## Why
Archiving or deleting the selected task could make Command Center selection jump to the current task instead of a neighboring task in the displayed list.
## What changed
Choose the next surviving task in displayed order before removing tasks, falling back to the previous task when needed. Apply this selection behavior to archive, delete, and hide actions, respecting filtering and grouping.
Preserve the pending selection across view rebuilds, batched removals, and duplicate server notifications. Allow selection to fall back when a rename target disappears while retaining the existing notice about its unsubmitted title.
## Testing
Add regression tests and snapshots for archive/delete selection across project, status, and model grouping, with and without filtering. Cover removal of the attached task, external removal notifications, removal of a pending successor, repeated repaints, and an empty task list. Update the disappeared-rename-target snapshot to verify that the remaining selection is preserved.
GitOrigin-RevId: ca93d664fadbc602993fbdae316c7a375b449345
## What changed
Render confirmation dialogs as centered overlays while preserving the composer or parent picker behind them. Share dialog sizing and cursor placement across stacked views and full transcript rendering, with input still routed exclusively to the active dialog.
Use the shared confirmation preset for prompts including full access, session archive/delete, goal changes, and log upload consent.
## Testing
Add coverage for backdrop retention and cursor routing at multiple terminal sizes, and for preserving the compact viewport and composer draft after dismissing a confirmation without replaying history. Update confirmation snapshots to show the retained backdrop.
GitOrigin-RevId: 026af89904ec345e2b330317b8cc844512125d0e
## Why
Accepting a Find result must not let a held `Enter` submit the composer draft, including when terminals report repeated keys as fresh presses.
## What changed
- Make `Enter` accept the displayed result for reading, while `Ctrl+P` and `Ctrl+N` navigate older and newer matches.
- Make `Escape` cancel query editing and restore the pre-search presentation; after acceptance, it returns to the latest transcript content.
- Consume unmodified `Enter` while reading a result, but let modified `Enter` reach configured composer bindings.
- Update footer hints to show acceptance, cancellation, and the active Find state.
## Testing
Extend input-routing coverage for repeated `Enter` presses and modified composer bindings. Update search tests and footer snapshots for acceptance, cancellation, and result navigation.
GitOrigin-RevId: 2a2b7c389240ffa941e3623d7fb7d877455fa9a5
## What changed
Remove the fixed 64 KiB output cap from `WorkspaceCommand` and send
`output_bytes_cap: None` in `command/exec` requests so bounded commands use
the app-server default. Preserve `disable_output_cap` for commands that need
uncapped output, including Git diffs.
GitOrigin-RevId: 6f2ed0d127d9ff2317670851894ae4988f7c7508
## Why
Bedrock catalogs cleared all service-tier metadata, and requests omitted every selected tier. This prevented users from selecting `ultrafast` or using tiers defined in custom catalogs.
## What changed
- Advertise `ultrafast` for `openai.gpt-6-astra` on Mantle and the `global.openai.gpt-6-astra` and `us.openai.gpt-6-astra` Runtime variants, while retaining the implicit default tier unless users select otherwise.
- Preserve custom catalog speed tiers, service-tier definitions, and defaults while continuing to normalize Bedrock web search compatibility.
- Send selected service tiers only when the Bedrock model advertises them, including `flex`.
## Testing
Add coverage for `model/list` tier discovery, custom catalog preservation, configured and per-turn HTTP request tiers, and TUI slash-command selection, toggling, and model switching.
GitOrigin-RevId: 4793e7af7b9f604a6b7812611030da6adb8acd35
## Why
Copying rendered transcript selections added Markdown formatting and escapes to the plain-text clipboard payload. Selecting bold text such as `hello` could paste as `**hello**`.
## What changed
Separate the literal selection text from the Markdown source used to render clipboard HTML. Plain-text copies omit inline formatting delimiters, added code fences, and Markdown escapes while retaining list and table structure. Rich-text pastes continue to preserve formatting through HTML.
## Testing
Update clipboard and transcript selection tests to verify literal text alongside rich HTML, including lists, inline code, paths with Markdown punctuation, hard breaks, streamed code blocks, and tables across layout widths.
GitOrigin-RevId: 980ee2ed0b0e201b581a3a301fa04d796c65af2e
## What changed
Add optional `native_usage_usd_micros` fields to thread usage totals and breakdown groups, and carry backend values through the client alongside existing credit and USD estimates. Missing or null native amounts remain `None`, while explicit zero amounts remain `Some(0)`.
## Testing
Add coverage for native totals and group amounts, mixed batches with legacy responses, and the distinction between missing, null, and zero native group amounts.
GitOrigin-RevId: 53891fc95807138e2eccb99d4cda1520b857dba4
## What changed
- Make `/copy` select the latest completed response directly in the owned transcript. Navigate user messages, code blocks, and blockquotes with arrow keys or `j`/`k`, use `g`/`G` to jump to the ends, and press Enter to copy or Escape to close.
- Highlight selected blocks and keep surrounding context visible during navigation and resizing. Preserve source payloads for code and quotes, including rendered Mermaid diagrams and fenced Markdown tables.
- Pause queued submissions until copy mode closes, and report clipboard results in the transcript footer.
## Testing
Add tests for copy routing, keyboard navigation, highlighting and resize behavior, source whitespace and line endings, clipboard completion, and queued-input resumption.
GitOrigin-RevId: bd4f58ec17568f95d0e91014e5ddba33ca8bd57c
## What changed
Allow accounts using an API key with the OpenAI provider to access `/daybreak` and Daybreak policy notices. Model availability and the connected server still determine program access.
Use the same eligibility checks for turn submission, continuation, and retries. For API-key accounts, send the selected `cyberAccessProgram` when Daybreak is enabled and omit it when Daybreak is off.
## Testing
Extend session lifecycle coverage to check API-key turn parameters with Daybreak enabled and disabled. Add an API-key `/daybreak` help snapshot and update the signed-out error snapshot.
GitOrigin-RevId: ab6d4313c430f316ef9835d4facb878aab0b9725
## What changed
Keep Markdown link destinations attached to prompt and last-message previews in the agents overview details pane as text wraps and is clipped. Render visible links as terminal hyperlinks, while keeping truncation ellipses unlinked.
## Testing
Add a regression test and snapshot covering links that span multiple rows, prompt links, and clipped previews with unlinked ellipses.
GitOrigin-RevId: d121e062b197790ce45a70d6d64aadcb181e4dde
## What changed
Label the `/new` and `/fork` picker options “Use current Git worktree” and “Create new Git worktree”. Explain that creating a worktree makes a separate checkout of the repository in another directory.
## Testing
Update picker assertions and snapshots for both commands to cover the revised labels and description.
GitOrigin-RevId: b7fb1aac3107e39c324707f9ae69c210a97346d7
## Why
Transcript scrolling hardcoded `PageUp` and `PageDown` to full-page movement, ignoring customized pager bindings.
## What changed
Resolve unmodified `PageUp` and `PageDown` through the pager's scroll bindings so they can scroll by a full page, half a page, or one row, or remain unbound. Preserve the one-row overlap for full-page scrolling and leave pager typing shortcuts unhandled by the transcript.
## Testing
Add a regression test and snapshot covering default, half-page, single-row, and unbound configurations. Verify that `PageDown` reverses `PageUp` scrolling and that `j` and `Ctrl+u` remain unhandled.
GitOrigin-RevId: 945e99d7370f84f326ab71037be2924dddada32c
## Why
Transcript selection can consume a configured composer shortcut such as `ctrl-space`, preventing it from submitting a prompt or steering a running turn.
## What changed
Let explicitly configured shortcuts for active actions take precedence over transcript key handling when no transcript interaction is active. Include global binding fallbacks, while preserving empty `Enter` returning to the latest transcript content and default `PageUp` scrolling.
## Testing
Add regression coverage for `ctrl-space` submission with idle and running turns, default `PageUp` scrolling, and empty `Enter` returning to latest with composer or global submit bindings.
GitOrigin-RevId: 16613043a7634b47fd24e4ee9feacdce94a9fabd
## Why
GNU Screen truncates Unicode in OSC titles to a byte, which can turn visible characters into control bytes and spill title text into the terminal.
## What changed
Detect Screen through `STY` and convert the full terminal title to printable ASCII. Map activity spinners and the status dot to ASCII equivalents, and replace other non-ASCII content with `?`. Keep Unicode titles outside Screen and preserve Unicode in TUI status rendering.
## Testing
Add coverage for ASCII title output with activity indicators and Unicode names, preserved Unicode outside Screen, and removal of control and invisible formatting characters.
GitOrigin-RevId: e6b45b9be0d06ab3c3eece89885647f3e9db17da
## Why
Hook system messages were rendered as plain text, leaving ANSI formatting uninterpreted.
