## What changed
- Accept two-stroke bindings such as `ctrl-x ctrl-s` in TUI keymap configuration while preserving arrays as alternative bindings.
- Route chords through the active TUI context, show pending and configured chord hints, and cancel pending chords on `esc`, context changes, or a one-second timeout.
- Extend `/keymap` to capture, add, replace, and display key chords.
- Reject chords that conflict with active single-key bindings, overlapping-context chords, or reserved terminal shortcuts.
## Testing
- Add coverage for chord parsing, validation, matching, timeout and cancellation behavior, context dispatch, key capture, and rendered shortcut hints.
GitOrigin-RevId: dfdede03f518d4936ad8621ebf5537026f2b282e
## What changed
- Carry dimensions on resize events and reuse the cached screen size for ordinary draws.
- Refresh terminal geometry after resize settling, process resume, and external program execution.
- Pass the resolved size through transcript reflow, viewport updates, and standalone TUI screens so each frame uses consistent dimensions.
## Testing
- Cover cached draws, resize-driven rendering, settled-size rechecks, resume refreshes, and alternate-screen size updates.
GitOrigin-RevId: 9d83dbab50d7a038bd59b4c66c13abcac69ddc79
## Why
Clients need to know whether a `request_user_input` request must wait for an
explicit response or may auto-resolve. Using `autoResolutionMs` as that signal
conflated the blocking decision with timeout policy.
## What changed
- Add required `isBlocking` fields to user input protocol and app-server
request payloads. Plan-mode requests are blocking, while requests from other
enabled modes are non-blocking.
- Drive the TUI's auto-resolution behavior from `isBlocking` and remove
`autoResolutionMs` from the model-facing tool schema.
- Deprecate `autoResolutionMs` while retaining it for compatibility, and treat
legacy payloads without `isBlocking` as blocking.
## Testing
- Cover mode-derived blocking behavior, legacy deserialization, app-server
forwarding, delegated requests, and TUI auto-resolution.
GitOrigin-RevId: 29aade657ef743065ec264376ba567a9b353d7d7
## What changed
- Load `environments.toml` in one operation, falling back to the default
environment provider only when the read reports that the file is missing.
- Attempt the default daemon socket connection directly instead of checking the
socket path first.
- Preserve each file search entry's type from the directory walker, avoiding a
second metadata lookup when producing matches and correctly classifying
followed directory symlinks.
- Write atomic-file contents through the existing temporary-file handle rather
than reopening its path.
## Testing
- Add Unix coverage for classifying a followed directory symlink as a
directory in file search results.
GitOrigin-RevId: aa6739cac23953ca8b9a3fcb53e43e72c41cfdf9
## What changed
- Start local resume and fork picker listings from indexed state DB metadata, while preserving the existing store-backed behavior for remote workspaces.
- Keep the selected listing mode across pagination and fall back to the normal local store listing when the initial state DB request returns no rows or fails.
- Add coverage for pagination, fallback rendering, and selecting an indexed thread without validating its rollout file.
GitOrigin-RevId: 9005fbe73134e261bc6dd3f588c4fff494bdeea0
## What changed
- Add `--approve-for-me` to interactive and exec commands to route approval requests through automatic review.
- Configure the mode with `approval_policy="on-request"` and the `workspace-write` sandbox.
- Propagate the option across root, `exec`, `resume`, and `fork` argument handling while preserving later subcommand permission overrides.
## Testing
- Cover parsing, permission conflicts, root/subcommand precedence, resume handling, and the effective exec approval and sandbox modes.
GitOrigin-RevId: ae969e8c18f925f943049fefff56255f10b25659
## What changed
- Recognize `enterprise_cbp_automation` as an Enterprise workspace plan in authentication, backend responses, and app-server account and rate-limit APIs.
- Expose the plan in generated protocol schemas and display it as `Enterprise (Automation)` in account status.
