## What changed
Add `ChatWidget::is_read_only_view()` and use it for read-only guards across input handling, navigation, transcript rendering, and session restoration. The new helper delegates to `is_external_writer_view()`, preserving existing behavior.
GitOrigin-RevId: c8fd66526f502d79be306a19ee261e79c5abcd57
## Why
After a cloud model selection was accepted for future turns, status displays still showed the session's serving model and reasoning effort. A reasoning-only `/model` command also resolved against that model instead of the accepted selection.
## What changed
- Show the accepted model's display name and reasoning effort in the status line, terminal title, and `/status`.
- Resolve reasoning-only `/model` commands against the selected model.
- Share the session-only model change confirmation between cloud and local selections, including reasoning effort and service tier when present.
## Testing
Extend cloud model admission coverage to check accepted selections in status output, reasoning-only commands, and unchanged status before acceptance and after session metadata clears the selection.
GitOrigin-RevId: cc50c2b0a98e884138ad2c2339c79c28ee3d346a
## Why
Saved side chats can inherit their parent's name, leaving them labeled for the parent conversation rather than their own question.
## What changed
Generate an automatic title from the first successfully submitted direct text input in a newly saved side chat. Allow the generated title to replace the inherited name while preserving manual renames and leaving the parent title unchanged. Image-only first inputs retain the `[Image]` label without generating a title from inherited conversation text.
## Testing
Add regression coverage for saved side chat labels from text and image-only inputs, inherited-name replacement, manual rename preservation after switching threads, and retaining title eligibility when turn submission fails.
GitOrigin-RevId: 97f08dee8cc3280f1128aca23f27960235e00e86
Initialize `environment_id` to `None` for statusline MCP inventory and resource-read requests, preserving existing server selection. Update request assertions to expect `environmentId: null`.
GitOrigin-RevId: 3ed5dde0de5ab69aa1349da7d829cc5e335db5c7
## Why
An unset voice preference should use the call destination's default. Changed or cleared preferences should also take effect on the next V3 call, even when the thread retains an older setting.
## What changed
- Use `gpt-live-1.1-codex` as the default V3 realtime model.
- Preserve an unset voice until request serialization, defaulting V3 API calls to `marin` and ChatGPT calls to `cove`, while honoring explicit voice selections.
- Reload current voice settings when starting a new V3 call through the app server, including cleared preferences.
- Populate the TUI voice picker from the V3 catalog, add `marin` to that catalog, and remove voice-catalog lookups from call startup and preference saving.
## Testing
Add regression coverage for API and ChatGPT voice defaults, explicit overrides, changed and cleared settings, and TUI call requests and voice selection.
GitOrigin-RevId: d0dd4dcd4bcad9ab869d7bf524e7095a88ffcfaa
## Why
MCP servers registered under the same name in different environments need distinct inventory, routing, and status reporting.
## What changed
- Keep MCP inventory and runtime status keyed by registration scope so same-named servers remain separate.
- Add optional `environmentId` selectors for status lookup, tool calls, resource reads, and OAuth login. Omitting the selector preserves existing name-only routing.
- Carry environment identity through startup notifications, elicitation requests, and tool-call history, and display it in the TUI.
- Support `/mcp login <name> --environment <id>` and update generated protocol schemas and SDK types.
## Testing
Add integration coverage for two environments with identically named MCP servers, tools, and resource URIs. Verify separate inventory, explicit environment routing, legacy routing when the selector is omitted, and errors for unknown environments. Update protocol and TUI tests for environment identity.
GitOrigin-RevId: 074a3db10549438cb6aff33eb7bed10791adae4d
## What changed
Add a statusline provider discovery stream that publishes the first inventory or named lookup result for each MCP server. Give global inventory a two-second head start, then probe known servers with at most four concurrent lookups while continuing to discover servers from inventory pages. Completed inventory triggers probes for missing known servers immediately.
Bound each refresh and each selected-provider lookup to five seconds, with independent deadlines. Report server and inventory failures separately, and cancel outstanding discovery waits when the stream is dropped.
## Testing
Add tests with controlled app-server replies and paused time covering inventory/probe races, concurrency limits, timeouts, cancellation and reopening, missing servers, and repeated pagination cursors.
GitOrigin-RevId: e2e1af9789bb67236afdbc76ec2d8ee1648d6ac4
## What changed
- Parse statusline entrypoints from MCP tool metadata, requiring exactly one valid `ui://` resource URI per tool.
