## What changed
Add `features.multi_agent_v2.disable_direct_message`, defaulting to `false`. When enabled, omit `send_message` and `followup_task` while preserving spawning, automatic child results, and the remaining agent management tools.
Require an available message-board `post` tool when this option is enabled for sessions using multi-agent v2 collaboration tools, exempting internal worker sessions.
## Testing
Extend configuration parsing tests and run the message-board subscription/resume scenario with direct messaging both enabled and disabled. Verify post search, subscription behavior, and which collaboration tools are exposed.
GitOrigin-RevId: 72ec22ef0b92fa81e02cdeb058d8b4f93aca3be6
Add a regression test that fails `exec_command` with a missing working directory, pauses command completion, and interrupts the turn before releasing completion.
Verify that the command emits exactly one start and completion, retains its failure status and launch diagnostic, and persists the completion in the rollout. Check that reconstructed history includes the failed command in the interrupted turn.
GitOrigin-RevId: 5962f0791b298ebb05e752138d02b0e0b3af4c63
## Why
V2 tools and model context need to use the controller's agent tree even when the session's local runtime has no registry entries.
## What changed
- Add target resolution and direct-child path lookup to `AgentControl`.
- Move lazy root registration into the controller's resolution and listing methods.
- Build V2 subagent context from controller-provided paths, keeping formatting and size limits in the session layer and preserving loaded-first ordering.
## Testing
Extend the V2 spawn and messaging test with an empty session-local registry to cover relative-path resolution, message delivery, and subagent environment context through the controller.
GitOrigin-RevId: c935b34a6d3314e968ba451ff981cf2a223bbfa8
## Why
When unified exec cannot create a process, command lifecycle events are missing, leaving clients without a command failure notification.
## What changed
Emit start and failure events for terminal process-creation errors in both regular and zsh-fork execution. Report no process ID, an exit code of `-1`, zero duration, and the launch diagnostic, while retaining plugin attribution. Once event publication starts, let it finish even if the caller is cancelled.
Preserve approval rejection handling and retryable sandbox denials.
## Testing
Extend app-server tests to cover pipe and PTY launch failures, plugin attribution on failed launches, and zsh-fork launch failures after approval. Assert failure metadata and check for duplicate lifecycle notifications while retaining approval-decline coverage.
GitOrigin-RevId: 26ed191fc69b903ea4710dd1a6c3b031e8caa4eb
## What changed
- Store `Arc<dyn AgentControl>` in session services and route agent tools, turn admission, usage accounting, completion notifications, and shared settings through the trait.
- Add `AgentControlInit` so delegated and guardian sessions inherit the parent's controller and local runtime.
- Move local registry and context helpers to `LocalAgentRuntime`, keep resume, close, inspection, and status subscriptions on the local controller, and simplify synchronous and infallible trait methods.
GitOrigin-RevId: ad3f213eb483ac524bde56d769f20a78f20989a0
## What changed
Add the boolean `transparent_background` argument to `image_gen.imagegen` for generation and editing. Map `true` to `transparent` and `false` or omission to `opaque`, replacing the previous `auto` background setting.
Update tool guidance to request transparency for background removal and cutouts, and to preserve existing transparency during edits unless the user asks to change it.
## Testing
Add integration coverage for transparent, opaque, and omitted background arguments across generation, editing, and code-mode generation. Verify that `null`, string, and numeric values return a validation error without dispatching an image request.
GitOrigin-RevId: b10ac200a619c72cc1787da41b49d65d0cde05dd
## What changed
Run `AGENTS.md` and thread-instruction refresh concurrently with capability discovery, MCP setup, and tool construction. Box both preparation futures to keep them off caller stacks while they are live together.
Finish delivering returned instruction warnings even when tool preparation fails or is cancelled. Preserve instruction-error precedence and publish the selected-plugin snapshot only after both branches succeed and cancellation is checked.
## Testing
Add tests covering concurrent preparation, warning delivery on tool failure and cancellation, instruction-error precedence, and plugin snapshot publication. Verify that cancellation does not repeat consumed warnings on the next capture.
