Repository navigation
[pull] main from openai:main - #49
Merged
Merged
Conversation
GitOrigin-RevId: b165bcc82473b5896f830ad8e56cca06b6f8bf7a
## What changed Add `features.multi_agent_v2.message_board_remote` with a board URL and a bearer token supplied directly or through an environment variable. When configured, use the remote board in preference to local or in-memory storage, including in ephemeral sessions, while preserving the existing board tools and session identity. Ignore remote board settings in project-local configuration and use the runtime HTTP client and clock for remote requests. ## Testing Add a mock-server integration test and snapshot covering an ephemeral session posting through the existing tool, with the expected bearer authentication, session identity, timestamp, and returned post. GitOrigin-RevId: 263413d90a1ee4c0bdba8c1b08ba9f68bdd7a986
…oads (#49269) ## Why Reloads can reject a valid thread configuration when the host configuration references a missing model provider that thread overrides replace. Concurrent cloud refreshes can also leave older policy snapshots or staged cache writes eligible for publication. ## What changed - Compose preserved session layers before materializing refreshed configuration, retaining source-aware validation errors. - Carry cloud policy revision bindings through config loading and role overrides. Reject stale MCP refreshes and disable enterprise MCP authorization when the policy is suspended. Retire the old policy when replacing or clearing its loader. - Stage cloud cache writes in temporary files and publish them atomically only while their policy revision remains current. - Route file reloads through the shared runtime refresh path, resolve paths relative to each config file, and preserve session settings. Restore host defaults for `secret_auth_storage` and `mcp_oauth_refresh_coordination` when explicit overrides are removed. ## Testing Add regressions for thread-provided model providers, managed plugin and feature requirement refreshes, stale and suspended policy snapshots, superseded and retired cache writes, and file reloads preserving runtime settings and restoring feature defaults. GitOrigin-RevId: 3280a2445eeb7074a142f720690bb0e4f01d174b
#49275) ## Why Responses prewarm can reconnect and consume scripted WebSocket replies intended for realtime conversations when both share a test server. ## What changed - Give realtime conversations a separate scripted server in tests for runtime replacement, prompts, and voice selection. - Disable Responses WebSocket prewarm in the audio/text round-trip test while preserving coverage of the default realtime endpoint. - Update connection counts and request assertions to address only realtime connections. GitOrigin-RevId: 8e3b5ac86ee80777cf94063db468c80203966999
## Why The app server previously rejected OAuth login for enterprise-managed MCP servers. These servers need an explicit sign-in flow that ties saved authorization to the active Codex user and workspace and prevents canceled or superseded attempts from saving credentials. ## What changed - Enable enterprise sign-in through `mcpServer/oauth/login` for configured servers with a connected thread, trusted IdP registration, and `features.use_xaa` enabled. Scope shared enterprise credentials by user, workspace, issuer, and client ID. - Add `loginId` to MCP OAuth login responses and completion notifications, preserving compatibility with older servers that omit it. - Support enterprise login replacement and `account/login/cancel`, wait for callback listener shutdown before replacement, and recheck account and configuration before saving grants. Fence stale attempts across processes and account changes. - Remove shared enterprise authorization during account logout and `codex mcp logout`, including when the feature is disabled. Continue account logout if enterprise cleanup fails, and invalidate MCP runtimes on account changes. Start a fresh session after successful enterprise sign-in to use the saved grant. ## Testing Add regression coverage for login replacement and cancellation, callback port reuse, account changes during setup, cross-process logout invalidation, persisted workspace policy selection, cleanup failures, and responses from older servers without `loginId`. GitOrigin-RevId: 7ed4caaab4659ed1e67064262cf5cee48e3a26ac
## Why `TurnComplete` can arrive before the previous turn finishes teardown, making `start_turn_if_idle` race with cleanup in the encrypted parent reply scenario. ## What changed Submit the reply through `Op::InterAgentCommunication` so it queues through the same mailbox path as real agent messages. The scenario continues to verify that the encrypted parent reply appears exactly once in each incremental Guardian review. GitOrigin-RevId: 3d356c274442aa839324b9425490feafacd47313
## Why Stale thread capability roots can reconnect executors that are not selected for