## What changed
- Open the agents overview with Left from an empty, focused composer in local-daemon sessions.
- Keep the shortcut inactive while editing text, using transient input surfaces, or when Left has been explicitly remapped.
- Show the contextual shortcut in the footer and shortcuts overlay.
- Leave the configurable `open_agents` action unbound by default instead of assigning `Alt+A`.
## Testing
- Add coverage for session eligibility, input-state guards, editor and Vim remaps, event dispatch, and footer rendering.
GitOrigin-RevId: ef17db3d9d09c3a08c3f7353c5b8a02f2b61c696
## What changed
- Reconnect out-of-process TUI sessions after the app-server transport drops, bootstrap a fresh client, and resume the active thread.
- Preserve cached transcripts, drafts, runtime settings, task-tool capabilities, and live notification routing across the new connection.
- Keep recovered or possibly submitted input paused for manual review instead of resending it, and leave conversations that cannot be resumed available as read-only cached views.
- Show reconnect progress and actionable failure states while still allowing drafts to be edited or copied.
## Testing
- Add app-level coverage for successful recovery, failed and unavailable resumes, input quarantine, and preserved session state.
- Extend the terminal integration test to verify that a draft survives reconnection, the thread is resumed without starting a turn, and notifications arrive through the replacement connection.
GitOrigin-RevId: 5dcb867c89e226a0c545d6313a77424c233cd47a
## Why
Streaming can temporarily hide the status row, but its elapsed time is still
needed when the row returns and when the final `Worked for` duration falls back
to the local clock. Approval prompts must also keep that clock paused.
## What changed
- Own the pause-aware status timer in the bottom pane independently of the
optional status row.
- Preserve elapsed time and modal pause state while hiding or restoring the row,
and reset the clock for new turns and Windows sandbox setup.
- Use the independent timer as the fallback for the final turn duration.
## Testing
Add timer unit coverage and TUI tests for hidden rows, outstanding approvals,
fallback turn durations, and fresh Windows sandbox setup clocks.
GitOrigin-RevId: a77931e465d5aedd4a8cd606a3a3117d1bb37ce7
## Why
Resumed threads need to continue per-turn and per-thread token totals without scanning arbitrarily far beyond the latest compaction checkpoint.
## What changed
- Add durable `TokenUsageRecord` rollout items with response, turn, thread, session, and root-turn attribution.
- Restore accumulated usage on resume and snapshot the latest record plus the compaction response ID in compaction checkpoints.
- Preserve root-turn lineage in persisted turn context, while ensuring forked child threads start with their own usage totals.
## Testing
- Cover usage accumulation across multiple responses and resumed turns.
- Cover local and remote compaction checkpoints, invalid remote compaction output, rollout reconstruction, and fork isolation.
GitOrigin-RevId: ef9e0c4a9102a08a2c382be4cdac68c84353c90a
## Why
Losing an external app-server connection can leave a submission's outcome uncertain. The TUI must preserve local work without retrying it or allowing stale server events to trigger more actions.
## What changed
- Enter an offline state when an external app-server transport disconnects during startup, event streaming, or submission.
- Keep conversation drafts, queued input, expanded pastes, attachments, and agent-overview input editable while blocking submissions, remote actions, and automatic queue replay.
- Show a connection-lost notice that directs users to copy their work and relaunch, while retaining `Ctrl-C` and an empty-composer `Ctrl-D` as quit shortcuts.
- Cancel pending views and asynchronous work, and ignore stale completions after the disconnect. Embedded app-server behavior is unchanged.
## Testing
Added unit, snapshot, and pseudo-terminal coverage for lost startup and mutation replies, offline draft editing, queued-input recovery, stale-event quarantine, agent-overview behavior, and end-to-end preservation without reconnection or resubmission.
GitOrigin-RevId: 7219a95fad676dda447d625db9e465345b469d58
## What changed
- Emit a separate history cell for each completed command instead of grouping
consecutive successes into a `Ran N commands` summary.
- Preserve `Explored` grouping for related file reads, searches, and listings.
- Replay completed commands as individual entries so their output and failure
status remain visible.
## Testing
- Update TUI tests and snapshots for live exploration and replayed commands.
