## What changed
- Retain mention targets, image paths, and collapsed paste contents when copying or deleting into the register. Pasting creates fresh element identities and image/paste labels.
- Preserve rich register contents across draft clears and composer replacement.
- Capture `Ctrl+Y` register contents for dot-repeat, restore exact mention bindings through undo/redo, and keep pasted rich objects atomic in Replace mode.
## Testing
Add composer tests and snapshots for repeated rich pastes, register handoff, undo/redo, Replace-mode Backspace, and selection replacement. Add a test ensuring register contents are omitted from debug output.
GitOrigin-RevId: d543d21fd542492af49cce01c2a673e6d3d01664
## Why
Terminals that do not answer the default-color probe lose the background shading on submitted prompts.
## What changed
Use an ANSI `DarkGray` background as a fallback. Keep the default text foreground when the background's RGB value is unknown, and preserve the red voice marker in terminal history and transcript selections.
## Testing
Add regression coverage for prompt shading without a terminal palette, voice marker colors under both history wrapping policies, and spoken-prompt selection contrast in compact and detailed transcripts.
GitOrigin-RevId: b8217a2ee1d37a2ea4a011faa75427c881202b82
## What changed
Add selectable `profile` and `provider` items to the TUI status line, including setup previews and theme colors. Render them as `profile: <name>` and `provider: <id>`, omitting the profile when unset and the provider until a thread is active. Accept `model-provider` as an alias for `provider`.
## Testing
Extend status line tests to cover omitted values, the active thread's provider, provider updates, and a selected profile. Update the setup popup snapshot to include both items.
GitOrigin-RevId: e7cbb7fb1e7017cfbd6ee71e1df7d0ddb1836ed4
## Why
Copying in a WSL SSH session with X11 forwarding should use the forwarded display's clipboard instead of writing to the Windows host clipboard.
## What changed
Treat a nonempty `DISPLAY` in an SSH session as X11 forwarding and bypass the Windows clipboard backend on WSL. Keep terminal clipboard forwarding in place.
## Testing
Add a regression test that verifies a WSL SSH session with X11 forwarding uses the native clipboard without invoking the Windows clipboard backend.
GitOrigin-RevId: 29f98dc39e5851d63d0459a55e234346167da26f
## Why
Restoring killed text should restore its local image attachments along with their placeholders.
## What changed
Keep image paths in the composer's kill buffer, including across composer replacement, and restore attachments with fresh labels when text is pasted back. Preserve plain-text insertion in Vim Replace mode so per-character recovery continues to work.
## Testing
Add regression coverage for restoring images after submission, transferring the kill buffer between composers, and preserving existing images and Backspace recovery in Vim Replace mode.
GitOrigin-RevId: 9bc052a1b372d5a1245ddc54c7ffafee4a637494
## What changed
Recognize `\%` as a literal `%` in inline and display math, so expressions such as `$3.8\%$` render as `3.8%`.
## Testing
Extend inline and display math snapshots to cover escaped percent signs, including an inline expression with multiplication and a fraction.
GitOrigin-RevId: a0f9935dc8492fe1cd5a0d33d62930c48c5433b8
## What changed
- Recognize `policy_capacity_unavailable` in HTTP and streaming API errors and expose it as `policyCapacityUnavailable` through the app-server protocol and generated bindings.
- Display “Policy-restricted capacity is unavailable. Please try again later.” while preserving overload retry behavior based on `Retry-After`.
- Handle the new error in TUI overload rendering, reviewer retries, and error telemetry.
## Testing
Add coverage for HTTP and streaming error classification, retry advice, WebSocket terminal error attribution, protocol serialization, and TUI rendering with and without an upstream message.
GitOrigin-RevId: 1b9536fba1e11cc891dcf689aee35410d82f5412
## What changed
- Stack integral limits above and below the integral in top-level display math, while keeping compact limits in lists and blockquotes.
- Render `pmatrix` environments with centered cells and scalable Unicode parentheses, aligning surrounding math to the matrix midpoint.