- Apply existing workspace eligibility and Business usage-limit behavior to the new plan.
## Testing
- Cover JWT parsing, plan conversion and serialization, app-server responses, workspace eligibility, usage-limit formatting, and TUI status rendering.
GitOrigin-RevId: d84ae2be3dd60fe398f226e6dc434efe27a387a5
## What changed
- Propagate MCP tool `readOnlyHint` annotations through tool-call start and
completion events.
- Include the optional hint in persisted thread history and app-server
`mcpToolCall` items, preserving compatibility when the annotation is absent.
- Document that the hint describes tool capability, not the outcome of a
particular invocation.
## Testing
- Cover read-only and write-capable tools in live events and persisted rollout
data.
- Verify the hint survives thread reads and resumes for both in-progress and
completed MCP calls.
GitOrigin-RevId: dddfe905146075e5137a1094da485b86b99807f0
## Why
OAuth discovery failures do not establish that an MCP server lacks OAuth
support. Reporting those failures as `unsupported` conflates an inconclusive
check with a confirmed result.
## What changed
- Add an `unknown` MCP authentication status across the protocol, app server,
CLI, and TUI.
- Preserve OAuth discovery errors so callers can report `unknown`, while
retaining `unsupported` for servers known not to support OAuth.
- Document the distinction in the app server API.
## Testing
- Verify transient HTTP discovery errors are preserved.
- Verify `codex mcp list --json` reports `unknown` when discovery is rate
limited.
GitOrigin-RevId: e4562985971606740538e542ec7eeee502111964
## What changed
- Accept an optional thread name with `/fork`, trimming surrounding whitespace.
- Apply the name to the newly forked thread and update the active session metadata.
- Keep the successful fork active and show an error when naming it fails.
## Testing
- Cover unnamed and named `/fork` dispatch, persisted names, and naming failures.
GitOrigin-RevId: 1799576f82ef0856f992a0378f041e4bab89621b
## Why
Built-in pet downloads used a standalone blocking client, so CDN redirects did
not use Codex's configured route handling.
## What changed
- Download pet spritesheets asynchronously with a reusable
`RouteAwareClientPool`.
- Keep cache validation, asset installation, and pet decoding off the async
runtime while sharing one asset-and-load path across startup, previews, and
selection.
- Preserve the download size limit while consuming streamed response chunks,
and remove the TUI's direct `reqwest` dependency.
## Testing
Add coverage for oversized response chunks, cached built-in assets, pet loads
without an existing Tokio runtime, and stale preview and selection completions.
GitOrigin-RevId: 725e76f3ddb7e84b7212769892f28dc0add15741
## What changed
- Add `thread/section/move` to atomically move a thread into, within, or out of a section. Threads can be inserted before an existing member or appended, and moves within a section preserve `sectionEnteredAt`.
- Add `section_position` sorting to `thread/list`, with ascending order as its default, and expose `sectionEnteredAt` in thread responses.
- Persist section positions and entry times in SQLite, including migration of existing section members into recency order. Section membership is no longer updated through `thread/metadata/update`.
## Testing
- Cover section moves, reordering, pagination, persistence across restarts and rollout reconciliation, concurrent updates, and rank renumbering.
GitOrigin-RevId: aec6d7ddedca5277029b5caf5c074975397e956c
## What changed
- Move the migration flow, model, and source picker under the
`external_agent_config_migration` module.
- Keep their tests and snapshots alongside the corresponding module files and
update imports and snapshot source paths.
GitOrigin-RevId: 4b2f83ca689534e4d9cd1dc7aaa8424e76166bba
## What changed
- Treat a single non-empty bold span as a title-only reasoning summary instead of transcript-only content.
- Render title-only summaries consistently in the TUI history and transcript.
- Add a regression test covering both render paths.
GitOrigin-RevId: e3cda451b3fa0ad92985463b14427384bcae4a8d
## What changed
- Use Ratatui-compatible terminal widths throughout TUI layout, preserving
full-width counters for long lines.