GitOrigin-RevId: 7dafe0b7846fc89784093791a6be137a1b1ab8ff
## What changed
- Carry optional backend-owned banner and account identity data through
`account/rateLimits/read`, filtering banners that do not match the authenticated
account and user.
- Render supported rate-limit notices above the composer with actions for usage,
credits, resets, owner notifications, and plan management while preserving the
existing fallback UI for absent or unsupported banners.
- Refresh usage after limit errors, reject stale responses, and keep queued input
paused until recovery completes. When instructed by the banner, switch to the
first available fallback model without changing unrelated thread settings.
## Testing
- Add protocol, banner parsing and rendering, CTA, identity filtering, refresh
ordering, fallback-model, account-change, and queued-input recovery coverage.
GitOrigin-RevId: e03d75a82e425deb87f4b120a71cf2286c0ef6cc
## Why
Older JediTerm versions can print the space intermediate in `DECSCUSR`,
overwriting the glyph beneath a cursor-style command.
## What changed
- Apply cursor-style commands at a repairable, terminal-owned glyph and redraw
that glyph with its original style and hyperlink before restoring the requested
cursor position.
- Omit the style command when the viewport has no safe repair anchor.
- Handle skipped cells, wide glyphs, and single-column viewports without
corrupting content or causing scrolling.
## Testing
Add cursor rendering tests for styled and cursor-only frames, skipped and wide
hyperlinked glyphs, single-column viewports, and viewports without owned cells.
GitOrigin-RevId: c8bbb74c53737b5980c533859af39da26f0e06cc
## What changed
- Relocate Vim history-navigation tests alongside the history search implementation.
- Share the human-like typing test helper with the nested test module.
GitOrigin-RevId: e2d03a173d2f3b73cf9f0c30411284a47f623838
## What changed
- Add draft-local forward and backward literal search with `/` and `?`, plus
wrapped repeat navigation with `n` and `N`.
- Support search motions after delete, change, and yank operators, while keeping
queries separate from the draft and skipping atomic elements and partial
grapheme matches.
- Render and edit the query in the composer footer, highlight matches, and add
configurable `tui.keymap.vim_search` bindings to the keymap picker and schema.
## Testing
- Cover navigation, wrapping, operator composition, repeat behavior, Unicode
graphemes, atomic elements, query editing, paste handling, and rendering.
GitOrigin-RevId: 087b080ff8fd74e48456c6b899c07ea5eed38e0c
## Why
The `core` and `tui` Bazel targets treated nearly their entire crate trees as
compile-time data, mixing embedded runtime resources with source files and test
fixtures.
## What changed
- Move embedded resources for `core` and `tui` into dedicated `assets/`
directories and update their `include_str!` paths.
- Restrict Bazel compile data to explicit asset and frame directories.
- Move test-only prompts into `tests/fixtures`, resolve the core prompt through
`find_resource!`, and reuse the integration-test file glob when assembling
Bazel test data.
GitOrigin-RevId: eee9b0e41df77ea2604215a7f7333a6fe8317bfa
## Why
The model picker can open from a cached startup catalog that no longer reflects the models available to the current account.
## What changed
- Fetch the current model list asynchronously whenever the picker opens, while showing cached choices immediately.
- Refresh an open model picker in place, preserving its highlighted model, dismissal behavior, and reasoning submenu.
- Apply accepted catalog updates to model-dependent UI, service-tier controls, and new-thread defaults. Ignore stale, failed, empty, unchanged, or account-invalidated responses.
## Testing
- Added coverage for catalog refreshes, stale and unusable responses, popup state preservation, empty choices, service tiers, and new-thread defaults.
GitOrigin-RevId: 45abe1d309ff7f90701fffe29c6544ca4157f836
## What changed
- Advertise `openai/elicitation` form support when the client declares an
object-valued `form` capability, without deriving it from the legacy
`openai/form` capability.
- Handle `openai/elicitation/create` requests in `form` mode and forward their
metadata and opaque schema through app-server as `openaiForm`, preserving
`x-openai-*` annotations.
- Keep legacy form handling independent and have the TUI automatically decline
the new form requests it cannot render.
## Testing
- Add an app-server round-trip test for capability negotiation, request
forwarding, and accepted responses.
- Extend MCP capability filtering coverage for `openai/elicitation.form`.