- Require spatial layouts, including single-row matrices, to fit the available width; preserve the source when they cannot fit or appear in nested Markdown.
## Testing
Add snapshots for integral limits and matrices, narrow-width fallback assertions, and rejection tests for ragged matrices and mismatched environment endings.
GitOrigin-RevId: 73b589c4422568b90d15f55bf7c9dddec0dccc97
## Why
Terminal reports still in flight when Codex exits can leak into the parent shell's input.
## What changed
Pause terminal event polling during shutdown and flush pending input before restoring normal terminal input mode. On Unix, use a primary device attributes (DA1) reply to wait for outstanding reports after disabling reporting, with a two-second timeout when startup detected DA1 support. During panic unwinding, flush queued input without locking the event reader.
## Testing
Extend PTY tests to cover mouse-report bursts with a split DA1 reply, clean shell input after exit, and queued input cleanup during panic unwinding.
GitOrigin-RevId: 304859b654fb2b2c8882e6cac4cb6522fe05475c
## What changed
- Replace Rust `1.99.1` pins with `1.95.0` across Cargo, Bazel, CI, release workflows, and Windows setup, and update the Bazel lockfile.
- Adjust Rust APIs, borrowing, and lint-related code for the pinned toolchain, and box MCP tool dispatch to bound compiler async-layout query depth.
- Update the halfwidth sound mark snapshot and allow optional symbol hash suffixes in the code mode host package smoke test.
GitOrigin-RevId: 75460c3d0465dc601811e619bce373a4f7ff2912
## What changed
- Return the selected workspace's display name as `workspaceName` in ChatGPT account responses, caching it alongside workspace routing and updating generated schemas and bindings.
- Display a `ChatGPT workspace` row with the name and account ID, falling back to the ID when the name is unavailable or invalid. Refresh workspace details with account identity updates and hide the row for providers that do not use ChatGPT authentication.
## Testing
Update account-response tests to cover workspace names and null values, add workspace details to the status snapshot, and verify that switching to a custom API-key provider hides the workspace row.
GitOrigin-RevId: 4b30ab8a39e1fa7ad1ba7367c5295544be8f6001
## What changed
- Show selectable safer follow-ups alongside safety-block explanations, with an option to enable Daybreak when disabled.
- Submit the selected rewrite in a verified fork before the blocked turn, preserving the original chat's draft and current model settings. Mark the new turn with `safety_recourse_follow_up`.
- Filter suggestions that could invoke commands, skills, apps, or plugins, and suppress recourse for unsupported servers and non-primary threads.
## Testing
Extend coverage for fork history, draft preservation, model selection, turn metadata, suggestion filtering, and the Daybreak picker.
GitOrigin-RevId: 49052df6301b6bfbba07262d40b007dcf97bb7c9
## What changed
- Handle `TurnModerationMetadata` for the active turn, showing a temporary block notice while an explanation is pending.
- Validate safety recourse metadata and render topic-specific explanations with safer ways to continue for biological and cybersecurity policy blocks. Apply the explanation only when the terminal policy error matches its domain; otherwise retain the existing error handling.
- Queue input while recourse is pending and preserve prepared images when queued messages are submitted.
## Testing
Add an integration test covering biological and cybersecurity blocks, the loading notice, and fallback for a mismatched policy error, plus a snapshot of the cybersecurity explanation. Extend queued-image coverage to verify submission succeeds after the original image file is removed.
GitOrigin-RevId: dd9ca57cf3b2d842e3deb8aff5d7c3c73a92e14d
## What changed
Split saved-thread resume into preparation and activation. Preparation resolves configuration and attaches to the destination thread before activation replaces the displayed conversation.
Keep stored-backend configuration and local settings separate from active settings during preparation, while retaining the existing eager settings refresh for active-backend resumes. Use the destination backend for working-directory, permission, and directory-trust checks.
Carry the backend identity in the prepared result and reject activation through a different backend before changing the active conversation or composer.
