## What changed
- Let users press `Ctrl+S` in the report note editor to save a diagnostic ZIP locally without sending it to OpenAI, including when uploads are disabled. Keep `Enter` for sending reports when uploads are enabled.
- Apply the attachment consent choice to both destinations, clarify the disclosures, and show the saved archive path on completion.
- Require a local app server for ZIP saves, report unsupported servers with an upgrade hint, and stop before collecting a note when no report destination is available.
## Testing
Add coverage for ZIP creation with and without log consent, no upload requests on save success or failure, destination availability, keyboard actions, and saved-path receipts. Update report UI snapshots.
GitOrigin-RevId: cbc0142988840e5e3f6475f31678915bf25d56a2
## Why
Switching to a model whose access metadata excludes Daybreak can leave Daybreak enabled and block subsequent turns.
## What changed
Automatically turn Daybreak off when a model switch or catalog refresh confirms that it is unavailable for the selected model. Persist the disabled preference for the thread and new threads, and warn that prior cybersecurity context may still cause refusals. Switching back to a compatible model leaves Daybreak off until the user re-enables it with `/daybreak`.
Require explicit access metadata before disabling Daybreak, and recheck the selected model before applying a queued change.
## Testing
Extend session lifecycle coverage for pending model discovery, supported and unknown models, persisted disabling, and subsequent turns using the standard access program. Add a snapshot of the model-switch warning.
GitOrigin-RevId: 6c294939d854c7176ed9a346e8ea806ffcf6f715
## What changed
Move `ThreadMetadataBuilder` into its own module, make its fields private, and replace direct field assignments with fluent `with_*` methods. Initialize `updated_at` and `recency_at` from the creation time and default the approval mode to `OnRequest`.
Update `apply_rollout_items` to accept a boxed `ThreadMetadata` seed, keeping callers' async frames small while preserving existing database fields except for the seed rollout path. Add `build_thread_metadata` to use the state runtime's configured provider, and use `thread_id_from_rollout_path` directly for the doctor's filename fallback.
GitOrigin-RevId: a27e4c6b22832e902922dbdd60d7f5c11b4a1a83
## What changed
Mark `untrusted_as_tool_output` as stable and enable it by default. Untrusted additional context, such as browser information and goal objectives, now reaches the model as `function_call_output` items in the `agent` namespace instead of user messages. Setting `features.untrusted_as_tool_output = false` preserves the message format.
## Testing
Update core, app-server, TUI, and Python SDK test expectations for the default output format. Cover context persistence, deduplication, goal continuation, and explicit opt-out behavior.
GitOrigin-RevId: 30828351e2ed584928f6055b6dcf276d8288c0fb
## Why
Failure to open the diagnostic logs database should not disable thread storage or database-only history listing. Thread deletion must still preserve saved conversations when diagnostic log cleanup cannot complete.
## What changed
- Allow state initialization to continue after non-corruption errors opening the logs database, while preserving corruption recovery.
- Report the original diagnostic database error after tracing is installed in the TUI and app server, and return it from log operations.
- Reject thread deletion before destructive cleanup when diagnostic storage failed to initialize.
- Continue periodic cleanup of legacy logs when the current logs database is unavailable.
## Testing
Extend coverage for unavailable log directories, database-only history listing, startup diagnostics, deletion preserving saved conversations, corrupt log headers, and periodic legacy log cleanup during a diagnostic storage outage.
GitOrigin-RevId: a5184580ae6c39ed0c4eefa8cb48ee7731a991c3
## What changed
Submit asynchronous question answers through Cloud's start-or-steer admission path when a turn is running, and use start-if-idle submission otherwise. Resolve the submission intent against the session mode so local and remote sessions retain their existing behavior.
Apply normal message admission handling to Cloud answers, clearing accepted replies and restoring rejected replies to the composer.
## Testing
Add a regression test covering accepted and rejected Cloud question replies, including the submitted answer and client message ID, composer state, and absence of extra requests.
GitOrigin-RevId: 757556e8a11bc148a92cde8ca05fe06aa291ee2c
## Why
The macOS clipboard reader requests TIFF even when PNG or JPEG data is available, causing clipboard owners to generate a large TIFF just for a paste. Pasted image files also need their orientation metadata applied before encoding attachments.
## What changed
- Read native macOS pasteboard representations before falling back to `arboard`, preferring PNG within each item while respecting item order and JPEG/TIFF ordering.