GitOrigin-RevId: 88f39257bffafe4ee98a9c910e38507843cd7eeb
## What changed
- Lazily index items in larger thread-history turns so late updates can reuse
their positions after turn completion and rollback.
- Map reverse-history search matches back to Unicode byte ranges with a linear
scan.
- Preserve first-occurrence semantics for duplicate item IDs and Unicode match
boundaries.
## Testing
- Cover indexed duplicate updates before and after the indexing threshold.
- Cover retained-turn updates after rollback and Unicode history-search ranges.
GitOrigin-RevId: 3a9c819966d90d833c4183cf6523b6ea4f7be7e7
## What changed
- Add an optional `timeoutMs` parameter to `thread/shellCommand` and propagate it to user shell execution.
- Preserve the one-hour default when the parameter is omitted or `null`, allow longer deadlines, and treat `0` as an immediate timeout.
- Reject negative or otherwise invalid values before execution. Timing out an auxiliary shell command leaves its active turn running.
## Testing
- Cover default, extended, immediate, invalid, standalone, active-turn, and interruption behavior.
GitOrigin-RevId: d72f67793d9766b7383f28d30140270a4a76a495
## What changed
- Build per-context conflict checks from the shared runtime action registry instead of maintaining separate action lists.
- Preserve the existing context validation order and error messages.
- Add regression coverage for the first reported conflict across editor, Vim, pager, list, agents, and approval contexts.
GitOrigin-RevId: 665839bb9094ac573ab1494248c69c4000998483
## What changed
- Emit turn-scoped authentication recovery started and completed events when a model provider refreshes expired credentials.
- Add stable `modelProvider/authRecoveryStarted` and `modelProvider/authRecoveryCompleted` app-server notifications with the thread, turn, provider, and user-facing message.
- Show recovery progress in the TUI and `codex exec`, including Amazon Bedrock session reauthentication.
## Testing
- Cover provider recovery success and failure events, app-server routing, client rendering, and Amazon Bedrock credential refresh.
GitOrigin-RevId: 3010c38d0676f18bced27761cf86dd38344d09f9
## What changed
- Reuse the mention codec's linked-tool parser and mention-name helpers when extracting skill mentions.
- Remove the duplicate parser and environment-variable filter from the skill mention code.
## Testing
- Cover Unicode byte offsets, whitespace-trimmed paths, both supported sigils, and malformed linked mentions.
GitOrigin-RevId: 4ed3627f0caf90d49bcbc0681ff9d9b43b3736e3
## Why
Restored app-server threads can carry permission profiles that cannot be
represented without loss as legacy sandbox-mode overrides. Sending those
profiles as per-turn overrides can discard their original permission details.
## What changed
- Distinguish restored permission profiles from legacy per-turn sandbox
overrides.
- Preserve restored profiles while routing turns and changing to compatible
working directories.
- Reject `/cd` when a restored profile cannot be represented safely by a
legacy sandbox mode.
## Testing
- Cover retaining a restored read-only profile across `/cd` without a turn
override.
- Verify that lossy sandbox-mode projections are detected.
GitOrigin-RevId: 6143dca4b83ab4f59bab05f6a59b4fe841c56192
## Why
Large or minified diffs can require substantial work to allocate wrapped rows and syntax-highlighted spans in the inline patch view.
## What changed
- Limit inline patch previews to 12 rendered rows across all changed files, while retaining file summaries and directing users to the transcript when content is omitted.
- Preserve complete diff content in transcript and raw views.
- Bound preview source scanning to 64 KiB so zero-width content cannot bypass the row budget.
## Testing
Add coverage for added, deleted, updated, renamed, minified, narrow-width, wide-character, combining-character, and multi-file diffs, including preservation of complete transcript and raw output.
GitOrigin-RevId: 1899129ab548771c29d226ff624549573fb2f688
## Why
Delegated prompts should retain the authority of the TUI tool that sent them instead of being recorded as user input.
## What changed
- Start delegated `create_thread` and `send_message_to_thread` turns with a namespaced tool output and an empty user input list.
- Recognize delegated outputs from trusted Codex namespaces when building activity summaries.
- Render replayed delegation outputs in history and transcripts with their source task attribution, without adding them to composer history.
## Testing
- Cover turn request encoding, namespace filtering, activity summaries, and replayed history/transcript rendering.
