2.10.0

Fixed

• Codex CLI and SDK share valid approval decisions, user questions and MCP
  elicitation handling. Both apply policy preflight and pin the human reviewer,
  including per-app overrides. Commandless network approvals display structured
  destinations; unsupported strict host policies block tasks up front.
• Session consent binds every action argument and the current policy. Persistent
  Codex rule changes require a second confirmation. Dynamic tool calls use the
  host executor and invocation-scoped receipts.
• Correct per-app reviewer override serialization; exclude changing approval
  timestamps from exact-scope consent. SDK request exceptions cancel or return
  JSON-RPC errors without stopping the SDK reader.
• History falls back to thread reads when paging is advertised but unimplemented.
  Fresh detached reviews create a separate thread and preserve unsaved originals.
• Optional mention catalogs are cached and lookup errors preserve the prompt.
  Read-only SDK inventories remain available under strict host network policy.
• Document the local server environment variable and check reference coverage
  in main CI and the publish gate.
• Session approval consent ignores changes to Codex's explanation while
  retaining the action scope. Descendant listings require installed-schema
  support, and history on a fresh thread displays a clean empty-state message.

Added

• Installed CLI schema discovery gates experimental controls. Native dynamic
  tools expose project memory, WorkOrder inspection and governed host MCP tools.
• Named permission profiles, granular/untrusted policies, MCP OAuth and forms,
  typed skill/app mentions, earlier tool history and separate read-only reviews.
• Native run state, hook events, typed errors and context-window reporting.
• Mediated permission preset, schema-checked next-turn options, native session
  and fork identities, and account rate-limit pools. Reviewer status remains
  unconfirmed until a thread reports it.
• Explicit loopback Codex app-server attachment with version checks and detach
  behavior that preserves the user's listener.
• Daily pinned/latest Codex compatibility CI and expanded live protocol release
  gates with isolated storage and no model inference.