- Keep copied image files ahead of clipboard previews and apply orientation metadata when decoding files and native PNG/JPEG data.
- Share orientation-aware decoding with transcript thumbnails while preserving allocation limits.
## Testing
Add tests for pasteboard item ordering, all EXIF orientations in PNG and JPEG images, and rejection of images exceeding the allocation budget.
GitOrigin-RevId: 088f37a3205e49c805a09a84bbbb00b74dd6cb78
## Why
The rate-limit model switch prompt can remain visible after account usage falls below the warning threshold.
## What changed
Use fresh account usage reads to clear pending prompts when all reported usage windows fall below 90%. If the prompt is already visible, replace it with a recovery notice that counts down for five seconds before dismissing. Users can also dismiss the notice with Enter or Esc.
Ignore stale account reads when detecting recovery and preserve the recovery state when backend banners replace the prompt.
## Testing
Add regression tests and a snapshot covering pending prompt cancellation, stale reads, the recovery notice countdown, automatic dismissal, and manual dismissal with Enter or Esc.
GitOrigin-RevId: 9408f7cc7b49c52535f00d8a476f208fe4872bdf
## Why
Background terminals kept the terminal program status at `Working` after a turn completed, preventing it from reporting `Done` or returning to `Idle` when acknowledged.
## What changed
Stop treating running background processes as active work when computing terminal program status. Background terminals remain visible in the TUI while the status follows the turn lifecycle.
## Testing
Update the lifecycle regression test to complete a turn with a background terminal still running and assert the `Done` → `Idle` transition on acknowledgment.
GitOrigin-RevId: cb995947e6868d6128736a621f268ebfe3891eec
## Why
URLs in fullscreen Markdown transcripts could split across rows even when the full URL would fit on its own row.
## What changed
Mark non-code Markdown lines containing URL-like text with the `UrlAware` wrap policy so transcript layout preserves fitting URLs on a single row.
## Testing
Add a regression snapshot showing a documentation URL moving intact to the next row after introductory text. Update the conversation snapshot and copy-on-select test dimensions for the changed wrapping.
GitOrigin-RevId: 4812c83483cff412406a71ae6745977c5384c7da
## Why
After Cloud thread history is replayed in the TUI, notifications for the same completed assistant items can render their text again.
## What changed
Track completed assistant items rendered from Cloud history by turn and item ID, and ignore subsequent starts, text deltas, and completions for those items. Apply this tracking when resuming threads and replaying thread snapshots, while allowing unfinished items and new turns to continue streaming.
## Testing
Extend the Cloud resume picker test to cover repeated notifications for completed messages, continued streaming in an active turn, and responses in a later turn. Retain coverage for queued user message reconciliation without resubmission.
GitOrigin-RevId: 1a829a2964586d876339c7c759022e4d366c8b2e
## Why
A queued cloud stream disconnect can outlive a successful reopen of the same conversation, causing an obsolete reconnect error to reach the TUI.
## What changed
Represent cloud reply stream losses with `AppServerEvent::ThreadStreamDisconnected` and filter queued losses superseded by a successful attachment to the same thread. Preserve losses for other threads and any newer disconnects; failed reopen attempts do not supersede pending losses.
Continue displaying current stream disconnects through the TUI's error notification handler.
## Testing
Add regression coverage for successful and failed reopens, disconnect ordering across threads, and TUI handling of disconnect events from the active and foreign backends.
GitOrigin-RevId: 640332b817970717fc816ab5a32bf658c01233bf
## Why
Failed Cloud turns can contain an error without any items. Loading history through item pages alone can omit these older failures from the full transcript.
## What changed
- Add a `FullTranscript` hydration scope that fetches remaining Cloud turn metadata in pages of 100 after loading items.
- Deduplicate overlapping turn pages while preserving chronological order and already loaded items.
- Use the new scope for session transcripts while retaining `Complete` hydration for exports.
## Testing
Add a regression test covering older itemless failures, overlapping turn pages, repeated pagination cursors, transcript ordering, and item-only exports.
GitOrigin-RevId: 51183e35984aa0183d044061768555bb6f5d1189
## What changed
- Show latest user-prompt previews beneath saved side-chat titles, fetching previews only for visible entries when the chooser refreshes.
- Keep cached chats available during discovery, show loading and refresh status, and offer an inline retry action on failure.
- Preserve the selected chat across list updates and prevent asynchronous changes or held activation keys from opening an unintended entry. Account for preview rows in paging and mouse selection.