GitOrigin-RevId: aeb2f5c8ad2f2a898c80e8fc791ed879a0ab655d
## What changed
- Add an optional `toolOutput` to `turn/start` for starting or steering a turn with a named function-call output instead of user input.
- Emit standalone outputs as `functionCallOutput` thread items, persist them in durable history, and include them in resumed threads.
- Validate that tool outputs have a name, are not combined with nonempty `input`, satisfy the text-size limit, and use supported image URLs.
## Testing
- Cover standalone tool-output notifications, model input, and resumed history in both legacy and paginated history modes.
- Cover the text-size limit for structured tool output.
GitOrigin-RevId: a1eeec7b9b7de67b1a1c5e829a54552b85ec118b
## What changed
- Return the number of directories flagged by successful Windows sandbox world-writable scans.
- Record that count in the `codex.windows_sandbox.world_writable_scan_flagged_directories` histogram for startup and warning-triggered scans.
- Tag each measurement with a `success` or `error` result, using a count of zero when the scan fails.
GitOrigin-RevId: 076160f36b1d62fa737f4b2d0318774e6c44a4b1
## What changed
- Add the `write_stdin_approval` feature flag, disabled by default, to require a fresh approval before sending non-empty input to an escalated unified-exec terminal.
- Route these reviews through hooks, Guardian, app-server, and the TUI as `writeStdin` approvals while keeping the parent command item unchanged.
- Preserve the terminal environment, launch directory, and escalation state across turns, and revalidate the process identity after approval before writing input.
## Testing
- Cover approval routing, policy decisions, process reuse, terminal identity preservation, app-server events, analytics, and TUI rendering.
GitOrigin-RevId: 4ba29eaae6208e934737ba078c96e589c7c2164d
## What changed
- Add `gg` and `G` motions to jump to the first and last buffer lines.
- Support the motions with delete, change, and yank operators, including dot-repeat for edits.
- Expose normal-mode and operator-motion bindings in the configurable keymap while preserving conflicting user bindings.
## Testing
- Cover buffer jumps, operator combinations, repeat behavior, chord routing, and custom remapping.
GitOrigin-RevId: 24a9178cf7964053aaf9a8cd268c5434dda0778e
## Why
App-server clients need the explanation and steering instruction returned with a
misalignment policy violation to offer a user-confirmed continuation. Missing or
incomplete details must continue to behave as a terminal block.
## What changed
- Parse optional misalignment classification, explanation, and steering details
from streamed and HTTP Responses errors and propagate them through core errors.
- Include the details in live app-server `error` and `turn/completed` payloads and
export the corresponding protocol schemas and TypeScript types.
- Keep explanations and steering messages out of serialized rollout events and
redact them from debug output.
- Document how clients can resume with `turn/start` after user confirmation.
## Testing
- Cover streamed, HTTP, and WebSocket-wrapped errors, including malformed and
classification-only details.
- Verify live app-server notifications expose resumable details without writing
the explanation or steering message to the rollout.
GitOrigin-RevId: 329258a444c2cd91d0c57ab1720830b33ddcfac5
## What changed
- Classify `response.failed` events with the `rate_limit_exceeded` code as a distinct retryable error while preserving any parsed retry delay.
- Expose the error as `rateLimitExceeded` through the core protocol and app-server schemas after stream retries are exhausted.
- Preserve the upstream message for TUI display while keeping it out of telemetry summaries.
## Testing
- Cover SSE classification, retry metadata, protocol conversion and serialization, exhausted stream retries, telemetry redaction, and TUI rendering.
GitOrigin-RevId: 02dab4d3477dcd7653a58c49c4bd38687a616579
## What changed
- Add `persistent` to the reasoning-effort protocol and TypeScript SDK types.
- Show model-advertised persistent reasoning in the TUI as “Persistent”.
- Preserve `persistent` in local configuration while sending the Responses API's `disabled` wire value.
## Testing
- Cover parsing and serialization, request translation, remote model requests, the TUI reasoning selector, and TypeScript CLI argument forwarding.
GitOrigin-RevId: 22fc2fba1975db345c12d555ec12803d8dc0abca
## Why
Stopping a task from the agents overview may need to look up its active turn. Paginated threads should use the turn history endpoint instead of requesting embedded full history.
