Move workspace roots onto thread/session state and stop using active permission profile modifications as an overlay for writable roots. Existing app-server threads now preserve their persisted PermissionProfile value across resume, fork, and turn updates; permissions requests on existing threads only update the active named profile after validating it exists. Workspace roots can be updated independently, and SandboxPolicy::WorkspaceWrite no longer stores its own writable_roots.

sdk/python/tests/test_artifact_workflow_and_binaries.py

@@ -99,6 +99,9 @@ def test_schema_normalization_only_flattens_string_literal_oneofs() -> None:
         "ExperimentalFeatureStage",
         "InputModality",
         "MessagePhase",
+        "PluginAvailability",
+        "ProcessOutputStream",
+        "TurnItemsView",
     ]
 
 
@@ -398,9 +401,7 @@ def test_runtime_resource_binaries_are_included_by_wheel_config(
     pyproject = tomllib.loads((staged / "pyproject.toml").read_text())
     assert {
         "include": pyproject["tool"]["hatch"]["build"]["targets"]["wheel"]["include"],
-        "helper": (
-            staged / "src" / "codex_cli_bin" / "bin" / "helper"
-        ).read_text(),
+        "helper": (staged / "src" / "codex_cli_bin" / "bin" / "helper").read_text(),
     } == {
         "include": ["src/codex_cli_bin/bin/**"],
         "helper": "fake helper\n",

sdk/python/tests/test_client_rpc_methods.py

@@ -66,6 +66,7 @@ def test_thread_resume_response_accepts_auto_review_reviewer() -> None:
                 "id": "thread-1",
                 "modelProvider": "openai",
                 "preview": "",
+                "sessionId": "session-1",
                 "source": "cli",
                 "status": {"type": "idle"},
                 "turns": [],

sdk/python/tests/test_public_api_runtime_behavior.py

@@ -93,6 +93,7 @@ def _item_completed_notification(
         method="item/completed",
         payload=ItemCompletedNotification.model_validate(
             {
+                "completedAtMs": 1,
                 "item": item,
                 "threadId": thread_id,
                 "turnId": turn_id,

sdk/python/tests/test_public_api_signatures.py

@@ -70,6 +70,7 @@ def test_generated_public_signatures_are_snake_case_and_typed() -> None:
             "service_name",
             "service_tier",
             "session_start_source",
+            "thread_source",
         ],
         Codex.thread_list: [
             "archived",
@@ -108,6 +109,7 @@ def test_generated_public_signatures_are_snake_case_and_typed() -> None:
             "model_provider",
             "sandbox",
             "service_tier",
+            "thread_source",
         ],
         Thread.turn: [
             "approval_policy",
@@ -148,6 +150,7 @@ def test_generated_public_signatures_are_snake_case_and_typed() -> None:
             "service_name",
             "service_tier",
             "session_start_source",
+            "thread_source",
         ],
         AsyncCodex.thread_list: [
             "archived",
@@ -186,6 +189,7 @@ def test_generated_public_signatures_are_snake_case_and_typed() -> None:
             "model_provider",
             "sandbox",
             "service_tier",
+            "thread_source",
         ],
         AsyncThread.turn: [
             "approval_policy",