## What changed
- Save side chats as attachments to their parent conversation when local workspace history supports them, and let users reopen them from the sidebar after a restart.
- Show chat names or first-prompt previews in sidebar labels, and allow saved side chats to be renamed with `/rename`.
- Add tab close buttons, middle-click closing, and the configurable `close_sidebar_tab` shortcut, defaulting to `Ctrl-X W`. Closing a saved chat keeps it available in the picker; archiving removes it from Side chats.
- Confirm actions that stop running work, discard unsent input, or lose temporary history. Delete saved TUI side chats when deleting their parent conversation.
## Testing
Add coverage for reopening saved side chats after restart, archive handling, close confirmations, and preventing close-confirmation keys from accepting a replacement approval dialog.
GitOrigin-RevId: 3d47533d007286a7354660c08df13a83dd48d5d7
## What changed
- Honor `RuntimeAgentInstances` and the configured runtime auth mode for Analytics plan discovery and report requests to OpenAI endpoints.
- Share installation ID resolution and Codex runtime registration setup through `codex-runtime-agent-instance`.
- Preserve typed runtime authentication errors so expired credentials retain the “Sign in again to load Analytics” guidance.
## Testing
Add coverage for both runtime auth modes across regional and staging endpoints, fresh assertions for each request, sign-in guidance after bootstrap failure, redirect rejection, and invalid organization/project selectors.
GitOrigin-RevId: 50e0d959b3abd81ebe7a6a584e272f14cf52e504
## Why
Security reminder requests need to use app-server's active authentication and HTTP runtime, with results bound to the login that fetched them.
## What changed
- Add `account/securitySetup/read`, returning an optional notice with account and user IDs, plus generated protocol schemas and bindings.
- Fetch reminders in app-server only for a matching saved ChatGPT login. Return `notice: null` for ineligible, unavailable, or timed-out reads, and discard results when the login changes during the request.
- Route TUI reminder reads through the new method while retaining notice validation and identity checks. Unsupported servers produce no reminder.
## Testing
Add coverage for shared runtime use across restarts, ineligible authentication modes, and login changes during a fetch. Update TUI coverage for unavailable, unsupported, and mismatched notices.
GitOrigin-RevId: 426fee7ce98df17970957c06876881bc5b005196
## Why
An inherited turn can suppress a fork's configured developer instructions, leaving the first side-chat request without its developer policy.
## What changed
- Move shared side-conversation instructions and the history boundary into `codex-context-fragments`.
- Inject the developer policy before the user-role boundary when creating a TUI side-chat fork, while retaining the configured instructions.
- Distinguish attached and temporary policies, applying the worktree restriction only to temporary side chats.
- Add guidance to set up recurring monitors in the main chat or a new chat because temporary side chats cannot run scheduled updates.
## Testing
Add a TUI integration test that checks the first side-chat model request contains the policy and boundary. Add a core request-history snapshot covering an attached side chat that preserves inherited context, policy, and its prior answer after resuming from disk.
GitOrigin-RevId: 889cb317dc3327457cd9ef0879ec9f77dbfaeeba
## Why
Cloud messages previously accepted only plain text, and switching a draft to Cloud waited for session preparation without processing composer input.
## What changed
- Support ordered text and image parts in Cloud submissions and user-message summaries, preserving attachment placeholders, image detail, and client message IDs.
- Accept inline data URLs and uploaded file IDs, including image-only messages. Reject invalid references and text spans locally, and cap encoded image requests at 3.75 MiB while retaining the existing plain-text limit.
- Keep the composer editable and redraw the TUI while Cloud prepares a conversation. Carry the latest draft, attachments, and Vim mode into the destination, retain drafts on failure, and prevent submission to the outgoing session during the handoff.
- Preserve buffered paste input and pending clipboard reads across the handoff, with connection and failure hints.
## Testing
Add regression coverage for image wire encoding, receipt identity, validation and size boundaries, draft editing during successful and failed handoffs, clipboard completion, Vim state, and attachment recovery after rejected submissions.
GitOrigin-RevId: 0cbcde0ab89ba961780b5f88456057e6b6a19cd5
## Why
Regular chats start MCP servers eagerly even when cached tool definitions are available and the servers go unused. Allow those chats to use the cached catalog and defer eligible stdio servers until first use.
## What changed
- Add the disabled-by-default `mcp_lazy_stdio_startup` feature and expose it through experimental feature configuration.
- Defer cached stdio servers in regular chats when enabled, while keeping servers that require a live startup connection eager. Required servers with `startup_readiness = "catalog"` may defer; explicit reconnects remain eager.
