## What changed
- Mark `api_key_model_discovery` as stable and enable it by default, while preserving explicit user opt-outs and provider catalog requirements.
- Fall back to bundled models when discovery is disabled at runtime, including when a remote catalog has already been loaded.
## Testing
Extend model-list coverage for default enablement, app overrides, and user configuration precedence. Add a regression assertion that runtime opt-outs hide loaded catalogs without additional fetches, and update daemon compatibility tests for the new default.
GitOrigin-RevId: feaf732757792cc58063f21a5327d0e633f079f4
## What changed
Render Control, Shift, and Alt as `⌃`, `⇧`, and `⌥` on macOS, and Control as `^` on Linux. Keep textual modifier labels on other platforms.
Route hard-coded shortcut hints through the shared key-label formatter so footers, overlays, pickers, and transcript notices use consistent notation.
## Testing
Update modifier-combination and chord label assertions, along with rendering snapshots and narrow-layout expectations for the shorter hints.
GitOrigin-RevId: 0d20fa218e4a11dfe7a81c8de64f8d25e093af03
## Why
A saved side conversation transcript can outlive its ephemeral server thread. The resulting `turn/interrupt` error prevented side conversation cleanup and blocked archiving the parent thread.
## What changed
Treat the specific `thread not found` interrupt error as successful interruption for replay-only side conversations, allowing unsubscribe and local cleanup to finish. Continue sending interrupt requests because replay-only conversations may still be running after reconnect.
## Testing
Expand archive lifecycle coverage for local daemon and remote server connections to include live side conversations, replay-only conversations with existing threads, and replay-only conversations whose threads are gone. Assert that interruption, unsubscribe, archiving, and local cleanup occur.
GitOrigin-RevId: 0528c9f5b5278931fd3a7941073071117f2f3612
## Why
The TUI unconditionally forwarded its resolved `web_search` mode, allowing implicit client settings to replace server defaults or saved thread settings.
## What changed
- Forward `web_search` on thread start, resume, and fork only when the winning choice comes from session flags or a selected profile.
- Translate legacy search feature flags into a canonical `web_search` override while preserving precedence, and remove those flags from forwarded feature overrides.
- Honor shared feature requirements for embedded sessions while letting remote servers enforce their own requirements on explicit search choices.
## Testing
Add coverage for configuration origins, canonical and legacy search precedence, and embedded versus remote feature requirements. Extend the Responses integration test to verify that a remote server's live search setting survives thread start and resume when the client's configuration disables search.
GitOrigin-RevId: c714f9cf0321aca9a5fa292a350720af5a2d02d4
## Why
Switching to a fork can interrupt approval routing for source and child threads that remain on a local daemon or remote app server. Their pending requests and event listeners need to survive the switch.
## What changed
- Retain background request routing and event listeners for tracked threads when switching to a daemon-backed fork, preserving pending approvals without duplicating them.
- Register the source thread before the `fork_thread` tool creates a fork so its requests remain routable during the operation.
- Route requests for the currently viewed thread to the active UI, even when that thread is also tracked in the agents overview.
## Testing
Add regression coverage for local daemon and remote forks retaining source and child threads, replaying pending requests when returning to the source, and displaying active-thread file-change approvals. Verify that embedded forks still discard the source thread state and that `fork_thread` registers its source before issuing the fork request.
GitOrigin-RevId: 63139e2b9a6eff373ab05a31e0140a432ce47389
## What changed
Fetch optional security setup notices asynchronously for local ChatGPT sessions using the OpenAI provider. Verify that saved credentials match the connected app server, ignore stale account responses, and validate notice text and HTTPS actions on `chatgpt.com`.
Show notices as dismissible inline banners with a browser action, while giving applicable usage banners priority. Preserve notice state and dismissal across thread changes, reconnects, and banner replacement for the same account and user.
## Testing
Add authenticated HTTP fixture tests, notice validation tests, and TUI tests covering stale responses, dismissal persistence, usage banner priority, browser actions, and wrapping in narrow terminals.
GitOrigin-RevId: b8635fcf6a26b42b6a06640601c8517d8d5e47e8
## What changed
Preserve the underlying error in `LocalStateDbStartupError` and use its error chain to decide whether CLI startup failures qualify for automatic database backup and recovery.