- Wrap and truncate on grapheme boundaries so halfwidth kana sound marks and
emoji sequences stay intact.
- Apply the corrected sizing to text input, selection popups, status and
history cells, Markdown, hyperlinks, and scrollable cloud diffs.
## Testing
- Add focused unit and snapshot coverage for wrapping, truncation, cursor and
mask alignment, popup columns, status output, session headers, Markdown
tables, process output, and scrollable diffs.
GitOrigin-RevId: 294ec0bcff743c6bb16d55ec26308524ce741879
## What changed
- Mark OSC 8 hyperlink cells with their visible width so Ratatui's buffer diff handles wide and halfwidth characters correctly.
- Use Ratatui's diff iterator while explicitly clearing styled trailing cells when a forced-width cell replaces a wider cell.
## Testing
- Add coverage for forced-width hyperlink rendering, always-update cells, and styled trailing-cell cleanup.
GitOrigin-RevId: 041128f43beb1e09d40179a3ac16dca1fbdcbc44
## What changed
- Upgrade `ratatui`, `ratatui-macros`, `crossterm`, and `ansi-to-tui`, and adapt the TUI to their updated rendering, backend, color-conversion, and cell APIs.
- Use Ratatui's cell-width and continuation-cell metadata when mapping OSC 8 hyperlinks so links remain aligned across wrapped wide glyphs and halfwidth characters with dakuten.
- Preserve explicit hyperlinks in the sign-in success screen and empty MCP state without embedding escape sequences in the text passed to Ratatui.
## Testing
- Add regression coverage for hyperlink placement across wide glyphs and halfwidth dakuten, hyperlink preservation in onboarding and MCP output, and display-width handling.
GitOrigin-RevId: 8460873e5a266923acd0417bc46264845eab0134
## Why
Pending MCP server startup can outlive an agent turn. Treating its shared
running indicator as an active user turn prevents queued follow-ups and slash
commands from advancing after the turn completes.
## What changed
- Allow the input queue to drain while only MCP startup remains active.
- Keep queued input blocked while a review, foreground shell command, or
compaction is pending or running.
- Resume queue draining after session-selection flows close.
## Testing
Add TUI tests covering queued follow-ups, slash commands, reviews, shell
commands, and compaction while MCP startup is pending.
GitOrigin-RevId: f5684f61c32e3728ff71cf222f0486df637dc3a5
## What changed
- Set `encrypted_function_args` when constructing the router test's local tool call.
- Box the TUI test's app-server request payload to match `AppServerEvent::ServerRequest`.
GitOrigin-RevId: 45195f362bc912d202d95ea67271bcb102bf1e2a
## Why
Switching away from a side conversation should not wait for its interrupt and
unsubscribe requests to finish.
## What changed
- Remove a side conversation from local TUI state immediately when switching
threads, then interrupt and unsubscribe it in a background task.
- Retry interruption with the active turn ID when the original turn races with
cleanup.
- Ignore late notifications and reject server requests for abandoned side
conversations.
## Testing
- Added coverage that background cleanup removes local state and ignores late
events and approval requests.
GitOrigin-RevId: 7a1d1c34f16ab023d1d1e235451b55404731190c
## What changed
- Display `Blocked` goal statuses as “stalled” in the goal menu and goal status footer.
- Update the goal menu snapshot and footer formatting test expectations.
GitOrigin-RevId: f3d8212d939f0d76354048231346328972226274
## What changed
- Preserve the original title when importing an external-agent session and return it with successful session entries from `externalAgentConfig/import/readHistories`.
- Add dedicated history-record success types so externally completed imports can optionally supply a session title without changing the live import result type.
## Testing
- Verify imported session titles are returned by the app server and persisted when session import ledger entries are created or refreshed.
