Sync Codex CLI upstream changes (8308618 -> 970111f) #12

Detected upstream updates in openai/codex affecting CLI surface tracking.

• Submodule path: submodules/openai-codex
• Watched branch: main
• Current pinned commit: 83086188ae0614bd882818ff1aa23f3194962012
• Latest upstream commit: 970111f6cb62cc02fe36a82ea7d71b37a2889c97
• Compare: openai/codex@8308618...970111f
• Latest commit: openai/codex@970111f

Changed files (CLI-relevant)

• codex-rs/.cargo/audit.toml
• codex-rs/.cargo/config.toml
• codex-rs/.config/nextest.toml
• codex-rs/Cargo.lock
• codex-rs/Cargo.toml
• codex-rs/agent-identity/src/lib.rs
• codex-rs/agent-message-board-client/Cargo.toml
• codex-rs/agent-message-board-client/src/client.rs
• codex-rs/agent-message-board-client/src/notifications.rs
• codex-rs/agent-message-board-client/src/protocol.rs
• codex-rs/agent-message-board-client/tests/remote_board.rs
• codex-rs/analytics/src/client.rs
• codex-rs/analytics/src/client_tests.rs
• codex-rs/analytics/src/events.rs
• codex-rs/analytics/src/reducer.rs
• codex-rs/analytics/src/tests/suite/approvals_tests.rs
• codex-rs/analytics/src/tests/suite/reducer_ordering_tests.rs
• codex-rs/analytics/src/tests/suite/tools_tests.rs
• codex-rs/analytics/src/tests/suite/turns/events_tests.rs
• codex-rs/analytics/src/tests/suite/turns/requests_tests.rs
• codex-rs/app-server-client/src/cloud.rs
• codex-rs/app-server-client/src/cloud_tests.rs
• codex-rs/app-server-client/src/lib.rs
• codex-rs/app-server-daemon/Cargo.toml
• codex-rs/app-server-daemon/src/backend/mod.rs
• codex-rs/app-server-daemon/src/backend/pid.rs
• codex-rs/app-server-daemon/src/backend/pid_start.rs
• codex-rs/app-server-daemon/src/backend/pid_tests.rs
• codex-rs/app-server-daemon/src/backend/pid_windows.rs
• codex-rs/app-server-daemon/src/backend/stderr_log.rs
• codex-rs/app-server-daemon/src/backend/stderr_log_tests.rs
• codex-rs/app-server-daemon/src/diagnostics.rs
• codex-rs/app-server-daemon/src/launch.rs
• codex-rs/app-server-daemon/src/lib.rs
• codex-rs/app-server-daemon/src/managed_install.rs
• codex-rs/app-server-daemon/src/prepare_install.rs
• codex-rs/app-server-daemon/src/prepare_install_tests.rs
• codex-rs/app-server-daemon/src/release_pruning.rs
• codex-rs/app-server-daemon/src/update_loop.rs
• codex-rs/app-server-daemon/src/update_loop_tests.rs
• codex-rs/app-server-protocol/BUILD.bazel
• codex-rs/app-server-protocol/schema/json/ClientRequest.json
• codex-rs/app-server-protocol/schema/json/ServerNotification.json
• codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
• codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json
• codex-rs/app-server-protocol/schema/json/v2/AccountRateLimitsUpdatedNotification.json
• codex-rs/app-server-protocol/schema/json/v2/AccountUpdatedNotification.json
• codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json
• codex-rs/app-server-protocol/schema/json/v2/ErrorNotification.json
• codex-rs/app-server-protocol/schema/json/v2/FeedbackSaveParams.json
• codex-rs/app-server-protocol/schema/json/v2/FeedbackSaveResponse.json
• codex-rs/app-server-protocol/schema/json/v2/GetAccountRateLimitsResponse.json
• codex-rs/app-server-protocol/schema/json/v2/GetAccountResponse.json
• codex-rs/app-server-protocol/schema/json/v2/HookCompletedNotification.json
• codex-rs/app-server-protocol/schema/json/v2/HookStartedNotification.json
• codex-rs/app-server-protocol/schema/json/v2/HooksListParams.json
• codex-rs/app-server-protocol/schema/json/v2/HooksListResponse.json
• codex-rs/app-server-protocol/schema/json/v2/ItemCompletedNotification.json
• codex-rs/app-server-protocol/schema/json/v2/ItemStartedNotification.json
• codex-rs/app-server-protocol/schema/json/v2/ListMcpServerStatusResponse.json
• codex-rs/app-server-protocol/schema/json/v2/PluginReadResponse.json
• codex-rs/app-server-protocol/schema/json/v2/ReviewStartResponse.json
• codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json
• codex-rs/app-server-protocol/schema/json/v2/ThreadItemsListResponse.json
• codex-rs/app-server-protocol/schema/json/v2/ThreadListResponse.json
• codex-rs/app-server-protocol/schema/json/v2/ThreadMetadataUpdateResponse.json