- Announce the full eager startup batch before terminal statuses and exclude dormant servers from the initial startup summary. Update TUI tracking so deferred servers can report startup independently in later rounds.
## Testing
Add scenario coverage for a cached server staying dormant during unrelated work, starting on first use, and refreshing tool definitions and visibility. Cover required live startup, eager event ordering, experimental feature configuration, and TUI status handling.
GitOrigin-RevId: 74075fcd4f26c8c79b5901b6a8cb03fdb9e35a7f
## Why
Extension status content was limited to one row, clipping multiline text and content that wraps at narrow terminal widths.
## What changed
Measure extension status content at the available width and reserve up to four rows in both shared and separate status layouts. Account for mode indicators and warnings, and remeasure when content or available width changes.
Extra status rows yield to the draft and other composer surfaces when vertical space is limited. An unfocused composer keeps a single dim status row.
## Testing
Add regression coverage for resizing, wrapping beside mode indicators and warnings, hyperlink preservation, limited vertical space, cursor placement, footer overrides, focus changes, theme updates, and reasoning effort changes.
GitOrigin-RevId: 6a637b5cf6f34684639a92d920da4795c90abb6f
## What changed
- Use the same status renderer for shared footer rows and separate status lines, allocating extension content the width left by the mode indicator.
- Measure extension content with `measure_natural()` instead of rendering it at maximum width.
- Skip reasoning effort status transitions for extension content and clear an active transition when extension content replaces the status line.
## Testing
Add regression coverage for matching shared and separate layouts across terminal resizing, natural width measurement, viewport clipping with hyperlinks, and skipping effort transitions when switching between native and extension content.
GitOrigin-RevId: 4ffc52ec6374f3c2b4995c0472bee25aa15ae7a0
## What changed
Use a shared layout traversal to measure prepared UI trees and paint text directly into terminal buffers. Add natural and viewport-constrained size measurement, and use direct rendering for extension footer content.
Preserve wrapping, styles, and terminal hyperlinks while clipping at grapheme boundaries and leaving overflow ellipses unlinked.
## Testing
Add coverage for size measurement in terminal cells, wide characters at clipping boundaries, and zero-width text around overflow ellipses. Update rendering tests to check painted buffer contents and hyperlinks.
GitOrigin-RevId: 828c45d3400f9e3dfce9a7bd812d1cc0ea51642f
## Why
Footer width measurement and rendering each prepared the same UI tree again.
## What changed
- Prepare footer extension content once and share the owned `PreparedUiTree` through `Arc`.
- Resolve colors against the active theme at render time, caching each color resolution within a render pass.
- Share leaf text buffers across prepared chunks instead of copying their slices.
## Testing
Add a test verifying that chunks from a clean text leaf retain slices of the original buffer. Update existing UI tree rendering tests to use the owned prepared representation.
GitOrigin-RevId: daba035c291338f3e0036e9ad4f2fd26f56a3910
## Why
Enabling `tui_extensions_status_line` routed configured status lines through a plain-text extension renderer and hid the “Use theme colors” option in the status line picker.
## What changed
Always use the native status line renderer for configured items and their live picker previews, preserving theme colors and pull request links regardless of the extensions flag. Always expose the theme color option in the picker, and clarify that the flag enables experimental MCP status line providers.
## Testing
Update coverage to require native status line content across extensions flag changes and exercise the live picker preview with the flag enabled. Retain checks for pull request hyperlinks and color preference preservation.
GitOrigin-RevId: bce7df5696c2bd3583d3ef99c43e7a2014e17294
## What changed
Render prepared UI trees within a viewport's width and height, preserving authored line breaks and wrapping text while retaining styles and hyperlink ranges.
- Add `wrap: "wrap"` for rows to move children onto additional lines; keep `nowrap` as the default.
- Allocate space to row children while reserving later siblings' minimum widths.
- Mark horizontal clipping and vertical overflow with an unlinked ellipsis, including in single-line rendering.
- Respect word hyphens across style boundaries and nonbreaking spaces when wrapping.
## Testing
Add regression tests for nested row wrapping, sibling width allocation, hyperlink offsets and clipping, and word boundaries. Add a buffer snapshot covering authored line breaks, collapsed whitespace, styles, and links.
GitOrigin-RevId: fdfbdee92808c0a8f55e2fdf11db95d68a76d9a5
## What changed
Add `UiTree::prepare` and `PreparedUiTree` to prepare styled inline text and row structure independently of viewport width. Compute minimum and preferred widths for text and nested rows, including gaps, and retain authored line breaks when filtering zero-width children.
Render the first line from the prepared tree while retaining overflow ellipses and hyperlink clipping.
