rhan-oai

Split analytics tests into focused suites (#46488) ## What changed Replace `analytics_client_tests.rs` with event-specific suites under `codex-rs/analytics/src/tests/suite/` and shared fixtures in `tests/support.rs`. Group turn tests by events, requests, compaction, and accepted lines, and keep cross-event arrival-order coverage in a dedicated reducer ordering suite. Separate app and plugin ingestion assertions into their respective suites while retaining a combined test for arrival order. Document where to place tests based on the contract they cover. GitOrigin-RevId: aba497f103ad6e23eca6266fc93d150d16f5913c

Centralize model-message resolution and rendering in `codex-prompts` (#46026) ## What changed - Add `ResolvedModelMessages` to resolve catalog text and bundled defaults while preserving explicit empty overrides and their source. - Move base-instruction rendering, Guardian prompt composition, multi-agent role rendering, and `update_plan` guidance filtering into `codex-prompts`; migrate consumers to the shared APIs. - Separate permission-profile resolution from prompt composition, and annotate Guardian policy and classifier instructions with content kinds. ## Testing Add and update coverage for missing versus empty templates, literal overrides, multi-agent role composition, Guardian policy substitution and truncation, and preservation of permission path spellings and order. GitOrigin-RevId: 52335bb7acec0f432d5c57acb2accd5f0276056e

Preserve runtime workspace roots across thread resume (#43848) ## Why Resuming a thread should retain its selected workspace folders, including additional roots and explicit empty selections. Resume overrides also need to survive a subsequent resume when no turn has run. ## What changed - Persist `runtime_workspace_roots` in startup metadata and thread settings snapshots, separately from explicit environment selections and permission-profile roots. - Restore roots from the latest snapshot owned by the resumed thread, falling back to owned startup metadata only when no snapshot exists. Honor explicit `runtimeWorkspaceRoots` overrides, retarget the old `cwd` root when `cwd` changes, deduplicate roots, and validate restored paths for the current host. - Checkpoint effective settings on resume and restored settings after revert. Reload resume configuration if saved workspace roots change during loading. - Normalize Windows rollout path spellings when matching thread search results, preserving selection of the correct rollout after revert, including compressed rollouts. ## Testing Add regression coverage for workspace restoration, empty and explicit overrides, foreign paths, compaction and revert, resume checkpoints without recency changes, concurrent settings persistence, and rollout search path matching. GitOrigin-RevId: d98d9d34dd63934d441120916c61c12b69e7f062

Add host-reserved V2 child creation APIs (#57586) ## What changed - Add `CodexThread::create_child` to create an idle child from a live tool invocation using a host-reserved thread ID and controller. - Add `prepare_child` and `ThreadManager::create_prepared_child` to capture inherited settings and fresh or forked history, then start the child on another manager even after the parent shuts down. Reject detached preparation when live bindings cannot be transferred. - Add opt-in `HostToolInvocationLookup` to track live calls and reject duplicate active call IDs within a turn. Revoke invocation access when dispatch ends and clean up provisional children when startup fails or is cancelled. ## Testing Add tests for invocation lifetime and call ID reservation, inherited policy and live bindings, detached startup with fresh and full history, and cancellation cleanup. GitOrigin-RevId: 71f17ecb4cd7636517e675df59289a8e8c7105b8

Render host-owned V2 subagent rosters in environment context (#59531) ## What changed - Expose `AgentSessionReader` and `AgentRef` for read-only access to host-owned agent session membership. - Read direct children when rendering V2 environment context, using the existing roster size limits. Refresh membership when rebuilding context after compaction, and omit the roster if the provider is absent or the read fails. - Preserve unrecorded initial input across suspension or interruption while waiting for a roster read. Resolve the roster before advancing the compaction window. ## Testing Add coverage for roster refreshes after compaction, unchanged environments avoiding extra reads, unavailable rosters, recoverable input during blocked reads, and stale compaction results rejected after a concurrent history replacement. GitOrigin-RevId: 3c7e3822af09e9295d405e53dabb87b020c8f00c