- Explain that side chats become available after the first main-chat message, and let `Ctrl+C` dismiss the chooser while preserving the main draft.
- Separate tabs with noninteractive gaps and improve hover styling for tabs, overflow arrows, and the add button.
## Testing
Extend integration tests and snapshots for discovery failures and retries, refreshed prompt previews, activation guards, variable-height paging, draft preservation, and tab hover states across light, dark, and fallback colors.
GitOrigin-RevId: 34423f5aeccb566682f7aa219f54ca5c7c8304fb
## Why
Command center search only filtered tasks already loaded for browsing, leaving older tasks undiscoverable without manually loading more history.
## What changed
- Scan history on the active backend for case-insensitive matches in task names, previews, and working directories, using a separate paging cursor for each query.
- Add loading, retry, and `Show more matches` states. Cancel superseded searches and ignore stale results.
- Keep history matches separate from browse results and restore the previous selection when leaving search.
- Preserve the original task preview for search while displaying the latest prompt in task details.
## Testing
Extend discovery and command center tests to cover older history matches, fresh queries after browse pagination is exhausted, selection restoration, actions on search results, loading and retry states, and separate original previews and latest prompts.
GitOrigin-RevId: 9864ee006a14bd232e9cfd7ab2ee099c84667597
## Why
Clients attaching to a shared app server can miss startup notifications and have a different local MCP configuration. Waiting for locally configured servers can leave the TUI stuck in a busy state.
## What changed
- Track only reported MCP servers for shared app servers and subagents, settling startup once observed starts complete.
- Handle standalone terminal updates without reopening startup, while reporting failures and cancellations even when their starts were missed.
- Suppress duplicate diagnostics until an observed retry or notification lag, and include all received outcomes in each active round's summary.
## Testing
Add regression coverage for attachment before, during, and after startup; idle keyboard behavior after startup settles; terminal-only failures and cancellations; and repeated failures after retries or notification lag.
GitOrigin-RevId: e19f23c212f2f3cee1adeb5c3b94a508aa599242
## What changed
Only allow the cancel action to dismiss the agents overview when a chat is displayed or a startup thread is pending. Hide the `esc back` footer hint when there is no chat to return to, while retaining back hints for help and metadata editing.
## Testing
Add coverage for returning to a chat that is still starting and for pressing Escape in the overview after cancelling folder trust. Update snapshots and test setup to reflect whether a chat is available.
GitOrigin-RevId: af259330eb2a743fde449bbbd47c7f0eb6fa937e
## What changed
Show a startup warning when the active model matches the CLI model override but is missing from the ChatGPT model list, for ChatGPT accounts using the OpenAI provider. Suggest checking the spelling or choosing another model with `/model`, while preserving the selected model and submitting queued startup input.
Reuse the transcript-visible warning helper for this notice and existing usage warnings.
## Testing
Extend the startup test to check the warning text, preserved model selection, and queued input submission.
GitOrigin-RevId: bb1e8c415346bf271e25ef4e8571c13b4bc2c8c8
## Why
Custom-provider sign-in previously required a saved gateway configuration and stopped at an error when none existed.
## What changed
- Add “Create a custom provider or gateway” to the sign-in picker, reusing the settings form and provider-write handling.
- Return to the picker after saving, highlight the new provider, and require explicit selection before setting it as the default and completing sign-in.
- Preserve entered fields after validation failures and keep the focused field or Save action visible in short terminals.
- Use consistent custom-provider and gateway wording across sign-in, settings, and validation messages.
## Testing
Add onboarding tests and snapshots for an empty picker, creation, validation retries, short-terminal rendering, and explicit default selection. Extend app-server coverage for rejecting the reserved `ollama-chat` provider ID.
GitOrigin-RevId: 339ac5807c5eecdae08df4dbd89874ea7c764d35
## What changed
- Add configurable `sidebar_up` and `sidebar_down` actions to cycle through tabs with wraparound while the sidebar has focus. Default leader shortcuts use `Shift-Tab` / `Tab`, `Up` / `Down`, and `k` / `j`.
- Support mouse-wheel tab switching over the tab strip and clickable overflow arrows when tabs do not fit.
- Show previous/next tab shortcuts in the leader HUD and keymap picker, and preserve pane zoom when switching tabs.
## Testing
Extend sidebar interaction tests and snapshots to cover overflow arrows, mouse-wheel navigation, leader shortcuts, repeated custom bindings, draft preservation, and scroll handling where the leader HUD overlaps the tab strip.