the current turn and shadow selected roots with the same ID. ## What changed Filter out roots whose environments are absent from the turn snapshot before deduplication and readiness resolution. Update app-server capability tests to explicitly select the executor environments used by each turn, including after resume. ## Testing Add regression coverage for full-access and workspace-write permissions, verifying that stale roots never connect an unselected executor, selected roots with matching IDs remain available, and turns with no environments expose no roots. GitOrigin-RevId: afe375047cc5e8aad06df83334149510460dcdcc
Replace the three optional fields in `AttachmentState` with `Attached` and `Detached` variants, making inconsistent field combinations unrepresentable. Keep the connection ID in both variants and the expiration deadline only in `Detached`, and update attachment and expiration checks to match on the state. GitOrigin-RevId: 6a5f05f0ce2f064acc8f5cacd00bc374c4f47986
## What changed Allow users with an active session to start MCP OAuth sign-in through `/mcp login <name>`. Request login through the app server, open the authorization URL in the browser, and display success or failure in the originating thread. Guard overlapping start requests and track login attempts per server so stale retry completions do not overwrite current results. Skip opening the browser when the attempt has already completed, and retain results across thread switches and session refreshes. ## Testing Add command dispatch coverage and regression tests for overlapping starts, stale retry completions, rejected starts, independent server logins, and result retention across thread switches and session refreshes. GitOrigin-RevId: aeec2dbee566660f9aa26ef23039196ef3ca49d6
…49294) ## Why Guardian review and classification telemetry lacks the context mode needed to distinguish `legacy`, `independent`, and `thread_owned` reviews. ## What changed - Add `guardian_context_mode` to review and classification analytics and `context_mode` to their metrics. - Capture the mode from the conversation history snapshot before review preparation or classification setup so failure metrics retain it, including when review preparation or reviewer startup fails. - Use `unknown` for review metric tags when no context mode is available. ## Testing Update metric assertions to cover `thread_owned` classification tags and the `unknown` review fallback. GitOrigin-RevId: 79f7d11b3e4ccfc53681890d75fbc7c54e1ce7de
## What changed Replace the custom recursive JSON canonicalizer with `serde_json::Value::sort_all_objects()` before hashing configuration values, preserving existing fingerprints. ## Testing Add a regression test that checks reordered keys in nested tables and tables inside arrays produce the same existing fingerprint. GitOrigin-RevId: 890e79865a1d690adea3b35f19fcc6c30dbd17ce
## Why Batch thread name lookups read the entire append-only session index even when all requested names could be found near the end. ## What changed Use `ReverseJsonlScanner` in `spawn_blocking` for `find_thread_names_by_ids`, stopping once every requested ID has a usable name. Preserve the latest nonempty, trimmed name for each ID while skipping malformed entries. ## Testing Add regression coverage for renamed threads, whitespace-only names, Unicode, reads across chunk boundaries, malformed entries, a partial final write, and missing IDs. GitOrigin-RevId: 2ab9254ba8b718fe3e02c47fc9b0de20c09fd10f
## Why Parsing multiple tag delimiters in a chunk repeatedly drained the pending buffer, shifting its remaining contents after each delimiter. ## What changed Track a consumed offset in `InlineHiddenTagParser::push_str` and drain the buffer once after processing the chunk, preserving partial delimiters for the next chunk. ## Testing Add a regression test comparing visible text and extracted tags against single-chunk parsing at every UTF-8 character boundary. The input covers non-ASCII text and delimiters, adjacent tags, an empty tag, and an unfinished tag at end of input. GitOrigin-RevId: 18bfbfdb81060ffda30901d5cb82ee5804878b09
## Why Thread name resolution performs a separate SQLite metadata lookup for each thread. Batch these reads to reduce database queries for large result sets. ## What changed Add `StateRuntime::get_threads` and use it in `resolve_thread_names`. Fetch metadata in batches of at most 999 IDs to stay within SQLite's bind limit, skipping missing or invalid records independently so valid metadata remains available. ## Testing Add regression coverage for reads spanning multiple batches, invalid and missing records, duplicate IDs, and empty input. GitOrigin-RevId: a403416f1da5adea56705c70839850760d3eb550
## What changed Use `ConsoleMode::NoWindow` for legacy Windows sandbox capture and non-TTY unified execution, enabling `CREATE_NO_WINDOW` for these piped processes. ## Testing Extend the PowerShell