Remove retired model entries while preserving migration prompts (#44250) ## Why Saved model selections can outlive their bundled catalog entries and still need migration guidance. ## What changed - Remove `gpt-5.2` and `gpt-5.4-mini` from the bundled model catalog. - Preserve migration from saved `gpt-5.4-mini` selections to `gpt-5.6-luna` when the old model is absent, while respecting catalog-provided migration metadata. - Update tests and snapshots to use current models or explicit test fixtures, and remove the obsolete prompt fixture. ## Testing Extend migration tests to cover catalog metadata precedence, saved selections, replacement model and reasoning-effort persistence, acknowledged prompts, and missing or hidden migration targets. GitOrigin-RevId: 82beea504cc4a15699677c28a61ec0939af3069c

Add host-owned turn admission to the agent runtime (#58963) ## What changed Add `AgentRuntimeOwnership::Host` and an `AgentTurnAdmission` provider so hosts can acquire execution capacity before runtime tasks run, including root turns. Require the provider at startup and retain its execution guard for the task lifetime. Controller ownership remains the default; host ownership skips controller rollout-budget accounting, budget reminders, and subagent roster context. Keep pending admission interruptible without blocking input submission. Report admission failures through the turn lifecycle, record accepted input before exposing the error, and unwind task setup such as review mode. Preserve recoverable input during suspension. On interruption, skip prompts that still require a `UserPromptSubmit` hook rather than recording them without inspection. ## Testing Add integration tests for missing-provider startup cleanup, denial and immediate retry, steering during admission, cancellation, execution guard lifetime, submit-hook handling, suspension recovery, and review-mode cleanup. Add a context snapshot verifying retained input reaches the next admitted turn. GitOrigin-RevId: 9ee85fad2ecfbfb38735bac8ef88888fb179a967

Enforce subagent ownership across app-server inputs (#40464) ## Why Parent-owned Multi-Agent V2 subagents must remain controlled by their parent, but several app-server endpoints could still mutate them directly. ## What changed - Centralize the direct-input ownership check and apply it to turn injection, MCP calls, reviews, compaction, rollback and revert, shell and Guardian actions, realtime requests, and goal mutations. - Enforce the same policy for goal mutations on unloaded threads while keeping goal reads and turn interruption available. - Document the affected endpoint behavior and continue exposing `canAcceptDirectInput: false` for parent-owned subagents. ## Testing - Cover direct-input rejection for both legacy and paginated thread history. - Cover goal mutation ownership checks for unloaded V2 subagents, V1 subagents, and non-subagent V2 threads. GitOrigin-RevId: 791b7af98490aed5eab4e672b90661acad11ec23

Refresh model instructions in incremental-tool context windows (#53872) ## Why Incremental-tool windows recorded base instructions only at setup, so a catalog refresh for the same model could leave active instructions stale. Instruction changes need to reach the model without rewriting the existing history prefix. ## What changed - Track model identity and instruction content independently, appending a `model_instructions` developer message when either changes. Explicitly mark replacement or removal of base instructions, and avoid repeating unchanged updates. - Start new windows after compaction with the latest model instructions while preserving custom base instructions. - Preserve the recorded window base during local compaction retries, including empty instructions, and rebuild current model instructions when reconstructing child context. ## Testing Add integration tests and request snapshots for catalog refreshes, instruction removal, model switches, compaction, restart, and forks. Extend regression coverage for legacy snapshots and local compaction retries. GitOrigin-RevId: eeca69067b4d9cd91c817732d79b4d5c1faa18b9

Add shared service-tier support for host-owned agents (#59770) ## What changed - Expose an optional `AgentServiceTier` provider so host-owned children, including detached children, inherit the root's committed tier during spawn preparation, startup prewarm, and each inference step. - Reject per-turn tier overrides for children using the shared provider. Root updates apply to subsequent requests without changing requests already in flight. - Preserve independent configured tiers and role overrides when no provider is installed, including across eviction and reload. Spawned children inherit the parent's thread preference rather than its per-turn override. - Publish the latest committed root tier only after successful runtime registration, preventing failed duplicate starts from changing shared settings. ## Testing Add coverage for detached-child WebSocket prewarm and between-step tier changes, shared-child override rejection, independent-tier inheritance and reload, and settings updates before registration. GitOrigin-RevId: f0f3676813a1c59bd77baf95121e2d13e0163a8e