GitOrigin-RevId: 39ccb40f40560d1be850397f9597e765caa996a3
## Why
Skill completion inserts a trailing space, leaving unwanted whitespace when the next typed character is punctuation, such as `$rustdoc ,`.
## What changed
Replace the space inserted by skill completion when immediately followed by common closing punctuation, producing `$rustdoc,` instead. Support both skill mention pickers, including full-width punctuation and `》`, while preserving skill bindings.
Preserve existing draft whitespace and keep the separator for pasted text or punctuation entered after cursor navigation. Classify buffered punctuation as typing or a paste burst before deciding whether to remove the space.
## Testing
Add regression tests for punctuation, existing spacing, cursor navigation, and paste bursts, plus a snapshot covering `》`, recovery state, and preserved skill bindings.
GitOrigin-RevId: 8988add8092e8cb5f0618ef834590d52a81ad576
## What changed
- Save side chats as attachments to their parent conversation when local workspace history supports them, and let users reopen them from the sidebar after a restart.
- Show chat names or first-prompt previews in sidebar labels, and allow saved side chats to be renamed with `/rename`.
- Add tab close buttons, middle-click closing, and the configurable `close_sidebar_tab` shortcut, defaulting to `Ctrl-X W`. Closing a saved chat keeps it available in the picker; archiving removes it from Side chats.
- Confirm actions that stop running work, discard unsent input, or lose temporary history. Delete saved TUI side chats when deleting their parent conversation.
## Testing
Add coverage for reopening saved side chats after restart, archive handling, close confirmations, and preventing close-confirmation keys from accepting a replacement approval dialog.
GitOrigin-RevId: 3d47533d007286a7354660c08df13a83dd48d5d7
## What changed
- Honor `RuntimeAgentInstances` and the configured runtime auth mode for Analytics plan discovery and report requests to OpenAI endpoints.
- Share installation ID resolution and Codex runtime registration setup through `codex-runtime-agent-instance`.
- Preserve typed runtime authentication errors so expired credentials retain the “Sign in again to load Analytics” guidance.
## Testing
Add coverage for both runtime auth modes across regional and staging endpoints, fresh assertions for each request, sign-in guidance after bootstrap failure, redirect rejection, and invalid organization/project selectors.
GitOrigin-RevId: 50e0d959b3abd81ebe7a6a584e272f14cf52e504
## Why
Security reminder requests need to use app-server's active authentication and HTTP runtime, with results bound to the login that fetched them.
## What changed
- Add `account/securitySetup/read`, returning an optional notice with account and user IDs, plus generated protocol schemas and bindings.
- Fetch reminders in app-server only for a matching saved ChatGPT login. Return `notice: null` for ineligible, unavailable, or timed-out reads, and discard results when the login changes during the request.
- Route TUI reminder reads through the new method while retaining notice validation and identity checks. Unsupported servers produce no reminder.
## Testing
Add coverage for shared runtime use across restarts, ineligible authentication modes, and login changes during a fetch. Update TUI coverage for unavailable, unsupported, and mismatched notices.
GitOrigin-RevId: 426fee7ce98df17970957c06876881bc5b005196
## Why
An inherited turn can suppress a fork's configured developer instructions, leaving the first side-chat request without its developer policy.
## What changed
- Move shared side-conversation instructions and the history boundary into `codex-context-fragments`.
- Inject the developer policy before the user-role boundary when creating a TUI side-chat fork, while retaining the configured instructions.
- Distinguish attached and temporary policies, applying the worktree restriction only to temporary side chats.
- Add guidance to set up recurring monitors in the main chat or a new chat because temporary side chats cannot run scheduled updates.
## Testing
Add a TUI integration test that checks the first side-chat model request contains the policy and boundary. Add a core request-history snapshot covering an attached side chat that preserves inherited context, policy, and its prior answer after resuming from disk.
GitOrigin-RevId: 889cb317dc3327457cd9ef0879ec9f77dbfaeeba
## Why
Cloud messages previously accepted only plain text, and switching a draft to Cloud waited for session preparation without processing composer input.
## What changed
- Support ordered text and image parts in Cloud submissions and user-message summaries, preserving attachment placeholders, image detail, and client message IDs.
- Accept inline data URLs and uploaded file IDs, including image-only messages. Reject invalid references and text spans locally, and cap encoded image requests at 3.75 MiB while retaining the existing plain-text limit.