## Testing
Add a preparation test covering row width measurements across styled text, nested rows, gaps, empty children, combining marks, and non-breaking spaces.
GitOrigin-RevId: 5f63366c0568a01cb55686d9f14c1b3fac90946f
## What changed
- Collapse spaces and tabs across inline leaves, trim leading and trailing whitespace, and keep rendering limited to the first line.
- Prepare Unicode line-break opportunities across style boundaries and join graphemes split across leaves. Use the first fragment's style and retain a hyperlink only when all fragments share its destination.
- Preserve row boundaries and explicit gaps, and use row gaps for status-line separators.
- Prevent zero-width fragments from adding row gaps or changing the ellipsis style.
## Testing
Add regression tests for whitespace collapse, split graphemes, hyperlink ownership, zero-width fragments, and line-break consistency between styled runs and contiguous text.
GitOrigin-RevId: 94e58808bc8469e9cd0adddb16c194b9568cfbb6
## Why
The UI tree renderer's CSI-only sanitizer leaves OSC command contents visible in rendered text, including embedded hyperlink URLs.
## What changed
Use `vtparse` to sanitize each string independently, retaining printable text, tabs, and newlines while discarding terminal commands and other control characters. Preserve the existing text limit, first-line rendering, and tab expansion.
## Testing
Add a regression test covering color escapes, carriage returns, OSC hyperlinks, and an incomplete escape sequence before a structured link. Assert the rendered text and the structured link's hyperlink range.
GitOrigin-RevId: 51899f62d10f6a1321f96278616fe7a51bad17d9
## Why
Extension UI trees previously accepted only named terminal colors and literal RGB values. Semantic colors let extension content follow the active syntax theme and terminal color capabilities.
## What changed
- Accept `primary`, `surface`, `accent`, and `status-*` color roles for text foregrounds and row backgrounds.
- Resolve semantic colors against the active theme when rendering extension footer content. Prefer the `codex.accent` scope for `accent`, falling back to the theme's accent setting.
- Reuse status-line scope mappings and fallback colors, with terminal-default fallbacks for unavailable primary, surface, and accent colors.
## Testing
Add color serialization coverage and rendering snapshots for dark, light, and empty themes in truecolor and ANSI 16-color terminals, including nested foreground and background styles.
GitOrigin-RevId: 156f137859d74178f9ae6aa46a02eecb815e9802
## What changed
Allow `requirements.toml` to pin `features.runtime_agent_instances.mode` to `dual_header` or `assertion_only`. Apply the required mode when no explicit mode is configured and reject conflicting explicit settings, while preserving legacy boolean requirements.
Document experimental runtime authentication configuration, credential lifecycle, and bootstrap authentication behavior.
## Testing
Add coverage for managed mode defaults and conflicts, runtime reuse and rotation across account requests and restarts, fresh assertions on Realtime and MCP reconnects, and Realtime destination and environment restrictions.
GitOrigin-RevId: bcf9502178f477c1e8232386f1f3e360bf23d667
## What changed
- Add the disabled-by-default `gateway_setup_wizard` feature to let users choose a saved custom gateway during eligible local sign-in onboarding.
- Save the selection as `model_provider`, restart the embedded app server with that provider, and complete required primary authentication and gateway OAuth before starting the first chat.
- Show gateway loading and configuration errors, browser sign-in links, and an OAuth retry action. Respect provider policy and launch overrides.
## Testing
Add coverage for onboarding eligibility, saved gateway selection and persistence, and gateway error and OAuth screens. Add a terminal integration test verifying that the selected gateway receives the first chat with authentication.
GitOrigin-RevId: 92bd2da3abd28d6c2274c91b2d7561bf359f0ca0
## What changed
- Extract helpers for image paste shortcuts, paste-burst ticks, restricted draft edits, and composer activity detection.
- Thread `ShellPrefixHandling` through text insertion and pending-input flushing.
- Return a configuration rebuild future that does not borrow the app or base configuration.
## Testing
Add a regression test covering image paste while `!` is buffered: Enter preserves the draft during the paste burst, and subsequent submission includes the image and literal `!` without running a shell command.
GitOrigin-RevId: fb9a3c8a70aed524c65022f2c0910ce2ad11d4d2
## What changed
Pass the local project's GitHub origin to cloud prewarming so new cloud threads can provision a repository checkout. Preserve the attached local project when switching backends and resolve its origin for each thread start.
Normalize supported GitHub origins to credential-free HTTPS URLs and select a repository-specific cloud working directory. Unsupported origins retain the blank environment behavior. Keep project metadata outside the app-server wire protocol, and fix HTTP Git URL parsing so query strings and fragments cannot be mistaken for authority text.
