeps unrelated requests from being
considered when pending interactions are surfaced after leaving a side
conversation.

## Testing

Extend the side-conversation routing test with an unrelated dynamic tool request
and verify that only the pending subagent approval is selected.

GitOrigin-RevId: 388968277bde34bedc43187c1d1746d76166131e

## What changed

- Add model and personality sections to the persisted world-state snapshot.
- Generate model-switch and personality instructions through world-state diffs, including when prior state must be inferred during replay.
- Keep those instruction fragments in standalone developer messages instead of merging them with adjacent context updates.

## Testing

- Cover initial, unchanged, and changed model and personality states.
- Verify that model changes are recorded in rollout world-state items.

GitOrigin-RevId: 497e29cf38cac08e992e546df900f6f8b01120f9

## What changed

- Add the stable, default-enabled `in_app_updates` requirements-only feature.
- Allow administrators to disable in-app updates through `[features]` in `requirements.toml`.
- Expose the policy through `configRequirements/read` and include it in the config schema.

## Testing

- Verify that in-app updates are enabled by default and disabled by the managed requirement.
- Verify that `configRequirements/read` returns the configured policy.

GitOrigin-RevId: e9c7074b516fe58385fdf7dc8420c0109c0c3df6

Backport cyber-model auto-review defaults to the 0.146 stable release
line.

Cherry-pick openai#37055. Omit precomputed schema artifacts that do not exist
on release/0.146.

Validation: git diff --check.

---------

Co-authored-by: Won Park <[email protected]>

- Apply safer automatic-review defaults for cyber-capable models and explain permission changes in the terminal interface. (openai#37057)

## Changelog

Full Changelog: openai/codex@rust-v0.146.0...rust-v0.146.1

- openai#37057 [0.146] Backport safer cyber-model auto-review defaults @anp-oai