- Keep the composer editable and redraw the TUI while Cloud prepares a conversation. Carry the latest draft, attachments, and Vim mode into the destination, retain drafts on failure, and prevent submission to the outgoing session during the handoff.
- Preserve buffered paste input and pending clipboard reads across the handoff, with connection and failure hints.
## Testing
Add regression coverage for image wire encoding, receipt identity, validation and size boundaries, draft editing during successful and failed handoffs, clipboard completion, Vim state, and attachment recovery after rejected submissions.
GitOrigin-RevId: 0cbcde0ab89ba961780b5f88456057e6b6a19cd5
## Why
Regular chats start MCP servers eagerly even when cached tool definitions are available and the servers go unused. Allow those chats to use the cached catalog and defer eligible stdio servers until first use.
## What changed
- Add the disabled-by-default `mcp_lazy_stdio_startup` feature and expose it through experimental feature configuration.
- Defer cached stdio servers in regular chats when enabled, while keeping servers that require a live startup connection eager. Required servers with `startup_readiness = "catalog"` may defer; explicit reconnects remain eager.
- Announce the full eager startup batch before terminal statuses and exclude dormant servers from the initial startup summary. Update TUI tracking so deferred servers can report startup independently in later rounds.
## Testing
Add scenario coverage for a cached server staying dormant during unrelated work, starting on first use, and refreshing tool definitions and visibility. Cover required live startup, eager event ordering, experimental feature configuration, and TUI status handling.
GitOrigin-RevId: 74075fcd4f26c8c79b5901b6a8cb03fdb9e35a7f
## Why
Extension status content was limited to one row, clipping multiline text and content that wraps at narrow terminal widths.
## What changed
Measure extension status content at the available width and reserve up to four rows in both shared and separate status layouts. Account for mode indicators and warnings, and remeasure when content or available width changes.
Extra status rows yield to the draft and other composer surfaces when vertical space is limited. An unfocused composer keeps a single dim status row.
## Testing
Add regression coverage for resizing, wrapping beside mode indicators and warnings, hyperlink preservation, limited vertical space, cursor placement, footer overrides, focus changes, theme updates, and reasoning effort changes.
GitOrigin-RevId: 6a637b5cf6f34684639a92d920da4795c90abb6f
## What changed
- Use the same status renderer for shared footer rows and separate status lines, allocating extension content the width left by the mode indicator.
- Measure extension content with `measure_natural()` instead of rendering it at maximum width.
- Skip reasoning effort status transitions for extension content and clear an active transition when extension content replaces the status line.
## Testing
Add regression coverage for matching shared and separate layouts across terminal resizing, natural width measurement, viewport clipping with hyperlinks, and skipping effort transitions when switching between native and extension content.
GitOrigin-RevId: 4ffc52ec6374f3c2b4995c0472bee25aa15ae7a0
## What changed
Use a shared layout traversal to measure prepared UI trees and paint text directly into terminal buffers. Add natural and viewport-constrained size measurement, and use direct rendering for extension footer content.
Preserve wrapping, styles, and terminal hyperlinks while clipping at grapheme boundaries and leaving overflow ellipses unlinked.
## Testing
Add coverage for size measurement in terminal cells, wide characters at clipping boundaries, and zero-width text around overflow ellipses. Update rendering tests to check painted buffer contents and hyperlinks.
GitOrigin-RevId: 828c45d3400f9e3dfce9a7bd812d1cc0ea51642f
## Why
Footer width measurement and rendering each prepared the same UI tree again.
## What changed
- Prepare footer extension content once and share the owned `PreparedUiTree` through `Arc`.
- Resolve colors against the active theme at render time, caching each color resolution within a render pass.
- Share leaf text buffers across prepared chunks instead of copying their slices.
## Testing
Add a test verifying that chunks from a clean text leaf retain slices of the original buffer. Update existing UI tree rendering tests to use the owned prepared representation.
GitOrigin-RevId: daba035c291338f3e0036e9ad4f2fd26f56a3910
## Why
Enabling `tui_extensions_status_line` routed configured status lines through a plain-text extension renderer and hid the “Use theme colors” option in the status line picker.
## What changed
Always use the native status line renderer for configured items and their live picker previews, preserving theme colors and pull request links regardless of the extensions flag. Always expose the theme color option in the picker, and clarify that the flag enables experimental MCP status line providers.
## Testing
Update coverage to require native status line content across extensions flag changes and exercise the live picker preview with the flag enabled. Retain checks for pull request hyperlinks and color preference preservation.
GitOrigin-RevId: bce7df5696c2bd3583d3ef99c43e7a2014e17294
## What changed
Render prepared UI trees within a viewport's width and height, preserving authored line breaks and wrapping text while retaining styles and hyperlink ranges.
- Add `wrap: "wrap"` for rows to move children onto additional lines; keep `nowrap` as the default.
- Allocate space to row children while reserving later siblings' minimum widths.
- Mark horizontal clipping and vertical overflow with an unlinked ellipsis, including in single-line rendering.
- Respect word hyphens across style boundaries and nonbreaking spaces when wrapping.
## Testing
Add regression tests for nested row wrapping, sibling width allocation, hyperlink offsets and clipping, and word boundaries. Add a buffer snapshot covering authored line breaks, collapsed whitespace, styles, and links.
GitOrigin-RevId: fdfbdee92808c0a8f55e2fdf11db95d68a76d9a5
## What changed
Add `UiTree::prepare` and `PreparedUiTree` to prepare styled inline text and row structure independently of viewport width. Compute minimum and preferred widths for text and nested rows, including gaps, and retain authored line breaks when filtering zero-width children.
Render the first line from the prepared tree while retaining overflow ellipses and hyperlink clipping.
## Testing
Add a preparation test covering row width measurements across styled text, nested rows, gaps, empty children, combining marks, and non-breaking spaces.
GitOrigin-RevId: 5f63366c0568a01cb55686d9f14c1b3fac90946f
## What changed
- Collapse spaces and tabs across inline leaves, trim leading and trailing whitespace, and keep rendering limited to the first line.
- Prepare Unicode line-break opportunities across style boundaries and join graphemes split across leaves. Use the first fragment's style and retain a hyperlink only when all fragments share its destination.
- Preserve row boundaries and explicit gaps, and use row gaps for status-line separators.
- Prevent zero-width fragments from adding row gaps or changing the ellipsis style.
## Testing
Add regression tests for whitespace collapse, split graphemes, hyperlink ownership, zero-width fragments, and line-break consistency between styled runs and contiguous text.
GitOrigin-RevId: 94e58808bc8469e9cd0adddb16c194b9568cfbb6
## Why
The UI tree renderer's CSI-only sanitizer leaves OSC command contents visible in rendered text, including embedded hyperlink URLs.
## What changed
Use `vtparse` to sanitize each string independently, retaining printable text, tabs, and newlines while discarding terminal commands and other control characters. Preserve the existing text limit, first-line rendering, and tab expansion.
## Testing
Add a regression test covering color escapes, carriage returns, OSC hyperlinks, and an incomplete escape sequence before a structured link. Assert the rendered text and the structured link's hyperlink range.
GitOrigin-RevId: 51899f62d10f6a1321f96278616fe7a51bad17d9
## Why
Extension UI trees previously accepted only named terminal colors and literal RGB values. Semantic colors let extension content follow the active syntax theme and terminal color capabilities.
## What changed
- Accept `primary`, `surface`, `accent`, and `status-*` color roles for text foregrounds and row backgrounds.
- Resolve semantic colors against the active theme when rendering extension footer content. Prefer the `codex.accent` scope for `accent`, falling back to the theme's accent setting.
- Reuse status-line scope mappings and fallback colors, with terminal-default fallbacks for unavailable primary, surface, and accent colors.
## Testing
Add color serialization coverage and rendering snapshots for dark, light, and empty themes in truecolor and ANSI 16-color terminals, including nested foreground and background styles.
GitOrigin-RevId: 156f137859d74178f9ae6aa46a02eecb815e9802
## What changed
Allow `requirements.toml` to pin `features.runtime_agent_instances.mode` to `dual_header` or `assertion_only`. Apply the required mode when no explicit mode is configured and reject conflicting explicit settings, while preserving legacy boolean requirements.
Document experimental runtime authentication configuration, credential lifecycle, and bootstrap authentication behavior.
## Testing
Add coverage for managed mode defaults and conflicts, runtime reuse and rotation across account requests and restarts, fresh assertions on Realtime and MCP reconnects, and Realtime destination and environment restrictions.
GitOrigin-RevId: bcf9502178f477c1e8232386f1f3e360bf23d667
## What changed
- Add the disabled-by-default `gateway_setup_wizard` feature to let users choose a saved custom gateway during eligible local sign-in onboarding.
- Save the selection as `model_provider`, restart the embedded app server with that provider, and complete required primary authentication and gateway OAuth before starting the first chat.
- Show gateway loading and configuration errors, browser sign-in links, and an OAuth retry action. Respect provider policy and launch overrides.
## Testing
Add coverage for onboarding eligibility, saved gateway selection and persistence, and gateway error and OAuth screens. Add a terminal integration test verifying that the selected gateway receives the first chat with authentication.
GitOrigin-RevId: 92bd2da3abd28d6c2274c91b2d7561bf359f0ca0
## What changed
- Extract helpers for image paste shortcuts, paste-burst ticks, restricted draft edits, and composer activity detection.
- Thread `ShellPrefixHandling` through text insertion and pending-input flushing.
- Return a configuration rebuild future that does not borrow the app or base configuration.
## Testing
Add a regression test covering image paste while `!` is buffered: Enter preserves the draft during the paste burst, and subsequent submission includes the image and literal `!` without running a shell command.
GitOrigin-RevId: fb9a3c8a70aed524c65022f2c0910ce2ad11d4d2
## What changed
Pass the local project's GitHub origin to cloud prewarming so new cloud threads can provision a repository checkout. Preserve the attached local project when switching backends and resolve its origin for each thread start.
Normalize supported GitHub origins to credential-free HTTPS URLs and select a repository-specific cloud working directory. Unsupported origins retain the blank environment behavior. Keep project metadata outside the app-server wire protocol, and fix HTTP Git URL parsing so query strings and fragments cannot be mistaken for authority text.
## Testing
Add coverage for project routing, origin normalization and rejection, managed environment encoding, local project retention, and Git URL credential stripping.
GitOrigin-RevId: 5859769965faf060461ccc1cbb3fd48f8e2f2155
## What changed
Add a nullable `userId` to `GetAccountResponse`, populated from the same authenticated account snapshot as the rest of the response. ChatGPT and personal access token sessions return the canonical ChatGPT user ID when available; API-only and signed-out sessions return `null`.
Update the cloud client, generated schemas, TypeScript and Python types, and account identity documentation. Default missing IDs to `None` when deserializing responses from older app servers.
## Testing
Extend account response tests to check ChatGPT and personal access token user IDs, null IDs for other providers and signed-out sessions, and ID changes when switching providers with saved ChatGPT credentials.
GitOrigin-RevId: 7ad3da3cfc835c4d08d03c8e91b06cd7e007d874
## What changed
Support `bold`, `italic`, and `underline` nodes, plus text properties for color, weight, italics, and underlining. Nested text can override inherited styles, including disabling modifiers.
Add row backgrounds that apply to children and gaps. Text colors and row backgrounds accept the eight standard ANSI color names or `#RRGGBB` values, with RGB colors resolved through the terminal palette. Preserve the last visible span's style on overflow ellipses while keeping them unlinked.
## Testing
Add coverage for style serialization and invalid values, nested modifier depth limits, inherited styles and overrides, row backgrounds, styled truncation, and foreground/background palette resolution, including a rendered buffer snapshot.
GitOrigin-RevId: 6b19b6b740cd754890c8adb489fba414a6ee62d3
## Why
Typed prompts currently display Markdown syntax literally, including emphasis, lists, and code fences.
## What changed
- Render Markdown in typed prompts while retaining the prompt gutter, background, and hyperlinks.
- Preserve literal rendering for spoken prompts, prompts with inline text elements, and text without visible Markdown formatting.
- Keep the original Markdown when copying a whole prompt, and preserve source text for code block and blockquote copy targets.
- Preserve bold styling when leaving the dim prompt marker and track hyperlink columns incrementally across styled spans.
## Testing
Add regression coverage for prompt rendering at multiple widths, hyperlink positions, terminal bold styling, and copying Markdown source, code blocks, and blockquotes, including original code line endings and fenced tables with table rendering disabled.
GitOrigin-RevId: eda62043ca8a9fe012ea7e0683fe05de6ad1b898
## Why
The sidebar chooser used hard-coded keys and hints instead of configured list bindings, limiting navigation and making custom shortcuts inconsistent.
## What changed
- Use configured list actions for chooser navigation, acceptance, and cancellation, including key chords, page movement, and jumps to the first or last choice. Show the configured shortcuts in footer and retry hints.
- Place “New side chat” first and group existing chats into compact rows with a count and optional thread colors. Keep the selected chat visible in short panes.