## Testing
Add coverage for project routing, origin normalization and rejection, managed environment encoding, local project retention, and Git URL credential stripping.
GitOrigin-RevId: 5859769965faf060461ccc1cbb3fd48f8e2f2155
## What changed
Add a nullable `userId` to `GetAccountResponse`, populated from the same authenticated account snapshot as the rest of the response. ChatGPT and personal access token sessions return the canonical ChatGPT user ID when available; API-only and signed-out sessions return `null`.
Update the cloud client, generated schemas, TypeScript and Python types, and account identity documentation. Default missing IDs to `None` when deserializing responses from older app servers.
## Testing
Extend account response tests to check ChatGPT and personal access token user IDs, null IDs for other providers and signed-out sessions, and ID changes when switching providers with saved ChatGPT credentials.
GitOrigin-RevId: 7ad3da3cfc835c4d08d03c8e91b06cd7e007d874
## What changed
Support `bold`, `italic`, and `underline` nodes, plus text properties for color, weight, italics, and underlining. Nested text can override inherited styles, including disabling modifiers.
Add row backgrounds that apply to children and gaps. Text colors and row backgrounds accept the eight standard ANSI color names or `#RRGGBB` values, with RGB colors resolved through the terminal palette. Preserve the last visible span's style on overflow ellipses while keeping them unlinked.
## Testing
Add coverage for style serialization and invalid values, nested modifier depth limits, inherited styles and overrides, row backgrounds, styled truncation, and foreground/background palette resolution, including a rendered buffer snapshot.
GitOrigin-RevId: 6b19b6b740cd754890c8adb489fba414a6ee62d3
## Why
Typed prompts currently display Markdown syntax literally, including emphasis, lists, and code fences.
## What changed
- Render Markdown in typed prompts while retaining the prompt gutter, background, and hyperlinks.
- Preserve literal rendering for spoken prompts, prompts with inline text elements, and text without visible Markdown formatting.
- Keep the original Markdown when copying a whole prompt, and preserve source text for code block and blockquote copy targets.
- Preserve bold styling when leaving the dim prompt marker and track hyperlink columns incrementally across styled spans.
## Testing
Add regression coverage for prompt rendering at multiple widths, hyperlink positions, terminal bold styling, and copying Markdown source, code blocks, and blockquotes, including original code line endings and fenced tables with table rendering disabled.
GitOrigin-RevId: eda62043ca8a9fe012ea7e0683fe05de6ad1b898
## Why
The sidebar chooser used hard-coded keys and hints instead of configured list bindings, limiting navigation and making custom shortcuts inconsistent.
## What changed
- Use configured list actions for chooser navigation, acceptance, and cancellation, including key chords, page movement, and jumps to the first or last choice. Show the configured shortcuts in footer and retry hints.
- Place “New side chat” first and group existing chats into compact rows with a count and optional thread colors. Keep the selected chat visible in short panes.
- Highlight inactive side-chat tabs on hover while preserving the selected tab's styling. Redraw when the hovered tab changes and suppress hover highlighting during pane resizing.
## Testing
Extend interaction tests and snapshots to cover custom acceptance chords, `j`/`k` navigation, paging, and tab hover styles and redraws with either pane focused, including the fallback when terminal colors are unavailable.
GitOrigin-RevId: bad992b3786215dcb5569acfc72af8841fad949d
## What changed
Read `final_answer_moderation` metadata and attach `moderation: { moderated: boolean }` to the completed final-answer message only when its item ID matches. Apply this in both normal and plan modes, and reset the pending decision when a new response starts.
Preserve the answer's native item ID and moderation flag through legacy events and history reconstruction. Combine text parts into one legacy event when a moderation decision is present.
Expose nullable moderation data on app-server agent messages and update the JSON schemas, TypeScript types, and Python models.
## Testing
Add an integration test for moderation on completed answers and their legacy events. Extend protocol conversion tests to cover populated moderation data and serialization as `null` when absent.
GitOrigin-RevId: f286b67731a84b3daf5d10b7644f2e31b62f0e53
## What changed
- Register an additional Cloud connection on supported macOS and Linux launches when `TuiMultiBackend` is enabled, using the selected ChatGPT account and local network policy.
- Preserve backend settings and identify Cloud in connection controls and status.
- Let Cloud supply the model when a thread opens, skip local skills requests and stale results, and allow resume without a local working-directory override.
- Preserve Git metadata in Cloud thread snapshots and continue history hydration past empty filtered pages within the scan budget.
- Report Cloud connection failures and require reopening Codex to reconnect.