GitOrigin-RevId: e896688a5763c238f1e1dc8b4672a7aa7bc1ed4c
## What changed
- Add nullable `installedAt` metadata to `PluginSummary` and its generated schemas, expressed as a Unix timestamp in seconds.
- Preserve the backend installation time for remote plugins across plugin list, installed, read, and share-list responses. Return `null` when the timestamp is unavailable, including for local or uninstalled plugins and older backend responses.
## Testing
- Cover timestamp conversion in the remote plugin list integration test and the field's serialization and backward-compatible default in protocol tests.
GitOrigin-RevId: 8a1640320adb298874e1074e9891d1017ad06937
## What changed
- Store `ServerNotification` and `ServerRequest` payloads behind `Box` in
`AppServerEvent`, `InProcessServerEvent`, and TUI `ThreadBufferedEvent` values.
- Update app-server delivery, TUI routing and replay, exec, onboarding, and tests
to borrow or consume the boxed payloads as appropriate.
GitOrigin-RevId: 7d0dab9aba47487114128ce55c914af5bb46c5b5
## What changed
- Add nullable `disabledReason` and `eligiblePlanTypes` fields to v2
`PluginSummary` responses and generated schemas.
- Preserve the remote catalog values across discovered, installed, and cached
plugin summary paths while returning `null` for local plugins and older
remote responses.
- Treat unrecognized disabled reasons as `unknown` for forward compatibility.
## Testing
- Cover protocol round trips, remote summary propagation, unknown disabled
reasons, and app-server responses for admin-disabled and plan-ineligible
plugins.
GitOrigin-RevId: 657a7ea6f838a6ff8bd1769ebcca0f3432684437
## Why
Announcement prewarming disabled proxy discovery to avoid the macOS sandbox
panic fixed by https://github.com/openai/codex/pull/16670.
## What changed
- Fetch announcement tips asynchronously with `RouteAwareClientPool` instead
of a blocking `reqwest` client.
- Pass the configured `HttpClientFactory` into prewarming so announcement
requests honor the configured outbound proxy policy.
GitOrigin-RevId: 535158d95a99c6f515bd30ea6e3bcb2ac6bb6d7e
## Why
TUI update checks and local OSS provider detection constructed their own HTTP
clients instead of using Codex's shared client behavior.
## What changed
- Route update requests through the configured route-aware client pool while
retaining the existing default headers and custom CA fallback.
- Probe the hardcoded LM Studio and Ollama loopback endpoints with a shared
direct client and a per-request timeout.
- Limit the legacy invalid-custom-CA fallback to the default routing policy so
system-proxy routing still reports certificate configuration errors.
## Testing
Add coverage for local provider probes with invalid `CODEX_CA_CERTIFICATE` and
`SSL_CERT_FILE` values, and for custom CA fallback under both routing policies.
GitOrigin-RevId: b5c230b61e8964b3f1af3395052361ff716d6ce1
## What changed
- Recognize `self_serve_business_prolite` across authentication, account and rate-limit APIs, generated schemas, workspace classification, status display, cloud configuration gating, and usage-limit messaging.
- Keep the Python SDK's `PlanType` enum compatible with non-empty string values introduced by newer Codex runtimes while preserving its known constants.
## Testing
- Cover token parsing, account reads and notifications, backend rate-limit mapping, workspace behavior, error formatting, and Python SDK response coercion for the new plan value.
GitOrigin-RevId: 70bc17a7c4ba4028cb10e4333cc1f2ac64da361f
## What changed
- Replace the `isPinned` thread metadata and filters with an optional persisted
`section` and `sectionId`.
- Add the paginated `threadSection/list` app-server method so clients can
discover sections even when they contain no threads.
- Seed a stable `Pinned` section, validate section assignments, and support
filtering for a specific section or for unsectioned threads.
## Testing
- Cover section protocol serialization, listing and pagination, metadata
updates, filtering, persistence, migration compatibility, and operation
without SQLite state.
