pakrym-oai

Simplify app-server integration test setup (#34786) ## What changed - Add typed helpers for initialized app-server instances, JSON-RPC requests, responses, notifications, and thread startup. - Add a composable `MockResponsesConfig` builder while preserving the existing mock config writers. - Migrate the app-server integration suite to the shared helpers, removing repeated request ID management, deserialization, initialization, and config assembly. ## Testing - Add unit coverage for composing mock provider, feature, and extra config, and for compatibility of the existing mock config writer. GitOrigin-RevId: 62da177c1d6e8299400de64bd6766567bf1ba3d8

Harden unsandboxed patch filesystem access (#39659) ## Why An `apply_patch` path can be replaced with a symlink after verification, allowing an unsandboxed patch operation to reach a different file than the one that was approved. ## What changed - Add `follow_symlinks` options to executor filesystem reads, writes, metadata lookups, directory creation, and removal, including the corresponding `followSymlinks` protocol fields. - Implement no-follow filesystem operations on Unix and Windows that reject links in any path component and restrict file access to regular files. - Run `apply_patch` with symlink traversal disabled when an otherwise-required sandbox is bypassed, while retaining the existing follow-symlink default for standalone callers. ## Testing - Cover leaf and ancestor symlinks across patch add, update, delete, and move operations, including a path swap after verification. - Exercise local and remote no-follow filesystem behavior, concurrent directory creation, special-file rejection, and Windows reparse points. GitOrigin-RevId: 43fd479084891493ce13564fbd894b98f329c6dd

Add early yielding for code-mode observations (#48123) ## What changed Add an optional `preempt` signal to `CodeModeSession::execute` and `CodeModeSession::wait` so callers can end an observation early while the cell continues running and remains available for later waits. Support the signal in the in-process runtime and across both remote transports: `operation/yield` with the negotiated `yield-observation` capability for stdio, and `YieldObservation` for gRPC. Preserve signals received before gRPC observation registration, and retain normal timeout behavior for older hosts that lack support. ## Testing Add runtime and transport tests covering early execute and wait yields followed by successful cell completion, yields before observation registration, and suppression of yield frames for older stdio hosts. GitOrigin-RevId: 3f8049d8f0582be6b8f0832cc03f2d974a0b8f18

Unify context snapshots and group requests into windows (#44932) ## What changed - Use one renderer for captured requests, raw request bodies, and input items. Show only appended items when inputs extend the previous request and settings match; start a new snapshot window otherwise and explain the boundary. - Add optional request settings and tool inventory deltas. Normalize volatile values with stable labels, preserve multiline content, and fingerprint omitted content so changes remain visible. - Migrate existing context snapshots and expand compaction snapshots to include request history. ## Testing Add focused tests for window boundaries, cache key changes, tool deltas, shared item rendering, stable normalization, and fingerprints. Assert that the follow-up request after pre-turn compaction includes the working directory override. GitOrigin-RevId: 6445b014081208ea432b1f3e2ac835c5e4955cb0

Scope runtime workspace roots to execution environments (#32952) ## Why Multi-environment turns can run against different filesystems, so a single thread-wide workspace-root list cannot accurately describe every selected environment. ## What changed - Add optional `runtimeWorkspaceRoots` to each app-server environment selection. Omitted roots default to that environment's `cwd`, while an empty list selects no roots. - Carry environment-native roots through turn selection, model-visible context, permission materialization, and tool sandboxing. - Keep the top-level `runtimeWorkspaceRoots` field as a compatibility input when constructing default environment selections; explicit selections use their own roots. ## Testing - Cover thread and turn API defaults, overrides, empty roots, and schema round-tripping. - Verify foreign roots remain model-visible and remote execution applies the target environment's roots before sandbox selection. GitOrigin-RevId: c6e7a62883c45c676c153055f46a55ee15a323a4

Require prefixes for outbound response item IDs (#32312) ## What changed - Add a `ResponseItemId` type that generates item-specific prefixes with UUIDv7 suffixes and use it across response items. - Keep deserialization permissive for legacy histories, but omit empty or unprefixed item IDs from HTTP and WebSocket requests. - Export the new type in the generated TypeScript protocol schema. ## Testing - Cover prefixed ID generation, legacy deserialization, prefix recognition, and outbound request filtering. GitOrigin-RevId: 0209fe430c826d0ae88bc4648652c4ebf390c4a4

Support per-tool MCP output limits (#41421) ## What changed - Add a positive `output_token_limit` setting to each entry under an MCP server's `tools` configuration. - Apply the most restrictive limit when plugin and user policies overlap, while keeping approval policy independent. - Carry the effective MCP output budget in conversation history so tool output, post-tool hook responses, and resumed sessions use the same truncation limit. ## Testing - Cover configuration parsing, serialization, schema validation, and plugin policy merging. - Cover MCP output below and above the configured limit, post-tool hook responses, and session resume. GitOrigin-RevId: d0beb4fca9ba6055d9e1d31c137373b465d50d61

Classify contextual fragments with content kinds (#40180) ## What changed - Require each `ContextualUserFragment` to provide a stable `<feature>.<name>` `ContentItemKind`. - Add `AnnotatedContent` and `RenderedFragment` so rendered text, its role, and its classification can travel together to API boundaries. - Derive extension-owned world-state classifications from the extension ID and keep the skills catalog classification with its fragment implementation. ## Testing - Verify that an extension-owned world-state section renders with an `<extension-id>.instructions` content kind. GitOrigin-RevId: e46b74a0bb41e0b6112667c9d36bc9e7f2714451

Make context snapshot text rendering consistent (#44976) ## What changed - Use the same text rendering for model instructions in request settings and Responses Lite developer content. - Make `rewrite_known_segments` emit plain tags for recognized guidance, including collaboration and multi-agent instructions. Check message roles and complete tag boundaries so lookalike user or tool content stays visible, and retain generated compaction summaries. - Normalize working-directory, workspace-root, and temporary paths in permission guidance while preserving policy differences. - Separate text clipping from normalization and retain eight lines at each end of long sections, with fingerprints for omitted content. Update affected snapshots. ## Testing Add regression coverage for instruction rendering across transports, literal and rewritten guidance, malformed and lookalike tags, compaction summary preservation, and permission path normalization that keeps policy changes detectable. GitOrigin-RevId: 33b052911323c73b0387d650478f9cc3370fd001

Separate session state from session I/O (#33209) ## What changed - Replace the combined `Codex` wrapper with an `Arc<Session>` and a dedicated `SessionIo` handle for submissions, events, status, and loop termination. - Make `Session::spawn` return the session and I/O handle separately, and have `CodexThread` own both. - Update thread management, delegated sessions, guardian reviews, and agent control to use the appropriate session or I/O interface. GitOrigin-RevId: 8523bad7e7366e2969fd0cc3849b4247b141427a