## Testing
Add regression coverage for Cloud model bootstrap, skipped skills requests, resume directory handling, history pagination through filtered pages, and Git metadata preservation.
GitOrigin-RevId: 6717f0f5ad7708c5e9b5796d94711dd1eecc49bb
## Why
Queued inputs previously stored and dispatched without the submitting client's Responses API metadata, losing attribution such as `client_type` when the queued turn started.
## What changed
- Accept `responsesapiClientMetadata` when adding or updating queued submissions and expose it on returned queue items.
- Persist metadata with the input and forward it when starting a selected item or dispatching an idle queue, including after restoration.
- Preserve existing metadata when an update omits it or supplies an empty map; replace it when a non-empty map is supplied.
- Keep stored inputs readable by older queue workers and update generated protocol artifacts.
## Testing
Extend queue service and app-server tests to cover metadata round trips, preservation and replacement on edits, compatibility with older readers, and forwarding during selected, idle, and restored dispatch.
GitOrigin-RevId: 508043b1d3d0298c9af2be8e05b6999de46596a1
## Why
Sidebar resizing previously required an open side chat, leaving the chooser without the same width controls.
## What changed
- Support keyboard resizing, width presets, and divider dragging for the sidebar chooser, with resize hints that fit narrow sidebars.
- Keep keyboard resize mode active across startup thread assignment and replacement of the chooser by a new side chat, so `Enter` finishes resizing without submitting the parent draft.
- Activate resize bindings only when a split is available, and prevent divider drags from starting while the split is animating.
## Testing
Add regression coverage for chooser resizing, width preservation when switching between the chooser and a chat, startup and side-chat creation transitions, draft preservation, and unavailable resize bindings in narrow terminals.
GitOrigin-RevId: 511cd4bb5894e6f33f0cf5d7472bb3013361ffe0
## Why
The TUI's cached active turn can be stale when a cloud message is submitted. A lost reply also leaves delivery uncertain, so automatically resending the draft risks submitting it twice.
## What changed
- Let the cloud server choose whether an Enter submission starts or steers a turn, and apply its receipt to the matching client message ID.
- Keep Tab-queued input waiting until the admitted turn finishes, including before its start notification arrives.
- Restore rejected submissions to the composer. Hold duplicate or unconfirmed submissions out of automatic delivery until history confirms them.
- Reconcile saved drafts and pending steers by client message ID when resuming sessions, and preserve submissions belonging to other turns during interruption recovery.
- Classify cloud preflight failures as invalid parameters so rejected queued input can be restored safely.
## Testing
Add regression coverage for cloud receipt outcomes, queued-input ordering, rejected drafts, lost replies, interruption recovery, and session resume with identical message text but distinct client IDs.
GitOrigin-RevId: ec4eb581e450488434bc4614ec59273d73ffd0a1
## Why
Incoming delegated messages were rendered as plain text, leaving Markdown formatting visible and links without hyperlink metadata.
## What changed
Use a dedicated history cell to render the message body as Markdown while keeping the source task attribution literal. Preserve hyperlinks and wrapping, and apply the appropriate list spacing for scrollback and the redrawable transcript.
Use the same rendering for live messages, resumed history, and transcript projection.
## Testing
Extend replay coverage to check matching live and replayed output, transcript rendering, hyperlink destinations, and shared source text across wrapped rows. Add a snapshot covering list spacing in scrollback and the redrawable transcript.
GitOrigin-RevId: e9864c7721fa1afa2d3662ab9f57122ab696a51e
## What changed
- When side retention is enabled, let the sidebar chooser create additional side chats from the main chat or reopen existing ones.
- Add numbered, clickable tabs and keyboard navigation in the chooser. Keep the selected tab visible when space is limited.
- Preserve drafts, transcript history, and the sidebar layout when switching between sibling side chats.
- Make `/side` with a prompt request a new side chat, while `/side` without arguments reopens the selected side chat. Preserve existing reuse behavior when side retention is disabled.
## Testing
Extend TUI tests and snapshots to cover creating sibling side chats, switching through the chooser and tabs, retaining drafts and history, and restoring image attachments after failed creation.
GitOrigin-RevId: 4166010c253c40a409390f7020b69478c04cf98c
## What changed
- Add an “Add custom provider” entry to the provider picker and an “Edit configuration” action for editable providers.
- Provide forms for custom gateway names, base URLs, and API key environment variable names, plus supported Bedrock and GCP settings.
- Validate required fields, suggest environment variable names from the provider catalog, and preserve drafts when validation or saving fails.
