## Why
A corrupt agent message-board database can block thread deletion even when the feature is disabled.
## What changed
When corruption prevents opening the database for board deletion, back it up and recreate it before recording deletion tombstones. Recovery resets all boards, retaining their previous storage in the backup. Other database open failures continue to return an error without deleting the thread or replacing storage.
## Testing
Add an app-server regression test with the feature disabled that verifies ordinary open failures preserve storage and the thread, while corruption recovery preserves the backup, deletes the requested thread, retains another thread, and records the board tombstone in the recreated database.
GitOrigin-RevId: 85f7d6303ae5c359782018cad4a78461d86c43db
## Why
Guardian can lose a confirmed User Messaging message from its parent context when a `PostToolUse` hook blocks the result or is cancelled. The message has already been sent and remains relevant to interpreting the user's authorization.
## What changed
Capture confirmed message text after input-rewriting hooks in shared per-call state before awaiting post-tool processing. Attach that evidence to the response metadata even when dispatch returns a blocked or aborted result, while keeping post-tool hooks cancellable. Calls cancelled before delivery confirmation contribute no message evidence.
## Testing
Extend Guardian subagent authorization coverage to verify retained messages after post-tool hook blocking and cancellation, and their absence when cancellation precedes delivery confirmation.
GitOrigin-RevId: 9abb7959980eada20d0fb5c0b3a4a8669e4cd0a3
## Why
OS discovery can launch subprocesses on Linux. Repeating it for requests, analytics events, and metrics provider creation adds unnecessary work for stable metadata.
## What changed
Cache `os_info::get()` with a separate `LazyLock` in user-agent generation, analytics runtime metadata, and metrics OS resource attributes. Continue reading the user-agent originator and suffix on each call so updates remain effective.
## Testing
Add an isolated Linux regression test that races initial user-agent lookups and repeats calls, verifies `lsb_release` and `getconf` each run once, and checks that subsequent originator and suffix updates appear in the user agent.
GitOrigin-RevId: 337e45ff88b863d2a4aa387a8e7d2e291c045906
## Why
Creating a cell deep-copies every stored JSON value, including values the cell never loads. Storing a value also duplicates its payload between the cell's local state and pending writes.
## What changed
Use `Arc<JsonValue>` throughout the session store, cell runtime, and completion writes to share immutable payloads. Keep a separate map snapshot for each cell so later commits cannot change its view of stored values.
GitOrigin-RevId: 4535f0f2ed0c8f8cbfb8d24cf1cb44cbc74472b5
## Why
Extension tool calls eagerly copied and converted conversation history even when the tool never read it.
## What changed
Retain a shared invocation-time snapshot and defer conversion to raw response items until `ConversationHistory::items()` is called. Cache the result across clones with `LazyLock`, and keep debug formatting from triggering materialization. Release unrelated history metadata when capturing the shared items.
## Testing
Extend the extension executor test to verify that history first read after a later turn still reflects the invocation-time snapshot, in both legacy and paginated history modes. Update the history API test to check that shared items preserve their envelopes.
GitOrigin-RevId: c737b765b7e4889735dc78e12d685d36e854570b
## Why
Guardian's retained root context appended assistant messages after user evidence and omitted questions sent through User Messaging. This could leave subagent authorization reviews with missing or misplaced conversational context.
## What changed
- Record assistant messages and function calls in the same order sequence as accepted user inputs, then merge retained review context by recorded position while prioritizing user evidence within the message budget.
- Capture bounded User Messaging text after input hooks when a send succeeds, and match it to the original call for assistant context.
- Label assistant context without a recorded position explicitly and clear parent assistant and tool positions when forking agent history.
- Clarify that recorded order does not establish delivery order or pair ordinary replies with questions; assistant messages remain untrusted context.
## Testing
Add coverage for hook-rewritten messages, failed or unconfirmed sends, queued replies with delayed tool results, ordering across resume, and removal of inherited assistant positions from forked history.
GitOrigin-RevId: ac717cf0f5efe4b05c18f2d8370dd48453ac4e35
## Why
Permanent thread deletion needs to remove persisted agent message board data even when the message board feature has been disabled.