## What changed
- Read the thread without turns first to determine its history mode.
- Fetch the first turn page for paginated threads when the app server supports it.
- Fall back to embedded turn history for legacy threads and legacy server negotiation.
## Testing
Added coverage for paginated and legacy threads, including fallback after legacy capability negotiation.
GitOrigin-RevId: 44d506b19e32c6b3c27fac11fb748c23b8e47b5e
## What changed
- Add line-local `f`, `F`, `t`, and `T` motions to Vim normal mode.
- Support the motions with `c`, `d`, and `y`, including dot-repeat for changes.
- Expose separate configurable normal-mode and operator-motion bindings, while preserving existing custom keymaps that use the new defaults.
- Keep character targeting aligned to extended grapheme boundaries and skip embedded composer elements.
## Testing
- Cover forward and backward motion and operator ranges, missing and adjacent targets, cancellation, dot-repeat, custom bindings, shifted terminal key events, grapheme clusters, and embedded elements.
GitOrigin-RevId: 2610cf9a13538d9ae9b890c01417ca25316c1d60
## What changed
- Detach and restore the live tail when rebuilding transcript renderables after history replacement, consolidation, removal, or highlighting.
- Keep an overlay that is following the bottom pinned to the tail when the composer height changes.
- Update cached content height after prepending history so subsequent scroll calculations use the rebuilt content.
## Testing
- Cover history rebuilds with absent, empty, and active live tails.
- Cover bottom-following across terminal height changes and subsequent committed output.
GitOrigin-RevId: be4bf4d0676261cc52864da9acb567573e34a799
## What changed
- Point the biology safety notice's Trusted Access link to the new ChatGPT route.
- Update the TUI rendering snapshots for the new destination.
GitOrigin-RevId: bba3adac8ac492f5407680bd54dbb727409e9496
## What changed
- Detect visible HTTP(S) URLs in the composer and attach the complete OSC 8 destination to every wrapped fragment, including when part of the URL is scrolled offscreen.
- Cache hyperlink metadata with the textarea wrap state while leaving masked input and destinations larger than 8 KiB unannotated.
- Make shared hyperlink mapping grapheme-aware, recognize Unicode whitespace boundaries, and scan URLs and trailing delimiters incrementally for large inputs.
## Testing
- Add coverage for wrapped and scrolled URLs, joined emoji, Unicode whitespace, preserved highlighting, masked input, cache invalidation, oversized destinations, and drafts containing many URLs.
GitOrigin-RevId: 40facdf2fe79438c91c82bff2d849c342f1ab28a
## What changed
- Read `x-codex-imagegen-request-id` from image generation and edit responses.
- Propagate the ID to `codex_image_generation_event` analytics.
- Keep the ID in process only, excluding it from extension item serialization, generated types, app-server wire data, and rollout history.
## Testing
- Cover response-header extraction and missing-header behavior in the images client.
- Verify end-to-end analytics emission and the unchanged image-generation item wire shape.
GitOrigin-RevId: 9b8e09b7d655c0c2faa84f0eee99aabae583668d
## Why
Users returning to a conversation need a short summary of its recent progress and next steps.
## What changed
- Generate a recap for eligible idle, unfocused conversations and add it to the transcript.
- Add `/recap` to request the same summary on demand, with visible progress and actionable errors.
- Keep recap requests bounded and isolated, reject stale results, and retry only automatic failures.
## Testing
- Cover automatic and manual generation, request eligibility, failure handling, loading-state cleanup, and temporary-thread configuration.
GitOrigin-RevId: 926a88d6996d67a42809ce2c4091b13fca882b52
## What changed
- Schedule recap eligibility checks when an unfocused thread changes, and cancel them when focus returns or recap state is replaced.
- Add bounded structured recap requests with stale-result rejection, normalized output, and one retry per turn revision.
- Harden temporary structured threads by reading the effective configuration and disabling all discovered MCP servers, tools, skills, and environment access.
## Testing
- Cover recap timers, focus changes, failed turns, output bounds, stale results, and retry behavior.
GitOrigin-RevId: eebf50059763928e9a2444b14d51648e0bdff4a8
## What changed
- Forward terminal focus changes through the TUI event stream and handle them across interactive screens.