## Testing
Extend coverage for preserving active settings and composer drafts during preparation, rejecting activation through another backend, applying destination remote-permission checks, and retaining active-backend settings refresh behavior.
GitOrigin-RevId: 7171f1abcf4bdd62793c21232a8b895bb809cf70
## Why
A subagent failure ends its work without requiring user action, but the agent command center treated it as needing attention and promoted its parent task into the `Needs you` group.
## What changed
Classify failed subagents as inactive when computing task groups and selecting details. Recognize subagents by either a parent thread or a subagent session source, including background workers without a parent.
Keep approval and user-input requests from descendants actionable, even beneath a failed agent. Show these requests as `Needs input` rather than `Error` when the displayed task is a failed subagent. Errors in non-subagent tasks continue to require attention.
## Testing
Add and update regression tests and a snapshot covering stable ordering after subagent failures, idle parents staying ready, failed background workers, and pending requests beneath failed agents.
GitOrigin-RevId: 1a06d5d00c08bb77c9ed36aadffd5e0514f0b2c6
## What changed
- Add `gpt-6.1-terra` to the bundled catalog and GCP Vertex model picker.
- Add `openai.gpt-6.1-terra` to Amazon Bedrock catalogs, including Global and US cross-region runtime variants.
- Use `gpt-6.1-terra` as GCP's preferred memory consolidation model.
## Testing
Extend catalog, model picker, thread startup, and Vertex request tests to cover GPT-6.1 Terra.
GitOrigin-RevId: edb3be3c4286c191349cdee742005ed3c67029e8
## Why
Async question replies appeared as plain user text, leaving Markdown formatting literal and repeating the full question above each answer.
## What changed
- Accent question titles with a `?` prefix while preserving Markdown in titles and suggestions.
- Render replies with a `↪ Re:` question caption and a Markdown answer. Limit captions to two rows with an ellipsis on overflow, while keeping answers complete.
- Apply the same rendering to live messages and loaded transcripts, preserving inline styles, hyperlinks, and Markdown when copying selections.
## Testing
Add snapshots and assertions for matching live and loaded transcript rendering, plus tests for caption clipping, hyperlink bounds, Markdown copying, partial selections, and whitespace-only or nonprinting answers.
GitOrigin-RevId: 0290d8a2ebfb42bd5d7374c7037cde5ae8a13b5d
## What changed
Replace `UserHistoryCell`'s `spoken` boolean with `UserMessagePresentation`, defaulting to `Plain` and using `Spoken` for speech transcripts. Route rendering checks through `is_spoken()`, preserving the existing prompt styling and whitespace handling.
GitOrigin-RevId: d0683a2b536a7d71f68fd9a089e6839d0ab0cc65
## What changed
Accept `[network_proxy]` in `requirements.toml`, retaining `[experimental_network]` as a compatibility alias. Reject both names in a single layer and normalize them before merging across layers so precedence and source tracking are preserved.
Honor the new spelling during credential broker project discovery, display `network_proxy` in debug configuration, and update diagnostics and documentation. Document the distinction between managed requirements, proxy feature configuration, and permission profiles. Policy publishers must keep using `[experimental_network]` until all clients and policy validation layers support the new spelling.
## Testing
Add coverage for alias equivalence, duplicate rejection, cross-layer precedence and sources, and broker project discovery. Exercise both spellings in proxy configuration, network approval routing, app-server requirements responses, and Windows machine policy validation.
GitOrigin-RevId: 5c5bb82bd4b6b1431aa97f27248775820eae6302
## Why
Mouse capture prevents the terminal from handling link-opening gestures in expanded questions.
## What changed
Disable mouse capture while questions are expanded and the TUI owns the screen, unless an interactive modal is active. Restore the default capture policy when questions collapse.
## Testing
Add a regression test covering expansion, collapse, non-owned screens, and link visibility with warnings open.