## What changed
- Add a cleanup hook for single and batch thread deletion, invoked after reference and writer checks but before rollout removal so cleanup failures remain retryable.
- Remove the deleted roots' channels, posts, and subscriptions regardless of the current feature setting.
- Record board tombstones and check them within write transactions to prevent delayed writes from recreating deleted data.
## Testing
Add an app-server regression test that creates a board, archives its root thread, restarts with the feature disabled, and verifies that permanent deletion removes the persisted channels, posts, and subscriptions.
GitOrigin-RevId: 4ea71559a8df0814dffda23a056a9bbaf6e0a0cb
## Why
Message-board tools hardcoded the `collaboration` namespace and used a different namespace description from the multi-agent tools. This ignored custom namespace configuration and caused conflicts under strict tool collision checking.
## What changed
- Use `multi_agent_v2.tool_namespace` and the shared multi-agent namespace description for message-board tools, resolving the namespace at runtime startup.
- Support unnamespaced tool specifications when no namespace is supplied.
- Remove hardcoded `collaboration` prefixes from message-board notifications.
## Testing
Add app-server integration coverage for the default `collaboration` namespace and a configured `agents` namespace with strict collision checking enabled. Verify that both tool families are advertised together and that `get_channels` executes through the installed extension.
GitOrigin-RevId: fef7be51ea2a84bbdb6d3491606db442ed4e6ea3
## What changed
- Tag metadata scan failures with bounded reasons for invalid history modes, responses before metadata, missing metadata, or I/O errors.
- Emit at most five metadata warnings per compression run with the rollout ID, error category, file size, and modification age, excluding paths and error messages. Include the total metadata failure count in the completion log.
- Preserve underlying metadata errors while redacting their details from `MetadataReadError` debug output.
GitOrigin-RevId: 13f8ec265405b8f8bb23a02ee37c1aabdce806eb
## What changed
- Register the existing message-board tools with the app server through a lifecycle extension, gated on `agent_message_board`, multi-agent v2, and non-ephemeral sessions. The new feature flag is disabled by default.
- Bind tools to each agent's identity and share the SQLite-backed board across the agent tree and runtime resumes.
- Use the runtime clock for posts and deliver ID-only notifications to running agents, with tools to retrieve post contents. Skip inactive recipients without starting them or queuing notices.
- Emit a warning and leave board tools unavailable if initialization fails.
## Testing
Add runtime scenarios and a context snapshot covering feature gating without creating storage, posting and searching, active-only notifications, sharing with child agents, persistence across resume, and clock failure without channel creation.
GitOrigin-RevId: a81bd85cd372b0d122ba375ed1a1bfd3ba3a3b7c
## Why
Agent inspection needs to distinguish registered but unloaded agents from missing identities and backend failures without restoring a runtime.
## What changed
- Add inspection returning `AgentInfo` with metadata, status, and configuration for loaded agents, or metadata for unloaded agents.
- Use inspection for configuration snapshots and to capture an agent's state before interruption.
- Add `AgentInfo` accessors and share V2 error mapping between interruption and messaging tools, preserving the distinction between invalid requests and a dropped thread manager.
## Testing
Extend the V2 reload test helper to assert that inspecting a registered, unloaded agent returns `AgentInfo::Unloaded` and leaves its runtime unloaded.
GitOrigin-RevId: fa897264ff3ff3ec6cc76259d8482be55dec0c0a
## Why
Tool allowlists alone cannot express the reviewer's sandbox and shell restrictions, which previously depended on session identity. Threads need to supply these restrictions explicitly at startup.
## What changed
- Replace `AllowedTools` with `ToolPolicy`, combining an optional allowlist with managed-sandbox requirements, unified-exec requirements, and control over additional-permission arguments.
- Capture the policy once at startup and apply it during tool registration and construction, including hosted tool filtering. Later extension-state changes cannot relax it.
- Supply the reviewer policy explicitly while retaining the fallback for reviewer sessions without a supplied policy. Explicit policies take precedence over session identity; ordinary defaults preserve existing tool setup.
## Testing
Update tool-planning tests to use explicit policies and add startup coverage for additional-permission schemas, ordinary defaults, reviewer fallbacks, explicit-policy precedence, and policy capture despite later extension-state changes.