- Highlight inactive side-chat tabs on hover while preserving the selected tab's styling. Redraw when the hovered tab changes and suppress hover highlighting during pane resizing.
## Testing
Extend interaction tests and snapshots to cover custom acceptance chords, `j`/`k` navigation, paging, and tab hover styles and redraws with either pane focused, including the fallback when terminal colors are unavailable.
GitOrigin-RevId: bad992b3786215dcb5569acfc72af8841fad949d
## What changed
Read `final_answer_moderation` metadata and attach `moderation: { moderated: boolean }` to the completed final-answer message only when its item ID matches. Apply this in both normal and plan modes, and reset the pending decision when a new response starts.
Preserve the answer's native item ID and moderation flag through legacy events and history reconstruction. Combine text parts into one legacy event when a moderation decision is present.
Expose nullable moderation data on app-server agent messages and update the JSON schemas, TypeScript types, and Python models.
## Testing
Add an integration test for moderation on completed answers and their legacy events. Extend protocol conversion tests to cover populated moderation data and serialization as `null` when absent.
GitOrigin-RevId: f286b67731a84b3daf5d10b7644f2e31b62f0e53
## What changed
- Register an additional Cloud connection on supported macOS and Linux launches when `TuiMultiBackend` is enabled, using the selected ChatGPT account and local network policy.
- Preserve backend settings and identify Cloud in connection controls and status.
- Let Cloud supply the model when a thread opens, skip local skills requests and stale results, and allow resume without a local working-directory override.
- Preserve Git metadata in Cloud thread snapshots and continue history hydration past empty filtered pages within the scan budget.
- Report Cloud connection failures and require reopening Codex to reconnect.
## Testing
Add regression coverage for Cloud model bootstrap, skipped skills requests, resume directory handling, history pagination through filtered pages, and Git metadata preservation.
GitOrigin-RevId: 6717f0f5ad7708c5e9b5796d94711dd1eecc49bb
## Why
Queued inputs previously stored and dispatched without the submitting client's Responses API metadata, losing attribution such as `client_type` when the queued turn started.
## What changed
- Accept `responsesapiClientMetadata` when adding or updating queued submissions and expose it on returned queue items.
- Persist metadata with the input and forward it when starting a selected item or dispatching an idle queue, including after restoration.
- Preserve existing metadata when an update omits it or supplies an empty map; replace it when a non-empty map is supplied.
- Keep stored inputs readable by older queue workers and update generated protocol artifacts.
## Testing
Extend queue service and app-server tests to cover metadata round trips, preservation and replacement on edits, compatibility with older readers, and forwarding during selected, idle, and restored dispatch.
GitOrigin-RevId: 508043b1d3d0298c9af2be8e05b6999de46596a1
## Why
Sidebar resizing previously required an open side chat, leaving the chooser without the same width controls.
## What changed
- Support keyboard resizing, width presets, and divider dragging for the sidebar chooser, with resize hints that fit narrow sidebars.
- Keep keyboard resize mode active across startup thread assignment and replacement of the chooser by a new side chat, so `Enter` finishes resizing without submitting the parent draft.
- Activate resize bindings only when a split is available, and prevent divider drags from starting while the split is animating.
## Testing
Add regression coverage for chooser resizing, width preservation when switching between the chooser and a chat, startup and side-chat creation transitions, draft preservation, and unavailable resize bindings in narrow terminals.
GitOrigin-RevId: 511cd4bb5894e6f33f0cf5d7472bb3013361ffe0
## Why
The TUI's cached active turn can be stale when a cloud message is submitted. A lost reply also leaves delivery uncertain, so automatically resending the draft risks submitting it twice.
## What changed
- Let the cloud server choose whether an Enter submission starts or steers a turn, and apply its receipt to the matching client message ID.
- Keep Tab-queued input waiting until the admitted turn finishes, including before its start notification arrives.
- Restore rejected submissions to the composer. Hold duplicate or unconfirmed submissions out of automatic delivery until history confirms them.
- Reconcile saved drafts and pending steers by client message ID when resuming sessions, and preserve submissions belonging to other turns during interruption recovery.
- Classify cloud preflight failures as invalid parameters so rejected queued input can be restored safely.
## Testing
Add regression coverage for cloud receipt outcomes, queued-input ordering, rejected drafts, lost replies, interruption recovery, and session resume with identical message text but distinct client IDs.
GitOrigin-RevId: ec4eb581e450488434bc4614ec59273d73ffd0a1
smurching-oai