- Save configuration through the connected app server, write only changed fields, and refresh the provider list after saving. For uncertain creation results, ask users to check the list before adding the provider again.
## Testing
Add editor tests for validation, draft recovery, Vim input, and patches that preserve unchanged authentication settings. Add an integration test covering the edit action and custom provider creation while preserving the default provider, with snapshots of the new UI.
GitOrigin-RevId: 8eb32ed30ed27ab671f08f565af48705f2b9f193
## Why
Clients need to list models for a configured provider other than the app-server's startup default.
## What changed
Add an optional `modelProvider` parameter to `model/list` and expose it in the generated schemas and client types. Explicit selections use provider definitions loaded at startup and respect current managed provider requirements. Unknown providers return a structured `modelProviderNotConfigured` error.
Use a temporary catalog when selecting another provider, preserving the default catalog and its disk cache while retaining runtime authentication. Requests without a selector keep the existing provider and caching behavior.
## Testing
Add coverage for provider selection, preservation of the default catalog and disk cache, unknown-provider errors, managed requirement enforcement, and runtime authentication for temporary catalogs.
GitOrigin-RevId: 6092df9f6141810c6ac215a8e1fb601f77e54747
## Why
Starting a side chat waits for fork and setup requests. Keep the workspace responsive during those requests and let users return to an existing side chat through the sidebar chooser.
## What changed
- Add a clickable `Side chat` tab and `+` chooser, plus the configurable `focus_sidebar_tabs` action bound to `leader t` by default.
- Create workspace side chats in the background, showing loading and failure states with `Enter` to retry and `Esc` to go back. Preserve opening prompts and avoid taking focus when the user has moved away.
- Retain inherited permission profiles and defer startup notifications until the side chat is registered on its owning backend.
- Quiet the parent composer while the chooser has focus and prevent completion popups or repeated activation keys from consuming chooser input.
## Testing
Extend tests and snapshots for loading and failure states, returning to an existing chat, draft preservation, inherited permissions, focus transitions, and deferred MCP startup notifications.
GitOrigin-RevId: 244bcd3f170819e2260f21dc1041cf8899fe048c
## What changed
- Open a sidebar chooser when no side chat exists, with keyboard and mouse controls to start a new side chat while preserving the parent draft.
- Animate sidebar opening and closing, including reversing an unfinished transition, when animations are enabled.
- Show context-aware workspace shortcuts in a floating panel after a short delay, and render presets in the same overlay without moving the composer.
- Prevent chooser input from accepting an approval dialog before it has been painted.
## Testing
Add coverage for chooser activation and draft preservation, sidebar animation reversal, shortcut and preset snapshots, and approval input handling.
GitOrigin-RevId: 014112622a94798f4e611756c55112dfd8016051
## What changed
- Add Space to set the default provider from Model providers settings, persisting `model_provider` on the connected server. Keep provider details available and disable selection when server configuration or client launch settings fix the provider.
- Apply the choice to `/new` while preserving the current chat. Refresh account details for new chats and reject account data that does not match the started provider.
- Block stale `/model` choices during saves and after confirmed or uncertain provider changes, including across reconnects. Tell users to restart the app server and TUI to refresh the model list, and discard queued picker actions from another backend or chat.
## Testing
Add coverage for provider saves, retry after disconnection, concurrent-save prevention, stale model choices, and account/provider matching, with updated provider-picker snapshots.
GitOrigin-RevId: af6d149f7de7a2eaa09a31935f7088faa64d6a59
## Why
A tool can start before an assistant message finishes streaming. The TUI needs to incorporate the completed text without duplicating the reply or leaving Markdown split across interrupted fragments. Some streams also include initial text in `item/started` before sending deltas.
## What changed
- Display initial assistant text from `item/started`, avoiding duplicate starts for the same message.
- Track interrupted replies by turn and item ID, then replace their flushed fragments with the completed message at the reply's original position, preserving intervening tool order.
- Re-render the completed Markdown and update transcript views and scrollback.
## Testing
Extend streaming tests to cover initial text, resumed deltas, Markdown spanning a tool interruption, and matching live and replayed transcripts. Expand completion-repair cases to cover missing text and resumed fragments.
GitOrigin-RevId: 7f35e52d0bca2100baf722d7ef4922cd127bbc45
## Why
Reasoning summaries can arrive with item start or completion events rather than streamed deltas. The TUI can miss or truncate these summaries, and replay after a voice handoff can hide reasoning that started before the handoff.
## What changed
- Initialize reasoning from item start payloads and reconcile live and replayed completions with their full summaries. Preserve streamed text when completion payloads are empty, and continue honoring `show_raw_agent_reasoning`.