Replace corruption checks against error-message text with SQLite result-code classification, including SQLx extended result codes and directly wrapped `SqliteError` values.
## Testing
Update the embedded startup corruption test to verify that the startup error retains a detectable SQLite corruption cause and the failed database path.
GitOrigin-RevId: 6e8ecd0ee67f3c239183ddea3fc75c4e4cd5744a
## Why
A database can open successfully while containing corruption that startup previously missed. Detecting it before runtime initialization completes allows recoverable databases to be rebuilt while preserving the damaged files.
## What changed
- Run `PRAGMA quick_check(1)` when opening writable databases, with a 100 ms scan budget. Share attempts across cloned `SqliteConfig` instances by file identity so repeated opens skip validation and replacement files are checked again.
- Back up and rebuild runtime databases that support recovery. Report corruption without rebuilding thread history or other databases without an automatic recovery policy. Treat interrupted or locked checks as incomplete rather than confirmed corruption.
- Collect startup backups across recovery retries and include their locations in the app server warning. Explain that saved conversations can restore the thread list and history, while some database-only metadata may be unavailable.
- Record confirmed corruption in `codex.sqlite.corruption.count`.
## Testing
Add tests for recovery policies, backup preservation, validation caching and concurrency, cancelled and interrupted checks, and locked databases. Add app server coverage for recovery warnings and saved conversation restoration, a TUI warning snapshot, and message board post preservation.
GitOrigin-RevId: 43e26328888e0301def642d69bd324acee867566
## Why
When a turn ends, recovered question answers are appended to the composer draft. If that draft starts with a shell or slash command, submitting the combined text can interpret it as a command instead of a prompt.
## What changed
Escape command prefixes before appending recovered answers so the combined draft stays editable and submits as literal prompt text. Convert shell mode's separate `!` prefix into escaped composer text, and leave slash-prefixed paths such as `/tmp/file` unchanged.
Keep prefix escaping and answer recovery in the same Vim undo edit.
## Testing
Add regression coverage for immediate and queued submission, whitespace around command prefixes, slash-prefixed paths, and already escaped commands. Extend Vim undo coverage to shell and slash command drafts, including shell mode, and add a snapshot of the recovered shell draft.
GitOrigin-RevId: 03c40f72a834a65bf367103cb9170a86dc35ad98
## Why
`windows.allowed_sandbox_implementations` permits MXC regardless of the listed implementations. Managed requirements need a separate way to block both explicit MXC configuration and automatic selection through `prefer_mxc`.
## What changed
Add the optional managed requirement `windows.allow_mxc`. Setting it to `false` disables automatic MXC selection and rejects explicit `windows.sandbox = "mxc"` configuration with an error identifying the requirement. Leaving it unset or setting it to `true` preserves existing behavior.
## Testing
Add coverage for the requirement alongside allowed sandbox implementations, preference resolution, and cloud-managed opt-out behavior for implicit, elevated, and explicit MXC configurations.
GitOrigin-RevId: a458a7b4c92cf17e687dbbad8208884d1c097da5
## Why
Session commands with `--remote` should use the selected server's authentication and execution environment, even when the caller has workload identity configured and cannot read its identity token.
## What changed
Connect `queue`, `archive`, `unarchive`, and `delete` directly to the explicit remote app server after validating configuration. Skip caller credential and runtime initialization, use remote thread parameters, and preserve the caller's working-directory override.
## Testing
Add end-to-end coverage with an unreadable caller identity token to verify queued turns use the server's API key and remote archive, unarchive, and deletion operate on the selected server. Add configuration-validation coverage for all four commands and `--no-daemon` rejection coverage for remote unarchive and delete.
GitOrigin-RevId: 5da7abbb40506cd754a8863e1a9d8fad9b1f09a9
## Why
User goal edits and clears need to reach the model as user instructions, including when a thread is unloaded or history is being compacted. Automatic goal lifecycle updates must not supply user authorization.
## What changed
- Add optional `origin` values of `user` and `automatic` to `thread/goal/set` and `thread/goal/clear`, and mark TUI goal requests as user actions. Omitted origins do not supply user authorization.
