rhan-oai

Split analytics tests into focused suites (#46488) ## What changed Replace `analytics_client_tests.rs` with event-specific suites under `codex-rs/analytics/src/tests/suite/` and shared fixtures in `tests/support.rs`. Group turn tests by events, requests, compaction, and accepted lines, and keep cross-event arrival-order coverage in a dedicated reducer ordering suite. Separate app and plugin ingestion assertions into their respective suites while retaining a combined test for arrival order. Document where to place tests based on the contract they cover. GitOrigin-RevId: aba497f103ad6e23eca6266fc93d150d16f5913c

Centralize model-message resolution and rendering in `codex-prompts` (#46026) ## What changed - Add `ResolvedModelMessages` to resolve catalog text and bundled defaults while preserving explicit empty overrides and their source. - Move base-instruction rendering, Guardian prompt composition, multi-agent role rendering, and `update_plan` guidance filtering into `codex-prompts`; migrate consumers to the shared APIs. - Separate permission-profile resolution from prompt composition, and annotate Guardian policy and classifier instructions with content kinds. ## Testing Add and update coverage for missing versus empty templates, literal overrides, multi-agent role composition, Guardian policy substitution and truncation, and preservation of permission path spellings and order. GitOrigin-RevId: 52335bb7acec0f432d5c57acb2accd5f0276056e

Preserve runtime workspace roots across thread resume (#43848) ## Why Resuming a thread should retain its selected workspace folders, including additional roots and explicit empty selections. Resume overrides also need to survive a subsequent resume when no turn has run. ## What changed - Persist `runtime_workspace_roots` in startup metadata and thread settings snapshots, separately from explicit environment selections and permission-profile roots. - Restore roots from the latest snapshot owned by the resumed thread, falling back to owned startup metadata only when no snapshot exists. Honor explicit `runtimeWorkspaceRoots` overrides, retarget the old `cwd` root when `cwd` changes, deduplicate roots, and validate restored paths for the current host. - Checkpoint effective settings on resume and restored settings after revert. Reload resume configuration if saved workspace roots change during loading. - Normalize Windows rollout path spellings when matching thread search results, preserving selection of the correct rollout after revert, including compressed rollouts. ## Testing Add regression coverage for workspace restoration, empty and explicit overrides, foreign paths, compaction and revert, resume checkpoints without recency changes, concurrent settings persistence, and rollout search path matching. GitOrigin-RevId: d98d9d34dd63934d441120916c61c12b69e7f062

Remove retired model entries while preserving migration prompts (#44250) ## Why Saved model selections can outlive their bundled catalog entries and still need migration guidance. ## What changed - Remove `gpt-5.2` and `gpt-5.4-mini` from the bundled model catalog. - Preserve migration from saved `gpt-5.4-mini` selections to `gpt-5.6-luna` when the old model is absent, while respecting catalog-provided migration metadata. - Update tests and snapshots to use current models or explicit test fixtures, and remove the obsolete prompt fixture. ## Testing Extend migration tests to cover catalog metadata precedence, saved selections, replacement model and reasoning-effort persistence, acknowledged prompts, and missing or hidden migration targets. GitOrigin-RevId: 82beea504cc4a15699677c28a61ec0939af3069c

Consolidate model instructions in `ModelMessages` (#36787) ## What changed - Remove `ModelInfo.base_instructions` as an in-memory instruction source and use `model_messages.instructions_template` consistently for bundled, remote, fallback, and overridden model metadata. - Preserve compatibility by promoting legacy `base_instructions` values when reading model responses and caches, and by including rendered legacy instructions when serializing `ModelsResponse` for older clients. - Treat templates without instruction variables as literal text and retain the other model-message fields when applying instruction overrides. This completes the consolidation proposed in https://github.com/openai/codex/pull/31302. ## Testing - Cover legacy response and cache migration, canonical-template precedence, fallback instructions, personality rendering, overrides, and model switching. GitOrigin-RevId: 089d986ca5e30da67db2c77a1b6a046d2cff52dc