- Retain active reasoning payloads across refreshes without resetting an already active item when its start event is replayed.
- Preserve the typed origin of reasoning started before a voice handoff and filter later delegated reasoning starts from buffered replay.
## Testing
Extend regression coverage for summaries supplied at start or completion, partial streamed summaries, active reasoning after refresh, and replay that retains pre-handoff summaries while hiding delegated reasoning even after the handoff marker is evicted.
GitOrigin-RevId: 724b9fc58e10f4d87dabd3d9930e252270855a4f
## What changed
Allow experimental clients to request `deferOutput: {"commandExecution": true}` in `thread/items/list` for a specific `turnId`. Completed commands with a recorded completion time, exit code zero, and nonempty saved output return `outputDeferred: true` and `item.aggregatedOutput: null`. Clients can retrieve the complete output through `thread/items/read` using the turn and item IDs.
Keep full output by default and for listings across turns. Make conversion from `ThreadItemEntry` to `ThreadItem` fallible so Rust consumers detect deferred output instead of treating an incomplete item as complete.
## Testing
Add integration coverage for experimental capability gating, default and disabled options, command status and output eligibility, listings across turns, deferred-item conversion, and full output retrieval by item ID.
GitOrigin-RevId: d6bfac34bb68f7e3b327fd5553270ed6d0fe87cf
## What changed
Add configurable pane actions with default leader shortcuts:
- `leader z` zooms or restores the focused conversation pane.
- `leader ,`, `leader .`, and `leader =` minimize, maximize, or equalize pane widths within layout limits.
- `leader shift-h` and `leader shift-l` move the divider while the side pane has focus.
- `leader r` enters resize mode, highlighting the divider and showing keyboard hints. Arrow keys or `h`/`l` move it one column; Shift+Left/Right move it ten columns. Enter or Esc saves the width to `tui.sidebar_width_percent`.
Discard resize previews when terminal focus is lost or the split layout becomes unavailable. Preserve exact column widths at the current terminal size for presets and completed keyboard resizing, avoiding percentage-rounding drift.
## Testing
Extend TUI tests and snapshots to cover zoom and restore, width presets, divider movement, resize previews and persistence, and interrupted resizing. Extend keymap tests to cover zoom binding conflicts and custom chords.
GitOrigin-RevId: 7dd823fd8c2a0c90368c66f254c4fdd7c863c8a8
## Why
Pets were unavailable in tmux even when fullscreen Codex could render Kitty images through passthrough.
## What changed
- Enable pet images and picker previews in fullscreen tmux panes with Kitty passthrough, and update the unavailable notice to recommend fullscreen mode with `allow-passthrough all`.
- Use pane-specific image IDs and virtual placements for pets and previews, reserving separate IDs from transcript images. Repaint underlying text when pet placeholders move or disappear.
- Draw pets and previews when refreshing the fullscreen transcript, and consume preview areas once per render.
## Testing
Extend the owned-screen lifecycle test to verify that preparing fullscreen enables the Kitty protocol in tmux and returning to scrollback disables it. Update `/pets` notice assertions and the popup snapshot.
GitOrigin-RevId: 02c838ceb06abcbb45314e1d38ff4cde77221426
## What changed
Enable composer and transcript image previews in owned-screen mode under tmux when the client is Ghostty or Kitty, RGB is supported, and `allow-passthrough` is `all`.
Use Kitty virtual placements and Unicode placeholders so images move with their pane. Allocate image IDs per pane and repaint the viewport when replacing or removing images to clear stale placeholders.
## Testing
Extend image rendering tests to cover tmux virtual placements, placeholder snapshots, redraw retention, and overlay cleanup. Add probe coverage for pane-specific image IDs and rejection of visible-only passthrough.
GitOrigin-RevId: d34abacabfabc47a4354eab016ee4370835cadc9
## What changed
- Use the shared runtime and effective configuration for account API clients and remote plugin requests, including standalone plugin commands.
- Support dual-header and assertion-only authentication for remote plugins and MCP file uploads when runtime agent instances are enabled.
- Keep plugin credentials and caches scoped to the thread's account when resuming with different credentials. Bind request pools and multi-step plugin storage operations to the selected account so account replacement revokes stale operations.
- Protect runtime credentials on cross-origin redirects while preserving configured routing policies and legacy authentication for custom backends.
- Apply server-provided `upload_headers` to file storage uploads.
## Testing
Add coverage for shared runtime registration, both authentication modes, configuration reloads, resumed-thread account selection, account replacement during plugin uploads and downloads, and credential stripping on redirects. Extend file upload tests to verify runtime assertions and storage-only upload headers.