GitOrigin-RevId: 1fd37feb5c9cd374b492218eeef8c80316bb1cf9
## What changed
Replace screen-specific `OverlayInput` variants with `MouseCapture::{Inherit, Enabled, Disabled}` and rename the setter to `set_mouse_capture`.
Preserve existing capture behavior: transcript and usage overlays enable capture, onboarding and static pagers disable it, and the inherited policy follows screen ownership. Update the alternate-screen and lifecycle tests to use the new policy.
GitOrigin-RevId: 965a3bb6d0854e289d2b0dbeedbf2b252b98293d
Compact token counts can round to `1000K`, `1000M`, or `1000B` near unit boundaries. Promote these values to the next suffix so, for example, `999,500` tokens displays as `1M` instead of `1000K`.
GitOrigin-RevId: 803e7c8c8eebd61522fb717275b43904a5da056f
## Why
Remote App Server sessions support the command center, but the empty-prompt Left shortcut and its footer hint were enabled only for local daemon sessions.
## What changed
Enable the shortcut and `← for agents` hint for remote sessions. Centralize command center availability in `AppServerTarget::supports_command_center()` and use it consistently across navigation, lifecycle handling, trust prompts, and command center actions. Embedded sessions keep command center support disabled.
## Testing
Extend navigation coverage to verify the footer hint and opening the agents overview for both local daemon and remote sessions, while keeping navigation disabled for embedded sessions. Add a remote-session footer snapshot and update related UI tests to use the shared capability flag.
GitOrigin-RevId: 8148812217f68cf0fd441c35ed3c5b466ecc9cbd
## What changed
- Allow selecting warning text while preserving wrapped URLs and hard line breaks when copying.
- Add mouse-wheel scrolling within the warning body and keep page navigation working after selection.
- Use the shared menu surface and show configured scroll hints only for directions with more content.
- Preserve painted backgrounds when rendering text selections.
## Testing
Add coverage for warning selection without changing the draft, paging after selection, wheel scrolling and directional hints, and selection boundaries in scrolled text containing tabs and wrapped words. Update warning panel snapshots.
GitOrigin-RevId: c4b77277a60b7b4af92043cb3761769ddc636454
## What changed
Emit `codex.tui.embedded_start` when the TUI successfully connects to an embedded app server, with a `reason` tag identifying daemon exclusions, disabled auto-start, failed daemon connections, or agent startup without a discovered daemon.
Distinguish `--search` from other configuration overrides when it is the only configuration exclusion preventing daemon use.
GitOrigin-RevId: b837ad2e83af17ea92392ffa6d5f91108ceaeecc
## Why
Cloud conversations own their execution settings and workspace. TUI requests must preserve those settings instead of overriding them with local configuration.
## What changed
- Add a distinct cloud parameter mode that omits local execution settings from thread start, resume, and turn requests, including misalignment continuations.
- Route cloud model and reasoning selections through `thread/settings/update`, requiring server acceptance rather than falling back to local changes or saved defaults.
- Use server model defaults and tolerate an unavailable `configRequirements/read` method during cloud bootstrap.
- Skip local tool setup and TUI-generated titles, and report that permission selection, forking, and conversation recaps are unavailable for cloud conversations.
## Testing
Add regression coverage for cloud request parameters, bootstrap without configuration requirements, rejected model changes, and suppression of unsupported requests.
GitOrigin-RevId: a2dafb6c8a6b0db8607575e2291fee739c2fb2b1
## What changed
- Make the `fast-mode` status line and terminal title items show the current model's processing tier name, falling back to `Standard`, instead of `Fast on` or `Fast off`.
- Share tier label resolution with `model-with-reasoning`, including `Flex` for configured providers other than Amazon Bedrock, and remove the ChatGPT account requirement for displaying tier names.
- Refresh model-dependent surfaces when Fast or Ultrafast mode is enabled or disabled.
## Testing
Update status surface tests and snapshots to cover tier selection, feature toggles, model changes, and provider-specific `Flex` fallback behavior.
GitOrigin-RevId: 7d67ae6177bb1b3c0be4ecf0910106aaaf2bd0be
## Why
Async question titles support Markdown, but named choices display Markdown syntax as plain text.