• codex-rs/app-server-protocol/schema/json/v2/ThreadReadResponse.json
• codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json
• codex-rs/app-server-protocol/schema/json/v2/ThreadRevertResponse.json
• codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json
• codex-rs/app-server-protocol/schema/json/v2/ThreadStartedNotification.json
• codex-rs/app-server-protocol/schema/json/v2/ThreadTurnsListResponse.json
• codex-rs/app-server-protocol/schema/json/v2/ThreadUnarchiveResponse.json
• codex-rs/app-server-protocol/schema/json/v2/TurnCompletedNotification.json
• codex-rs/app-server-protocol/schema/json/v2/TurnStartResponse.json
• codex-rs/app-server-protocol/schema/json/v2/TurnStartedNotification.json
• codex-rs/app-server-protocol/schema/precomputed/app-server-exports-experimental.json.zst
• codex-rs/app-server-protocol/schema/precomputed/app-server-exports-stable.json.zst
• codex-rs/app-server-protocol/schema/typescript/ClientRequest.ts
• codex-rs/app-server-protocol/schema/typescript/ImageGenerationInputImage.ts
• codex-rs/app-server-protocol/schema/typescript/ImageGenerationItem.ts
• codex-rs/app-server-protocol/schema/typescript/PlanType.ts
• codex-rs/app-server-protocol/schema/typescript/index.ts
• codex-rs/app-server-protocol/schema/typescript/v2/Account.ts
• codex-rs/app-server-protocol/schema/typescript/v2/ApplicationRequirements.ts
• codex-rs/app-server-protocol/schema/typescript/v2/ApplicationStorageRequirements.ts
• codex-rs/app-server-protocol/schema/typescript/v2/CodexErrorInfo.ts
• codex-rs/app-server-protocol/schema/typescript/v2/FeedbackSaveParams.ts
• codex-rs/app-server-protocol/schema/typescript/v2/FeedbackSaveResponse.ts
• codex-rs/app-server-protocol/schema/typescript/v2/HookEventName.ts
• codex-rs/app-server-protocol/schema/typescript/v2/HookMetadata.ts
• codex-rs/app-server-protocol/schema/typescript/v2/HookRunSummary.ts
• codex-rs/app-server-protocol/schema/typescript/v2/HooksListParams.ts
• codex-rs/app-server-protocol/schema/typescript/v2/ManagedHooksRequirements.ts
• codex-rs/app-server-protocol/schema/typescript/v2/McpServerStatus.ts
• codex-rs/app-server-protocol/schema/typescript/v2/NetworkRequirements.ts
• codex-rs/app-server-protocol/schema/typescript/v2/index.ts
• codex-rs/app-server-protocol/src/lib.rs
• codex-rs/app-server-protocol/src/lib_tests.rs
• codex-rs/app-server-protocol/src/protocol/common.rs
• codex-rs/app-server-protocol/src/protocol/thread_history.rs
• codex-rs/app-server-protocol/src/protocol/thread_history_projection_tests.rs
• codex-rs/app-server-protocol/src/protocol/v2/account.rs
• codex-rs/app-server-protocol/src/protocol/v2/application.rs
• codex-rs/app-server-protocol/src/protocol/v2/config.rs
• codex-rs/app-server-protocol/src/protocol/v2/feedback.rs
• codex-rs/app-server-protocol/src/protocol/v2/hook.rs
• codex-rs/app-server-protocol/src/protocol/v2/item.rs
• codex-rs/app-server-protocol/src/protocol/v2/mcp.rs
• codex-rs/app-server-protocol/src/protocol/v2/memory.rs
• codex-rs/app-server-protocol/src/protocol/v2/mod.rs
• codex-rs/app-server-protocol/src/protocol/v2/plugin.rs
• codex-rs/app-server-protocol/src/protocol/v2/realtime.rs
• codex-rs/app-server-protocol/src/protocol/v2/shared.rs
• codex-rs/app-server-protocol/src/protocol/v2/tests.rs
• codex-rs/app-server-protocol/src/protocol/v2/thread.rs
• codex-rs/app-server-protocol/src/protocol/v2/thread_sample.rs
• codex-rs/app-server-protocol/src/protocol/v2/turn.rs
• codex-rs/app-server-test-client/src/lib.rs
• codex-rs/app-server-transport/Cargo.toml
• codex-rs/app-server-transport/src/lib.rs
• codex-rs/app-server-transport/src/transport/mod.rs
• codex-rs/app-server-transport/src/transport/remote_control/auth.rs
• codex-rs/app-server-transport/src/transport/remote_control/tests.rs
• codex-rs/app-server-transport/src/transport/remote_control/websocket.rs
• codex-rs/app-server-transport/src/transport/remote_control/websocket_retry_tests.rs
• codex-rs/app-server-transport/src/transport/unix_socket.rs
• codex-rs/app-server-transport/src/transport/unix_socket_tests.rs