- Resolve saved or discovered providers against the displayed thread's tool catalog, checking global advertisement, plugin ownership, and connection status. Reject providers whose effective server, plugin, or marketplace registration includes project configuration.
- Read the resolved resource on the displayed thread, forwarding the statusline snapshot in `com.openai/codex-statusline-state` metadata.
## Testing
Add tests for malformed and ambiguous entrypoints, thread-specific resource reads, configuration precedence, project overrides, ownership mismatches, and unavailable providers.
GitOrigin-RevId: 5a43212177704f546e5d53be53f8979fe3bb8d8a
## What changed
Add a TUI module for reading MCP server identities and tool catalogs from the connected app server's global inventory. Support paginated discovery and targeted server lookup through `mcpServerStatus/list`.
Retain plugin identities and tool errors, filter entries to those with an explicit null `httpOrigin`, and reject repeated pagination cursors or mismatched targeted responses. This adds inventory infrastructure without enabling provider discovery yet.
## Testing
Add tests for global inventory independence from startup project overrides, preservation of tool catalogs and errors across pages, transport filtering, and rejection of a targeted response naming another server.
GitOrigin-RevId: f429991deed38eb106641b1780f24c701626b4e1
## What changed
Track whether a thread is being viewed without a live attachment. Hide the status line and context usage for saved history and unavailable conversations, even when token usage updates arrive. Restore these displays when the thread resumes interactively, including sessions using read-only permissions.
Avoid a leading separator before the Vim mode indicator when context usage is hidden.
## Testing
Add regression coverage for history viewing, token updates, and interactive resume. Update unavailable-conversation snapshots to omit the status line.
GitOrigin-RevId: 14dfd2ee0f232001814b7fc45a5ac8a5d755669b
## Why
Saved side chats with `attached_to_thread_id` set could appear as root sessions in the agents overview.
## What changed
Exclude attached threads alongside ephemeral threads when building the overview. Reuse the same root eligibility check for history discovery, pinned threads, and refill accounting so attached threads do not count as overview roots.
## Testing
Extend `shared_overview_shows_only_root_sessions` with a saved side chat attached to a root thread, verifying that it stays out of the overview snapshot.
GitOrigin-RevId: 3417d444cfde7fc034c07ec124ba72cbf64b0ef6
## Why
Resuming another session must keep drafts, queued follow-ups, and interrupted steer retries with their original thread. Submitted input whose delivery is still uncertain must wait for matching receipts before the queue can advance.
## What changed
- Pause submissions while draining outgoing events, then capture input before switching threads or backends.
- Restore saved input through a shared resume path, reconcile receipts from resumed history and buffered events, preserve active-turn state, and dispatch eligible queued input when the resumed thread is idle.
- Preserve whether a draft's leading `!` is literal text or a shell command.
- Reject `!` shell commands in Cloud conversations with an error and clear the pending submission so the next prompt can proceed.
## Testing
Add regression coverage for session round trips with buffered completion and interruption events, receipt reconciliation across read-only and writable resumes, draft shell mode, and submitting a prompt after a rejected Cloud shell command.
GitOrigin-RevId: 9a823a398a371e689b8ae743de494323ae95ef57
## What changed
- Add a TUI helper that saves `tui.status_line_provider` to the active local user configuration, supporting `"default"` and MCP server/tool selections.
- Update the app and chat widget selections only after the write succeeds.
- Return an error when `ConfigEdit::SetPath` cannot insert a value at the requested path.
## Testing
Add tests covering active local profile writes during remote sessions, preservation of unrelated settings and configuration files, CLI override reloading, and failed writes that leave the file and live selection unchanged.
GitOrigin-RevId: 08008f58d7a467bb0c9129b7c198b4d224262ff1
## What changed
Add `tui.status_line_provider` to select `"default"` or an MCP provider identified by `server` and `tool`. Replace provider identities as a unit across configuration layers so partial overrides cannot inherit half an identity.
Ignore this setting from project configuration and packaged defaults when computing effective values and origins, while retaining strict validation. Preserve relative path resolution when an ignored provider value is malformed.
Carry the selection into TUI local settings and refresh it on configuration reload. Use the client's configuration home when rebuilding settings for remote sessions.
## Testing
Add coverage for provider precedence, incomplete profile overrides, malformed values and diagnostics, relative path resolution, and local preference preservation when resuming remote sessions.