GitOrigin-RevId: 6b2d7b091aae2dba67ad154a19bdb0ed0f96f6f7
## What changed
Move WebSocket authentication arguments, settings, credential loading, and upgrade authorization into a shared crate using `http` types. Update the app server, transport, and CLI to consume it directly, and remove the `AppServer` prefix from the shared types.
Hide token digests and JWT verification secrets from authentication policy `Debug` output.
## Testing
Move the existing argument validation, capability-token authorization, and signed bearer-token verification tests into the new crate.
GitOrigin-RevId: 1dd20043a3f8efbca55af7eda338b62a62e8fd68
Apply `secondary_text_style()` to the shortcut hint separator and label
so they use a readable foreground color instead of terminal-dependent dimming.
GitOrigin-RevId: 6cd9ced75deca9353c1224d3e5fefc6c4ad6ae8f
## Why
Retry timing assertions can fail if the test is descheduled before retry telemetry is emitted, and parallel tests can leave shared tracing callsites disabled for the test subscriber.
## What changed
- Measure retry intervals from the failed request, filter HTTP observations to `/responses`, and track WebSocket stream requests as well as connections.
- Keep a tracing interest-cache guard alive and rebuild callsite interest when installing the telemetry capture.
- Reserve the connection-failure test's port with a bound socket until the recovery server starts listening.
- Wait for the WebSocket warmup request and assert `generate: false` before submitting user input in connection-limit, rate-limit, and overload tests.
GitOrigin-RevId: bba39ea2ac29ac8553ae6184139382f1e6cdc7ac
## What changed
- Add `environments` to `TurnSettingsUpdate` to replace the selection for subsequent steps without changing future turns.
- Capture model settings and environments together so combined updates apply or reject atomically, while existing steps retain their captured selection.
- Validate environment IDs, working directories, configuration ownership, and permission requirements against the running turn's selections.
- Preserve executor startup behavior when switching environments and use the step's local working directory for tool hooks.
## Testing
Add coverage for workspace switching and restoration on the next turn, atomic model and environment updates, permission validation, executor connection waits, and replacement of pending environment selections.
GitOrigin-RevId: 02b5c57a78fd594b2aed84fc09d9e99eb97be28c
## Why
Thread permission updates could affect later steps of a running turn. Keep inherited environment settings consistent throughout the turn and apply saved updates when the next turn starts.
## What changed
Store active thread defaults alongside selected environments and refresh them when activating a new turn, even when its environment selections are unchanged. Resolve new selections from those active defaults while preserving owner-provided configuration, selection workspace roots, and the local Windows sandbox type.
## Testing
Add a regression test that changes permissions during a paused turn and verifies that both steps retain restricted filesystem access while the next turn receives unrestricted access. Update session and MCP elicitation tests to check that permission changes take effect on the next turn.
GitOrigin-RevId: 37ee44198fa40c138d140974dc90c4177d8c1f4c
## Why
An async question notification can outlive its unanswered question and suppress the lower-priority turn completion notification.
## What changed
Clear pending `AsyncQuestion` notifications when collecting question drafts on completion, interruption, or failure, including the error-handling path. Completed turns can then queue their completion notification.
## Testing
Add regression coverage for all three turn outcomes and assertions for error handling and completion after dropped message deltas.
GitOrigin-RevId: 647b2b37acced431fc98fd4f5334c8973a0be241
## Why
Recovering question answers or interrupted input can cancel an active `Ctrl+R` search or overwrite its preview. Recovery should preserve the search while keeping the recovered input available on cancellation.
## What changed
- Apply background updates to the saved draft without changing the search query or visible preview, including when a query has no match.
- Restore the updated draft on `Esc` or `Ctrl+C`; discard it when accepting a history match. Keep search open when `Enter` has no match to accept.
- Capture the saved draft rather than the preview in draft snapshots, preserving attachments, mention bindings, and pending pastes.
- End search on an explicit fresh draft replacement so cancellation cannot resurrect discarded input.
## Testing
Add regression coverage for recovery on turn completion, failure, and interruption; accepting and canceling search after recovery; Vim undo/redo; pending paste preservation; and clearing drafts after a misalignment policy failure.