• codex-rs/app-server-transport/src/transport/websocket.rs
• codex-rs/app-server-transport/src/transport/websocket_compression_tests.rs
• codex-rs/app-server-transport/src/websocket_compression.rs
• codex-rs/app-server-transport/src/websocket_compression_tests.rs
• codex-rs/app-server/Cargo.toml
• codex-rs/app-server/README.md
• codex-rs/app-server/src/account_notifications_tests.rs
• codex-rs/app-server/src/bespoke_event_handling.rs
• codex-rs/app-server/src/config_manager.rs
• codex-rs/app-server/src/config_manager_provider_tests.rs
• codex-rs/app-server/src/config_manager_service.rs
• codex-rs/app-server/src/config_manager_service_tests.rs
• codex-rs/app-server/src/effective_plugin_change.rs
• codex-rs/app-server/src/extensions.rs
• codex-rs/app-server/src/external_agent_migration/processor.rs
• codex-rs/app-server/src/external_agent_migration/session_importer.rs
• codex-rs/app-server/src/in_process.rs
• codex-rs/app-server/src/in_process_bootstrap.rs
• codex-rs/app-server/src/lib.rs
• codex-rs/app-server/src/lib_tests.rs
• codex-rs/app-server/src/main.rs
• codex-rs/app-server/src/mcp_refresh.rs
• codex-rs/app-server/src/message_processor.rs
• codex-rs/app-server/src/message_processor_gateway_oauth_tests.rs
• codex-rs/app-server/src/message_processor_tracing_tests.rs
• codex-rs/app-server/src/message_processor_workspace_routing_tests.rs
• codex-rs/app-server/src/model_catalog.rs
• codex-rs/app-server/src/models_refresh_worker_tests.rs
• codex-rs/app-server/src/notification_media.rs
• codex-rs/app-server/src/outgoing_message.rs
• codex-rs/app-server/src/request_processors.rs
• codex-rs/app-server/src/request_processors/account_processor.rs
• codex-rs/app-server/src/request_processors/account_processor/enterprise_login.rs
• codex-rs/app-server/src/request_processors/account_processor/workspace_routing.rs
• codex-rs/app-server/src/request_processors/account_processor/workspace_routing_tests.rs
• codex-rs/app-server/src/request_processors/apps_processor/installed.rs
• codex-rs/app-server/src/request_processors/catalog_processor.rs
• codex-rs/app-server/src/request_processors/config_errors.rs
• codex-rs/app-server/src/request_processors/config_processor.rs
• codex-rs/app-server/src/request_processors/config_reload_tests.rs
• codex-rs/app-server/src/request_processors/feedback_log_snapshot_tests.rs
• codex-rs/app-server/src/request_processors/feedback_processor.rs
• codex-rs/app-server/src/request_processors/feedback_thread_index.rs
• codex-rs/app-server/src/request_processors/mcp_processor.rs
• codex-rs/app-server/src/request_processors/memory_status.rs
• codex-rs/app-server/src/request_processors/persisted_resume_settings.rs
• codex-rs/app-server/src/request_processors/plugins.rs
• codex-rs/app-server/src/request_processors/thread_attachments.rs
• codex-rs/app-server/src/request_processors/thread_delete.rs
• codex-rs/app-server/src/request_processors/thread_lifecycle.rs
• codex-rs/app-server/src/request_processors/thread_memory.rs
• codex-rs/app-server/src/request_processors/thread_processor.rs
• codex-rs/app-server/src/request_processors/thread_processor_tests.rs
• codex-rs/app-server/src/request_processors/thread_resume_redaction.rs
• codex-rs/app-server/src/request_processors/thread_sections.rs
• codex-rs/app-server/src/request_processors/turn_processor.rs
• codex-rs/app-server/src/request_serialization.rs
• codex-rs/app-server/src/startup_config.rs
• codex-rs/app-server/src/stderr_logging_tests.rs
• codex-rs/app-server/src/thread_sample.rs
• codex-rs/app-server/src/thread_sample_cancel_context_tests.rs
• codex-rs/app-server/src/transport.rs
• codex-rs/app-server/src/transport_tests.rs
• codex-rs/app-server/src/user_verification_test_support.rs
• codex-rs/app-server/tests/common/auth_fixtures.rs
• codex-rs/app-server/tests/common/rollout.rs
• codex-rs/app-server/tests/suite/conversation_summary.rs
• codex-rs/app-server/tests/suite/logging.rs
• codex-rs/app-server/tests/suite/v2/account.rs
• codex-rs/app-server/tests/suite/v2/account_enterprise_tests.rs
• codex-rs/app-server/tests/suite/v2/account_gcp.rs
• codex-rs/app-server/tests/suite/v2/app_installed.rs