Enforce subagent ownership across app-server inputs (#40464) ## Why Parent-owned Multi-Agent V2 subagents must remain controlled by their parent, but several app-server endpoints could still mutate them directly. ## What changed - Centralize the direct-input ownership check and apply it to turn injection, MCP calls, reviews, compaction, rollback and revert, shell and Guardian actions, realtime requests, and goal mutations. - Enforce the same policy for goal mutations on unloaded threads while keeping goal reads and turn interruption available. - Document the affected endpoint behavior and continue exposing `canAcceptDirectInput: false` for parent-owned subagents. ## Testing - Cover direct-input rejection for both legacy and paginated thread history. - Cover goal mutation ownership checks for unloaded V2 subagents, V1 subagents, and non-subagent V2 threads. GitOrigin-RevId: 791b7af98490aed5eab4e672b90661acad11ec23

Reload Multi-Agent V2 children through their parent (#40477) ## Why Multi-Agent V2 children are owned by their parent at runtime. Resuming an unloaded child directly could rebuild it from caller-provided settings instead of the parent's current authority. ## What changed - Route child reloads through their loaded immediate parent and reject direct cold resume when that parent is unavailable. - Preserve the child's recorded model, provider, reasoning effort, and role while inheriting the parent's execution policy and MCP extensions. - Validate cached environments against the parent, intersect local permission profiles, and reject stale remote or workspace-root configurations. - Keep paginated cold-resume token usage attribution when attaching to the reloaded child. ## Testing Add coverage for owner validation, nested-parent reloads, permission and environment changes, role instruction restoration, paginated usage replay, and app-server child resume behavior. GitOrigin-RevId: 84014762bcdb57f94fc23974c9c1af55dc1babf1

Retire Friendly and Pragmatic personality selection (#44946) ## What changed - Use literal model instruction templates and the standard fallback prompt, ignoring legacy personality variables. Retain catalog decoding compatibility and report `supports_personality` as `false` for generated model presets. - Stop emitting `<personality_spec>` developer messages and assigning an implicit Pragmatic configuration default. - Filter Friendly/Pragmatic overrides from TUI requests while preserving explicit `personality = "none"`. With `features.personality` enabled, this opt-out still strips the model's personality section. - Refresh inherited model instructions for agent roles only when the personality opt-out changes, preserving custom instructions. ## Testing Update coverage for literal legacy templates, deprecated overrides on turn start and resume, role instruction refresh, and forwarding the explicit opt-out through thread start, resume, and fork requests. GitOrigin-RevId: 1391db4e565e010569f0885f80013d1f86b45825

Source multi-agent instructions from the model catalog (#38619) ## What changed - Add model-catalog messages for root and subagent roles, explicit delegation, and delegation hints. - Resolve role instructions in config, catalog, then bundled-default order, while preserving empty values as an explicit way to suppress fallback text. - Refresh catalog-provided role and mode instructions when the model changes, and give full-history forks the selected child model's subagent role without retaining the parent's role guidance. - Keep existing config overrides and reasoning-effort behavior, including proactive delegation for ultra reasoning effort. ## Testing - Cover message deserialization and preservation through model overrides. - Cover precedence, empty overrides, model switches, resumed sessions, and full-history subagent forks. GitOrigin-RevId: 4625cf7c6a5490176adddfaa0fb99100707daea9

Restore thread cwd from owned settings snapshots (#41567) ## Why Resuming a thread without an explicit `cwd` should restore that thread's latest retained setting. Forked history can contain settings copied from another thread, while compaction can move the latest setting outside the replay window. ## What changed - Record the owning thread ID on new settings snapshots and only use snapshots owned by the resumed thread when restoring `cwd`. Older snapshots without an owner remain readable but do not override the startup `cwd`. - Checkpoint the current settings after compaction and serialize checkpoints with settings updates so the retained history contains an accepted, current snapshot. - Cover resume behavior across compaction, forks, reverts, legacy histories, and concurrent settings updates. GitOrigin-RevId: 1efc9cf55472d6b88c465c4efe44672a232dbf64