GitOrigin-RevId: d3de19bbbcdab2e461c19d47b2b7dca0b28f6ff3
## What changed
Clear pending asynchronous questions when a live turn completes, is interrupted, or fails, and append nonblank typed answers to the main composer in question order without submitting them. Preserve existing composer content and input restored after interruption, and retain large answers as paste placeholders.
Cancel history previews and pending Vim commands during recovery while preserving undo grouping and dot-repeat behavior. Skip recovery during replay and keep input cleared after a misalignment policy violation.
## Testing
Add regression tests and snapshots for open and collapsed drafts, buffered typing, answer ordering, repeated completion notifications, large pastes, interrupted queued input, and Vim undo/redo behavior. Update coverage for terminal errors and realtime question expiration.
GitOrigin-RevId: fec109fe8aecb0735a3a5410fbb063b5c5c6e9a1
## What changed
- Detect Terminal.app from primary and secondary device attributes during startup on Unix SSH sessions without a detected multiplexer. Ignore signatures inside bracketed paste and leave incomplete replies unknown.
- Use inline mode when Terminal.app is detected and `tui.alternate_screen` is `auto`. Apply the decision before the first startup frame and retain it for later configuration loads. Preserve explicit `always`, `never`, and `--no-alt-screen` overrides.
- Update the `crossterm` dependency revision and lockfiles.
## Testing
Add coverage for terminal signatures, fragmented and pasted replies, probe completion and timeout behavior, screen-mode overrides, and an inline startup snapshot.
GitOrigin-RevId: 9b937824b080f9bd6de29df1d9e84f42a698af46
## What changed
Extend an existing transcript selection with Shift-click while preserving its original anchor and selection unit. Allow continued dragging and repeated extension in either direction, including whole-word selections made by double-clicking. An ordinary click still starts a fresh selection.
## Testing
Add tests for extension in both directions, preservation of selection units, continued dragging, and ordinary-click reset, plus a snapshot of word-selection highlighting.
GitOrigin-RevId: e6208c1bc6260ac26e7cd1f81c752b2c0b375f36
## Why
Repeated gateway OAuth credential reads decrypt and deserialize the same unchanged secrets file each time.
## What changed
Add a single-entry cache shared by clones of `LocalSecretsBackend` for `GatewayOAuth`. Reuse decrypted secrets only when the file path, ciphertext hash, and keyring passphrase hash match, and invalidate the cache after writes. Omit cached credentials from the backend's `Debug` output.
GitOrigin-RevId: 91fa03655f5e233d1649f4c2571c5465dfe57f35
## Why
Application network restrictions need to cover clients created by the TUI and `codex exec` before embedded app-server startup, and remain effective when configuration is rebuilt.
## What changed
- Introduce `EmbeddedNetworkPolicy` to share live policy between caller-owned transports and the embedded app-server.
- Apply loaded requirements before creating telemetry, background HTTP clients, and executor connections. Limit authentication and cloud configuration bootstrap requests to exact endpoints under local policy.
- Preserve the shared policy across TUI session changes, permission-profile rebuilds, and worktree cloud loaders so existing clients observe policy reloads and failures.
- Document application network policy behavior and transport coverage.
## Testing
Add regression coverage for policy activation, reload failure and recovery, retained policy across TUI rebuilds, rejected OAuth and cloud-policy redirects, and workspace network restrictions with `CODEX_API_KEY`. Also cover retaining the caller-selected project during embedded startup.
GitOrigin-RevId: 629009f087b8cb21fc34a1ee7ea6fe95d9e0f2b5
## What changed
- Route remote-control enrollment, pairing, client management, and WebSocket connections through the authenticated HTTP client factory. Keep policy denials distinct from authentication failures and wait for policy changes before reconnecting.
- Preserve policy denials through exec-server connection failures so later connection attempts and capability discovery can recover. Keep direct executors running through temporary policy outages while rejecting permanent policy failures.
- Build cached HTTP transports on blocking workers, serialize construction, and retain successful builds after callers time out so request deadlines cover queued construction.
## Testing
Add regression coverage for policy recovery during remote startup, direct registration, accepted WebSocket reconnection, and capability discovery; queued transport construction timeouts; and remote-control WebSocket fallback with invalid custom CA files.
GitOrigin-RevId: c81db18e83de957175bb213d165281ac701089dd
## Why
AWS credential discovery, analytics, and telemetry used clients that did not share the application's network policy. These requests need to honor destination restrictions and permission revocation.
## What changed
- Route AWS credential and region HTTP requests through the shared HTTP client, and check the signing destination before loading credentials. Skip discovery for static access keys with an explicit region.
- Apply account-scoped policy to Bedrock authentication. Require unrestricted policy for credential exporters and reauthentication commands, and cancel active work when permission is revoked. Document that AWS profile `credential_process` network traffic remains outside the application's HTTP policy.
- Send analytics through the authenticated account's HTTP client factory.
- Guard OTLP log, trace, and metric exports with revocable permits, disable them under destination restrictions, and make managed HTTP exports cancellable. Suppress global Statsig settings while managed policy is active.
## Testing
Add coverage for metadata credential request cancellation, allowed and denied SigV4 destinations, AWS credential precedence and endpoint configuration, and blocked credential exporter recovery. Update telemetry tests for account transitions and managed-policy Statsig suppression.
GitOrigin-RevId: d8a2018bfbbe971ec430699b0d3f86a7a9e1e072
## What changed
- Load `application.network` requirements at startup and explicit config/account reloads, applying local policy before authentication and cloud configuration bootstrap.
- Block traffic when policy loading fails, cancel requests that a new policy no longer permits, and reject configuration loads based on superseded policy snapshots. Local requirements edits take effect on the next explicit reload or restart.
- Bind authenticated clients to the current account and revoke them when account ownership changes. Carry policy enforcement through backend requests, realtime connections, workload identity exchanges, and code-mode gRPC streams while preserving gRPC trailers.
- Treat denied credential refreshes as policy errors without retrying them or invalidating stored credentials.
## Testing
Add regression coverage for startup restrictions, reload ordering, cancellation after restrictive or malformed requirements edits, account revocation, gRPC destination denial, workload identity cancellation, and credential preservation after denied OAuth refresh.
GitOrigin-RevId: 0cb4c720a906397e9df06675f01ecf60d741101f
## Why
Codex could enable mouse capture even when the containing tmux session had mouse support turned off.
## What changed
- Probe tmux's `mouse` and `extended-keys-format` settings together, targeting `TMUX_PANE` when available.
- Suppress mouse capture when tmux explicitly reports `0` or `off`, and apply that policy across fullscreen and overlay input changes. Refresh the policy when entering or restoring the alternate screen.
- Preserve normal mouse behavior when the probe fails or the setting is unknown, and retain the keyboard-format fallback for older tmux versions.
## Testing
Add tests for pane targeting, explicit and unknown mouse settings, probe failures, keyboard fallback, and mouse-policy changes across fullscreen and overlays.
GitOrigin-RevId: 7bdd2759207b30a3877e983b489462de7c96e692
## What changed
- Switch the GPT-6, GPT-5.6, GPT-5.5, and auto-review catalog entries to `shell_command` and expand their plan availability.
- Mark `gpt-6-astra` as supporting reasoning-effort updates and disable its experimental-context flag. Add explicit capability and instruction defaults to other entries.
- Update Astra's messaging guidance to recognize authorization from explicitly invoked skills or plugins, with attribution in the final response, and simplify its Default-mode clarification instructions.
- Revise auto-review guidance on autonomy, assumptions, and actions within the user's requested scope.
- Refresh seven scenario snapshots to reflect the updated prompts.
GitOrigin-RevId: b7ed8c413f6451008c982024506009b170e6311e
## Why
A single blob upload failure previously aborted the file upload, even for a temporary `503` response or an interrupted stream.
## What changed
- Retry `503` responses and timeout, connection, body, or request errors, with at most five attempts within a shared five-minute deadline.
- Honor `x-ms-retry-after-ms` and `Retry-After`, falling back to backoff when no valid server delay is available.
- Reopen the contents for each retry while reusing the same file record and upload URL. Preserve the initial read permission check and reopen MCP file streams under the same sandbox policy.
- Record retry, recovery, and terminal failure events with a fresh client request ID for each attempt.
## Testing
Add coverage for recovery after `503` responses and interrupted streams, attempt and deadline limits, non-retryable responses, retry delay parsing, and unique request IDs. Extend the restricted-read MCP upload test to verify that both attempts send the complete file contents.
GitOrigin-RevId: 78089ecfd5076313f5784cbbc864df12d082e3b1
## Why
Destination restrictions and policy revocation must remain effective during redirects, response body reads, and established WebSocket traffic. Policy denials must also survive error handling so callers do not retry them or report a revoked operation as successful.
## What changed
- Route managed HTTP clients through a shared `RequestBuilder` and policy-aware execution, checking each redirect destination before route resolution and retaining a network permit while consuming response bodies.
- Guard WebSocket connection setup, reads, and writes with revocable permits, including independent wakeups for split readers and writers.
- Preserve `TransportError::Policy` through HTTP, SSE, and realtime error handling, and treat policy denials as non-retryable.
- Keep the supplied network policy in plugin startup HTTP requests and propagate response body failures from backend and plugin requests.
## Testing
Add regression coverage for rejection before connecting, revocation during redirect routing and streamed body reads, split WebSocket revocation, realtime writer error propagation, and revoked plugin upload responses.
GitOrigin-RevId: fba36700444c98a8364c09b4dc5452c4d78a90fb
## Why
Selecting text can pause following while the final transcript row remains visible. Clearing that selection could leave an unnecessary `esc latest` hint in place of the composer hints.
## What changed
Only show the return-to-latest footer for paused navigation when the transcript tail is out of view. At the bottom, show selection shortcuts without the earlier-history status, then restore composer hints when the selection is cleared, even if following remains paused. Preserve loading and retry hints.
## Testing
Add regression coverage for selection, clicking away, and scrolling at the bottom with partial and complete history, plus selection above the bottom. Verify retry hints with selected text and update activity expectations and the composer-gap snapshot.
GitOrigin-RevId: aeb2109244d6c3214c945abb51cf469087d03074
## What changed
Display a `voice` badge on the task whose session owns the running voice conversation, including when a child thread owns it. Refresh the overview after voice controls and realtime conversation resets so the badge clears when background voice closes asynchronously.
## Testing
Add snapshot coverage for a child thread owning voice and a regression test for clearing the badge after an asynchronous background voice close.
GitOrigin-RevId: 815dfad4ce1a31945d2dd0d3f9cecc5abfa419d6
## Why
Switching threads stopped the active voice conversation. Users should be able to view another task while continuing the call on its original thread.
## What changed
- Retain the voice owner's live widget and subscription in the background, routing voice controls, speech, and connection callbacks to that owner.
- Restore the live call and transcript when returning to its thread, without duplicating captions or letting background UI events affect the visible task.
- Preserve undelivered speech and defer background errors until the owning thread is shown.
- Stop background voice on shutdown, disconnect, or removal of the owning session.
## Testing
Extend regression and end-to-end coverage for thread switching during delegated speech, voice control routing, transcript restoration, caption deduplication, and cleanup on disconnect or archive/delete.
GitOrigin-RevId: ce010dce6fa8cd6fa44949a131f3f16e8cb80c4d
## What changed
- Handle voice toggle and mute shortcuts in `App`, and route `/voice`, `/voice stop`, and `/voice mute` through thread-scoped events that ignore requests for a different current thread.
- Allow function-key voice toggle bindings and chords beyond chat, including transcript browsing and search, while preserving existing surface bindings and raw key capture.
- Exit transcript browsing when toggling voice, avoid matching completed chords again, and preserve startup submission handling before dispatch.
## Testing
Add regression coverage for voice chords outside chat, binding conflicts, key capture, transcript browsing, mute dispatch, and startup submission cancellation with draft preservation.
GitOrigin-RevId: c4d110ca8a2e1840247a7fe84cd69c6b7cdb36d7
## What changed
Add `backend_reasoning_status`, disabled by default, to relay public reasoning summaries during active, server-managed realtime V3 delegations.
Use the last non-empty summary from each completed reasoning item, truncate it to 256 bytes at a character boundary, and append it as `[STATUS]` context on the `commentary` channel. Discard queued updates if their delegation is no longer active.
## Testing
Add an integration test covering enabled and disabled behavior, selection of the latest non-empty summary, exclusion of raw reasoning and partial summaries, and delivery without triggering `response.create` or changing the model's reasoning-summary setting.
GitOrigin-RevId: 75ce87dbbbab15a6d9d0ad0b23737738837192fd
## What changed
Add the default-off `features.prefer_mxc` flag to select MXC for local Windows execution when native support is available and effective network settings do not explicitly forbid local binding. Otherwise, retain the configured backend and legacy setup behavior.
Resolve the preference during config loading and use the effective local backend for execution, network proxy setup, sandbox diagnostics, and `windowsSandbox/readiness`. Preserve the configured backend for remote executors and `config/read`. Explicit `windows.sandbox = "mxc"` remains strict, and command failures do not trigger backend fallback.
## Testing
Add coverage for preference resolution, startup readiness without rewriting configuration, local and remote backend selection across environment updates and child threads, and workspace-write permission context in an agent turn.
GitOrigin-RevId: b51178f0371d38ebb58e41af54a068fca67fa316
## Why
Restoring persisted V2 agent identities reads descendant metadata serially, making each storage read wait for the previous one.
## What changed
Read up to eight descendants concurrently while registering identities in graph order, preserving path and nickname reservation order. Skip identities already registered and continue restoring after individual read failures.
## Testing
Add a cold-resume regression test that gates child metadata reads to verify overlap, completes reads out of order to check deterministic path reservation, and injects a read failure. It also verifies that child runtimes remain unloaded until requested.
GitOrigin-RevId: ae90f24875966be83208884937621a6a9eb0d848
## Why
Resuming a compacted thread should use the compaction and its newer records without depending on older turn contexts or restoring stale state from before the compaction.
## What changed
- Stop paginated model-context scans at the newest compaction with `replacement_history` and `window_number`. Fall back to full replay if the newest compaction lacks either field.
- Align reconstruction with that boundary and restore `last_started_turn_id`, previous turn settings, and the multi-agent version from compaction resume metadata. Allow newer completed turns to override the saved settings.
- Keep canonical session metadata alongside the bounded replay and use the same scan boundary for subagent rollout migration.
## Testing
Add coverage for cold resume after mid-turn compaction, bounded/full replay equivalence, missing companion state, settings precedence, and incomplete-compaction fallback.
GitOrigin-RevId: f836464bb5cadd9be4a4e05b5d1679223713fc87
## What changed
- Enforce an 8 KiB encoded-message limit for requests, unrecognized notifications, and malformed messages received by exec-server clients over stdio, WebSocket, relay, and Noise relay transports.
- Allow process output, exit, close, and HTTP request body notifications up to 2 MiB. Keep responses and errors subject to existing transport limits, and preserve executor-side request limits.
- Read stdio stderr in chunks of at most 8 KiB.
- Drop outgoing server-request `tracestate` values larger than 512 bytes while preserving `traceparent`.
## Testing
Add regression coverage for oversized requests across transports, malformed messages, requests wrapped in `RawValue`, fragmented Noise messages, large responses, streamed notifications, and trace-context preservation.
GitOrigin-RevId: 3fb87b6dc334296985ef40983d7276acfe9b9796
## Why
Shared filesystem capabilities must not grant access to another logon session's processes, threads, or IPC objects. A shared account's implicit owner rights can also allow another logon to rewrite an object's DACL.
## What changed
- Grant full access in the token's default DACL only to the runner's logon SID, removing grants to Everyone and capability SIDs.
- Add an `OWNER RIGHTS` entry granting only `READ_CONTROL` to suppress the owner's implicit `WRITE_DAC` access.