Detected CLI flag surface changes

• added --print-startup-config

Detected model catalog changes

• (no model catalog change detected from models.json)

Detected feature flag changes

• added app_server_websocket_compression
• added executor_capability_discovery_v2
• added guardian_recorded_items
• added guardianv3
• added mcp_tool_list_changed
• added multi_env_copy_file
• added runtime_agent_instances
• added subagent_thread_environments
• added tui_multi_backend
• added wake_on_agent_messages

Commits

• 970111f6cb Allow configuring GCP project and location in provider settings (#56560) (2026-10-23)
• 7848e3393c Remove Guardian snapshot-specific context helpers (#56559) (2026-10-23)
• 2d86506823 Exercise retained sampling in Guardian transport tests (#56557) (2026-10-23)
• 4b1cf9a4c9 Use conversations for all Guardian v2 async classification (#56556) (2026-10-23)
• 5deceaa927 Apply sync Guardian message limits during transcript preparation (#56555) (2026-10-23)
• 15fbcac045 Enable masked AWS credentials for local proxy signing (#56554) (2026-10-23)
• c483edf177 Include environment hooks in thread hook listings (#56553) (2026-10-23)
• 0d7f3ea03b Initialize SQLite databases with DELETE journaling on NFS (#56552) (2026-10-23)
• f970f4be67 Track resume picker pagination and selection metadata per backend (#56543) (2026-10-23)
• 7c568b331b Extract the head-tail buffer into a utility crate (#56535) (2026-10-23)
• 0efc474605 Defer sync Guardian tool-output truncation to transcript preparation (#56533) (2026-10-23)
• ea819e1f4d Record skill and plugin catalog sizes on publication (#56530) (2026-10-23)
• adca78ddae Remove the 1 MiB response limit for explicit model catalogs (#56525) (2026-10-23)
• b82d542aef Add turn, tool, and skill attribution to traces (#56524) (2026-10-23)
• 3985001067 Respect server approval policy defaults during TUI startup (#56516) (2026-10-23)
• 810501d60d Add trace instrumentation for turn startup and response streaming (#56515) (2026-10-23)
• bca6f238cb Preserve tracing context throughout tool dispatch (#56514) (2026-10-23)
• 1c0c45bfc3 Defer synchronous Guardian tool-call truncation to preparation (#56505) (2026-10-23)
• 2839ed763b Add paginated channel subscription queries to the local message board (#56495) (2026-10-23)
• 2f1cc59790 Add channel upserts to message boards (#56494) (2026-10-23)
• e52045f989 Move Guardian tool description preparation into context composition (#56493) (2026-10-23)
• de06fd0be4 Allow installed plugin metadata to skip display enrichment (#56483) (2026-10-23)
• 7d592f6dd9 Move Guardian approval reason caps into context composition (#56477) (2026-10-23)
• d4bdafd378 Preserve SystemRoot for Windows filesystem sandbox helpers (#56468) (2026-10-23)
• b559e6a398 Add experimental thread memory summary reads (#56465) (2026-10-23)
• 90894a780d Prevent memory imports from racing with consolidation (#56462) (2026-10-23)
• b719a7fb7f Add silent append support to message boards (#56461) (2026-10-23)
• bca6cff1e1 Add Guardian v3 local board helpers (#56460) (2026-10-23)
• f71c6afc30 Add Guardian V3 feature configuration (#56459) (2026-10-23)
• d8acdf1515 Make sandbox mount cleanup tests tolerate file descriptor reuse (#56454) (2026-10-23)