- Persist explicit user objective, status, and clear instructions before changing goal state. Recording failures leave goal state unchanged.
- Coordinate goal edits with thread resume, reload stored history under writer ownership, and preserve edits accepted after the compaction input snapshot.
- Update generated protocol schemas and TypeScript and Python bindings.
## Testing
Add coverage for user edits and clears on loaded and unloaded threads, concurrent path-based resume, exclusion of automatic goals from user instructions, preservation of edits during compaction, and recording failures that leave goal state unchanged.
GitOrigin-RevId: d779d7c678a0c32a6ef76975dbe5b1400d1df245
## Why
Copying a rendered local file target such as `repo/foo_bar!` should preserve the selected path without adding Markdown escapes.
## What changed
Treat selections contained within rendered file targets as plain text, including partial selections and targets in tables. Coalesce adjacent file targets and inline code into literal ranges while preserving Markdown escaping when the selection includes surrounding content.
## Testing
Add regression coverage for partial paths, adjacent literal spans, styled links, table cells, special characters, and mixed selections at narrow and wide rendering widths.
GitOrigin-RevId: 94bcdacf14b013f9198cb84adfdb237eb644dd48
## What changed
- Fork the selected conversation and open the new session with `f`, configurable through `agents.fork` in the TUI keymap.
- Move the default search shortcuts to `F3` and `/`, preserving unshadowed defaults when custom bindings conflict.
- Keep queued input on the source conversation while attaching and forking, and require closing an open side conversation before forking another task.
- Expose the fork action in command-center help and the keymap picker.
## Testing
Add regression coverage for queued-input preservation, side-conversation protection, configurable fork shortcuts, metadata editing, disconnected actions, and search fallback bindings. Update help and keymap snapshots.
GitOrigin-RevId: b11ae21ef6a2053609b31ce97c646104f18806a3
## What changed
Define `thread/prediction/request` with `threadId` and `sourceTurnId`, and `thread/prediction/updated` with a `completed` result containing optional text or a `failed` result.
Update generated JSON schemas, TypeScript types, and Python notification models. Route prediction notifications to their thread in the TUI and ignore them in the chat widget.
The request remains unimplemented and returns a method-not-found error.
GitOrigin-RevId: 09922f583d5c56f808d018121c651dcd92734515
## Why
Client permission definitions and constraints can differ from those on the connected app server. Accepted permission changes also need to survive task transitions before their settings notifications arrive.
## What changed
- Discover permission profiles and availability from the connected server and apply selections through `thread/settings/update`, including custom profiles.
- Adopt the server's effective permission settings instead of reapplying local definitions or constraints.
- Retain accepted selections and effective approval settings across new tasks, forks, side conversations, directory changes, reconnects, and safety retries without blocking navigation on a settings notification.
- Recognize the current built-in permission preset when the server supplies an unnamed profile.
## Testing
Add regression coverage for conflicting client/server profile definitions, rejected and unchanged selections, consecutive requests with omitted approval settings, and permission carryover before confirmation. Extend discovery and menu tests to verify server-provided availability and unnamed-profile highlighting.
GitOrigin-RevId: bcd767b58dc92dc4f945189078e51e6e5fce6d24
## Why
Voice conversations previously opened the system-default microphone and speaker. Users need to choose which local devices to use, including when connected to a remote app server.
## What changed
- Add input and output device pickers alongside voice selection, with back navigation and a System default option.
- Persist selections as `audio.microphone` and `audio.speaker` on the TUI's machine, excluding project configuration layers. Apply them to the next voice conversation.
- Enumerate devices without opening audio streams and pass the selected names to the voice helper at startup.
- Disable ambiguous device names in the picker and use the same eligibility filtering for discovery and named-device startup.
## Testing
Add tests for device preference persistence across project and remote transitions, picker navigation and duplicate names, discovery without capture, and forwarding selected devices to the helper.
GitOrigin-RevId: d48fb3a09fa9b982a408f5a7c96bdd81776af21d
## What changed
Register `login_shell_package_path` as a disabled-by-default experimental feature and add it to the configuration schema. Expose it in `/experimental` as “Bundled tools in login shells,” with a description explaining its intended use when login shell startup resets `PATH`.