## What changed
Render named choices with Markdown styling and terminal hyperlinks, wrapping them to the available width after the numbered prefix. Use the rendered rows for height measurement and scrolling, and reuse layout measurements for the option tip.
Share viewport-aware Markdown rendering between question titles and choices, preserving hyperlink destinations when splitting overwide tokens.
## Testing
Extend tests to cover Markdown-aware height measurement, italic styling, and terminal hyperlinks in selected choices. Update the long-choice snapshot to show text starting beside its numbered prefix.
GitOrigin-RevId: 7a1292ac7dff16b55439888d569fc7fa7c6ef689
## Why
ENT26 plans are billed directly in dollars, so credit estimates and credit-weighted breakdowns do not describe their thread usage.
## What changed
- Expose optional `nativeUsageUsdMicros` in app-server `ThreadUsage` responses and generated schemas and SDK types. Missing native usage means unknown, not zero.
- Enable ENT26 usage fetching and display native dollar amounts in `/status`, the status line, terminal titles, and the agents overview. Hide credits and omit credit-weighted `/status` breakdowns for these plans.
- Use native dollar amounts when tracking post-turn usage settlement for ENT26 plans.
## Testing
Add coverage for native usage forwarding, ENT26 billing displays, and settlement polling with stale, missing, or zero dollar amounts.
GitOrigin-RevId: ca8ea98141a66bdf0a27feb9f58f67822b821f5f
Run the deferred paste newline and standalone Enter handoff tests with
`start_paused = true` so their timing uses Tokio's paused clock.
GitOrigin-RevId: d903c0e1078b81531912e54819499b0c3a0fb307
## What changed
Add `codex queue --resume` to resume an unloaded thread after queueing a message through the local daemon or selected `--remote` server. Already loaded threads are left running. If resumption fails, emit a warning while preserving the successful queue result.
Read only the thread status when checking whether to resume, allowing remote metadata to contain paths from another operating system.
## Testing
Extend CLI integration coverage for unloaded threads consuming queued messages, archived thread rejection, and successful queueing when another server owns the thread and rejects resumption.
GitOrigin-RevId: cc8aa3c11a37e990da36e6ff9a17934f73322e7b
## Why
NFS database migration rejected files with group or other access. Allow accessible databases to migrate while making the effects on file access explicit.
## What changed
- Preserve file mode bits during migration while requiring owner read and write permissions on replacement files.
- Before CLI consent, disclose that replacements belong to the current user and do not copy the original owner, group, or extended ACLs. Require explicit confirmation for files with permissions other than `0600`.
- Warn at Linux TUI startup when NFS databases need migration and permission confirmation. Inspect journal mode without accessing WAL shared memory or releasing another connection's locks.
- Allow five seconds to acquire the exclusive database lock during migration.
## Testing
Add CLI coverage for consent, access disclosures, and migration of `0644` files. Extend state tests for permission preservation, rejection of missing owner access, and interrupted migration recovery; snapshot the startup warning.
GitOrigin-RevId: 2d9c3663172c3e631a787dc1dc76db95c39e6aa1
## Why
Existing databases retain their journal mode, so selecting `DELETE` for new NFS databases leaves existing WAL databases unchanged.
## What changed
- Add the managed `unsafe_enforce_sqlite_journal_mode` requirement to migrate existing NFS databases before opening writable pools and require `DELETE` on each connection.
- Share migration code between startup and `codex migrate-nfs-db`, preserving WAL backups and resuming interrupted replacements, including lazily opened databases.
- Hold the migration lock through pool initialization and keep migration failures out of automatic corruption recovery.
- Preserve local logs behavior and skip legacy NFS logs cleanup when enforcement is enabled.
## Testing
Add coverage for requirement precedence, database settings, data and backup preservation across restarts, interrupted replacement recovery, refusal of active WAL databases, migration lock waiting, and local logs remaining in WAL mode.