interrupt and capture tests to assert that `GetConsoleWindow()` returns null before checking process termination and descendant survival. GitOrigin-RevId: dcc3b5554986ab0280748e5fa7080d36ded3d673
## Why A subagent stopped by repeated Guardian denials remained interrupted without notifying its parent. The parent needs guidance to report the stop and wait for explicit user confirmation before continuing the blocked work. ## What changed Forward `TooManyDenials` interruptions from `MultiAgentV2` children to their parents with Guardian-specific guidance to inform the user and avoid resuming or retrying until the user explicitly confirms. Preserve the child's `Interrupted` status and keep ordinary interruptions silent. ## Testing Add integration coverage for parent notifications under `CircuitBreakAction::Strict`, silence under `CircuitBreakAction::Default`, and preservation of the child's interrupted status. Add a unit test ensuring long denial messages stay within the notification token limit while retaining the guidance. GitOrigin-RevId: c9bb90827393068d9c92edaf0443a52e6ff57f9f
GitOrigin-RevId: c6d6d0bce393a37eac79fa1ee32c7d8641ce3596
Add `gpt-6.1-sol` to the bundled model catalog with its capabilities, reasoning levels, and availability message. Give it the highest catalog priority and update older Sol descriptions to reflect their generations. Update startup, model picker, and tool catalog snapshots to reflect the new default and catalog contents. GitOrigin-RevId: 1092a0524c6d1813ddd600c31c4fd0e708294ae9
## Why `CreateProcessWithLogonW` failures with `ERROR_SERVICE_ALREADY_RUNNING` (1056) previously aborted sandbox startup without retrying. At this stage, neither the runner nor the user command has started, so retrying does not replay the command. ## What changed Retry runner creation once with the same sandbox credentials when logon returns error 1056. Propagate a second failure without refreshing credentials, and keep child startup errors with the same code ineligible for this retry. ## Testing Add regression tests for recovery, the two-attempt limit, and exclusion of child startup failures. Add a unified exec test that injects a logon failure, verifies that the retry preserves the original request and credentials, and checks that the command runs exactly once. GitOrigin-RevId: 78def6cdb93bf32f9b4a3e398cd16de83286fec4
#49330) ## Why Reaching the reconnect backoff cap reset the attempt counter, restarting fast retries during sustained failures such as HTTP 409 responses indicating that the remote app server is already online. ## What changed Keep the reconnect delay at the 30-second cap and stop advancing the backoff exponent once capped. Successful connections and auth changes still reset backoff. Remove logging for the obsolete reset-at-cap behavior. ## Testing Add regression tests for long failure streaks and repeated HTTP 409 handshakes, with and without a subscribe cursor. Verify capped retry intervals, recovery after a successful handshake, backoff reset on success, and preservation of enrollment and cursor state. GitOrigin-RevId: 56e3f10ec5ceeced5a71397a99ca22b75dd5ef52
## Why Canceled RPC calls could leave entries in the pending request map until further traffic or disconnect. Cleanup should happen when the call is dropped, even if no response arrives. ## What changed Use a `PendingRequestGuard` to remove each registration when its call completes or is canceled. Protect the pending map with a synchronous mutex so cleanup can run in `Drop`, replacing opportunistic pruning and explicit error-path removals. ## Testing Add a regression test that drops an in-flight call and verifies that the pending request count immediately reaches zero without further traffic. GitOrigin-RevId: 82c0629f37a2f4bb89b8d10e167e2a09765b26eb
## What changed Add `openai.gpt-6.1-sol` to the Bedrock Mantle catalog and its `global.` and `us.` variants to the Bedrock Runtime catalog. Make GPT-6.1 Sol the default and provider fallback model, preferring the global variant for Runtime. Keep existing models available. ## Testing Update catalog and provider assertions, thread-start fallback tests, and TUI model-picker snapshots to cover GPT-6.1 Sol and the new defaults. GitOrigin-RevId: ec65744ff9409980474cc1faf516beed0b2430da
## What changed Preserve catalog `multi_agent_version` values instead of forcing V1, allowing models that declare V2 to use it by default. Retain Ultra in supported reasoning levels so it appears in the Astra advanced reasoning picker for Bedrock Mantle and Runtime. ## Testing Add coverage for preserving configured multi-agent versions, selecting V2 and exposing `collaboration.spawn_agent` and `collaboration.followup_task` without the V2 feature flag, and displaying and selecting Ultra in both Bedrock reasoning pickers. GitOrigin-RevId: 4fb1336c79b3f86ce12fa5ea81fe2237a300840d
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )