## Why
Image generation usage-limit errors with the `imagegen_premium` limit ID were not recognized as structured `UsageLimitExceeded` failures.
## What changed
Recognize `imagegen_premium` alongside `image_gen`, preserving the limit ID and available reset time in image generation failure metadata.
## Testing
Extend app-server coverage to verify premium limit metadata and reset-time fallback in completion events, thread reads, and resumed threads. Add unit coverage for missing exhausted-window reset times and unrelated or absent limit IDs.
GitOrigin-RevId: 8cf991776403ddce1f45d9780b8040982fd0fcfe
## What changed
Collect REPL evidence as shared immutable response records, then select and render it during synchronous context preparation. Share response selection logic between text and multimodal layouts while preserving rendering limits, omission markers, and image order.
Use the shared `NodeReplResponse` type in core evidence storage and preserve existing snapshots through copy-on-write image eviction.
## Testing
Extend tests to verify shared response identity during collection, unchanged rendering after preparation, and snapshot stability when storage pressure evicts images.
GitOrigin-RevId: 8564d3732faa5adf01a66bca523d4c03cfbe1822
## What changed
- Validate inherited options before and after the `queue` subcommand, with explicit errors for unsupported flags and positional prompts.
- Reject `--model` and `-c model=...` because queued messages use the thread's model.
- Allow `--cd` for local server startup, but reject it with `--remote`.
- Hide unsupported inherited options from queue help and clarify the scope of startup configuration overrides.
## Testing
Add regression coverage for unsupported options in both argument scopes, model configuration overrides, remote `--cd` conflicts, and queue help output. Preserve coverage for overrides that bypass a running local daemon.
GitOrigin-RevId: 703ba26f38930a01559847e66e1af3d0d338d1e9
## What changed
Add session options for client- or server-owned output truncation and optional `max_output_tokens` budgets for wait and terminate observations. Introduce `TerminateRequest` and update session implementations and callers to use it.
Extend the stdio and gRPC schemas with optional truncation settings and budgets, and define the `bounded-output-v1` capability. Existing sessions retain client-side truncation; providers reject server mode by default. This change defines the contracts without enabling server-side truncation.
## Testing
Extend protocol serialization coverage for `outputTruncation: "server"` while preserving existing wire shapes when optional fields are absent.
GitOrigin-RevId: 22145897ea16d385c5ba9e7549109f7a669fceb4
## What changed
- Allow selecting warning text while preserving wrapped URLs and hard line breaks when copying.
- Add mouse-wheel scrolling within the warning body and keep page navigation working after selection.
- Use the shared menu surface and show configured scroll hints only for directions with more content.
- Preserve painted backgrounds when rendering text selections.
## Testing
Add coverage for warning selection without changing the draft, paging after selection, wheel scrolling and directional hints, and selection boundaries in scrolled text containing tabs and wrapped words. Update warning panel snapshots.
GitOrigin-RevId: c4b77277a60b7b4af92043cb3761769ddc636454
## Why
Sandbox invocations without an explicit permissions profile and remote `exec-server` connections using ChatGPT auth need access to cloud-defined model providers and managed requirements. Cloud bootstrap requests must also respect local application network policy.
## What changed
- Bootstrap sandbox cloud config whenever managed config is included, even without an explicit profile. Skip bootstrap when `--sandbox-state-json` supplies the sandbox state.
- Load cloud config for remote executors beyond workload identity, while skipping forwarders and executors using stdin credentials, AWS SigV4, or agent identity auth. Honor `CODEX_API_KEY` selection so API key connections skip ChatGPT cloud config.
- Apply local application network policy during cloud bootstrap and activate effective application network policy before exec-server clients are created.
## Testing
Add coverage for cloud-defined providers in sandbox and remote exec-server invocations, API key bypass, local policy blocking bundle requests, cloud policy blocking remote registration, and bootstrap exclusions.
GitOrigin-RevId: e8bd6210751e96161f575ade309ebf41bf10f8b5
## Why
The Bazel V8 source build supported Windows GNU but lacked an MSVC-targeting toolchain to produce `*-pc-windows-msvc` archives.
## What changed
- Add opt-in archive targets for native Windows x64 and ARM64 hosts, selected by `//third_party/v8:rusty_v8_native_windows_archive_for_target`.
- Fetch pinned LLVM and scope its `clang-cl` toolchain to V8 artifacts, using the installed Microsoft SDK. Bundle Chromium libc++ and compiler-rt builtins into the resulting `.lib`.
- Adapt V8 dependencies, assembly, snapshot generation, and platform feature settings for MSVC, and derive test metadata from the selected engine features.
- Document the native build workflow. Existing MSVC consumers continue using prebuilt artifacts; generated Rust bindings and publishing integration remain separate.
GitOrigin-RevId: abd5049245aece90a116fc3bfeac2b158a76f6af
## What changed
Emit `codex.tui.embedded_start` when the TUI successfully connects to an embedded app server, with a `reason` tag identifying daemon exclusions, disabled auto-start, failed daemon connections, or agent startup without a discovered daemon.
Distinguish `--search` from other configuration overrides when it is the only configuration exclusion preventing daemon use.
GitOrigin-RevId: b837ad2e83af17ea92392ffa6d5f91108ceaeecc
## Why
Cloud conversations own their execution settings and workspace. TUI requests must preserve those settings instead of overriding them with local configuration.
## What changed
- Add a distinct cloud parameter mode that omits local execution settings from thread start, resume, and turn requests, including misalignment continuations.
- Route cloud model and reasoning selections through `thread/settings/update`, requiring server acceptance rather than falling back to local changes or saved defaults.
- Use server model defaults and tolerate an unavailable `configRequirements/read` method during cloud bootstrap.
- Skip local tool setup and TUI-generated titles, and report that permission selection, forking, and conversation recaps are unavailable for cloud conversations.
## Testing
Add regression coverage for cloud request parameters, bootstrap without configuration requirements, rejected model changes, and suppression of unsupported requests.
GitOrigin-RevId: a2dafb6c8a6b0db8607575e2291fee739c2fb2b1
## What changed
- Make the `fast-mode` status line and terminal title items show the current model's processing tier name, falling back to `Standard`, instead of `Fast on` or `Fast off`.
- Share tier label resolution with `model-with-reasoning`, including `Flex` for configured providers other than Amazon Bedrock, and remove the ChatGPT account requirement for displaying tier names.
- Refresh model-dependent surfaces when Fast or Ultrafast mode is enabled or disabled.
## Testing
Update status surface tests and snapshots to cover tier selection, feature toggles, model changes, and provider-specific `Flex` fallback behavior.
GitOrigin-RevId: 7d67ae6177bb1b3c0be4ecf0910106aaaf2bd0be
## What changed
- Add optional `omitted_paths` and `denied_reads` fields to catalog permission messages. The latter requires exactly one `{{ denied_reads }}` placeholder.
- Preserve mandatory denial and no-bypass warnings, path/glob facts, and existing path selection limits. Limit each override to 500 UTF-8 bytes and fall back independently to bundled wording for invalid overrides.
- Pin `i18n-config` to an upstream revision that removes the unmaintained `basic-toml` dependency, updating Cargo and Bazel lockfiles.
## Testing
Add serialization and rendering coverage for sparse values, invalid templates, byte limits, and preserved policy facts. Extend model-switch scenarios to verify that warning wording follows the selected model while preserving request history and permission annotations.
GitOrigin-RevId: f5fa1a978abe07d90917f552c64e7c8fc257c061
## What changed
- Add the disabled-by-default `skill_catalog_deltas` feature flag to append new and updated skills without repeating unchanged catalog entries.
- Share a cumulative metadata budget across executor, cloud, and host catalogs, preserving usage across turns and resume. Removals emit no update and do not refund budget.
- Rebuild the current catalog and reset its budget after compaction, including any required skill root mappings in updates.
## Testing
Add unit and integration coverage for update costs, shared source budgets, feature rollback, and catalog updates across resume and compaction, with a request-history snapshot.
GitOrigin-RevId: e88b4265d7361498113d43fdc2e0260a9f930bbc
## What changed
Extract patch parsing, verification, and permission assessment into request preparation helpers used by the tool handler and intercepted shell patches. Execute the prepared `ApplyPatchRequest` through the existing runtime and derive auto-approval status from its approval requirement.
Move approval action construction onto `ApplyPatchRequest` and update the existing approval tests to use the new helpers.
GitOrigin-RevId: 7f07d38f0dbf2a971c94b897281651b7a174fd05
## What changed
Introduce `PreparedPermissionRequest` to encapsulate argument parsing, path resolution, permission normalization, and approval action construction. Pass the prepared request, including the selected environment ID, into session permission handling.
## Testing
Extend the selected-environment path resolution test to assert that the prepared approval action carries the expected environment, reason, and resolved permissions, matching the emitted permission request.
GitOrigin-RevId: ebd34fad0e5d4c9f98330d17a6254325526b8c78
## Why
Async question titles support Markdown, but named choices display Markdown syntax as plain text.
## What changed
Render named choices with Markdown styling and terminal hyperlinks, wrapping them to the available width after the numbered prefix. Use the rendered rows for height measurement and scrolling, and reuse layout measurements for the option tip.
Share viewport-aware Markdown rendering between question titles and choices, preserving hyperlink destinations when splitting overwide tokens.
## Testing
Extend tests to cover Markdown-aware height measurement, italic styling, and terminal hyperlinks in selected choices. Update the long-choice snapshot to show text starting beside its numbered prefix.
GitOrigin-RevId: 7a1292ac7dff16b55439888d569fc7fa7c6ef689
## Why
Cache presence and freshness checks deserialize full plugin records even when callers only need to decide whether a cached catalog is available.
## What changed
- Probe cache availability without deserializing plugin records, while still requiring a valid catalog envelope and a `plugins` array.
- Let `PreferFreshCache` reject stale catalogs from a 256-byte prefix when the header provides enough information; fall back to a full read otherwise.
- Limit discovery cache probes to the user and workspace scopes that need them, skipping the global cache probe.
- Serialize cached plugin slices directly without cloning them.
## Testing
Add coverage for malformed cache headers and payloads, reordered fields, stale-prefix rejection, and deferring plugin-record validation until a full catalog load.
GitOrigin-RevId: 1e5ec95917f38c84bba30dbd3bb8c2f91cc7e3a8
## Why
Tool suggestions loaded and cloned the cached connector directory even when no candidates remained after excluding accessible apps.
## What changed
- Filter out accessible connectors before loading the directory, skipping the lookup when no candidates remain.
- Share cached directory entries through `Arc<[AppInfo]>` and clone only matching entries for suggestions.
- Preserve placeholder suggestions for candidate connectors missing from the directory.
## Testing
Add coverage for skipping directory lookups with no remaining candidates, sharing cached storage, and preserving directory metadata and missing-connector fallbacks while excluding accessible apps, including disabled ones.
GitOrigin-RevId: acaf3e1564fb4e2b4f805cffe1d7db8e40d5fe3d
## Why
Attached threads need inherited context for model requests while exposing only their own turns to clients. Parent turns and token usage should not appear as activity in an empty attached thread.
## What changed
- Stop attached-thread history traversal at the parent boundary, including after reverts, and hide inherited interruption markers.
- Apply visible-history boundaries to search, realtime timelines, and turn-specific fork and revert requests.
- Suppress inherited token-usage replay on paginated fork resumes, require fork replay to reference a returned turn, and skip empty turn IDs.
- Require a paginated source for `thread/fork` with `attachToSource` and update the protocol documentation.
## Testing
Extend regression coverage for attached-thread restart and database recovery, retained parent context in model requests, child-only history, mid-turn fork boundaries, legacy-source rejection, and suppression of parent token-usage notifications.
GitOrigin-RevId: 67858caf3bb74b7e79d4dd59bed9c61055fe0ff1
## What changed
Add four advisory exceptions to `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml`, documenting the usage constraints and removal criteria:
- `RUSTSEC-2026-0391`: borrowed contexts are not reused across streams; remove after upgrading to `zstd >=0.14.3` on all paths.
- `RUSTSEC-2026-0398`: the affected seekable feature is disabled; remove after upgrading to `zstd-safe >=8.2.0` on all paths.
- `RUSTSEC-2026-0403`: callers use read decoders or initialized output buffers and discard output on error; remove after upgrading to `zstd-safe >=8.2.0` on all paths.
- `RUSTSEC-2026-0410`: the allocator bug affects `wasm32`, while Codex ships native binaries; remove when the lockfile uses `zstd-sys >=2.1.2`.
GitOrigin-RevId: 556e53be961b01191590e2ca4e9f08dd9f017eac
## Why
On Linux, a cold start from a rotational disk can exceed the ten-second readiness timeout. Extending that timeout should still let startup failures surface promptly when the daemon exits.
## What changed
- Increase the Linux readiness timeout to 30 seconds, matching macOS.
- Stop waiting for readiness when the published daemon process exits, preserving the PID reservation and reporting startup diagnostics, including stderr.
- Kill pending `ps` subprocesses when their process checks are dropped.
## Testing
Add coverage for a managed daemon becoming ready after 15 seconds and for reporting an exited daemon's stderr within five seconds.
GitOrigin-RevId: c663e52bea9039807f14ef8fc4b44aca9df3df21
## Why
ENT26 plans are billed directly in dollars, so credit estimates and credit-weighted breakdowns do not describe their thread usage.
## What changed
- Expose optional `nativeUsageUsdMicros` in app-server `ThreadUsage` responses and generated schemas and SDK types. Missing native usage means unknown, not zero.
- Enable ENT26 usage fetching and display native dollar amounts in `/status`, the status line, terminal titles, and the agents overview. Hide credits and omit credit-weighted `/status` breakdowns for these plans.
- Use native dollar amounts when tracking post-turn usage settlement for ENT26 plans.
## Testing
Add coverage for native usage forwarding, ENT26 billing displays, and settlement polling with stale, missing, or zero dollar amounts.
GitOrigin-RevId: ca8ea98141a66bdf0a27feb9f58f67822b821f5f
## Why
Hosts that only need installed plugin inventory should be able to skip startup requests for plugin discovery.
## What changed
Add the stable, default-enabled `features.plugin_discovery_prefetch` flag. Setting it to `false` skips startup prefetching of the plugin directory, featured plugins, and recommendations while preserving installed plugin cache refreshes and bundle downloads.
## Testing
Update app-server integration coverage to verify that installed plugin bundles download with discovery prefetch disabled and that no directory, featured, or suggested plugin requests are made during startup. Also cover listing remote marketplaces with the flag disabled.
GitOrigin-RevId: 7cc3072f6045131b9f1acb851f6240db75ac173e
## Why
The same-owner token-refresh tests need the original backend response to remain pending until `getAuthStatus` publishes refreshed credentials. A fixed response delay does not guarantee that ordering.
## What changed
Gate responses in the `getAuthStatus` test cases until a request-specific auth reload log confirms the credential change. Emit that log after updating the cached auth and generation, and include `auth_changed_for_refresh` as a structured field.
Extend the JSON log test helper to match events with predicates, allowing tests to identify the refresh by its request span.
GitOrigin-RevId: 698f3be499ea3c035f082c501836dae4178adaef
## Why
A duplicated or inherited file handle can keep the rollout maintenance lock held after its guard is dropped, blocking subsequent compression or migration.
## What changed
Explicitly unlock the file in `RolloutMaintenanceGuard::drop` so lock ownership ends with the guard even if another handle remains open.
## Testing
Add a regression test that retains a duplicated file handle, verifies that the lock stays held until the last shared guard is dropped, and checks that dropping the old handle does not release a newly acquired lock.
GitOrigin-RevId: 19005680dbc0a01b36c6f13e4ec358c6f00b75a0
## Why
Each turn runs an external hook, making a shared ten-second deadline too restrictive. Turn completion can also precede deletion of the queued item.
## What changed
Use the event waits' progress deadlines in the rejected-message test and wait for the queue to empty before checking results, replacing the immediate empty-queue assertion.
GitOrigin-RevId: 2b417840156893d829dc2984aa88b06a5a13aefe
Replace the fixed 200 ms sleep in
`reusing_completed_process_returns_unknown_process` with polling until
`write_stdin` reports no process ID, bounded by a 10-second timeout. This
ensures the shell has completed before asserting that reusing its process
ID returns `UnknownProcessId`.
GitOrigin-RevId: c752e9c2c0a419fa5a06ba957bee49dcaeb5d6d2
Run the deferred paste newline and standalone Enter handoff tests with
`start_paused = true` so their timing uses Tokio's paused clock.
GitOrigin-RevId: d903c0e1078b81531912e54819499b0c3a0fb307
## What changed
Change the default `thread_unload_delay_secs` from 1800 to 60 seconds. App-server threads become eligible for unloading after one minute with no subscribers and no activity. Update the configuration documentation, schema, and thread manager sample to match.
## Testing
Update the configuration test to cover the 60-second default, zero for immediate unloading, and an explicit 1800-second override.
GitOrigin-RevId: 0da8454eb25a6ef4b7e3665601982d2e0c183f7c
Remove the hard-coded 9,000-token cap for encrypted agent messages in both synchronous and asynchronous guardian context. Use `message_tokens` directly when converting the configured limit to a byte budget, allowing larger messages when the configured limit permits them.
Messages that exceed the configured budget still produce an omission notice; encrypted content remains intact when retained.
GitOrigin-RevId: a9032ca19102ebad44be8df1ac4d4892d4404ead
## Why
Memory baseline snapshots need bounded file reads, and recovery must keep existing memory files visible to consolidation rather than treating them as already processed.
## What changed
- Limit baseline files to 10 MiB, skip oversized working files, and check stored blob sizes before reading them.
- Version baselines and replace missing, outdated, or unusable metadata with an empty baseline, preserving working files as additions. Also invalidate the baseline when a tracked file grows beyond the limit.
- Serialize baseline initialization, resets, and diffs with a cross-process lock. Isolate repository access and pin index writes to the baseline worktree.
## Testing
Add coverage for oversized files, legacy baseline migration, interrupted resets, cross-process locking, and consolidation with unchanged inputs after baseline recovery.
GitOrigin-RevId: 34ecc9e5700a88ed37eff83a90f08d8a9b0d9f29
## Why
The timeout fallback test depends on short wall-clock deadlines and a server-side sleep, making its timing dependent on thread scheduling.
## What changed
Use a paused Tokio clock and advance past the timeout only after the server receives `HEAD`. Keep the blocking server task alive until the probe consumes the `GET` response to prevent automatic clock advancement during socket I/O.
Assert both request lines and retain the check that the fallback returns `HTTP 405`.
GitOrigin-RevId: da7b2fa9c67e662648da8568ce7f8cfde153dc12
## Why
The context inheritance tests enabled `MultiAgentV2` but invoked `spawn_agent` through the V1 namespace, leaving the V2 path untested.
## What changed
- Share a helper that spawns through the V2 namespace, waits for child completion, and identifies the child's request by its thread ID.
- Assert that the child receives inherited instructions in a `developer` message and its task in an `agent_message` addressed to `/root/worker`.
- Test skill instructions both enabled and disabled for parent and child requests, with an explicit skills extension and discovery isolated to the fixture skill.
GitOrigin-RevId: 193fca57398e950acad1f020382dc1bae6453df4
## Why
Commands that fall back without using a shell snapshot should remain associated with their configured snapshot mode in telemetry.
## What changed
Add a `shell_snapshot_mode` telemetry tag to `exec_command` with values `disabled`, `v1`, or `v2`. Give `v2` precedence when enabled. The tag records configuration, not whether a command actually used a snapshot.
## Testing
Add parameterized coverage for all four combinations of snapshot feature flags using a non-login command, which cannot use V2 snapshots.
GitOrigin-RevId: 2dd9e79b9e02448938166254ea1b988034a81b5e
## Why
The fixture token `new` can appear in randomly generated Base64 public keys, causing the executor registration response's credential check to reject valid test responses.
## What changed
Use hyphenated fixture tokens that cannot occur in Base64 keys. Set the retry test's X25519 public key to a value containing `new` so the former collision is exercised deterministically.
GitOrigin-RevId: 059043eddc388a69c4659d6cdcac6ee107ae1973
## Why
Some I/O errors can repeat without advancing the dotenv iterator, causing environment loading to loop indefinitely.
## What changed
- Only open the Codex home `.env` path when it is a file.
- Stop processing entries on I/O errors other than `InvalidData`, while continuing past invalid UTF-8 lines and parse errors.
GitOrigin-RevId: 4b79b5e87b6924b342265e0688ebe59fefea4637
## What changed
Add `codex queue --resume` to resume an unloaded thread after queueing a message through the local daemon or selected `--remote` server. Already loaded threads are left running. If resumption fails, emit a warning while preserving the successful queue result.
Read only the thread status when checking whether to resume, allowing remote metadata to contain paths from another operating system.
## Testing
Extend CLI integration coverage for unloaded threads consuming queued messages, archived thread rejection, and successful queueing when another server owns the thread and rejects resumption.
GitOrigin-RevId: cc8aa3c11a37e990da36e6ff9a17934f73322e7b
## What changed
Remove unused pending initial-yield state and its plumbing from cell completion handling. Route completion delivery through `send_cell_event`, retaining the completion event and original timestamp when an observer has disconnected.
## Testing
Extend `failed_completion_delivery_rebuffers_the_event` to verify that failed delivery attempts preserve output and report the full elapsed buffering duration on a later successful observation.
GitOrigin-RevId: eebe990a4f8258f1ccb12d0694945678f0cc3a8f
## Why
Pairing can take up to 30 seconds in the daemon, but the client used a two-second timeout when waiting for each response message.
## What changed
Apply a single 35-second deadline to `start_pairing`, including connection and initialization. Wait for the pairing response without a per-message timeout so status notifications cannot extend the overall deadline. Preserve the existing per-message timeout for other remote control requests.
## Testing
Extend the manual pairing test with a three-second response delay and add coverage verifying that a status notification does not reset the pairing deadline.
GitOrigin-RevId: c011fd131262b30baa21e17bc0e0f733dce53fb0
## Why
A running turn can record stale permissions after the thread accepts a settings update. Resuming or forking from that history should preserve the accepted approval and permission settings.
## What changed
- Prefer settings snapshots owned by the source thread over stale turn contexts, including later legacy updates associated with that thread's checkpoint.
- Restore unnamed permission profiles from attributable settings updates while honoring explicit request overrides. Avoid restoring raw permission grants from history without an identifiable owner.
- Share permission restoration logic between resume and fork.
## Testing
Add regression coverage for stale turn contexts, legacy updates across thread ownership boundaries, and unnamed permission restoration on resume and fork.
GitOrigin-RevId: 450bc1688be78c7ec685f6dc56bcc5e5dd2d130a
## Why
NFS database migration rejected files with group or other access. Allow accessible databases to migrate while making the effects on file access explicit.
## What changed
- Preserve file mode bits during migration while requiring owner read and write permissions on replacement files.
- Before CLI consent, disclose that replacements belong to the current user and do not copy the original owner, group, or extended ACLs. Require explicit confirmation for files with permissions other than `0600`.
- Warn at Linux TUI startup when NFS databases need migration and permission confirmation. Inspect journal mode without accessing WAL shared memory or releasing another connection's locks.
- Allow five seconds to acquire the exclusive database lock during migration.
## Testing
Add CLI coverage for consent, access disclosures, and migration of `0644` files. Extend state tests for permission preservation, rejection of missing owner access, and interrupted migration recovery; snapshot the startup warning.
GitOrigin-RevId: 2d9c3663172c3e631a787dc1dc76db95c39e6aa1
## Why
Existing databases retain their journal mode, so selecting `DELETE` for new NFS databases leaves existing WAL databases unchanged.
## What changed
- Add the managed `unsafe_enforce_sqlite_journal_mode` requirement to migrate existing NFS databases before opening writable pools and require `DELETE` on each connection.
- Share migration code between startup and `codex migrate-nfs-db`, preserving WAL backups and resuming interrupted replacements, including lazily opened databases.
- Hold the migration lock through pool initialization and keep migration failures out of automatic corruption recovery.
- Preserve local logs behavior and skip legacy NFS logs cleanup when enforcement is enabled.
## Testing
Add coverage for requirement precedence, database settings, data and backup preservation across restarts, interrupted replacement recovery, refusal of active WAL databases, migration lock waiting, and local logs remaining in WAL mode.
GitOrigin-RevId: da41ec1b58b1ee8092591cdf8b358280928ff9d4
## Why
Leaving transcript selection with a held key can send repeated input to the composer and submit a preserved draft.
## What changed
- Route the transcript selection shortcut and selection controls in both the owned transcript and transcript overlay, preserving drafts and ignoring pastes outside search.
- Give fixed selection controls and pager motions precedence over conflicting key chords while allowing search and voice controls.
- Consume held exit keys across selection dismissal and asynchronous copy completion, and require fresh presses for composer submit and queue actions.
- Initialize overlay selection against the refreshed transcript frame and complete selection navigation when older history finishes loading.
## Testing
Add regression coverage for draft preservation, repeated `Enter` events, selection and search key precedence, refreshed-frame selection, and pending copy exit-key cleanup.
GitOrigin-RevId: 6cca9f399af1d49ff79337ae745cfc1564a14b88
## What changed
- Add `tui.keymap.global.select_transcript` with an implicit `leader [` shortcut that follows the configured leader, respects explicit remapping or unbinding, and yields to existing bindings.
- Connect transcript overlays to keyboard selection, including Find, mouse selection, and navigation to the beginning of paged history. Give selection commands priority over remapped pager shortcuts.
- Close selection overlays on exit or after a confirmed copy-and-follow operation, preserving the pending close decision while clipboard confirmation is asynchronous.
- Show selection navigation and copy hints that adapt to the available footer width.
## Testing
Add coverage for shortcut dispatch, remapping, unbinding, and conflicts; overlay exit behavior; selection across history paging; mouse and keyboard selection interaction; and cursor and footer rendering snapshots.
GitOrigin-RevId: 8a920e5fa2b06ff0544d829ba30f8ecb654db0ee
## What changed
- Support `/` to open Find in selection mode and `Enter` to move the cursor to the match, extending an active selection.
- Repeat the accepted search from the cursor with `n` for older matches and `Shift+n` for newer matches. Cancel pending repeats when the cursor or selection changes.
- Restore the previous search, cursor, and selection when cancelling a new search, and reuse the previous search when accepting an empty query.
- Align the cursor to selectable graphemes and preserve expanded matches when leaving selection mode.
## Testing
Add regression coverage for search acceptance and cancellation, repeated searches, Unicode cursor placement, expanded output retention, and history pages loaded while a search is saved.
GitOrigin-RevId: 077be52a54d5e006f65eacc4634baf8c089d3662
## What changed
- Add word motions (`w`, `b`, `e`), logical line boundaries, page and half-page motions, and jumps to the transcript's beginning and end. Honor configured pager bindings for navigation.
- Add whole-line selection with `V` and active-end swapping with `o`.
- Adopt existing mouse selections when entering select mode, preserving selection units and endpoint bounds so keyboard motions can adjust the range.
## Testing
Add regression tests for word motion across entries, reverse whole-line selection, empty-line boundaries, configured pager motion, final-grapheme selection, endpoint swapping, and caret placement after copying.
GitOrigin-RevId: f0cd05900f2a7a15840777cee4d50659a2c8b134
## What changed
Track cumulative compressed and uncompressed payload bytes, message counts, and percentage savings for each connection and direction. Use paired Zstd codecs for listener and native client connections, sharing a connection ID between transmit and receive statistics.
Log totals as traffic is processed at 60-second intervals and when codecs are dropped. Transmit totals include encoded payloads even if the subsequent socket write fails; receive totals count only successfully decoded messages.
## Testing
Extend compression tests to verify shared connection IDs, matching transmit and receive totals, savings calculations, and exclusion of oversized messages rejected during decoding.
GitOrigin-RevId: 32602caa85864de7a4e0d28907311af6f67d8db2
## What changed
Advertise `zstd-stream-v1` compression for WebSocket and Unix socket connections and use the negotiated codec for JSON-RPC messages. Retain compression history for the connection and keep plain-text messaging when compression is not negotiated.
Fragment compressed writes to respect the server's advertised frame limit, reject text messages in compressed sessions, and stop using the connection after a failed write to avoid mismatched compression history.
## Testing
Add an integration test covering compression negotiation, fragmentation, retained codec history, request/response handling, and disconnection on an uncompressed text message.
GitOrigin-RevId: 510073444ea49376a116c05214bcb79bd0bc3b50
## What changed
- Add a source coordinator that streams rows as backends reply, preserves each source's pagination cursor and listing mode, and rejects stale replies.
- Route previews, transcripts, archive, and restore requests to the selected row's backend.
- Keep healthy results visible when a source fails, and fall back from an empty or failed initial database listing per source.
- Cancel reads when the picker closes while allowing accepted mutations to finish.
The app-server picker now uses the coordinator with a single source.
## Testing
Add regression coverage for independent source replies, pagination and fallback, action ownership, stale replies, disconnected sources, and mutation completion after picker shutdown. Add a snapshot for the partial-backend failure warning.
GitOrigin-RevId: 1b565c680133d460f4a29c9946a8398e9c950773
## What changed
- Configure the code-mode host to send zstd-compressed responses when clients advertise support, and enable both client transports to accept them.
- Preserve uncompressed responses for clients that do not advertise zstd support.
- Patch `tonic` in Bazel builds to use zstd compression level 1, favoring response latency over compression ratio.
## Testing
Extend the TCP session integration test to check response encoding and successful session opening for both zstd-capable and uncompressed-only clients.
GitOrigin-RevId: b6cf0da51dd30fc2ac9a1b0af11bec26555c559d
## What changed
Extend `mcp_connection_sharing` to pool compatible local stdio connections that negotiate MCP `2026-07-28`. Keep legacy servers and servers that request input during startup private.
Preserve each chat's tool catalog and route input requests to the calling chat. Release connections independently for each chat, shutting down the shared server after the final release, and retire pooled connections on forced refresh without interrupting other chats.
## Testing
Add pool, runtime, app-server, and core scenario tests covering protocol gating, startup cancellation, refresh, final-release shutdown, and separate tool visibility and simultaneous input responses across chats sharing one process.
GitOrigin-RevId: 896b107267a20ec1bffccdefca6c40fe2945a022
jimxie-oai