## What changed
Parse hook system messages into styled spans so colors and text styles render across lines. Preserve hook prefixes, continuation indentation, and trailing blank lines.
## Testing
Add a snapshot test for multiline ANSI styling and style resets, and extend multiline coverage to include a combining character and a trailing newline.
GitOrigin-RevId: 0a5a88ec26fac114fc66efa656bacf6fa15a1adf
## Why
Cached subagents can remain in the TUI picker after being archived, including when archive notifications are missed.
## What changed
- Hide archived threads from the picker and keyboard navigation, and restore them when unarchived.
- Refresh both active and archived descendants to reconcile cached visibility, including after dropped server events. Queue a follow-up refresh when needed and preserve visibility changes received during an in-flight refresh.
- Preserve picker selection by thread ID as visible rows change, and mark archived thread attachments as replay-only.
## Testing
Extend regression coverage for missed archives, unarchive notifications, hidden subagent navigation, and the subagent enable prompt when only archived subagents are cached.
GitOrigin-RevId: 9e75906dfe6946b1400583a386922453e2b77ea1
## Why
A hung tmux command or a descendant holding stdout open can block terminal input setup indefinitely.
## What changed
Run tmux option probes on a worker thread with a shared one-second deadline, returning default input options when the wait times out. Prevent overlapping probes and kill and reap commands that exceed the deadline.
Capture stdout in a temporary file so completed commands do not wait for descendants to close it, and read at most 4 KiB of output.
## Testing
Add Unix regression tests for successful output, killing and reaping a timed-out command, and returning promptly when a descendant keeps stdout open.
GitOrigin-RevId: a5a4c9323a3e18d1baada5ab1cf3734ce6a9403a
## What changed
Replace the rename field with a single-line `TextArea` that honors configured editor bindings and the composer's Vim setting. Start renaming in insert mode and support Vim Escape recovery on legacy terminals.
Strip carriage returns and newlines from titles and pasted text, keep Vim linewise pastes inline, and scroll horizontally at grapheme boundaries to keep the cursor visible.
## Testing
Add single-line editor coverage for newline filtering, Vim commands, repeat edits, and inline yanks. Extend command-center tests to cover Vim renaming across status-filter changes and cursor placement in narrow layouts.
GitOrigin-RevId: 8d320d6b6de9f77e18292169418383929ca6ceda
## Why
Windows Terminal forwards `Ctrl+Insert` when its Copy action has no native terminal selection. Recognize this shortcut so it can copy text selected within Codex.
## What changed
Add `Ctrl+Insert` to the shared copy-key detection used by transcript and composer selections. Use the same detection for transcript input ownership so the selection consumes the shortcut before other input handlers.
## Testing
Extend transcript tests to verify `Ctrl+Insert` input ownership and copying. Extend composer tests and snapshots to verify that failed or unconfirmed copies preserve the selection, while confirmed copies clear it without changing the draft or cursor.
GitOrigin-RevId: 5a33c72cff4c4395511779a7051fc92f8bd5e5d7
## What changed
Add `tui.mouse_scroll_speed` as a finite positive multiplier for transcript mouse wheel scrolling, including transcript overlays and session previews. Change the default from three rows to one row per wheel event; set the multiplier to `3.0` to retain the previous speed.
Fractional values accumulate movement across events and discard the remainder when direction reverses. For example, `0.5` scrolls one row every two events. Following the latest output pauses only when a whole row moves.
## Testing
Add tests for configuration validation, integer and fractional scroll speeds, direction changes, decimal accumulation, and following behavior. Extend local settings coverage to include a command-line override for the new setting.
GitOrigin-RevId: d355e246fd943415f0ce5a6affe849f77f3615e6
## Why
Table holdback kept completed tables and subsequent content mutable until the response finished. Releasing completed tables earlier also requires a final scrollback reflow when late reference-link definitions change previously emitted content.
## What changed
- Release table holdback once the containing top-level Markdown block is stable, rescanning the remaining tail for later tables.
- Track completed-block boundaries across incremental and full renders.
- Request scrollback reflow at answer completion when reference-link definitions are present, including definitions pending without a trailing newline.
## Testing
Add regression assertions and snapshots for completed tables entering scrollback while later tables remain mutable, and for late reference-link definitions resolving correctly at completion. Cover reflow requests with and without a trailing newline and reference handling with inline visualizations enabled.