GitOrigin-RevId: 0777d754d46cf009569ff0c90fd7426f8b7650bf
## What changed
Set `retain: true` on tool outputs submitted when TUI dynamic tools start a turn, requesting retention of delegation prompts in the thread's model history.
## Testing
Update session lifecycle assertions to require `retain: true` for both `create_thread` and `send_message_to_thread` requests.
GitOrigin-RevId: 095d0f6f687a67fbf0b5ffd98539f764d32e2acc
## What changed
- Update the workspace, Bazel toolchain and lockfile, CI and release workflows, and Windows setup script from Rust `1.95.0` to `1.99.1`.
- Adapt Rust code to the updated toolchain and Clippy lints, including `try_update` for atomics, `as_chunks` for fixed-size slices, and targeted allowances for generated tonic services.
- Refresh the halfwidth sound mark rendering snapshot to use literal characters in debug output.
GitOrigin-RevId: 5852029f687436dc814c2bca68141ee1f4a67d49
## What changed
- Store `CodexErr` in a `Box` within `ImageBackendError` while preserving its accessor.
- Terminate `bail!` calls with semicolons in the cloud client and TUI.
- Share a body-prefix length constant across OTLP loopback assertions and remove redundant borrows of diagnostic strings.
GitOrigin-RevId: 40aee7d4d03b17fc8dbd9295e0853c811852c177
## What changed
- Replace `FooterContent` and the separate layout cache with a `StatusLine` that owns native or extension content and caches its layout by bounds.
- Move footer padding into the caller's layout and retain cached wrapping for unchanged agent-labeled status lines.
- Remove extension-to-single-line conversion and render prepared UI trees directly within their allotted rectangles.
## Testing
Extend composer coverage to verify that replacing measured extension content updates the displayed rows. Adapt status-line and UI-tree tests to exercise direct rendering, clipping, hyperlinks, and viewport bounds.
GitOrigin-RevId: 72273c87d689b8b59748ab243793a9e2a45f4884
## Why
Inline image previews can leave stale pixels in terminal history when streamed output scrolls their rows.
## What changed
Clear retained previews before inserting history that could move them, then let the next frame redraw them while preserving the draft text. Keep direct Kitty previews when standard history insertion scrolls only above an unchanged, bottom-aligned viewport.
## Testing
Add regression coverage for clearing previews before scrolling, preserving unsent draft text, redrawing file-backed previews, and retaining or repainting direct Kitty previews as appropriate.
GitOrigin-RevId: 683d1313349b1ac707499b021092fc390e21530d
## Why
Reconstructing a thread session from the primary session could carry over another thread's fork parent and cached parent title.
## What changed
Use the target thread's `forked_from_id` when reconstructing sessions from `thread/read` responses and `ThreadStarted` notifications. Clear the cached parent title when the parent changes, and treat absent or invalid parent IDs as no parent.
## Testing
Extend the session reconstruction test to cover replacing an inherited fork parent and clearing inherited fork metadata for a thread with no parent, while retaining coverage of active permission settings.
GitOrigin-RevId: 860779b40dc21fb4cc2ec1ac392523da5e439a94
## What changed
- Stage Cloud speed choices for the next new turn in the conversation, alongside pending model and effort selections. Update the displayed conversation speed after admission without changing the local default.
- Offer speed commands supported by the pending model. Clear an incompatible pending speed change with a warning when switching models.
- Carry `service_tier` through Cloud message requests, preserving omission to inherit the thread tier and explicit null to clear it. Translate `default` to null and reject tier overrides on queued requests.
## Testing
Add tests for Cloud speed toggling, model-dependent speed choices, admission-time updates, and preserving the conversation tier when selecting a model. Extend request and wire tests to cover service-tier values, explicit clearing, and queue rejection.
GitOrigin-RevId: b4daa701f1fe29593d90a938e60cc20cb980298a
## What changed
- Create WebRTC calls using the TUI's local provider and credentials, then attach the app server through `existingCall` with the returned call ID.
- Preserve the effective voice preference and share realtime prompt preparation and thread headers between call creation and the backend observer.
- Run negotiation asynchronously, cancel pending startup when voice stops, and ignore results from stale startup attempts.
## Testing
Update voice request and handoff tests for client-created calls. Add coverage ensuring that canceling and restarting voice attaches only the new attempt, including when an earlier result is already queued.
GitOrigin-RevId: b704976f4918dddd24a17fbaa868a7c62e81885b
## What changed
Rename `SidebarLayout::Chooser` to `SidebarLayout::Panel` and use panel helpers for geometry, transcript visibility, focus routing, and shortcut hints. Retain `chooser_focus()` for chooser-specific logic.
When changing panel focus, reuse the pane's visible content instead of explicitly selecting `SidebarContent::Chooser`. Update existing sidebar tests to use the renamed geometry helper.
GitOrigin-RevId: ee6180bad691da3a76bd23835077aeb11c7d969d
## Why
Unfocused chat panes reduced status content to a single dim line, hiding rows that were visible while focused.
## What changed
- Share status measurement, wrapping, rendering, and footer row allocation between the main conversation and side chats.
- Retain structured status content in inactive side chats so native and extension status lines can use the available rows and reflow when resized.
- Keep unfocused status content dimmed with hyperlinks suppressed, while respecting space reserved for the draft and footer hints.
## Testing
Add regression coverage for status reflow across split-pane focus switches and resizing, and update extension status coverage to verify multiple dimmed rows when unfocused.
GitOrigin-RevId: f4def37259fe106d6a3fac9fe4c6cc2d4972f244
## What changed
Render service tier names in lowercase for the `model-with-reasoning` status line item, while preserving their display casing in terminal titles.
## Testing
Extend footer snapshots to cover Fast and Ultrafast, verify terminal title casing, and check lowercase Flex and multiword tier labels.
GitOrigin-RevId: 16227735d4aae55463df537b91ff7e81c436a66e
## Why
A lost Cloud reply stream previously required reopening the conversation, even when it was idle. Recover the displayed conversation automatically while holding queued input until its reply stream is usable.
## What changed
- Add bounded retries for transient stream failures in the displayed, idle conversation, with credential and network-policy checks. Keep explicit reopen behavior when recovery is unavailable or fails.
- Enable HTTP/2 keepalive pings for Cloud connections.
- Queue input while disconnected and resume ordinary submission after recovery. Mark recovered history as potentially incomplete so an explicit reopen reloads missed turns while preserving drafts and reconciling pending submissions.
- Store retained input per backend and apply background settings updates to the owning backend's drafts.
## Testing
Add regression coverage for queued input during disconnection and extend resume and backend-handoff tests to cover history refresh, draft preservation, and retained settings.
GitOrigin-RevId: 3d753e53d3c0d594680a90cac8a75fe33b91e219
## What changed
Separate shortcut binding definitions from rendering in the TUI shortcut overlay. Store optional bindings, paired alternatives, and repeated-key labels in typed entries, then format them through a shared rendering path.
Use `KeyBinding` values for Page Up and Page Down instead of hard-coded labels.
GitOrigin-RevId: da5d61eb94aefa3334612005fe614f58e6bfcae8
## What changed
Add lossless conversions between legacy sandbox templates and `PermissionProfile` without probing workspace metadata, collapsing fixed roots into current-directory access, or deduplicating writable roots. Reject profiles whose restrictions cannot survive the round trip.
Use these conversions for sandbox inheritance in `create_thread` and for validating read-only temporary structured threads.
## Testing
Extend coverage for duplicate writable roots, existing `.git` metadata, unrepresentable restrictions, and child threads inheriting writable roots, network access, and temporary-directory exclusions.
GitOrigin-RevId: cb37acaf615b09f45680b4b0c4152470fbc04abb
## Why
Command Center retains tasks across backend switches. Opening a retained task must use its owning backend, and restoring its draft must account for history or settings that changed while another backend was displayed.
## What changed
- Track each thread's first observed backend, reject conflicting ownership, and switch to the owning backend when opening a retained task. Require users to open tasks on other backends before running task actions.
- Keep discovery cursors, initialization, and pins per backend. Scope refreshes and usage requests to their owner, and handle background archive and delete notifications without consuming the displayed backend's pagination budget.
- Verify cached blank sessions are still idle and have no turns before reusing them, with a history-read fallback for older servers. Otherwise, resume saved history and preserve current server collaboration settings when restoring drafts.
- Use only interactive task-list pages for cloud discovery, which does not support the additional source filters.
## Testing
Add regression coverage for ownership conflicts, action routing, pins across backends, background removals, usage isolation, cloud discovery, and draft restoration with blank or populated history, including older-server fallbacks.
GitOrigin-RevId: 0d0913ec38dc16a839823008a4a84aa46ad8e6c6
## Why
Threads need a visible title while automatic generation is pending or fails. Hidden title-generation requests must also stay out of the foreground conversation, including during skill installation prompts.
## What changed
- Immediately display a Markdown-stripped, single-line excerpt of the first message, capped at 60 characters. Replace it with the generated title, or save the excerpt if generation fails or returns an invalid title.
- Give title threads explicit read-only permissions and request the `never` approval policy, subject to managed policy constraints. Keep blocking input requests on the hidden thread until timeout.
- Interrupt timed-out temporary structured turns before detaching them.
## Testing
Add coverage for provisional title replacement, fallback persistence, managed permission and approval policies, and hidden input requests. Add a terminal integration test that verifies title generation after choosing “Continue anyway” on a skill installation prompt.
GitOrigin-RevId: f408f3061e5e7f0d9d6bc1f2f9674303e9e68400
## What changed
Make “Yes, clear context and implement” save the approved plan as an app-server attachment and submit a short prompt referencing it. Add the experimental `thread/prepareApprovedPlan` request to verify that the fresh thread's executor can read the file and that its contents match the approved plan.
If the attachment cannot be written or read, inject the complete plan as `proposed_plan` tool output within the model's context and truncation limits. If the complete plan cannot fit, report an error and keep the current session. Clear the UI and switch threads only after plan preparation succeeds.
## Testing
Add TUI tests covering a large plan read from its attachment, complete fallback context when attachment writes or reads fail, and preservation of the original session when the fallback is too large. Snapshot the fresh thread's initial request.
GitOrigin-RevId: b717f30359256994c6efb3f4fe7f87aabe8936af
## What changed
Move permission selection into `codex-config` with a shared `PermissionConfig` representation for legacy sandbox settings and named profiles. Resolve selectors using config layer precedence while preserving explicit session profile selection and sandbox mode overrides.
Share legacy permission translation between config derivation and core loading, preserving merged workspace roots, network access, temporary-directory exclusions, and platform sandbox availability without modifying source layers or field origins.
## Testing
Add coverage for mixed selector precedence, merged legacy settings, unchanged source metadata, and the Windows read-only fallback. Extend the managed preferences loader test to verify settings merged across layers and the absence of an active named profile for legacy permissions.
GitOrigin-RevId: a435be7af38424ac33711e6a7557f52b9b672577
## Why
Narrow composer footers can clip hints or crowd out mode indicators and actions.
## What changed
Use a shared layout for navigation, actions, mode indicators, context, and warnings. Shorten or drop whole labels in priority order instead of clipping them. Add a second row when input modes and queue or active side-conversation actions fit separately but not together, keeping navigation and modes above actions.
## Testing
Add coverage for fullscreen and scrollback layouts, narrow Plan mode hints, active side-conversation actions, oversized goal indicators, and warning hit areas.
GitOrigin-RevId: 849a53d45ef1b36b40c52282e329b48ec7d7d12e
## Why
Long built-in status lines were truncated to a single row even when the footer had room for more content.
## What changed
- Wrap status text to the available width and row budget, preserving styles and hyperlink targets across rows.
- Show an unlinked ellipsis when content exceeds the available space.
- Refresh wrapped content when the status text, agent label, or width changes.
- Keep reasoning-effort transitions on one row and restore wrapping after the final animation frame.
## Testing
Add coverage for wrapping and hyperlink boundaries across footer layouts, content and agent-label updates, resizing, and wrapping restoration after an effort transition. Update transcript and startup snapshots for multiline status text.
GitOrigin-RevId: 30e0795c473efd62fc4d0dca4deb6029b625a9e8
## Why
Status content and footer hints need to fit within the composer's height budget while preserving room for editing and active search controls.
## What changed
- Share row allocation between composer measurement and rendering. Cap status and hints at two rows in inline scrollback, and scale the fullscreen cap from two to four rows with the available budget.
- Reserve space for active footer controls, give suggestions and image previews priority over additional status rows, and avoid reserving an empty hints row when status is enabled.
- Keep textarea row counts and scroll offsets as `usize`, saturating only the terminal height so very tall drafts remain scrollable with a visible caret.
## Testing
Add layout and snapshot coverage for constrained height budgets, status and hints, image previews, slash suggestions, and transcript search cursors. Add a regression test for rendering a draft beyond the `u16` row limit.
GitOrigin-RevId: 20fb0384ffc976dfd12e648004763feff0597dda
## Why
Composer hints could replace configured status content, and mode indicators and warnings reduced the width available to status extensions.
## What changed
- Give enabled status content a dedicated area below the composer in both inline and fullscreen layouts, preserving it during transient hint states.
- Keep shortcuts, queue hints, mode indicators, and warnings in the hint row.
- Measure extension status content at the full available width, allowing up to four rows while yielding space to the composer when height is limited.
- Suppress composer hints behind centered dialogs.
## Testing
Update layout assertions and snapshots for status persistence, extension resizing and clipping, warning placement, and reasoning-effort transitions.
GitOrigin-RevId: f11c2e4fb53c35b69c2fbdbe80cef31bb28faca4
## Why
A live parent thread continues receiving lifecycle notifications while its side chat has focus, so returning to it does not need another liveness read.
## What changed
- Skip the parent liveness read when returning from a side chat while the parent is still attached and online. Keep the read when reattachment is needed.
- Stop scheduling a deferred screen clear when handling a transcript reset that preserves the screen.
## Testing
Add regression coverage for parent `thread/read` requests with and without reattachment, and assert that side-chat navigation leaves no deferred screen clear.
GitOrigin-RevId: a07f161ec86b0ae51250c5a0156402d328c42bdf
## Why
Gateway sign-in needs a way to complete authentication over SSH or when no local browser is available.
## What changed
- Prefer device authentication for gateways that support it in SSH sessions, headless Linux environments, or when no browser handler is available.
- Check the selected session's provider and complete required gateway sign-in before requesting models, including when resuming a thread.
- Display the verification URL, one-time code, and cancellation instructions. Handle sign-in results, cancellation, and connection failures while the prompt is open.
- Skip device login for older servers that do not support it while preserving errors from current servers.
## Testing
Add protocol tests for early sign-in completion, connection loss, provider selection, resumed threads, and legacy-server compatibility, plus snapshots of the device prompt and gateway sign-in loading text.
GitOrigin-RevId: 4f3675ab2fc7fccafbad17796c72a7736ebb86b5
## What changed
Add experimental `environments` fields to `turn/settings/update` and `thread/settings/update`. Turn updates apply to later steps of the running turn; thread updates apply to future turns. Omission or `null` preserves the selection, while `[]` clears it. Providing `cwd` in a thread update without an environment list selects the defaults for that directory.
Include the ordered environment selection in `thread/settings/updated`. Wait for Core to accept thread settings updates before returning success, and return rejections as request errors.
## Testing
Add integration coverage for attaching, replacing, preserving, and clearing environments; rejected updates; and the distinction between later steps and future turns.
GitOrigin-RevId: bfebeda57c676be94427aeb0c567c0b94fd9c387
## Why
Cloud conversations previously used the model returned on activation without exposing model discovery or supporting model changes from the TUI.
## What changed
- Fetch the account-scoped Cloud catalog on demand through `/v2/models`, independently of the submission and attachment queue.
- Let users stage a supported model and reasoning effort for the next new turn in the current conversation. Send these settings with the user message and show acceptance after successful admission.
- Show a loading picker when the catalog is empty, preserve compatibility with Cloud servers that lack discovery, and discard stale catalog results and selections when the account changes.
## Testing
Add coverage for catalog request parameters and queue bypass, deferred discovery and compatibility, model and effort serialization, admission outcomes, account invalidation, and opening the picker after discovery.
GitOrigin-RevId: 2cd0e7fe5f760d4da9258eefe9f0dcbcd23f9b07
Pass `can_save: true` when opening the consent dialog and assert that the
popup displays “Include logs and session history?”.
GitOrigin-RevId: d6035a9a1b3e5114a6e92a6fd31547f02c4980fc
## What changed
- Replace footer chord hints with a floating guide that shows available completions after a 350 ms delay, including custom prefixes.
- Share guide rendering across conversations, transcript overlays, the session picker, startup drafts, hook review, and daemon recovery. Preserve workspace-specific pane labels and filter startup drafts to supported actions.
- Adapt the guide to short inline viewports, retain `Esc` cancellation, and redraw when pending chords clear. Consume clicks on the guide so they do not activate controls beneath it.
## Testing
Extend tests and snapshots for delayed reveal, timeout, custom prefixes, compact and inline layouts, startup-safe completions, and picker redraws after chord completion or cancellation.
GitOrigin-RevId: afa2fe3ae1b5fbea4cd871c17d35206e749c842c
## What changed
- Add cloud archive and unarchive requests and support listing archived threads.
- Detach successfully archived threads and emit archive notifications. Report loaded cloud threads from live attachments rather than cached resume metadata, including after archive failures.
- Scope resume picker archive state and transcript previews by backend and thread so archiving a cloud session preserves a local session with the same ID.
- Limit cloud task archive cleanup to the selected thread, preserving child agents and their active session state, and update the confirmation text accordingly.
## Testing
Add regression coverage for archive acknowledgments, archived-thread discovery and restoration, attachment state after archive failures, same-ID sessions across backends, and preservation of attached child agents.
GitOrigin-RevId: bd155be85ee911375d4d326b18f9b5abe8e82b3d
## Why
Locally configured MCP servers may differ from those reported by the app server. Waiting for unreported servers can leave startup progress busy after the observed servers have finished.
## What changed
- Track startup progress from received server status updates, settling when no observed starts remain pending. Handle standalone outcomes after attachment or lag, deduplicate repeated diagnostics, and reactivate progress on new starts.
- Read effective MCP configuration through `config/read` to prevent task tools from shadowing the `codex_tui` namespace, including when configuration changes after startup.
- Use the same configuration reader to disable MCP servers for temporary structured threads.
- Remove client-side MCP requirement checks for the task-tools server and MCP requirements from debug configuration output, leaving enforcement to the app server.
## Testing
Update regression coverage for unreported local servers, startup rounds after lag, diagnostic handling, namespace conflicts, and server-enforced managed requirements.
GitOrigin-RevId: 370767b90ee55f8b0b1403872ef437d53257586b
## What changed
- Show a refusal status while preparing alternative suggestions and remove the pending notice above the composer.
- Clarify that choosing a rewrite starts a new chat with earlier context, and update overview suggestions to explicitly say users can ask Codex.
- Add an option to report safety-check concerns through the consent flow when reporting is enabled.
## Testing
Update safety recourse snapshots and extend coverage for reporting consent, returning to the picker, and Daybreak notices when enabled or unavailable for the selected model.
GitOrigin-RevId: 99f565ebec7064ec55d388e73acede2dfe639474
## Why
Opening a saved side chat waits for thread resume and history loading. Keep the chooser usable during that work and switch conversations only if the user still wants to open the chat.
## What changed
- Prepare saved chats in the background and show opening, waiting, and retry states in the sidebar. Allow cancellation and keep only the latest queued destination, with at most two preparations in flight.
- Ignore stale completions after navigation, archiving, disconnects, or backend changes, and release unclaimed subscriptions on their original connection.
- Preserve live events, settings, read receipts, and pending approvals received during loading. Anchor paginated history to the resumed snapshot to avoid overlap with live events.
- Carry held-key suppression across conversation switches.
## Testing
Add regression tests for retry and supersession, cancellation, stale completions, subscription cleanup, live updates during attachment, and held keys, plus snapshots for waiting and retry rows.
GitOrigin-RevId: 2c7d94482078f16895049ce79b242d3eb0d92f40
## Why
Title and content searches exclude attached threads, preventing clients from finding their saved conversations alongside ordinary threads.
## What changed
- Add `includeAttachedThreads` to `thread/list` and `thread/search`. For `thread/list`, require a non-empty `searchTerm` and preserve the usual provider and source filters.
- Expose `attachedToThreadId` on thread responses to identify the owning parent independently of fork and subagent lineage.
- Support inclusive searches through SQLite and filesystem fallback, repairing missing database entries with saved thread names during title searches.
## Testing
Add regression coverage for opt-in title and content searches, attached-parent metadata after restart, default search filters, filesystem searches without SQLite, and discovery and repair of unindexed title matches.
GitOrigin-RevId: ac12ec3c730ad7f1722bdf8e21600d17f12017f0
## Why
A failed side chat's opening prompt and image attachments could be restored into the parent chat's draft when dismissing the failure.
## What changed
Clear the pending opening message when sidebar chat creation fails, and stop restoring the opening message when side conversation creation returns an error.
## Testing
Update the sidebar chooser test to verify that dismissing a failed creation preserves the parent draft and a subsequent prompt without restoring the failed prompt or its image attachment.
GitOrigin-RevId: 1423786b2209e9441e0bc1504ffcf51e74ba7cde
Benjamin Carlsson