## Testing
Extend the experimental feature metadata snapshot test to cover the new feature's label, description, and unchecked default state.
GitOrigin-RevId: dc110486ccd8d2d76ac788ba5a413a1374699ff8
## What changed
Remove startup greeting phrases and the shared greeting state from startup drafts, session headers, and the empty-state animation. Raw session headers now consistently include `model:` and `directory:` fields.
## Testing
Update startup and fresh-thread snapshots to omit greetings, and adjust raw-header assertions to check model and directory fields.
GitOrigin-RevId: 531b5ba42d7a88f86b1c7f69030f3560abc25198
## Why
Credentials can use a keyring backend, so describing all login and logout operations as reads or writes to `auth.json` is misleading.
## What changed
- Remove the API-key onboarding claim that keys are stored in `auth.json`.
- Describe authentication storage and credential-removal errors in terms of stored credentials and the selected backend.
- Label the doctor output's auth-file path as the file backend or fallback, and document why startup checks also consider `config.toml` when credentials may be in a keyring.
## Testing
Add API-key entry snapshots for terminal widths of 80 and 40 columns.
GitOrigin-RevId: 87189f422448b88721ea2d7448930ece63102803
## Why
Pasting multiple lines into a blockquote previously left subsequent lines unquoted.
## What changed
- Continue the current line's `> ` prefix across pasted lines, including blank and trailing lines, in the TUI composer and embedded answer fields.
- Append two unquoted newlines so typing resumes in the next Markdown block. Preserve quoting when large paste placeholders expand on submission.
- Use a shared edit target for paste context and insertion so selection replacement uses the prefix at the replacement start.
- Keep shell input and provisional startup pastes literal.
## Testing
Add unit tests and rendering snapshots for blockquote pastes, embedded answers, cursor placement, selection replacement, and large-paste expansion. Add textarea tests for forward and backward selections, adjacent elements, and Vim Replace backspace recovery.
GitOrigin-RevId: 525a7951aa16a25d49cc3be98822d0dd0709de97
## What changed
Preserve catalog `multi_agent_version` values instead of forcing V1, allowing models that declare V2 to use it by default. Retain Ultra in supported reasoning levels so it appears in the Astra advanced reasoning picker for Bedrock Mantle and Runtime.
## Testing
Add coverage for preserving configured multi-agent versions, selecting V2 and exposing `collaboration.spawn_agent` and `collaboration.followup_task` without the V2 feature flag, and displaying and selecting Ultra in both Bedrock reasoning pickers.
GitOrigin-RevId: 4fb1336c79b3f86ce12fa5ea81fe2237a300840d
## What changed
Add `openai.gpt-6.1-sol` to the Bedrock Mantle catalog and its `global.` and `us.` variants to the Bedrock Runtime catalog. Make GPT-6.1 Sol the default and provider fallback model, preferring the global variant for Runtime. Keep existing models available.
## Testing
Update catalog and provider assertions, thread-start fallback tests, and TUI model-picker snapshots to cover GPT-6.1 Sol and the new defaults.
GitOrigin-RevId: ec65744ff9409980474cc1faf516beed0b2430da
Add `gpt-6.1-sol` to the bundled model catalog with its capabilities,
reasoning levels, and availability message. Give it the highest catalog
priority and update older Sol descriptions to reflect their generations.
Update startup, model picker, and tool catalog snapshots to reflect the
new default and catalog contents.
GitOrigin-RevId: 1092a0524c6d1813ddd600c31c4fd0e708294ae9
## What changed
Allow users with an active session to start MCP OAuth sign-in through `/mcp login <name>`. Request login through the app server, open the authorization URL in the browser, and display success or failure in the originating thread.
Guard overlapping start requests and track login attempts per server so stale retry completions do not overwrite current results. Skip opening the browser when the attempt has already completed, and retain results across thread switches and session refreshes.
## Testing
Add command dispatch coverage and regression tests for overlapping starts, stale retry completions, rejected starts, independent server logins, and result retention across thread switches and session refreshes.
GitOrigin-RevId: aeec2dbee566660f9aa26ef23039196ef3ca49d6
## Why
Configuration reloads must honor current managed restrictions without granting new enterprise MCP authority to existing sessions or overwriting newer configuration with stale snapshots.
## What changed
- Allow enterprise managed authentication only for configured MCP servers. Remove plugin `ema_auth` overlays from the schema and disable servers that still use them.
- Refresh ordinary MCP settings while preserving session settings and initially admitted enterprise registrations. Disable enterprise MCP when its registration changes, policy revokes access, or configuration loading or resolution fails; require a new session to restore enterprise authority.
- Publish refreshes only when their captured configuration is still current, with bounded retries in app-server reloads. Preserve updated managed restrictions even when a refresh is rejected.
- Finish processing other thread refreshes before `config/mcpServer/reload` reports a rejection, and document that an error can accompany partially applied changes.
## Testing
Add regression coverage for stale refreshes, bounded retries, managed-policy revocation, persistent enterprise disablement, ordinary MCP transport changes, and rejection of plugin enterprise authentication. Verify that denied enterprise servers receive no requests.
GitOrigin-RevId: 34429cd339c1ec152a2ee8697cb29f0cff5d9e5f
Read `model_provider` from the effective configuration's nested `config`
field in `history_model_provider`, retaining the `openai` fallback.
GitOrigin-RevId: 06a8b3da1b499e673f80b8827951020c469c3970
## Why
Client provider defaults can override the app server's configured provider and hide its sessions from resume and fork history.
## What changed
- Omit implicit provider overrides from thread start, resume, and fork requests so the server can resolve its defaults.
- Use the server's effective provider for named history lookup, `--last`, and resume and fork pickers, while honoring explicit CLI and selected-profile choices.
- Respect managed provider requirements when resolving history filters and preserve the active session's provider when forking it.
## Testing
Add app-server regression tests for provider defaults, explicit choices, configuration changes, selected profiles, and managed requirements. Add CLI coverage for resume and fork pickers and `--last` with local daemon and embedded servers, plus a picker rendering snapshot.
GitOrigin-RevId: a077758b13a5e55552b52e5532ad4bebe86dce7e
## What changed
- Skip folder trust prompts for locally discovered projectless directories without a saved trust decision. Apply workspace-write permissions and granular approval defaults only when local execution, configuration, and managed policy allow them.
- Prompt for Windows sandbox setup when needed before enabling implicit workspace-write permissions.
- Restore saved task permissions on resume unless explicitly overridden, and keep ordinary turns from overwriting the server's saved permission profile. Track explicit approval reviewer choices separately from restored permissions.
- Let `/cd` request folder trust with a “Keep current directory” option. Recheck task activity and background terminals before switching, and enforce destination permission requirements.
## Testing
Add regression coverage for projectless defaults and session transitions, explicit permission overrides, saved profile preservation, trust discovery, destination policy conflicts, and the directory consent and Windows sandbox prompts.
GitOrigin-RevId: cf74f5a90245f2aee96caa80d76de64da6ec1ebd
## Why
Copying text selected within a blockquote adds Markdown quote markers that are not part of the selected content.
## What changed
Return plain text for selections containing only quoted content, preserving literal `>` characters and selected whitespace. For quoted tables and task lists, remove quote prefixes while retaining table reconstruction and checkbox states. Selections spanning quoted and unquoted content continue to preserve Markdown structure.
Preserve the existing logical source when marking list separator lines as omitted from Markdown copying.
## Testing
Add coverage for partial and nested blockquote selections, quoted tables and task lists at narrow and wide widths and after rewrapping, and copying a mouse-selected blockquote.
GitOrigin-RevId: 5ac0c8c47a77937e5a35c376d8908065217ad2dc
## What changed
Omit the reasoning summaries setting from the model details when connected to a remote server or local background server. Continue displaying it when no server connection is present.
## Testing
Expand status snapshots to cover no server connection, a remote server, and a local background server, including the reasoning summary setting visibility in each case.
GitOrigin-RevId: f7213e7ad7439107705461ccf4e070501729113b
## Why
Forwarding local defaults as request overrides can replace server defaults or saved thread settings for reasoning summaries and verbosity.
## What changed
Only forward `model_reasoning_summary` and `model_verbosity` as shared thread request overrides when their winning configuration layer is a session flag or an explicitly selected user profile. Use the effective values from that layer, and omit values whose winning source is ordinary user or project configuration. Preserve the existing reasoning-summary defaults for new embedded threads.
## Testing
Add coverage for profile, project, and CLI precedence. Extend outbound model request tests to verify that remote-mode thread start and resume preserve server reasoning summary and verbosity settings despite conflicting local values.
GitOrigin-RevId: 5e14254a51ed7506118a46847bb7466ab58908ef
## What changed
Render macOS Option shortcuts as `⌥t` and `ctrl+⌥t` instead of `⌥+t` and `ctrl+⌥+t`. Keep `+` separators after text modifier labels such as `ctrl`, `shift`, and `alt`.
## Testing
Update key-label and chord assertions and UI snapshots to expect the compact labels across shortcut help, navigation hints, and tooltips.
GitOrigin-RevId: 7d52088ebce3dfa3f8bdad65eb159ca0fead8a31
## Why
Providers with `model_catalog_url` could advertise bundled models absent from their catalog or reuse stale models after a failed refresh. Model metadata could also match by prefix or namespaced suffix instead of the provider's exact model ID.
## What changed
- Suppress bundled model fallback and merging for explicit provider catalogs, including when discovery is disabled.
- Require unique, non-empty catalog slugs and match metadata by exact model ID.
- Serialize explicit catalog refreshes and invalidate in-memory and persisted catalog entries after fetch failures, preventing stale cache reuse.
- Report a clear configuration error when startup has no available model, while allowing an explicitly configured `model`.
## Testing
Add regression coverage for exact model matching, hidden catalog entries, cache invalidation across restart and recovery, invalid slugs, and empty-catalog startup with and without an explicit model. Update app-server model-list expectations and verify the TUI configuration error.
GitOrigin-RevId: ac323a94178e3c48df8d4a159a86fdbac20b03a2
## What changed
- Publish released mouse selections from both transcript views to X11 `PRIMARY` as plain text, even when copy-on-select is disabled. Preserve configured `CLIPBOARD` copying when it is enabled.
- Paste `PRIMARY` into the editable fullscreen composer on middle-click, including while a transcript selection remains active.
- Limit support to local Linux X11 sessions, excluding Wayland, SSH, tmux, WSL, and VS Code terminals.
- Retain the latest deferred selection publication and order it before a pending `PRIMARY` read, while giving explicit copies priority. Cancel stale deferred work when its selection or paste target is invalidated.
- Clarify that scrollback mode uses native terminal copy, paste, and scrollback.
## Testing
Add regression tests for selection publication with copy-on-select enabled and disabled, publication-before-read ordering, explicit-copy priority, cancellation of deferred work, and middle-click paste invalidation.
GitOrigin-RevId: 6ba7bddffda60183b7f9ad5cd69a97da8a4a8dcd
## Why
The command center seeded only ten recent sessions, with no way to browse older history from the task list.
## What changed
- Add a keyboard-selectable “Show more” row that discovers up to ten more tasks, with loading and retry states that remain accessible during search.
- Retain per-source cursors and buffered rows across requests, merging interactive and non-interactive history by recency without discarding existing tasks on failure.
- Refill vacancies after tasks are archived or deleted, and prevent stale refreshes from restoring removed tasks.
- Limit routine detail refreshes to recent and loaded tasks, plus explicitly targeted threads, as retained history grows.
## Testing
Add regression coverage for pagination across mixed sources, cursor retries without row loss, automatic refill, queued pagination, and “Show more” navigation, loading, search, and retry rendering.
GitOrigin-RevId: 0bfcc970c9adf0c8d509b275a92ecf01c29595ad
## Why
Reconnecting paused all recovered input, including queued messages that had never been sent. Those messages can resume automatically once any uncertain submissions are resolved.
## What changed
- Track unsent and unconfirmed messages separately. Reconcile submitted prompts and steers using exact client message IDs from restored history, buffered events, and later receipts.