• 2130b56710 Make the Realtime V2 background-agent steering test deterministic (#56453) (2026-10-23)
• 60adfa8513 Treat model-not-found provider errors as terminal failures (#56445) (2026-10-23)
• ca9d103f39 Update ctutils from 0.4.2 to 0.4.5 (#56439) (2026-10-23)
• e6ebdfe00b Support memory v2 in external-agent memory imports (#56414) (2026-10-23)
• d6817454d7 Make the Guardian review timeout configurable (#56371) (2026-10-23)
• a96fa4f220 Allow callers to set the thread source for sampling (#56364) (2026-10-23)
• 30587d7885 Add experimental attached thread forks (#56351) (2026-10-23)
• 4610b573e5 Run environment hooks on their owning executors (#56343) (2026-10-23)
• e5ea2ed50b Match rollout trace image content across request snapshots (#56342) (2026-10-23)
• 8531184b49 Make agent-message wakes respect interrupts and Plan mode (#56330) (2026-10-23)
• f3a90545ae Add managed configuration loaders for custom config servers (#56314) (2026-10-23)
• e103bbc06f Apply model catalog overrides to history, notes, and context tools (#56313) (2026-10-23)
• 5b792948f9 Track accepted conversation history in rollout traces (#56312) (2026-10-23)
• 878070b5a6 Support model-specific writable-root permission wording (#56309) (2026-10-23)
• 334527705c Separate directory and repository scopes in the TUI (#56308) (2026-10-23)
• 75a4146411 Add support for environment-scoped managed hooks (#56304) (2026-10-23)
• 7a5860da35 Add hook configuration to environment attachments (#56302) (2026-10-22)
• dc4844c907 Add TLS forwarding tests for MITM SigV4 requests (#56301) (2026-10-22)
• e4deed3981 Mark built-in dummy credentials and strengthen collision checks (#56297) (2026-10-22)
• 5a1c247dd5 Decouple managed configuration loading from ChatGPT authentication (#56295) (2026-10-22)
• eca79b000c Use fixed-token auth fixtures in Vertex tests (#56293) (2026-10-22)
• ef33e43a15 Fix MCP cancellation tests to use the metadata callback (#56292) (2026-10-22)
• 66f6da6036 Lock Python release build tools with uv (#56290) (2026-10-22)
• 9100b9c3d3 Pin Linux artifact signing to Cosign v3.1.4 (#56288) (2026-10-22)
• e0fdd608e8 Bump @modelcontextprotocol/sdk to 1.32.0 (#56286) (2026-10-22)
• 2326a3f74b Scope model catalogs and caches by thread originator (#56284) (2026-10-22)
• 35e2102808 Group consecutive transcript prompts into one background block (#56280) (2026-10-22)
• d124fe9de1 Add negotiated network policy metadata support for MCP calls (#56278) (2026-10-22)
• 129220bf05 Support bounded request bodies in AWS SigV4 signing (#56277) (2026-10-22)
• ca87ef86e1 Wait for cloud config refresh cancellation in loader lifetime tests (#56274) (2026-10-22)
• 0eb98b4617 Upgrade Python SDK model generation to datamodel-code-generator 0.64.0 (#56272) (2026-10-22)
• cb2581dae8 Preserve MCP disable reasons across runtime overlays (#56266) (2026-10-22)
• 3fd148a20c Add a built-in Google Cloud Vertex AI provider (#56265) (2026-10-22)
• 61a991990f Reject backslashes in HTTP(S) marketplace URL userinfo (#56263) (2026-10-22)
• 85de07048c Isolate V8 source dependencies and their C++ runtime settings (#56261) (2026-10-22)
• 40db507eec Avoid redundant settings checkpoints when resuming threads (#56250) (2026-10-22)
• 8eaf5fd115 Bump uv to 0.13.5 in CI and release workflows (#56248) (2026-10-22)