GitOrigin-RevId: da41ec1b58b1ee8092591cdf8b358280928ff9d4
## Why
Leaving transcript selection with a held key can send repeated input to the composer and submit a preserved draft.
## What changed
- Route the transcript selection shortcut and selection controls in both the owned transcript and transcript overlay, preserving drafts and ignoring pastes outside search.
- Give fixed selection controls and pager motions precedence over conflicting key chords while allowing search and voice controls.
- Consume held exit keys across selection dismissal and asynchronous copy completion, and require fresh presses for composer submit and queue actions.
- Initialize overlay selection against the refreshed transcript frame and complete selection navigation when older history finishes loading.
## Testing
Add regression coverage for draft preservation, repeated `Enter` events, selection and search key precedence, refreshed-frame selection, and pending copy exit-key cleanup.
GitOrigin-RevId: 6cca9f399af1d49ff79337ae745cfc1564a14b88
## What changed
- Add `tui.keymap.global.select_transcript` with an implicit `leader [` shortcut that follows the configured leader, respects explicit remapping or unbinding, and yields to existing bindings.
- Connect transcript overlays to keyboard selection, including Find, mouse selection, and navigation to the beginning of paged history. Give selection commands priority over remapped pager shortcuts.
- Close selection overlays on exit or after a confirmed copy-and-follow operation, preserving the pending close decision while clipboard confirmation is asynchronous.
- Show selection navigation and copy hints that adapt to the available footer width.
## Testing
Add coverage for shortcut dispatch, remapping, unbinding, and conflicts; overlay exit behavior; selection across history paging; mouse and keyboard selection interaction; and cursor and footer rendering snapshots.
GitOrigin-RevId: 8a920e5fa2b06ff0544d829ba30f8ecb654db0ee
## What changed
- Support `/` to open Find in selection mode and `Enter` to move the cursor to the match, extending an active selection.
- Repeat the accepted search from the cursor with `n` for older matches and `Shift+n` for newer matches. Cancel pending repeats when the cursor or selection changes.
- Restore the previous search, cursor, and selection when cancelling a new search, and reuse the previous search when accepting an empty query.
- Align the cursor to selectable graphemes and preserve expanded matches when leaving selection mode.
## Testing
Add regression coverage for search acceptance and cancellation, repeated searches, Unicode cursor placement, expanded output retention, and history pages loaded while a search is saved.
GitOrigin-RevId: 077be52a54d5e006f65eacc4634baf8c089d3662
## What changed
- Add word motions (`w`, `b`, `e`), logical line boundaries, page and half-page motions, and jumps to the transcript's beginning and end. Honor configured pager bindings for navigation.
- Add whole-line selection with `V` and active-end swapping with `o`.
- Adopt existing mouse selections when entering select mode, preserving selection units and endpoint bounds so keyboard motions can adjust the range.
## Testing
Add regression tests for word motion across entries, reverse whole-line selection, empty-line boundaries, configured pager motion, final-grapheme selection, endpoint swapping, and caret placement after copying.
GitOrigin-RevId: f0cd05900f2a7a15840777cee4d50659a2c8b134
## What changed
- Add a source coordinator that streams rows as backends reply, preserves each source's pagination cursor and listing mode, and rejects stale replies.
- Route previews, transcripts, archive, and restore requests to the selected row's backend.
- Keep healthy results visible when a source fails, and fall back from an empty or failed initial database listing per source.
- Cancel reads when the picker closes while allowing accepted mutations to finish.
The app-server picker now uses the coordinator with a single source.
## Testing
Add regression coverage for independent source replies, pagination and fallback, action ownership, stale replies, disconnected sources, and mutation completion after picker shutdown. Add a snapshot for the partial-backend failure warning.
GitOrigin-RevId: 1b565c680133d460f4a29c9946a8398e9c950773
## Why
The standalone Unix update pipeline could return success when `curl` failed because the shell consuming its output exited successfully.