- Track completed turns and recap eligibility across active, resumed, and switched threads.
- Add bounded recent-conversation prompt construction and a wrapping `Conversation recap` history cell.
- Cover focus timing, repeat eligibility, restored progress, UTF-8 prompt limits, and recap rendering with unit and snapshot tests.
GitOrigin-RevId: d7542c18b2bb1e72f5906f563898645bb526255f
## What changed
- Add the experimental `turn/start.cyberAccessProgram` option with `standard`,
`daybreakBlue`, and `daybreakRed` values.
- Forward the selection as `access_programs.cyber` on Responses, WebSocket,
and remote-compaction requests made with ChatGPT authentication, while
omitting it for API-key and custom-provider requests.
- Preserve the per-turn selection across recovery, compaction, and child-agent
turns without making it a persistent thread setting.
## Testing
- Cover app-server forwarding, authentication boundaries, WebSocket reuse,
turn recovery, compaction, and child-agent inheritance.
GitOrigin-RevId: d2eb468f365b2214c5099bc21741cf30f8bd2eb5
## What changed
- Add a feature-gated Amazon Bedrock option to eligible TUI sign-in flows.
- Discover existing AWS profiles and environment credentials, with manual setup for profiles, access keys, environment variables, and Bedrock API keys.
- Collect the AWS Region, mask secrets during entry, persist the selected Bedrock configuration through the app server, and restart the embedded server when the provider changes.
## Testing
- Cover wizard eligibility, sign-in option rendering, credential discovery ordering, region entry, and secret masking.
GitOrigin-RevId: 0a49afb6aca442b88e8448efa80336777848f4ac
## Why
Paginated thread history should be loaded incrementally through
`thread/turns/list` and `thread/items/list` instead of being fully reconstructed
in `thread.turns`.
## What changed
- Emit `deprecationNotice` when `thread/read`, `thread/resume`, or `thread/fork`
requests full history for a paginated thread.
- Direct clients to omit `includeTurns` for reads or use `excludeTurns: true` for
resumes and forks, then page history through the list APIs.
- Document the deprecation in the protocol schemas and app-server README.
## Testing
- Cover notices for paginated reads, cold and loaded resumes, and forks.
- Verify metadata-only requests, legacy threads, and rejected forks do not emit
the notice.
GitOrigin-RevId: 0d387b46d73608f90b7960120a54af4ef332e510
## What changed
- Report `Session archived: <thread-id>` after successfully archiving the current session.
- Show the session ID when no resume hint is available, including for non-fatal exits.
- Keep deleted-thread exits distinct from successful archive exits.
## Testing
- Add coverage for archive lifecycle handling and exit-message formatting.
GitOrigin-RevId: 1812374e4c74fa1b3f11feb323de18a9dbff745b
## What changed
- Add an optional `turnTrigger` field to app-server `turn/start` requests and
expose it in the generated protocol schemas.
- Propagate non-empty trigger values to Responses request metadata as the
reserved `turn_trigger` field, while preserving the original value when a
request steers an active turn.
- Classify turns started by queue dispatch, goal continuation, retry recovery,
and realtime handoff.
## Testing
- Cover HTTP and WebSocket metadata forwarding, steering behavior, reserved
metadata handling, and the built-in trigger classifications.
GitOrigin-RevId: c12fe2c522286db21b76081ae6154fbf6bfb3639
## Why
Stream animation ticks generated on a background thread can accumulate while the
TUI is busy, causing stale ticks to run after the animation stops or the chat
widget is replaced.
## What changed
- Replace the animation thread and `CommitTick` app event with a Tokio interval
owned by the foreground event loop.
- Delay missed ticks instead of replaying a burst, and let pending app events run
before animation work.
- Drop the interval when animation stops or the chat widget is replaced, while
preserving `CommitTick` session-log entries.
## Testing
Add a paused-time test covering stable pacing, missed ticks, restart behavior,
and chat-widget replacement.
GitOrigin-RevId: d0561d3f8962b5e05a728463e76aa8ec83cd5a31
## Why
Exiting a TUI connected to a persistent app server can leave work running, so
the existing session-exit summary does not explain how to reconnect or stop the
active turn.
## What changed
- Distinguish disconnects, interrupted turns, and removed threads when building
exit summaries.