- Remove confirmed submissions from the recovered queue and resume unsent input after replay. Keep uncertain submissions paused without resending them, and show a notice identifying the message whose delivery could not be confirmed.
- Preserve pauses for unavailable conversations, pending compact/review requests, and existing input recovery failures.
- Simplify reconnect status text and remove blanket disconnect/reconnect transcript notices.
## Testing
Update reconnect integration tests and snapshots for automatic queue resumption. Add coverage for matching and unrelated receipts, missing history, late confirmations across navigation, pending compaction, and preservation of image-failure recovery pauses.
GitOrigin-RevId: d0b9aa43c4019d472985d12bbce8ba9bbfb9253b
## What changed
- Replace plan-specific and Fast-mode promotions with the desktop app tip for the current platform, while preserving announcement priority and random-tip fallback.
- Share desktop app tips between the preferred slot and random tip pool, including Windows. Keep Linux app tips limited to graphical sessions outside WSL.
- Clarify installation and launch instructions for macOS, Windows, and Linux, and format launcher commands as code.
- Remove the Fast-mode status plumbing used by tooltip selection.
## Testing
Add snapshots for all three platform tips at a narrow terminal width. Update tests to cover plan-independent tip selection and platform availability.
GitOrigin-RevId: 34bbc95c47c83618f9ac1691a1b69ca4690b8665
## Why
Follow-up directives contain display labels and prompt attributes. Show the labels without exposing directive syntax or prompt text in rendered responses and streaming previews.
## What changed
- Render `:codex-followup[label]{prompt="..."}` as its label, preserving inline Markdown styling and source offsets.
- Replace recognized follow-up directives with their labels when copying whole responses, while retaining the original source.
- Withhold unfinished directives in rich streaming previews and avoid cropping into prompt attributes when the preview window advances.
- Preserve literal code, escaped directives, and malformed source when rendering completed messages or copying responses.
## Testing
Add regression coverage for label formatting, nested brackets and backticks, literal and malformed directives, whole-response copying, and streaming holdback across long prompts and preview window boundaries.
GitOrigin-RevId: dce61d1164de0a576fe95fb2c67b177a1ed414e8
## What changed
Use a shared subscription label mapping for status and analytics views. Rename
`Pro Extra` to `Pro 200`, `Pro Standard` to `Pro 100`, and `Pro Max` to `Pro 500`,
while preserving the existing differences between status and analytics labels
for other plans.
## Testing
Update the status plan-label test expectations for the three Pro tiers.
GitOrigin-RevId: 47af1e7d56ef9f7701caff8af315f530087920b8
## Why
Failed `thread/realtime/listVoices` requests silently fell back to the built-in catalog, allowing voice selection and conversation startup to proceed without the server's voice catalog.
## What changed
- Propagate catalog errors and show an error instead of opening the voice picker or starting a realtime conversation.
- If the catalog lookup fails after saving a preference, report that the preference was saved but the effective voice could not be confirmed. Leave the in-memory voice settings unchanged.
## Testing
Extend remote voice tests and snapshots to cover catalog failures when opening the picker, saving a preference, and starting a conversation. Verify that the preference is persisted, in-memory settings stay unchanged, and failed startup clears realtime state without sending `thread/realtime/start`.
GitOrigin-RevId: ba40800d6f9002e02e2b33de8dc858188c3cddd7
## What changed
Update plan labels in the analytics views and status display:
- `PlanType::Pro`: `Pro (More)` → `Pro Extra`
- `PlanType::ProLite`: `Pro` → `Pro Standard`
- `PlanType::ProMax`: `Pro (Max)` → `Pro Max`
## Testing
Update the status display-name test expectations for all three Pro tiers.
GitOrigin-RevId: 9bd9f1cd8a701019fd40047cd8131e6193f66cb9
## Why
Copying text selected entirely within inline code added Markdown backticks that were not part of the selected content.
## What changed
Return only the selected content as plain text when the selection is contained within one inline code span, including in a single table cell. Preserve Markdown formatting for selections that also include surrounding content, and continue filtering control characters from table copies.
## Testing
Add regression coverage for full and partial inline code selections, embedded backticks, Unicode, whitespace, wrapping and resizing, and table selections with mixed content or control characters.