GitOrigin-RevId: 71e561d76ea24d961f5b29c7c619bdb1356c216a
## What changed
Replace `LocalAgentControl::deliver_message` with `send(SendRequest)`, accepting both user input and agent messages with captured resume configuration and turn options. Resolve target references relative to the caller's registered identity and return recipient metadata and a submission ID in `DeliveryReceipt`.
Migrate the V2 messaging tools to the new entry point and use receipt metadata for activity events. Preserve recipient reload behavior, non-waking queue-only messages, and rejection of follow-up tasks targeting the root agent.
## Testing
Update the cold-resume and sibling-reload tests to exercise `SendRequest` while checking instruction inheritance.
GitOrigin-RevId: 8fd330b8a9c3510483110ed05c4c9d3d616db237
A failed lockfile check does not necessarily mean `MODULE.bazel.lock` is
out of date. Update the shell script and Windows recipe to direct users to
the Bazel error and recommend `just bazel-lock-update` only when Bazel
reports an out-of-date lockfile.
GitOrigin-RevId: cf156a83b931f5109d1382190b475e496e1bfad0
## What changed
Add an integration test covering channel creation, case-insensitive channel search, channel and thread subscriptions, and notification recipients through the message board tools.
Verify that control-character-heavy posts produce valid JSON within the 8,000-byte output limit, mark truncated thread previews, preserve all threads across pagination in reverse creation order, and return the expected root and reply when reading a thread. Also cover rejection of subscription requests that specify both a channel and a thread.
Extract a shared `board_tool_call` helper for the tool tests.
GitOrigin-RevId: 05dc2f1f2ec883b030a8d354688c5e7fd65aec31
## What changed
Expose `message_board_tools` to create nine tools for channel creation and discovery, thread listing, post search and reading, subscriptions, and posting. Bind tools to the host-supplied caller identity and resolve agent references relative to the caller. The factory does not register or enable the extension.
Keep responses valid JSON within an 8,000-byte cap and the call's output budget. Reduce read limits and previews as needed while preserving backend pagination, and reject mutations when the budget is too small to acknowledge them. Derive post request IDs from turn and invocation metadata for direct and Code Mode calls.
## Testing
Add integration coverage for invalid arguments, mutation rejection without writes under insufficient budgets, duplicate post calls, distinct Code Mode invocations, relative notification recipients, author filtering, and bounded Unicode reads with continuation offsets.
GitOrigin-RevId: 2fbc58a4c7eb861055847c363061d73749bf573c
macOS temporary directories can use symlinked paths. Use `project_trust_key`
in `doctor_reports_only_safe_config_error_metadata` so the fixture trusts the
canonical workspace when testing project configuration errors.
GitOrigin-RevId: 61b15e4cfc2eaa8d258b51a482decc0b9bd684e9
Add an index on `posts(board,channel,timestamp,seq)` to support the channel summary query that selects the latest message by `timestamp` and `seq`.
GitOrigin-RevId: 862b318fd70a039aa749240c389865f1c84f552c
## What changed
Implement `AgentMessageBoard` for `LocalAgentMessageBoard`, adding SQLite queries to list channels and threads, search posts, and read thread replies.
- Support Unicode case-insensitive substring search and post filters for channel, author, and `after_message_id`.
- Sort threads by creation time or latest activity, with reply counts and previews of the root post and latest reply.
- Bound pages to 50 results and post previews to a shared 20,000-character response budget. Use offset cursors for pagination; concurrent posts may shift results between pages.
- Add indexes for board and thread timestamp queries.
## Testing
Add integration tests covering pagination, page and preview caps, Unicode search and truncation, thread activity ordering, filtered search, and rejection of non-root thread IDs and unknown callers.
GitOrigin-RevId: c9c673768596efb6d33160e2db8dff62ee9b9cdb
## What changed
Add `LocalAgentMessageBoard` with persistent channels, posts, and subscriptions scoped by `SessionId`. Support channel creation, posting and replies, subscription changes, and bounded reads using Unicode character offsets.
Serialize mutations across independent handles with immediate transactions. Deduplicate retries by caller and request ID, reject changed requests that reuse an ID, and return existing post metadata without repeating notifications. Deliver deduplicated notifications after commit; notification failures leave committed posts successful and readable.
## Testing
Add integration tests covering concurrent retries across independent handles, reopening persisted boards, subscription routing, board isolation, Unicode reads, invalid recipients, inactive recipients, and notification failures.
GitOrigin-RevId: 0cdf621d19517bf57d527fd729290e08ac99f165
## Why
Configuration load errors can echo configuration values, including credentials, into diagnostic reports.
## What changed
Replace raw error messages in `config.load` failures with typed metadata. Report the file, line, and column when a `ConfigLoadError` is available, including when wrapped in an I/O error. Otherwise, report only the I/O error kind or a generic configuration load failure.
## Testing
Add regression tests and snapshots for malformed user and project configuration, an unknown model provider, and invalid header configuration. Verify that both tested JSON reporting modes omit the test credentials while retaining the expected failure details.
GitOrigin-RevId: bec53313888dbfc8c0869f3cb410b1c3e5496630
## What changed
Add `codex-agent-message-board-extension` to the Cargo workspace with a Bazel target. Define backend-independent contracts for discussions within a persistent agent tree:
- `AgentMessageBoard` covers channel creation, posting, thread listing, post search, bounded reads, and subscriptions, with documented membership and retry semantics.
- `MessageBoardHost` provides agent resolution, the caller's configured clock, and metadata notifications restricted to active turns.
- Shared request and response types represent channels, posts, threads, subscriptions, and cursor pagination, including derived page counts and continuation indicators.
The crate defines interfaces and records for local or remote backends; storage, tool adapters, and feature registration remain separate.
GitOrigin-RevId: d8734f0226bc0c0d521929e7dd30b414136dcb95
## Why
Native `openai/userVerification` requests need to carry optional `_meta` to clients for extension-specific presentation.
## What changed
- Accept optional metadata objects with the same validation as MCP elicitation.
- Restore metadata from the MCP request context, excluding `progressToken`, and forward it through `mcpServer/elicitation/request`.
- Update protocol types, schemas, and documentation while retaining support for requests without metadata. Challenge bytes and acceptance proofs remain unchanged.
## Testing
Add coverage for metadata validation, transport context restoration, and protocol round trips. Extend MCP integration tests to check that verification metadata reaches the client.
GitOrigin-RevId: 5d04004244cf33effac675c19e543157c48d1504
## Why
Tool responses can arrive without a `thread/started` notification, leaving background threads missing from the agents overview.
## What changed
Register metadata returned by background thread creation, forking, and resumption as a fallback, then refresh and repaint the overview. Clear turn history before registration and exclude ephemeral threads.
Preserve existing metadata and track archived or deleted threads so delayed tool responses cannot restore removed rows. Clear that removal tracking when a thread starts or is unarchived.
## Testing
Extend tests to cover tool-created and forked thread registration, missing start notifications, and delayed responses alongside metadata refreshes and lifecycle removals.
GitOrigin-RevId: a6f892f1c839dc69fac24b00c34927a7c5f8ce84
## What changed
Add `tui.rendering.mermaid`, `tui.rendering.math`, and `tui.rendering.tables`, all enabled by default and independent of animation settings. Disable individual renderers to display their source instead of diagrams, Unicode math, or formatted tables.
Apply preferences to streaming and completed responses, startup previews, and session changes. When table rendering is disabled, preserve pipe syntax, cell markup, and enclosing Markdown fences. Keep HTML clipboard formatting independent of terminal rendering preferences.
## Testing
Add coverage for individual defaults, source preservation, nested table fences, session settings, and clipboard behavior. Verify incremental rendering and emitted output match completed rendering across all eight toggle combinations.
GitOrigin-RevId: 48d765eac20a82881eed94f186bf5b025ff4f0db
## Why
Fullscreen composer hints used a small, fixed rotation, while catalog shortcut tips hard-coded default bindings. Tips should reflect the user's configured shortcuts and expose the shared catalog with working links.
## What changed
- Select complete, single-row catalog tips that fit the composer gap, keeping selection stable across redraws and varying it across sessions and turns.
- Prefer eligible startup announcements until a user turn begins, without restoring them after history is cleared. Cache parsed announcements while reevaluating eligibility.
- Resolve `{key:context.action}` placeholders using current primary shortcuts and chords; skip tips with invalid or unbound actions.
- Expand the tip catalog and share Markdown rendering between composer and session tips, preserving hyperlinks and supporting Ctrl/Super-click in the composer gap.
- Keep usage notices and interaction controls ahead of tips, and respect `show_tooltips` and idle, empty input.
## Testing
Add tests and snapshots for remapped shortcuts, unbound actions, stable tip selection, announcement dismissal, narrow layouts, styled links, and removal of stale link targets.
GitOrigin-RevId: 64751293d9f91e4444b112361540a73234f1d51d
## Why
Interleaved speaker transcripts can fragment handoff context, and delayed final transcripts can overwrite newer speech.
## What changed
- Reconcile V3 transcript deltas and finals with the latest entry for the same speaker.
- Replace accumulated text only when the final transcript extends it, preserving newer speech when a final arrives late.
- Start a new entry after each completed utterance, keeping repeated speech and final-only turns distinct even when empty deltas arrive.
- Preserve live transcript notifications and legacy protocol behavior.
## Testing
Add unit coverage for interleaved speakers across reconnects, either completion order, repeated utterances, final-only turns, and empty deltas. Add app-server integration coverage for expanded and delayed finals, checking live notifications and reconciled handoff context.
GitOrigin-RevId: 961729281f61b95fd3e0c5cc3ec72512987980b3
## Why
The app server retains its startup model provider, but managed provider requirements can change while it is running. Catalog reads and background refreshes must check those requirements even when models are cached.
## What changed
- Gate `model/list` and background refreshes through a shared catalog that validates the startup provider against current requirements.
- Return JSON-RPC error `-32600` with restart guidance when the provider no longer complies, and skip background requests to that endpoint. Requirement load failures also block catalog access.
- Log only the error kind for blocked refreshes to avoid exposing credentials in parser diagnostics.
## Testing
Add coverage for cached catalog access after provider selection or definition changes, invalid requirements, cloud configuration load failures, and recovery when requirements allow the retained provider again. Extend refresh tests to cover startup provider overrides, blocked endpoint requests, and credential-safe logging.
GitOrigin-RevId: 03127bba46f1f59f2a8b1dc37391eab75f9be23c
## Why
Quota warnings were hidden from normal transcript rendering, leaving no persistent reminder of remaining usage near the composer.
## What changed
- Show the most constrained quota window in the existing composer hint row, using the existing plan-specific warning thresholds. Include remaining usage, reset time, and `/status` when space permits.
- Keep the notice visible while typing or running a turn, even with tooltips disabled. Yield to interaction controls and blocking banners, and suppress the notice when usable credits are available.
- Preserve quota metadata across sparse updates and thread switches. Require a fresh account usage read to confirm recovery, ignore reads made stale by newer rolling updates, and clear notice state on account changes.
- Render quota warning history cells in both transcript modes while retaining warning counts and replay deduplication.
## Testing
Add unit, integration, and snapshot coverage for warning thresholds, narrow layouts, unchanged composer geometry, suppression, recovery, overlapping reads, account changes, and native transcript replay.
GitOrigin-RevId: e45dc94a6e7a9dad50307840b9fdb15978d053dc
## Why
Opening a settings picker while reading older messages should preserve the
reading position. Settings errors and confirmations still need to be visible.
## What changed
- Keep the transcript anchored when opening `/model`, `/theme`, `/keymap`,
`/memories`, `/title`, and `/statusline` without arguments.
- Resume transcript following for settings actions that report confirmations
or errors, including save failures and unavailable commands.
- Keep inline commands and commands with arguments following their output.
## Testing
Add regression tests for picker open/close behavior, settings save failures,
confirmation output, and `/model` before startup completes. Include snapshots
of the preserved reading position and a visible theme save error.
GitOrigin-RevId: 0680e6414d43b8b5d2a3ab9a2df187abfb727d49
## What changed
Rename the `/status` connection row from `Remote` to `Server`. For local daemon connections, display `Local background server` instead of the socket address and version. Keep the address and version for remote connections, including explicitly configured Unix sockets.
## Testing
Add a local background server snapshot and coverage distinguishing local daemon connections from remote Unix sockets. Update daemon startup and worktree tests to expect the new label.
GitOrigin-RevId: 9460415fe1ec16d90f575917c1a4ce1bf19faaaf
## Why
Pausing transcript following can leave the current final row visible, making the “Back to bottom” control unnecessary after copying text, closing find, or enlarging the viewport.
## What changed
Base control visibility on whether the current transcript tail is visible, and hide it for an empty viewport. Keep the control available when a paused view shows an older live revision with new activity.
## Testing
Add regression coverage for empty viewports, copying at the bottom, closing find at the bottom, and resizing a paused view. Extend live-revision assertions and update the composer-gap snapshot to keep the gap blank in the paused detailed view at the tail.
GitOrigin-RevId: d33b4279f5f5f43ae76c34466c18e89b61ad766c
## Why
Adding blank lines only after multiline items gives lists uneven spacing. Completed lists in redrawable transcript views can use consistent spacing based on their rendered width.
## What changed
- Keep assistant and plan lists compact while streaming in the fullscreen transcript, without holding back completed list rows.
- On completion or interruption, separate all sibling items if any item spans multiple rows; keep single-line lists compact and recompute spacing on resize.
- Preserve the reader's displayed content when consolidating streamed cells, and include spacing policy in the Markdown render cache key.
- Retain existing list spacing for native terminal scrollback.
## Testing
Add regression and snapshot coverage for streaming completion and interruption, width-dependent reflow, reader position, nested and quoted lists, item paragraphs, and preservation of links and source metadata.
GitOrigin-RevId: b2230aaf76ae798ebb6bf15563f8b8dcb6f3d19d
## Why
Activity charts bypassed the terminal color adjustments used elsewhere in the TUI, so Windows Terminal could receive a low-color fallback despite supporting truecolor.
## What changed
Use `effective_stdout_color_level()` when building the token activity palette so it honors the existing terminal adjustments and `FORCE_COLOR` override handling.
## Testing
Add a regression test with scoped terminal colors that asserts the current palette uses color and snapshots all five daily activity levels with RGB colors.
GitOrigin-RevId: c5a474bacb1416df754d71285106926f46a38e09
## What changed
Allow right-clicking inside the transcript or composer to copy its selected text using the existing clipboard status messages. Clear the selection only when the right-click copy is confirmed; retain it after failed or unconfirmed copies. Keyboard copies continue to retain composer selections.
Preserve the draft, cursor, and transcript reading position. Refresh composer layout before checking mouse coordinates, and respect modal and transcript input ownership.
## Testing
Add regression tests and snapshots covering copy outcomes, selection retention, reading position, editor bounds after layout changes, and input ownership.
GitOrigin-RevId: 322b303394378a20b2a25b3d218777c9ea65c92b
## Why
Transcript links required a modified click to open, and bare URLs lacked the visual styling of explicit Markdown links.
## What changed
- Open links on release after an unmodified, stationary left click. Cancel activation after dragging, scrolling, or releasing elsewhere so text selection remains usable.
- Apply Markdown link styling to bare URLs while preserving surrounding prose, existing emphasis, Unicode, and table wrapping.
## Testing
Add gesture tests for bare and Markdown links at narrow and wide widths, drag and scroll cancellation, and existing modified-click behavior. Add styling tests and snapshots covering punctuation, emphasis, tabs, Unicode, and wrapped table URLs.
GitOrigin-RevId: 23d12c901932d7e3586d841e5a0ece00e422fccd
## What changed
Add a picker for Scrollback and Fullscreen modes that requires explicit
confirmation and saves `tui.fullscreen_transcript` to the selected user config
file. Keep the running renderer unchanged and explain that a restart is required
and launch overrides still apply. Report save failures without changing the
stored preference in memory.
## Testing
Add picker snapshots and tests for confirmation, cancellation, selected-config
persistence, and failed saves. Add a PTY test covering mode changes in both
directions across restarts while verifying that the current session stays in
its original mode.
GitOrigin-RevId: 7f231ab37c89e2168133fcfd6aaee54775aa7972
## What changed
- Group shortcut help into Navigate, Tasks, and View sections using the shared shortcut renderer, adapting to one, two, or three columns and indicating when more height is needed.
- Show movement hints in the footer, move the new-worktree hint into help, and remove the idle search row. Give task-list column headers consistent styling.
- Change the default task-deletion binding from `Delete` to `Backspace`, while preserving text editing in search and rename inputs.
## Testing
Add snapshots for responsive help layouts, custom bindings, and active search. Add regression coverage for `Backspace` editing without deleting tasks, and update keymap conflict tests for the new default.
GitOrigin-RevId: 45d7f122c9474f1c054450800dcca5a9b2bbbcc5
## Why
A second audio ring can overwrite late speech with silence, and valid RTP
bursts can exceed the jitter buffer's 60 ms reordering window and be dropped.
## What changed
- Forward decoded PCM directly from a GStreamer `BaseSink` to the bounded
CPAL queue, letting CPAL pace playback and handling partial writes.
- Disable `drop-on-latency` so valid queued speech survives packet bursts;
existing ingress permits continue to bound retained packets and bytes.
- Cancel blocked writes on native flushes while preserving speaker epoch
isolation, and remove the obsolete playback delay accounting.
## Testing
Add regression tests for preserving PCM across a pause, forwarding all admitted
packets in an RTP burst, and cancelling a blocked speaker write on an unexpected
flush.
GitOrigin-RevId: c299c6289563d6b4d943362bc3463dbfce9289e7
## What changed
Increment `codex.tui.fullscreen_transcript` after final startup configuration resolution, tagging `enabled` with the configured `tui_fullscreen_transcript` value regardless of screen policy. Emit the metric only when analytics are not explicitly disabled, a metrics exporter is configured, and a global metrics client is available.
GitOrigin-RevId: 59732bc33dfa25f2fb1947ceec2e300e8e0045ca
## Why
MCP requests requiring user input previously failed in subagents with guidance to ask the parent agent, blocking browser sign-in, form input, and interactive tool approval in the child thread.
## What changed
Remove the root-only MCP elicitation guard and `allow_user_interaction` plumbing so subagents can surface prompts and wait for responses under the existing approval policy and automatic review rules. Connector authentication can now return retry guidance after acceptance or preserve the original failure when declined.
Keep legacy tool approvals through `request_user_input` restricted to the root thread.
## Testing
Update unit and integration coverage for subagent prompt resolution, form responses, connector authentication acceptance and decline, automatic approval, strict review, and approval-policy updates on reused connections. Update the browser sign-in scenario snapshot to show the subagent continuing after an accepted response.
GitOrigin-RevId: c226fc6dfde724ed22b91dc04dd32bbc15245bee
## Why
Subagent activity can arrive while the parent answer is still streaming. Rendering it immediately flushes the answer stream before the authoritative message completes.
## What changed
- Defer subagent activity until the answer stream finishes, preserving one complete answer before the activity row.
- Drain queued lifecycle activity when a turn ends without opening queued prompts.
- Show late subagent activity after the turn stops even when unresolved prompts remain queued.
## Testing
Add regression coverage for completion before or between answer deltas, a missing final delta, interrupted and failed turns, and late activity with queued questions. Extend dynamic activity coverage to verify that turn finalization leaves queued prompts unopened.
GitOrigin-RevId: f0577b9ac47cf652c7c75b3aace38c10dccada18
## What changed
- Enable mouse input for the usage overlay, with clickable tabs and report controls that invoke the same actions as keyboard shortcuts.
- Scroll the report, dashboard, or help body with the mouse wheel in bounded three-line steps, preserving separate reading positions.
- Limit clicks to rendered targets and ignore stale targets after refreshes, control changes, or surface transitions.
## Testing
Add coverage for mouse event routing, clipped targets, remapped or disabled keybindings, stale targets, bounded scrolling, and retained reading positions. Exercise the business token model filter through a mouse click.
GitOrigin-RevId: be839695d46609b6df7062f99711701372335907
## Why
Switching reports reset their scroll positions, and resizing could pull users back to a selection they had deliberately scrolled away from. Small terminals also need room for usage details, while larger terminals can show more of the chart.
## What changed
- Retain independent scroll positions for each report, the dashboard, and help. Keep visible selections on screen during resizing while respecting manual scrolling.
- Hide plots in small report areas, expand charts to use available height, and place breakdown tables beside plots in wide focused reports.
- Highlight selected chat and plan rows with the shared picker style, preserving padding after wrapping.
- Show dated plan periods in the dashboard and collapse expanded plan details before closing with `Esc`.
## Testing
Add regression tests and snapshots for responsive layouts, reading-position restoration across tabs and help, selection visibility during resizing, and highlighted chat-row padding.
GitOrigin-RevId: e18a472ff4356324fed71e496f47762a7ccf657d
## Why
Wrapping navigation and contextual hints can shift report content as the displayed state changes, especially on narrow terminals.
## What changed
- Use compact report tabs, fixed control rows, and two footer hint rows to keep report geometry stable.
- Show the account plan in the `Usage` heading and move date ranges, grouping, model filters, sort controls, and update timestamps above reports.
- Add scrollable `?` help with an independent scroll position, preserving report selection, expanded details, and reading position when dismissed.
- Share control availability between keyboard actions and help, and preserve configured keybindings when they conflict with the help shortcut.
## Testing
Add regression coverage for stable tabs after request failures, help state preservation, dashboard selection scrolling, date and update-time controls, and custom keybinding precedence. Update layout snapshots for the revised navigation and narrow help view.
GitOrigin-RevId: ab89ed2fd346171362f487c64af7206d9123859a
## Why
Analytics must discard previously loaded reports when account identity checks fail. Usage actions also need to remain readable on narrow terminals and reflect customized list bindings.
## What changed
- Track identity invalidation across analytics reports and refresh the view to clear stale data and reload the account and reports.
- Recheck identity around chat and task loading, including after asynchronous work, before accepting results.
- Shorten `/usage` labels and use picker layouts that hide descriptions when space is limited. Show action-specific `open`, `choose`, and `confirm` hints using the active list keymap.
## Testing
Extend regression coverage for account switches during report loading, clearing and reloading reports, and retrying account discovery with `R`. Add a narrow usage-menu snapshot and update usage and reset-dialog expectations.
GitOrigin-RevId: 0c60a0f930c6b00457aa897711bd5a496c7decde
## What changed
Remove analytics snapshot assertions, saved snapshots, and snapshot-only setup and serialization code. Retain targeted behavior and rendering assertions, and add explicit checks for narrow-screen dollar amounts, negative usage values, metric selection, and summary scrolling.
GitOrigin-RevId: 58f43f8037818d5f6d55630b0bf670b017efd8be
## What changed
- Remove the animated logo and its redraw scheduling from fresh conversations while retaining conversation lifecycle tracking.
- Enlarge the onboarding logo stage from 48×17 to 60×21 cells and raise the minimum terminal size to 64×41.
- Keep the final onboarding pose at full opacity after the spin finishes, without a completion fade or further redraws.
## Testing
Update snapshots for the fresh conversation header and larger onboarding logo. Add coverage for the full-color settled pose and verify that hidden or clipped frames preserve the remaining animation time.
GitOrigin-RevId: a1914ca01a49a6641e16d9fda8673826a975d70d
## What changed
- Support click-to-position, drag selection, double-click word selection, and triple-click logical line selection in the composer, respecting wrapping, scrolling, and atomic grapheme and placeholder boundaries.
- Copy selected draft text through the existing clipboard status flow without changing the draft or selection, before interrupt and exit shortcuts consume the key.
- Replace or delete selected text with editor input, flush buffered typing before mouse edits, and reconcile removed paste and image placeholders.
- Coordinate composer gestures with transcript selections, completion popups, and modals. Use generic retry messages for copy failures.
## Testing
Add coverage for Unicode and wrapped-text hit testing, selection highlighting and editing, multiclick dragging, placeholder cleanup, history navigation, and fullscreen copy and input ownership.
GitOrigin-RevId: 939ef461ec67855b3e87c3c7ddd8a60a3250c7cd
jif