GitOrigin-RevId: 7972b5471d29317b9387bfd90aa9f573f691ad4c
## What changed
- Update the `rmcp` model and transport integrations for `3.0.0-beta.3`.
- Preserve legacy `elicitation/create` form requests, schema defaults, metadata, and wire-format compatibility while adopting the new elicitation types.
- Harden OAuth discovery by using GET-first discovery without starting an MCP session, preventing cross-origin header redirects, validating authorization-server and callback issuers, and retaining compatibility with metadata that omits an issuer.
- Keep stored OAuth credentials readable and avoid requiring reauthorization after transient refresh failures.
## Testing
- Add coverage for legacy elicitation round trips, OAuth discovery variants, callback issuer validation, credential migration, and refresh failures.
GitOrigin-RevId: 756197d26f3fd347c28c400228f6b3d06ed493b7
## Why
Opening the subagent picker could wait on thread metadata and live event-store locks, delaying terminal input. Its cached entries could also omit descendants that were not observed in the current TUI session.
## What changed
- Render the picker immediately from cached navigation state and refresh root descendants asynchronously with `thread/list`.
- Merge discovered descendants into an open picker while preserving its selection and live status, and coalesce concurrent refresh requests.
- Ignore refresh responses from a previous session and avoid blocking on busy event stores.
## Testing
- Extend session lifecycle coverage for nonblocking picker opens, refresh coalescing, descendant discovery, selection preservation, and status updates.
- Add coverage for rejecting a refresh response after navigation state is cleared.
GitOrigin-RevId: 7eae7f696f8d2d323a47b3fd2800ea1c1cdbf2a0
## Why
Refreshing the terminal palette on a focus event can block the input loop and
discard keystrokes entered while focus is returning.
## What changed
- Keep the palette cached by the startup probe when handling `FocusGained`.
- Continue updating focus state and requesting a redraw without issuing new
foreground or background color queries.
## Testing
- Verify a queued key is delivered after `FocusGained`.
- Exercise focus regain in a pseudo-terminal with immediate and delayed input,
and verify it emits no additional palette queries.
GitOrigin-RevId: 16e26f81c1343d01f6d0baeff3f204bcc91dd6f3
## What changed
Only collect buffered requests from inactive threads whose event store reports
pending user input or approval. This keeps unrelated requests from being
considered when pending interactions are surfaced after leaving a side
conversation.
## Testing
Extend the side-conversation routing test with an unrelated dynamic tool request
and verify that only the pending subagent approval is selected.
GitOrigin-RevId: 388968277bde34bedc43187c1d1746d76166131e
## Why
When rebuilding a thread from rollout events, errors embedded in turn completion
events were ignored. Failed retries could therefore be restored as completed
turns, causing warnings such as model-overload errors to disappear from the TUI
transcript.
## What changed
- Mark turns with terminal completion errors as failed and retain their message
and structured error information.
- Apply late completion errors to their matching historical turn without
interrupting the active turn.
## Testing
Added history-builder coverage for current and late completion errors, plus a
TUI replay snapshot covering repeated overload failures.
GitOrigin-RevId: 5c474baa0fd5c73368b444d79fb850cbd4c8023a
## What changed
- Stack action descriptions below their labels when the keymap action menu is too narrow for a readable description column.
- Keep descriptions column-aligned at wider terminal widths.
- Show a dash instead of a number beside the disabled remove-binding action.
## Testing
- Add snapshot coverage for the action menu at 48, 64, and 96 columns.
GitOrigin-RevId: 25b97fd2d8764563e0a0c36d436711f2429093c4
## What changed
- Restart file search whenever a unified mention popup opens so restored or repeated queries receive results instead of inheriting stale search state.
- Cache the popup's filtered rows and refresh them when the query, file matches, search mode, skills, or plugins change.
## Testing
- Add regression tests for bare, reopened, and restored unified mention searches.