GitOrigin-RevId: a6b2aac74496281495b53840bbb1daf06bef60d2
## Why
Account-update notifications include authentication mode and plan information but
omit the email, causing `/status` to lose the signed-in account's email after an
update.
## What changed
Fetch the ChatGPT account email asynchronously after account updates, with a
30-second timeout, without blocking terminal input. Apply the result only if its
request ID is still current, invalidating pending results on subsequent account
updates and disconnects.
## Testing
Extend the account-update test to verify that the email is restored and a stale
result is ignored. Update the status snapshot to include the account email and
plan alongside credits and limits.
GitOrigin-RevId: 202421f78f3d6a7b373194f9c65d1c22d70a04c1
## What changed
Expose `create_worktree`, `get_worktree_creation_status`, and `list_worktrees` through MCP when the worktrees feature is enabled for a trusted local project and attachment storage is available. Support both embedded and local daemon sessions.
Create worktrees asynchronously and attach them to the requesting task, with ownership and attachments retained across restarts. Default to the repository's remote default branch unless `ref` is supplied. Keep the task's working directory and execution environment unchanged, and leave uncommitted source changes in place.
Reject creation in ephemeral side conversations and explicitly untrusted source projects, reuse pending operations, and reject configured MCP servers that conflict with the TUI tools namespace.
## Testing
Add integration and model-request snapshot coverage for creation, polling, listing, attachment persistence across restart, task isolation, trust checks, namespace conflicts, and worker failure reporting.
GitOrigin-RevId: b6a57e92cf5f6fc51fd6d4028543d6fabaf5ac49
## Why
Permission shortcuts checked local configuration while the picker used the connected server's catalog and requirements. Shortcuts should respect the same server restrictions, including model-specific auto-review requirements.
## What changed
- Share a cached server catalog between the permission picker and shortcuts. Show the loading picker when no catalog is available and reuse an outstanding fetch.
- Clear the cache on session, account, working-directory, or connection changes.
- Give discovery RPCs distinct request IDs for each fetch and profile page so repeated requests after timeouts do not collide.
## Testing
Add coverage for loading and catalog reuse, managed permission restrictions, and refetching after disconnect. Update timeout coverage to verify that repeated discovery attempts use distinct IDs and each reports a timeout.
GitOrigin-RevId: 7d79874294136bfe3a654bb306eb7caf36d4df1e
## What changed
Move the voice connection spinner into shared helpers in `codex-rs/tui/src/motion.rs`, keeping its 100 ms animation cadence and static reduced-motion glyph. The helpers handle frame scheduling, and `loading_glyph_with_delay` supports hiding the animated spinner until a specified delay expires.
GitOrigin-RevId: c4ebe5e6a33239999aab2f4432c9145432c8f4fd
## Why
Long drafts need to remain browsable while leaving room for the transcript. Remote image attachments also need to leave an editable prompt row visible.
## What changed
- Cap the fullscreen composer, including padding and hints, at two-thirds of the screen, with a minimum of eight rows when the screen allows.
- Support mouse-wheel browsing without moving the caret or changing transcript selection, search, or activity focus. Show arrows for hidden prompt rows and hide the cursor when the caret is offscreen.
- Resume caret following on editor input, paste, and external edits.
- Keep the selected remote image visible while reserving space for prompt text.
## Testing
Add regression tests and snapshots for fullscreen scrolling, caret restoration after navigation, paste and external edits, remote image navigation and deletion, resizing at scroll boundaries, and disconnected editing.
GitOrigin-RevId: 9a1e4ce14b3b3747e6d136207546327531339258
## What changed
Move footer property construction, mode resolution, hint overrides, quit shortcut hints, and custom footer height calculation from `chat_composer.rs` into `chat_composer/footer_state.rs`. Preserve existing behavior and expose the moved helpers to the parent module where needed.
GitOrigin-RevId: 4a23753ac1648352ab19d4bcc3da9f368c48f619
## Why
Subagents spawned without forked history do not receive their parent's client-defined dynamic tools, preventing them from using those tools for delegated work.
## What changed
Add the disabled-by-default `multi_agent_v2_dynamic_tools` feature flag. When enabled, fresh V2 subagents inherit the parent's dynamic tool definitions and persist them in session metadata.
## Testing
Add coverage for V1 and V2 feature gating, tool persistence, and a fresh V2 subagent calling an inherited tool and receiving its result without inheriting parent history. Update TUI assertions and a snapshot to reflect blank-line separation and question text in recovered answers.
GitOrigin-RevId: a17a16bf5570f54ce922c1521cffb883022354f2
## What changed
- Centralize `windows-sys` at version `0.61.2` in the workspace and migrate dependent crates to it.
- Adapt Windows API calls to the updated handle, boolean, and type definitions. Replace custom handle owners with `OwnedHandle` and use `BorrowedHandle` where ownership stays with the caller.
- Add explicit wrappers for non-owning Windows handles passed between threads.
## Testing
Enable the MCP refresh cleanup test on Windows. Retain process handles to verify that a superseded MCP server stays alive during an in-flight call, exits after cancellation, and leaves the replacement running until shutdown.
GitOrigin-RevId: 86f53d9b300d13edff7154f4a7c32e34dacd2919
## Why
When a turn ends, unsent question answers are recovered into the main composer. Recovering only the answers loses which question each answer belongs to.
## What changed
Prepend each recovered answer with its question title as a Markdown blockquote. Separate questions, answers, and existing composer text with blank lines.
Sanitize question titles and limit them to 512 bytes at a UTF-8 character boundary, adding an ellipsis when truncated. Keep answer text untruncated.
## Testing
Add coverage for bounded titles, multibyte characters, control characters, and multiline question-and-answer submission. Update recovery assertions and snapshots for turn completion, failure, interruption, large pastes, and Vim undo.
GitOrigin-RevId: 141dacfb64bcad5fcabc5be217d2340ef7de1eb5
## Why
Starting Find expanded the entire transcript into detailed mode. Searching hidden content should preserve the compact view and manually expanded activities.
## What changed
- Search full transcript content, including hidden live output, and temporarily expand only the current matching entry.
- Preserve manual disclosure state and retained text revisions while reading or selecting a match. Allow activity controls while reading results.
- Use `Enter` or `Ctrl+P` for older matches and `Ctrl+N` for newer matches, with matching footer hints.
## Testing
Add regression tests and snapshots for selective expansion, manual disclosures, hidden live matches, retained selections across updates and resizing, and Find in compact transcript overlays.
GitOrigin-RevId: 618ee47ba6c3f3a5138c9e3fe0961e7faa3383da
## Why
Closing Find previously restored the pre-search view, making it difficult to read a match and its surrounding transcript context.
## What changed
- Make `Esc` with a nonempty query close query editing while preserving the query, highlighted match, and expanded output. A second `Esc` returns to the latest output; `Ctrl+C` cancels Find and restores the pre-search presentation.
- Allow paging through surrounding context and loading older history without losing the query. Keep `Ctrl+N` and `Ctrl+P` available for match navigation, and reopen Find to edit the retained query.
- Show context above matches when space permits, preserve match layouts across resizing, and display navigation and history status while reading results.
## Testing
Add regression tests and snapshots for retained results, surrounding context, resizing, paging around live output, older-history loading, and footer status. Update interaction tests for the additional `Esc` transition.
GitOrigin-RevId: d822956d3c6ffab88fc1665ebdf0c86ccf110899
## Why
Concurrent Linux test spawns can inherit writable descriptors for executable fixtures, preventing those fixtures from being executed even after the writing test closes its descriptor.
## What changed
Replace direct executable fixture writes and copies across the Rust tests with `codex_utils_cargo_bin::write_executable` and `copy_executable`. These existing helpers complete writes and copies in separate processes on Linux.
Remove the empty temporary inode before creating fake bubblewrap executables, and stage tampered bubblewrap bytes in a separate data file before copying them into the executable fixture. Add the required test dependencies.
GitOrigin-RevId: c875c83088731a4933ef1574e8d79d8cecc12f54
## Why
Fresh TUI threads should use the app server's model settings unless the launch explicitly overrides them. Sending resolved configuration values in `thread/start` turns defaults into explicit overrides.
## What changed
- Track explicit launch choices for `model`, `model_provider`, and `model_reasoning_effort`, and omit unselected settings from the initial `thread/start` request.
- Preserve accepted model migrations as explicit model and reasoning-effort choices.
- Keep explicit profile launches on the existing resolved-configuration path.
## Testing
Update startup request tests to cover omitted defaults, CLI model and provider overrides, repeated model overrides, reasoning-effort overrides, accepted migrations, and explicit profiles.
GitOrigin-RevId: 4e2661ba42322a80e2b769a55c62f61a576762b0
## Why
Forcing `approval_policy` to `never` on temporary structured threads can trigger configuration warnings when managed requirements allow only `on-request`. These hidden threads also need to reject unexpected interaction requests without prompting the user.
## What changed
Inherit the app server's approval policy when starting temporary structured threads. Reject their server requests before dynamic tool handling or interactive TUI routing.
## Testing
Extend regression tests to verify inherited `on-request` approval without approval-policy warnings, and error responses for recap-thread approval and user-input requests even when the thread is marked active and primary.
GitOrigin-RevId: 2d0a071d3687742c83ba933a7ef1357feea53403
## What changed
Remove personality from TUI turn commands and cached thread session state, and stop applying personality from thread settings notifications. Send no personality override in `turn/start` requests.
Forward `personality` through session configuration only when explicitly supplied as a CLI override, rather than deriving it from the effective local configuration.
## Testing
Extend configuration override coverage to verify that `personality = "none"` is forwarded only when supplied through CLI overrides.
GitOrigin-RevId: bd3c3bacc90e0561016c0cac557eb1b0e50d32c0
## Why
Startup presentation needs client preferences before thread initialization establishes effective execution permissions. The startup header should not infer permission state from local configuration.
## What changed
- Load `LocalSettings` directly from bootstrap TOML, preserving preference defaults and overrides, accessibility settings, and audio settings that exclude project layers.
- Use those settings for first-frame presentation and pass `LocalSettings` plus the working directory to the startup draft instead of a full `Config`.
- Stop showing the YOLO indicator in the startup header while execution permissions are unknown.
## Testing
Update tests to compare bootstrap settings with resolved configuration, verify first-frame keybindings and paste preferences with an unresolved permission-profile parent, and snapshot the configured startup header. Adapt startup editor tests to the settings-based interface.
GitOrigin-RevId: f33cf8f42c53a9ddcbe0273491b5a849da9e6808
## What changed
Replace `https://chatgpt.com/codex/settings/usage` with
`https://chatgpt.com/settings/usage` in usage-limit errors, the `/status`
card, and backend banner actions. Credit purchase actions retain
`?credits_modal=true`.
## Testing
Update error-message assertions, banner action tests, status hyperlink
assertions, and TUI snapshots to expect the new URL.
GitOrigin-RevId: 1e1db971284a25a781120da30a6dea5ff9c3d957
## What changed
Add a selectable `daybreak` item to the status line and terminal title, including setup previews and terminal-title validation. Display `Daybreak on` when enabled for the thread and `Daybreak off` otherwise, including during side conversations.
## Testing
Add coverage for on/off rendering and side conversations, update setup preview snapshots, and verify that terminal-title diagnostics accept `daybreak`.
GitOrigin-RevId: b0b7a6f0ee0a107ba4ee2d56113a5b9b6ebd1d41
## Why
Cyber-policy refusal guidance did not distinguish whether Daybreak was on or off, and policy continuations and background task turns omitted `cyberAccessProgram`.
## What changed
- Show refusal guidance for the current Daybreak setting and offer eligible users an “Enable Daybreak” picker for their next request. Persist the selection without automatically retrying the refused request, and suppress the picker during history replay and when viewing parent-owned threads.
- Select and validate the cyber access program for policy continuations and background task turns using account eligibility, model support, and the thread's Daybreak setting.
- Resolve new background threads' Daybreak defaults from effective configuration unless launch flags or a selected profile explicitly override them. Use the target thread's saved setting for follow-up messages.
## Testing
Add unit, snapshot, and request-recording coverage for refusal guidance, picker behavior, continuation access programs, and background tasks retaining Daybreak after configuration changes.
GitOrigin-RevId: 94dee39c067e8eea5791cb31d5fe65fc600e5a18
## What changed
- Add `/daybreak` with account-aware help and availability messages for broader access for cybersecurity work.
- Save the selection in thread metadata and the `daybreak` default for new threads, restore it on resume, and confirm that it applies to new turns.
- Select `cyberAccessProgram` from the connected server's model catalog. Require a signed-in ChatGPT account, the OpenAI provider, and confirmed model support when Daybreak is enabled, including for faster-model retries. Keep Daybreak disabled for side conversations.
## Testing
Add tests for toggle persistence, turn access-program selection, unsupported-model rejection, side-conversation behavior, command help, and the resumed-thread banner.
GitOrigin-RevId: e3c028b0a6a8e0a862c16fdc766f374aae618ef1
## What changed
Select cyber refusal notices from the current model's `available_access_programs` for ChatGPT accounts using the OpenAI provider. Show Astra-specific guidance only when an Astra model offers standard cyber access without Daybreak access, and use the limited notice when Daybreak access is available. Otherwise, show application guidance.
Remove the separate account eligibility request, background prefetching, and notice cache.
## Testing
Update tests to cover catalog-based notice selection, missing model metadata, isolation from other models' access programs, and rendering the application notice for a cyber policy error.
GitOrigin-RevId: 88e9522bd6ece2d2b9caa6cff01a4178768babb7
## Why
The Windows shared daemon rejects elevated launches so shared clients cannot inherit administrator privileges. Local TUI sessions launched as administrator should still be able to start.
## What changed
Select embedded mode before daemon discovery or startup for elevated local Windows sessions. Show a startup warning explaining that the shared background server is disabled and that restarting Codex in a non-elevated terminal enables it. Record `elevated_windows` as the server selection reason.
## Testing
Add Windows integration coverage for elevated normal, `resume`, and `fork` launches without creating daemon directories, and verify that explicit daemon `start` and `restart` still reject elevation. Add a snapshot test for the startup warning in the warning center.
GitOrigin-RevId: 89594e86d6ee19b080dfb11553cee8676395f188
## Why
Mixing every input on a multichannel audio device can include playback channels in microphone capture. Selecting only microphone inputs keeps those playback channels out of the captured audio.
## What changed
- Add `audio.microphone_channel` with one-based channel numbers, accepting a single value or an array such as `[1, 2]`. Leaving it unset preserves mixing of all inputs.
- Add an input-channel picker for the selected microphone when it has at least three channels. Require a nonempty selection and save it locally for the next voice conversation.
- Average only the selected channels, deduplicate selections, and reject empty or unavailable selections without falling back to other inputs.
- Clear saved channel selections when saving an input device and report configuration overrides that prevent the reset from taking effect.
## Testing
Add regression coverage for excluding playback channels, sample conversion, subset mixing, invalid selections, configuration loading, local persistence and overrides, and picker selection and cancellation. Update UI snapshots and verify channel selections are passed to the voice helper.
GitOrigin-RevId: 99960dcfa7b10cf38270768a90bb84a4be95a406
## Why
When saving the default service tier fails, users need the underlying configuration error and guidance on how to retry without interrupting their task.
## What changed
Format the error with `format_config_error` and explain that the task can continue. Tell users to resolve the error, then switch to a different tier and back to the desired tier to retry saving the default.
## Testing
Add a snapshot assertion for a rejected service tier save caused by malformed configuration, covering the detailed error and recovery guidance.
GitOrigin-RevId: d666f7915f185d219396d24034412b175c49173e
Stop adding an informational message to chat history when `open_url_in_browser` succeeds. Continue displaying an error when opening the browser fails.
GitOrigin-RevId: 28d33917c1a2e354017470e785e44aa0032c3b46
## Why
Without a UI flush tick, expired paste detection can cause Enter to be treated as part of a paste instead of submitting buffered input.
## What changed
Flush due characters and paste buffers before classifying Enter during submission, including in Vim insert mode. Preserve the buffered text when submission is blocked for a parent-owned thread.
## Testing
Add regression tests for held characters and buffered bursts with and without Vim mode and parent-owned threads, plus a snapshot test for Enter submitting expired input in Vim insert mode.
GitOrigin-RevId: 1d0d309b57e9d2151e0d9c1774a3401d05413d3c
## Why
Explicit launch permissions such as `--yolo` can be lost during reconnect recovery, causing subsequent input to use different approval and sandbox settings.
## What changed
Remember explicit local launch approval policies, approvals reviewers, and permission profiles at startup and when creating new sessions. Restore the approvals reviewer independently of profile overrides during reconnect recovery. Keep constrained profiles that cannot be expressed through legacy turn parameters under server control.
## Testing
Add regression coverage for `--yolo` across new sessions and reconnects, later permission-picker choices, reviewer-only overrides, and server-owned constrained profiles. Extend the reconnect integration test to submit the preserved draft and verify its approval and sandbox settings.
GitOrigin-RevId: 7a77dc41b2a357ab17fec9ba6cb2361f4a8f4aa5
Benjamin Carlsson