## What changed
Download the installer into a shell variable and evaluate it only after a successful download, preserving `CODEX_NON_INTERACTIVE=1`. Update the displayed update command to match.
## Testing
Add a Unix regression test that forces an installer download failure and asserts a nonzero exit status. Update the update-available snapshot for the new command.
GitOrigin-RevId: cf6ce0dae483203e3609bb35f35eb04bb3096c28
## What changed
Omit zero-count actions and use singular or plural wording when summarizing skill changes. For example, show `Disabled 1 skill` instead of `0 skills enabled, 1 skills disabled`.
## Testing
Add a snapshot test covering enable-only, disable-only, mixed, and unchanged skill states, including no summary when nothing changes.
GitOrigin-RevId: ff68c799f29ceb8736e6941778d29a3f8d500b70
## What changed
- Use the managed configuration loader in CLI, exec, TUI, and app-server configuration flows so `requirements.toml` can select a config server.
- Sign in to the config server when needed during interactive TUI startup and CLI login, reload configuration after CLI sign-in, and clear config-server credentials on CLI logout.
- Preserve the app-server's config-server settings and refresh worker across OpenAI login and logout.
- Require config-server settings to be applied when loading CLI and doctor configuration.
## Testing
Add app-server integration tests using a local HTTPS config server to verify managed provider and instruction settings at startup, preservation across API-key login and logout, and cache reuse after restart and thread resume.
GitOrigin-RevId: 27ee81f7943d2290a5c3fcc0ac556579ec63f8b4
## What changed
- Add nullable `startedAtMs` and `completedAtMs` fields to `ThreadItem` in live notifications and turn history. Values are Unix milliseconds when recorded.
- Preserve recorded item times through history reconstruction, pagination, and resume, including command start times recorded during approval.
- Separate the Rust item payload into `ThreadItemPayload` while keeping the JSON payload flat, and update consumers, schemas, and generated TypeScript and Python types.
## Testing
Extend coverage for timestamp serialization, history reconstruction, paginated reads and resume, and persisted Python SDK items.
GitOrigin-RevId: ecbcee95af52db7c807b46a6e9deb30e5fba1f80
## What changed
- Rename ChatGPT-specific bundle loaders to `chatgpt_config_bundle_loader*` and use managed-config terminology for shared loader plumbing.
- Pass `Config` directly when updating the app-server's managed configuration loader.
- Share configuration loading, logging setup, and result handling between browser and device-code login.
- Expose the CLI cloud-config helpers and `provider_uses_first_party_auth_path` through their library APIs.
## Testing
Extend CLI login coverage to verify that `forced_login_method="api"` rejects both `login` and `login --device-auth` while preserving saved API-key credentials.
GitOrigin-RevId: 9e8fa6110dc80882ba365e550b48ac77da604940
## Why
Automatic marketplace update failures were only logged, leaving users without a visible startup warning.
## What changed
Send marketplace update errors and task startup failures through app-server warning notifications. Queue background warnings until a client initializes in both standalone and in-process servers, and centralize startup configuration warning delivery.
## Testing
Add a TUI integration test and snapshot covering two marketplace name mismatch failures, the warning count, and navigation between their details with `F2` and the arrow keys.
GitOrigin-RevId: af55a5555affd9d89ac15a546163daeaafd3b3e8
## Why
Listing hooks by working directory alone omits hooks supplied by a thread's selected execution environments, including hooks that can block a turn.
## What changed
- Add `threadId` to `hooks/list` to return a loaded thread's current hook inventory, including selected, ready environments. Reject requests that also specify `cwds`.
- Expose `environmentId` in hook metadata and have the TUI hooks browser query the current thread and label environment-owned hooks. Keep working-directory lookup for startup review.
- Represent environment hook source paths with `PathUri` and use `LegacyAppPathString` in hook run summaries to preserve native path conventions.
## Testing
Add coverage for listing a blocking environment hook and removing it after environment failure, delivering prompt input and reporting exit status in PowerShell and Bash, and running `PreToolUse` hooks only on the command's owning executor. Extend remote network tests to verify that environment hooks use the command's network policy while retaining their filesystem access.