GitOrigin-RevId: 68aef81051a6f9bf919fffda52f372b108fce805
## What changed
Add a Model providers entry under Sessions to browse the connected app server's provider catalog. Show the current chat's provider and the default for new chats, with scrollable details for endpoints, authentication settings, and provider-specific configuration. Browsing does not change the active provider.
Handle loading, dismissal, stale responses, disconnected servers, and unsupported server versions. Refresh an open provider list when the first chat attaches.
## Testing
Add tests and snapshots covering provider lists, scrollable details, initial chat attachment, nested views, stale results after dismissal and reopening, and unsupported server methods.
GitOrigin-RevId: 2deb4e286b2648d9f459e403361e5501db98ca96
## What changed
- Allow dragging the pane divider and save the preferred width in `tui.sidebar_width_percent`, defaulting to one third of the terminal. Defer reflow until release when retained images are present.
- Support scrolling and loading older history in the unfocused pane, opening links, copying selections, and clicking its composer to switch focus while preserving the clicked text position.
- Keep assistant replies, running command completion, and turn status current in the unfocused pane without duplicating answers or completion metadata when focus returns.
## Testing
Add regression coverage for divider previews and saved widths, image-aware resizing, composer clicks, unfocused history pagination and copying, and streaming replies and command completion across focus changes.
GitOrigin-RevId: a26accc0f8df3c17f53bc915db29a11c8de3c480
## Why
UI tree limits previously applied during rendering, silently dropping content
beyond the budgets. Validate the whole JSON tree before rendering so oversized
inputs are rejected, including content outside the visible line.
## What changed
- Add a `UiTree` string parser that limits JSON to 64 KiB, nesting depth to 16,
non-null nodes to 256, and total string content to 16 KiB of UTF-8.
- Represent text as string leaves or `text` elements with children. Remove node
keys, `spacer`, and `divider` elements.
- Require an explicit `row` gap as a non-negative JavaScript-safe integer measured
in terminal columns. Bound rendered spacing by the viewport and skip empty
children when inserting gaps.
- Update footer content and built-in status lines to use the revised tree format.
## Testing
Add coverage for malformed elements and gaps, whole-tree size boundaries, URL
length limits, large-gap rendering, and bounded UTF-8 prefixes for directly
constructed text. Update hyperlink and footer clipping tests for the new format.
GitOrigin-RevId: 3c00881d3e7f2d79d11aa188f64f0725cd47ee68
## What changed
Replace parallel lookup sets and per-turn maps with a single arrival-ordered list of pending interactive requests. Centralize request matching for replay filtering and cleanup, deduplicate repeated requests, and resolve user input answers against the oldest pending question for the turn.
GitOrigin-RevId: c02115c289718a39359a6e6653d1dc7d588d2f90
## What changed
- Extend server-owned fresh-start bootstrap to embedded connections, preserving explicit profile and launch overrides.
- Require `config/read` to succeed before starting a fresh thread, including on servers that do not support the method.
- Prefetch `model/list` alongside `hooks/list` and reuse the result during bootstrap.
## Testing
Extend startup coverage for managed model and reasoning-effort defaults across embedded, daemon, and remote connections. Verify startup failure shuts down all initial backends, and directory-trust startup requests the model catalog exactly once while `hooks/list` is outstanding.
GitOrigin-RevId: c96edfbc13c98203b7c2a809a87d225e05cf5f1b
## Why
Changing the default model provider should not prevent users from resuming or continuing a thread that uses another configured provider.
## What changed
- Resolve cold resumes using the thread's saved provider and reject explicit attempts to switch it on resume.
- Use retained provider configuration for loaded threads without reloading the current default selection, while continuing to enforce managed provider policy.
- Preserve errors for missing provider definitions and policy conflicts.
## Testing
Update app-server and TUI coverage for resuming with a different default, recovering after restoring a missing provider definition, preserving drafts across resume retries, and continuing loaded threads with malformed system defaults.
GitOrigin-RevId: c5bf3b03cacde7349480c94c2f10bac827a0eb1f
## Why
Directional pane switching cleared the parent conversation's transcript selection or Find state, so returning to it interrupted the interaction.
## What changed
Route left/right pane switches through the existing conversation toggle to park and restore each pane's transcript interaction. Explicitly focusing the main composer still clears transcript interaction.
## Testing
Extend the side-conversation test to cover restoring selections, Find text and caret position, and composer input after scrolling. Add a snapshot verifying that Find remains editable after switching away and back.
GitOrigin-RevId: 172f9be0df15517fbfe7f3773b63cbd1cef1cc77
Felipe Coury