- Close the new token handle if default DACL or privilege setup fails.
## Testing
Add a Windows `AccessCheck` regression test verifying that process memory, thread creation, termination, query, and DACL modification rights remain available to the creating logon but are denied to a simulated other logon sharing the same owner and capability.
GitOrigin-RevId: 94608466ee1b461fe10db1866e80b3988119bdfc
## Why
User prompt URLs only received explicit hyperlink destinations when they required forced wrapping, leaving other URLs without those annotations.
## What changed
Annotate web URLs before wrapping user messages so their full destinations survive both adaptive wrapping and forced splitting of oversized URLs.
## Testing
Add a regression test and snapshot at widths of 120, 60, and 24 columns, checking URL destinations, line width limits, and matching display and transcript output, including a prompt with an image placeholder and a parenthesized URL.
GitOrigin-RevId: fccae7b76a3613776d7a663c41e699ebad7eebc1
## What changed
Highlight recognized paths and URLs in check descriptions and details in red for failed checks and cyan otherwise. Extend path recognition on Windows to drive-absolute, UNC, Win32, and NT DOS paths.
## Testing
Add Windows and non-Windows color snapshots covering successful, warning, and failed checks, punctuation, and backtick-quoted paths with spaces. Assert that descriptions and details remain unchanged when color is disabled.
GitOrigin-RevId: e8f9982505aa155fd312b12f91a71271effeb35e
## What changed
Reserve a blank row below a trailing recap when the transcript viewport has room. Keep this spacing in layout rather than selectable content, and omit it when a completed or live message follows the recap.
## Testing
Add snapshots covering recap tail spacing across terminal sizes, with and without a next action, and with completed or streaming follow-up messages. Verify that reflowed history retains a single separator between a recap and the following message.
GitOrigin-RevId: f9552931fac4eabd7d72c2b312ffba717257e9e1
## Why
`invalid_prompt` responses were classified as generic invalid requests, losing the server's specific error classification.
## What changed
Add `InvalidPrompt` variants to the API and core error types and serialize the core protocol classification as `invalid_prompt`. Recognize the code in HTTP 400 responses, wrapped WebSocket errors, and SSE `response.failed` events while preserving server messages and keeping the error non-retryable. Map it to `other` in the app-server v2 protocol.
## Testing
Extend coverage for typed error mapping, missing and blank messages, protocol conversion, and guardian retry handling. Exercise HTTP and SSE failures in core integration tests, asserting the error message, serialized classification, and a single request without retry.
GitOrigin-RevId: 5d9a299a013b06158a4dc27a4054f3dbc5fd0f4d
## Why
Cloud skill discovery ran on every turn, even when the Apps resource generation and authentication scope were unchanged.
## What changed
- Reuse warning-free catalogs, including empty catalogs, while their authentication scope and Apps resource cache key remain current.
- Refresh after invalidation and retry failed or partial discovery on the next turn.
- Reject discovery results if the Apps resource cache key changes during discovery.
## Testing
Update lifecycle tests to verify cached turns avoid catalog listings and skill reads, while connection and authentication changes trigger refreshes. Update the referenced-resource test to verify partial discovery retries on the next turn without an explicit MCP refresh.
GitOrigin-RevId: ac47d5202d76703c4946afef3b1a48eaf05b54c2
## What changed
Emit `<recommended_plugins>` with the `developer` role and append it to the shared developer message after other context. Retain recognition of legacy user-role recommendations in existing rollouts.
## Testing
Add a startup context snapshot and assertions that recommendations share the developer message with permissions instructions. Update core and app-server tests to check developer-role recommendations, including across successive model requests.
GitOrigin-RevId: 0326ff347e86ec38b948f93e39e90e6a88a8730c
## Why
Forked subagent startup serializes history persistence and spawn-edge writes. Cancellation during startup can also leave a provisional child behind.
## What changed
- Defer copied-history durability so it can run alongside spawn-edge persistence, while still awaiting both before submitting the child's initial input.
- Commit agent and residency reservations and notify clients only after initial input is accepted.