GitOrigin-RevId: 9d38438fade01a0552e03cb05e023ee64af60a4c
## What changed
- Add nullable `canPublishToWorkspace` metadata to plugin share contexts and `plugin/share/save` responses.
- Preserve the remote capability through catalog parsing and app-server responses so clients can decide whether to offer workspace-directory publishing.
- Document that clients should fail closed when the capability is unavailable.
## Testing
- Cover remote catalog parsing, share-save response propagation, and protocol serialization.
GitOrigin-RevId: b0346b3b330169838f800dfdf21dfa5db1a47f4d
## What changed
- Parse the `browser_use.disable_auto_review` setting from layered
`requirements.toml` configuration.
- Return the setting as `browserUse.disableAutoReview` from
`configRequirements/read` and publish it in the generated JSON and TypeScript
schemas.
## Testing
- Add an app-server RPC test covering the Browser Use requirement.
GitOrigin-RevId: 5749d5bc17bcc5b582bf7ed59b8e5b72d6c8f7fc
## What changed
- Add optional `plugin_id` and `script_path` fields to execution approval and guardian assessment events.
- Propagate validated plugin attribution through delegated approvals, guardian-reviewed command items, app-server notifications, thread history, and rollout traces.
- Preserve attribution on both started and completed command items, including declined commands.
## Testing
- Extend core, app-server, thread-history, and rollout-trace tests to cover plugin attribution propagation and serialization.
GitOrigin-RevId: 723684d010cab04142918d7a95e06ed95d008da1
## Why
Reporting key event types can leak an exit-shortcut release into the parent
shell in iTerm2 and can cause tmux's `xterm` extended-key format to lose
Shift+Enter.
## What changed
- Select keyboard enhancement flags using the detected terminal and tmux
extended-key format.
- Disable event-type reporting for iTerm2 and tmux's `xterm` format while
retaining alternate-key reporting.
- Preserve event-type reporting for other terminals and tmux's `csi-u`
format so repeat events remain distinguishable.
## Testing
Added unit coverage for iTerm2, Kitty, unknown terminals, and both tmux
extended-key formats.
GitOrigin-RevId: 03a6b9d5443f626da5279413a14933af2a0ec3e5
## What changed
- Resolve shell and unified-exec commands against the trusted plugin roots loaded for each turn.
- Add optional `pluginId` and safe plugin-relative `scriptPath` fields to command execution items and legacy execution events, and propagate them through app-server notifications.
- Include the attribution in command execution analytics while rejecting absolute, unsafe, and unattributed script paths.
## Testing
- Cover attribution for cached curated and remote plugin scripts from command execution through core and app-server events.
- Verify analytics serialization and unsafe-path filtering.
GitOrigin-RevId: 02fac3a233284ccfc6642fa502a95f1881dba83d
## What changed
- Add nullable `iconSmallUrl` and `iconLargeUrl` fields to the v2
`SkillInterface` protocol and generated schemas.
- Populate the fields from remote plugin catalog metadata while returning null
values for local skill interfaces.
- Document the new `plugin/read` response fields.
## Testing
- Extend the remote `plugin/read` test to verify both icon URLs are returned.
GitOrigin-RevId: 0a631a0121627d944a84e542728a506823ff2738
## What changed
- Add a configurable `toggle_side_conversation` TUI action, bound to `ctrl-/` by default, to switch between a side conversation and its parent without closing either.
- Show the active binding in the footer and distinguish switching from closing with `ctrl-c`.
- Allow starting a replacement side conversation from the parent, while cleaning up the previous side thread and preserving it if cleanup fails.
- Clean up retained side conversations when shutting down the current thread.
## Testing
- Cover shortcut remapping, conflicts, and compatibility with existing `ctrl-/` and `ctrl-7` bindings.
- Cover side-thread replacement and footer states for both the parent and side conversation.
GitOrigin-RevId: a621c21e1c45ba73197d59750b2e05efa5ee1081
## What changed
- Dispatch app-server turn interrupts in the background so the TUI can keep
processing thread events while an interrupt is pending.