GitOrigin-RevId: c63e13cb781f9fca28ae53500cb4f9ae08b72c96
## Why
The fullscreen status line showed Plan mode without explaining how to leave it.
## What changed
Show `Plan mode (shift+tab to cycle)` when the composer is idle and accepts input, and the hint fits alongside the status text. Fall back to the mode label when space is limited, and hide the shortcut during tasks, popups, interactive footer use, or other non-composer modes.
## Testing
Add a rendering snapshot and regression assertions for wide and narrow layouts, running tasks, interactive search, empty status text, disabled input, and parent-owned threads.
GitOrigin-RevId: a1cf2762b33f5442ab0611a15205f2e36c84b075
Describe permissions and approvals explicitly in the Codex docs link text,
and clarify that the user's ChatGPT plan rate limits and training data
preferences apply. Remove the “Before you start” preamble to shorten the
success screen.
Update the rendering snapshot and hyperlink styling assertions for the
revised copy and layout.
GitOrigin-RevId: 5166ddade6a433191fa86c960899c4da5092b9f5
## What changed
- Default `flowchart` and `graph` to top-down layout when no direction is specified.
- Support solid and dashed edges with directed, undirected, or bidirectional endpoints: `-->`, `---`, `<-->`, `-.->`, `-.-`, and `<-.->`.
- Accept pipe labels on these edges and spaced directed infix labels such as `A -- send --> B` and `A -. retry .-> B`.
- Expand `&` groups into all source-to-target edges, including in chains. For example, `A & B --> C & D` creates four edges. Enforce the 24-edge limit after expansion and cap each group at 24 node references.
## Testing
Add coverage for equivalent syntax, edge styles and endpoints, malformed input, and expansion limits. Extend rendering snapshots across all four directions and the TUI native-renderer test with the new syntax.
GitOrigin-RevId: 6e51653ebf6b8b7e7e1edec0c2e09a5d9c8dec74
## What changed
Render interrupted turns with secondary text styling and shorter wording,
removing the suggestion to tell the model what to do differently.
## Testing
Update interruption snapshots and assert that the notice uses secondary text
styling.
GitOrigin-RevId: 7cb042ed9e6781d107a93d5677fa193f082c764d
## What changed
- Show a hand pointer over actionable transcript links while Codex captures mouse input in Ghostty and Kitty, excluding sessions inside terminal multiplexers.
- Share link hit testing between hover and click activation, and refresh hover after rendering so scrolling and live output cannot leave a stale hand pointer.
- Suppress link hover during mouse presses and drags, overlays, and popups, and clear remembered mouse coordinates on focus loss, resize, and resume.
- Restore the terminal's pointer policy when releasing mouse capture, releasing Kitty's override and using a text pointer in Ghostty. Deduplicate pointer updates and preserve cleanup after write failures.
## Testing
Add tests for wrapped links containing wide characters, hover/click target agreement, scrolling, pointer transitions and restoration, write-failure retries, and hover invalidation.
GitOrigin-RevId: 1cf52e039a229e12260fa334879784c9bc1c8c87
## Why
Completion footers hid known durations unless they exceeded 60 seconds, leaving short turns without elapsed-time information.
## What changed
Show all known durations for live and restored turns, rendering sub-second durations as `Worked for <1s`. Separate completion metadata with `•` instead of `·`.
## Testing
Update live completion, history replay, and separator tests to cover short durations, missing timestamps, and the revised footer format. Refresh affected TUI snapshots.
GitOrigin-RevId: 666e765db5426c5f9cc00d73f71cab649ad34947
## Why
The “Implement this plan?” prompt blocked transcript scrolling, preventing users from reviewing earlier steps in a long plan while deciding how to proceed.
## What changed
Allow mouse-wheel scrolling over the visible transcript while a modal is active. Keep keyboard input with the modal and preserve restrictions on transcript selection, scrolling outside the transcript, and scrolling with completion popups open.
## Testing
Add input tests and a snapshot covering plan-prompt scrolling, keyboard navigation, dismissal and submission, pointer boundaries, and completion-popup behavior.
GitOrigin-RevId: ac5227c877ce34324a0d3830d5383495241ddbc3
andrewgu-oai