- Guard provisional children so cancellation or startup failure removes and shuts them down, discards their stored state, and closes their spawn edge after any pending edge write finishes.
## Testing
Add coverage for cancellation at the child-history durability barrier, checking child termination, removal, and edge closure. Extend fork-context tests in legacy and paginated history modes to verify inherited context can be read from storage after spawn acknowledgment without flushing the live child first.
GitOrigin-RevId: e02dda57efc32b7237bb7af0ce5e5844922890c3
## What changed
Add `openai.gpt-6-sol` and `openai.gpt-6-luna` to the Bedrock catalog, including `global.` and `us.` variants for Bedrock Runtime. Make GPT-6 Sol the default and provider fallback model, preferring its global variant for Runtime. Retain the existing models and update model picker ordering.
## Testing
Extend catalog and provider tests to cover the new models, metadata, ordering, and default selection. Update thread-start tests for supported model preservation and fallback behavior, and refresh Mantle and Runtime model picker snapshots.
GitOrigin-RevId: 5ce646e384353ae26cdfc4ea4e7c049ac61e698c
## What changed
Skip the thread store title lookup when initializing an ephemeral fork, leaving its thread name unset.
## Testing
Add a regression test that forks an ephemeral thread from history and verifies that the in-memory thread store's `read_thread` count does not increase.
GitOrigin-RevId: 81180c4a836c932584d2cb94c0816eae33b04af3
## Why
Callers need to interrupt a specific active turn without discarding queued input. Tool callbacks must be able to await the interruption decision without blocking task cancellation.
## What changed
- Add `CodexThread::interrupt_if_no_pending_input` and `Op::InterruptIfNoPendingInput`.
- Check the turn identity and pending user input or mailbox items before taking the active task. Leave the turn running for stale or abandoned requests.
- Acknowledge the decision before joining cancellation, and unblock pending submissions when the active task is cancelled.
## Testing
Add regression coverage for successful interruption, stale turns, preservation of queued user input and agent mail, abandoned requests, and cancellation while the submission queue is full.
GitOrigin-RevId: 42e31c09369fb070ba1b4b3c64ef45334dd872d8
## What changed
- Add “Inspect activity” to the shortcut help’s Session section, using the runtime `focus_activity` binding (`F4` by default) and hiding it when unbound.
- Remove the passive activity footer hint so composer hints remain available. Keep previous, next, details, and back controls while activity is focused, shortening them to fit the available width.
## Testing
Add snapshot coverage for default, remapped, and disabled activity shortcuts. Update footer coverage to verify the absence of passive hints and interactive controls at 20, 32, and 80 columns.
GitOrigin-RevId: 52ca6f4992778cd3cf3eebe163d533e69a8dabeb
## What changed
- Add `gpt-6-sol` and `gpt-6-luna` catalog entries and refresh model descriptions.
- Offer migrations from `gpt-5.5`, `gpt-5.6-sol`, and `gpt-5.6-terra` to `gpt-6-sol`, and from `gpt-5.6-luna` to `gpt-6-luna`.
- Retarget retired `gpt-5.4` and `gpt-5.4-mini` selections to GPT-6 Sol and Luna, respectively.
- Recommend `gpt-6-luna` in the rate-limit switch prompt.
## Testing
Extend migration tests to cover the new targets, their default reasoning effort, and prompting again after a previously acknowledged migration to an older target. Update model-picker and rate-limit prompt snapshots.
GitOrigin-RevId: d3a093d18ce44a903383504ab8f5cbbc911d602d
## Why
An empty composer hint row already separates activity from the input. Adding another separator wastes transcript space, especially in short terminals.
## What changed
Reserve the extra separator only when copy status text, a follow control, or a fitting hint occupies the shared row and the viewport has room. Recalculate the transcript layout in the same frame when adding that separator, and use a shared timestamp for copy status visibility and expiry.
## Testing
Extend snapshots for running turns with no hint, follow controls in short terminals, and copy status text at narrow widths and limited heights. Update resize assertions to check that the draft and caret remain stable relative to the terminal bottom.
GitOrigin-RevId: a73894063b759ec6b9a25f720e0e8007516109c8
jif