GitOrigin-RevId: 97229e22793df51f4bd502c1f9e19f0c52fb2305
## What changed
- Add a thread catalog that tracks cursors, pending requests, and exhaustion per backend, preserves cursors on errors for retry, and rejects stale completions after a reset.
- Tag listed rows with their backend and use that backend when selecting a session.
- Store history mode on each row, preserving updates from later duplicate pages.
## Testing
Add coverage for independent source pagination, retry cursors, stale completions, and selection routing. Extend the history-mode test to verify that later metadata updates are used when resuming.
GitOrigin-RevId: ed5cf33b2df0e91394682f58ad5b353b949255ff
## Why
Fresh TUI sessions sent the locally resolved approval policy in `thread/start`, overriding the app server's configured default. Local constraints could also prevent the TUI from adopting the policy returned by the server.
## What changed
- Send explicit approval policy overrides at startup and otherwise let the server resolve the policy. Preserve the resolved-config behavior for selected profiles.
- Forward granular `approval_policy` overrides with their replacement and dotted-key merge semantics.
- Forward eligible projectless approval defaults only when allowed by the server's approval policy requirements.
- Accept the server's startup policy before submitting initial or queued input, including when local constraints would reject it.
## Testing
Extend startup tests to cover explicit override precedence, granular policy merging, projectless defaults, and use of the server's approval policy on the first turn.
GitOrigin-RevId: 995ce5f21b04b058d60c2ea80a139c0cf48c0e98
## What changed
- Add `attachToSource` to `thread/fork` to persist a fork attached to its source without emitting `thread/started`. Attached forks require local storage and cannot use `ephemeral` or `deferGoalContinuation`.
- Hide attached threads from ordinary listings and add `attachedToThreadId` to `thread/list` for explicit discovery, including empty threads. Keep this relationship separate from spawned-agent parent and ancestor filters.
- Persist attachment metadata in rollouts and SQLite so it survives restarts and database recovery. Reject source deletion until its attached threads are deleted.
## Testing
Add coverage for legacy and paginated history, restart and missing or corrupt database recovery, filtered listings and pagination, resume, conflicting options, and deletion safeguards across store instances.
GitOrigin-RevId: 589f3174fc36f6054e75d65818360695645a5913
## Why
The `Cwd` session filter included sessions from linked worktrees, leaving no way to restrict the picker to the current directory. Project grouping also combined tasks across linked worktrees.
## What changed
- Keep `Cwd` filtering and directory-scoped `resume --last` and `fork --last` lookups limited to the current directory.
- Add an explicit `Repo` picker filter when multiple local worktrees are available, including sessions from corresponding directories across linked worktrees. Cycle between `Cwd`, `Repo`, and `All` in either direction.
- Add `Directory` grouping to the agent command center alongside `Project`, `Status`, and `Model`. Keep this choice in memory without writing a configuration value older clients cannot read.
## Testing
Extend coverage for directory and repository filtering, pagination scope, linked-worktree grouping, directory aliases, grouping persistence, and adjacent selection after task removal. Update picker and command center snapshots.
GitOrigin-RevId: 59603c9c5136db43124102b3277d1d1dab36bb87
## Why
Consecutive user prompts in the rich transcript have extra blank spacing that breaks up their shared background.
## What changed
- Join adjacent visible user prompts into one background block, skipping hidden entries when determining adjacency.
- Keep prompts separated when intervening content becomes visible through detailed mode or search, and restore grouping when it is hidden again.
- Preserve selectable source offsets and joined spacing when text is rewrapped, and reuse cached layouts when checking adjacency.
## Testing
Add regression tests for prompt grouping, layout cache reuse, source offsets across rewrapping, detailed reasoning, and search-driven visibility. Update transcript snapshots to reflect the tighter spacing.
GitOrigin-RevId: faca8001244b0ac883d9d670864c8f7856ac2bad
Benjamin Carlsson