- Coalesce repeated interrupt requests for the same active turn and clear the
pending state when the turn completes or the thread closes.
- Preserve the retry for stale active-turn IDs, surface interrupt failures as
warning notifications instead of exiting the TUI, and reset backtrack state
whenever an interrupt is handled.
## Testing
- Add an app-server integration test covering nonblocking event handling,
repeated-request coalescing, and pending-state cleanup.
- Verify that interrupting without an active turn clears backtrack state.
GitOrigin-RevId: 9ada247a739e2e0a63b425f75ebd6d054167d825
## Why
The TUI must inspect the default execution environment before loading its final
configuration. Initializing the environment manager at that point can give
startup services the bootstrap HTTP policy instead of the effective policy after
managed requirements are applied.
## What changed
- Split environment discovery from manager construction so callers can inspect
the default environment without starting remote connections.
- Build the environment manager after final configuration loading and pass its
resolved `HttpClientFactory` through all construction paths.
- Add shared test support for managers that use the legacy default HTTP policy.
## Testing
- Cover connection-free environment discovery and explicit HTTP policy
propagation.
- Verify TUI startup services use the final managed `respect_system_proxy` value.
GitOrigin-RevId: 928fa31e6b4bcfbe1a121cade2f351427fdfa0f4
## Why
Codex and SQLite data can use separate home directories, but state consumers
could reconstruct database paths from the Codex home instead of consistently
using the resolved SQLite configuration.
## What changed
- Pass `SqliteConfig` through the core, rollout, state runtime, and thread store
instead of passing a directory and rebuilding the configuration downstream.
- Use that shared configuration for state, logs, memories, goals, and paginated
thread-history database access, including integrity checks and cleanup.
- Reject state database handles whose SQLite configuration does not match the
requesting store.
## Testing
Add coverage with separate Codex and SQLite homes that verifies startup
backfill, thread listing, and paginated history all use the configured SQLite
directory.
GitOrigin-RevId: 1de1cdd1d6ff1d70bbb6c360c8352e6543fb8ebf
## What changed
Remove `first_party_type` from connector app metadata and the app-server v2
protocol. Update metadata conversion and merge paths, generated JSON and
TypeScript schemas, and affected test fixtures to match.
GitOrigin-RevId: 3f2e56eca68352360d8c0d99d48486ae65d664c1
## What changed
- Add `isPinned` to thread responses and allow `thread/metadata/update` to pin or unpin stored threads.
- Add an `isPinned` filter to `thread/list`, including cursor-based pagination and combinations with relationship filters.
- Persist pin state in SQLite without modifying rollout files, default existing threads to unpinned, and preserve pins through reconciliation and archive transitions.
## Testing
- Cover protocol serialization, database migration and indexing, pin updates, filtered pagination, rollout reconciliation, and archive/unarchive behavior.
GitOrigin-RevId: c2eacabd6dae465e2ae6ce8a169e00740960cdb7
## What changed
- Add `SqliteConfig` to own the resolved SQLite home, runtime database paths,
and shared read/write and read-only pool settings.
- Pass the configuration through state and local thread-store consumers,
replacing standalone path helpers and duplicated connection setup.
GitOrigin-RevId: 7351b08da94b5c8b6c0bbe492f86aeeca0699d3c
## Why
Very long individual lines can make syntax highlighting consume excessive CPU or memory even when the overall input remains below the existing size and line-count limits.
## What changed
- Fall back to plain, unstyled text when any input line exceeds 4 KiB.
- Keep the existing 512 KiB total-size and 10,000-line guardrails.
## Testing
- Cover highlighting fallback and text preservation for a long single-line Bash command.
- Snapshot rendering of a command that exceeds the per-line limit.
GitOrigin-RevId: ba02997331a294d8a32ca89ee06acb12dd3bbd83
Felipe Coury