- For daemon and remote sessions, report whether work may still be running and
print commands to reconnect or stop the current turn.
- Sanitize remote WebSocket addresses in displayed commands and preserve the
configured remote authentication environment-variable option.
- Keep the existing token-usage and resume summary for embedded sessions.
## Testing
Add coverage for daemon, remote, interrupted, embedded, archived, and deleted
session exits, including credential sanitization.
GitOrigin-RevId: 9cbbf9c7dd36423a5ed99909a2b4cb32e3e87712
## Why
Closed agent channels can retain stale in-progress turns, which can incorrectly
block `/cd` or cause unnecessary background-terminal checks.
## What changed
- Mark agents closed whenever a `thread/closed` notification is routed, including
for inactive event channels.
- Exclude closed agents from running-turn detection and background-terminal checks
during working-directory changes.
## Testing
Cover directory-change recovery with both a routed close notification and a
replay-only closed thread that contains a stale in-progress turn.
GitOrigin-RevId: 1072456056f8c1a1b751a52635470b0be160d76c
## Why
The active goal's elapsed-time label could become stale while the TUI was idle because it was refreshed only as part of a redraw.
## What changed
- Refresh the goal status indicator when the terminal-title timer fires.
- Request a redraw only when the displayed elapsed-time label changes.
## Testing
- Add a regression test covering the minute transition and confirming that an unchanged label does not trigger another redraw.
GitOrigin-RevId: f10a1c2334cf7a5f1d2ee90d7138114479998c8d
## Why
Terminal title animations only need to update the title, but each animation tick
previously requested a full TUI frame.
## What changed
- Track the next terminal title refresh deadline on `ChatWidget`.
- Have the foreground event loop refresh the title when that deadline expires.
- Clear the deadline when title animations are disabled or the configured title is
empty.
## Testing
- Verify spinner and action-required animations set the expected refresh deadlines.
- Verify refreshing an animated title does not enqueue a TUI draw request.
GitOrigin-RevId: 269347cd48de4ad9ba9a0aef9ed105c25d1a7dae
## What changed
- Add `serviceTierForTurn` to `turn/start` so a newly started turn can override the service tier without changing the thread's saved tier.
- Treat `"default"` as standard speed and omitted or `null` values as inheriting the thread tier.
- Keep `serviceTier` authoritative for subsequent turns when both fields are supplied, and ignore the turn-scoped override when steering an active turn.
## Testing
- Extend the app-server turn-start test to verify both the one-turn `"default"` override and inheritance on the following turn.
GitOrigin-RevId: 4c2c4db21d8d31617a7a6e6df65bf54834e72383
## Why
Windows Terminal and xterm.js can render a theme that differs from the
underlying console color table. Querying that visible theme through OSC shares
the console input queue with keystrokes, including input for security-sensitive
startup prompts.
## What changed
- Defer the Windows OSC color probe until protected startup decisions and the
world-writable workspace scan have completed.
- Preserve and replay unrelated console input records around the probe, while
removing only valid OSC 10 and 11 replies and retaining the console palette
as a fallback.
- Require an explicit confirmation key after shortcuts select trust, sandbox,
or world-writable warning choices, so a fragmented terminal reply cannot
accept them.
- Accept one- through four-digit OSC RGB components so the visible terminal
palette is applied across supported response formats.
## Testing
Added coverage for delayed startup scans, protected prompt confirmation,
console-record replay, bracketed paste and malformed OSC preservation, RGB
response parsing, and light-theme composer rendering.
GitOrigin-RevId: b8ae456fe32c701ba3af31e9cc452fc4e8bffa22
## What changed
- Record collaboration tool analytics for `send_message`, `followup_task`,
`interrupt_agent`, and `list_agents`, including receiver attribution, duration,
failures, and interrupted calls.
- Include these calls in per-turn subagent tool counts while keeping the existing
`subAgentActivity` output unchanged and omitting additional public collaborator
tool items.
- Extend the collaboration tool schemas with the new tool variants and the
`interrupted` terminal status.
## Testing
- Add an app-server integration test covering successful and failed calls,
receiver attribution, duration, prompt omission, activity items, and turn
counts.
GitOrigin-RevId: e73eaa05c508261e5fc97e7d08d7881a31e04e22
Eric Traut