• c227654800 Consolidate Rust unit tests under dedicated test modules (#56247) (2026-10-22)
• 22db5847c8 Bump Bazelisk to 1.30.0 in the Bazel CI setup action (#56246) (2026-10-22)
• a3d93e1e69 Make the code mode yield/resume test yield explicitly between phases (#56236) (2026-10-22)
• 8c7affbe1b Emit prompt telemetry only after hooks accept input (#56234) (2026-10-22)
• 7ace9c6aa2 Make Opus encoder test timestamps follow sample time (#56233) (2026-10-22)
• ffda54f5b8 Reuse current model context across paginated resume config loading (#56224) (2026-10-22)
• 9cb547349e Consolidate Bazel CI setup into prepare-bazel-ci (#56222) (2026-10-22)
• 96a0d8d551 Use cargo_bin in the Windows sandbox manifest test (#56220) (2026-10-22)
• be537fb60c Remove the u64 cast from WSL DrvFS detection (#56214) (2026-10-22)
• a390571745 Default fresh memory profiles to v2 (#56211) (2026-10-22)
• 8ba7aed55f Stabilize the marketplace staging cleanup test (#56210) (2026-10-22)
• 9a8a85bc53 Add AWS SigV4 signing to network proxy MITM hooks (#56182) (2026-10-22)
• 2f3fb111be Enable reasoning effort overrides by default (#56163) (2026-10-22)
• 94350a9101 Add managed network review domains before allow rules (#56154) (2026-10-22)
• 67fb9da4b6 Preserve safe enterprise MCP authentication error details (#56153) (2026-10-22)
• 61f34c35af Fix the MCP auth status test's IdP OAuth configuration (#56139) (2026-10-22)
• b337fe06b7 Defer agent mail after empty final answers (#56133) (2026-10-22)
• 2dbe6bfa44 Cancel MCP tool requests when response futures are dropped (#56132) (2026-10-22)
• c260087efe Avoid blocking EMA auth status checks on account refresh (#56127) (2026-10-22)
• 07316174c6 Forward Guardian reviewer events to parent raw-event subscribers (#56124) (2026-10-22)
• 86e17e98c7 Prepare TUI startup to accept multiple backend sessions (#56097) (2026-10-22)
• c2d5ea52e1 Keep TUI preferences editable when execution settings are invalid (#56091) (2026-10-22)
• 47a1f6bb77 Honor server approval reviewer defaults on fresh TUI startup (#56090) (2026-10-22)
• b4ad33d1a3 Cache decrypted Codex auth and managed secrets (#56081) (2026-10-22)
• 342ed69a17 Require managed configuration from the configured server (#56055) (2026-10-22)
• 2a77e82f09 Support configured credential providers in remote execution (#56049) (2026-10-22)
• 0769c6aeeb Enable executor cleanup hooks with V2 capability discovery (#56044) (2026-10-22)
• 45179176e5 Add a channel-backed cloud app-server client (#56037) (2026-10-22)
• 09ec2451bf Add request-scoped OAuth credentials and session lifecycle APIs (#56036) (2026-10-22)
• 8440e76ae6 Enable the Bedrock setup wizard by default (#56033) (2026-10-22)
• 004c13292f Fix entrypoint lookup in package debug-symbol smoke tests (#56032) (2026-10-22)
• 943c70d8d2 Support client Responses API metadata in thread/sample (#56031) (2026-10-22)
• e8bb1b6641 Limit decoded HTTP/3 response headers in the TCP tunnel (#56024) (2026-10-22)

Action required

• Validate latest codex --help and codex exec --help output
• Validate latest codex features list output
• Sync C# SDK constants/options/models with upstream CLI changes
• Add or update tests for new flags/models/features
• Update docs (README + docs/Features + docs/Architecture if needed)

Opened automatically by scheduled workflow 'Codex CLI Upstream Watch'.