## What changed
Remove `first_party_type` from connector app metadata and the app-server v2
protocol. Update metadata conversion and merge paths, generated JSON and
TypeScript schemas, and affected test fixtures to match.
GitOrigin-RevId: 3f2e56eca68352360d8c0d99d48486ae65d664c1
## What changed
- Add `isPinned` to thread responses and allow `thread/metadata/update` to pin or unpin stored threads.
- Add an `isPinned` filter to `thread/list`, including cursor-based pagination and combinations with relationship filters.
- Persist pin state in SQLite without modifying rollout files, default existing threads to unpinned, and preserve pins through reconciliation and archive transitions.
## Testing
- Cover protocol serialization, database migration and indexing, pin updates, filtered pagination, rollout reconciliation, and archive/unarchive behavior.
GitOrigin-RevId: c2eacabd6dae465e2ae6ce8a169e00740960cdb7
## What changed
- Add `SqliteConfig` to own the resolved SQLite home, runtime database paths,
and shared read/write and read-only pool settings.
- Pass the configuration through state and local thread-store consumers,
replacing standalone path helpers and duplicated connection setup.
GitOrigin-RevId: 7351b08da94b5c8b6c0bbe492f86aeeca0699d3c
## Why
Very long individual lines can make syntax highlighting consume excessive CPU or memory even when the overall input remains below the existing size and line-count limits.
## What changed
- Fall back to plain, unstyled text when any input line exceeds 4 KiB.
- Keep the existing 512 KiB total-size and 10,000-line guardrails.
## Testing
- Cover highlighting fallback and text preservation for a long single-line Bash command.
- Snapshot rendering of a command that exceeds the per-line limit.
GitOrigin-RevId: ba02997331a294d8a32ca89ee06acb12dd3bbd83
## What changed
- Track adjacent cells with the same OSC 8 destination and emit a single
hyperlink around their visible text.
- Close active hyperlinks before non-link content and at the end of a draw.
- Cover a production-length browser authentication URL at narrow terminal
width, including the remote-login guidance and cancellation footer.
GitOrigin-RevId: 9b87166ce78578137dfd2bf19db359ac83a908ee
## Why
Streamed message deltas can be dropped when the transport is saturated, leaving
clients with a truncated final response.
## What changed
- Include the last non-empty final agent message in successful `turn/completed`
notifications and mark the items as a summary.
- Treat completed message content as authoritative in the TUI, repairing an
incomplete stream while avoiding duplicate messages when `item/completed` was
already received.
- Continue backfilling full turn items for persisted `codex exec` threads when a
completion contains only the summary view.
## Testing
Added coverage for completion summaries, dropped stream deltas, duplicate item
handling, and directive-only responses.
GitOrigin-RevId: ffe9d36d683d6b6690e4a468ff68aa9189fe6ab7
## Why
Session header rows can exceed the available inner width when the terminal is
narrow, causing the bordered header to render wider than its requested width.
## What changed
Truncate each session header row to the available inner width and append an
ellipsis when content overflows.
## Testing
Add a snapshot test for a 44-column session header and assert that every
rendered line matches the requested width.
GitOrigin-RevId: 7cf0ea48aa95a6f1ddd1a9dbb7c7fb70bdbcb5a3
## What changed
Apply the existing whitespace-only line normalization to both streaming and
finalized agent Markdown. Blank lines now discard indentation and stale
hyperlinks while preserving their line style.
GitOrigin-RevId: f6150190b02f8cd8c853220cae1a2dcd2f4578a5
## What changed
- Size the unified mention popup from its filtered row count, while keeping a one-row minimum and the existing maximum.
- Update composer snapshots to cover the compact layout when only one mention result is visible.
GitOrigin-RevId: 7cd30a5c53c7e81cf7158a6b3dda3c09bd024f29
## Why
Auth managers should use the application's resolved HTTP client factory instead
of silently falling back to the transport's default proxy behavior.
## What changed
- Make `AuthRouteConfig` required when constructing an `AuthManager` or
`AuthConfig`.
- Pass each production caller's resolved routing configuration through without
wrapping it in an optional value.
- Add a test helper that explicitly selects the transport-default proxy policy
for callers that do not exercise custom routing.
GitOrigin-RevId: d89a3b1f8b5d4007650cdac0aae241c94d598580
## Why
Auth routing represented the default proxy policy as an absent configuration,
leaving consumers to reconstruct the fallback HTTP client independently. Carry
the application's resolved policy explicitly so auth and related requests use
the same client configuration.
## What changed
- Build `AuthRouteConfig` from the resolved `HttpClientFactory` for both
`ReqwestDefault` and `RespectSystemProxy` policies.
- Pass that route configuration through login, auth, cloud task, and cloud
configuration flows, and reuse its factory when loading cloud configuration.
- Log cloud-task configuration load failures before falling back to the
transport-default proxy policy.
## Testing
Extended configuration tests to verify that effective and bootstrap auth routes
select the expected proxy policy when system-proxy support is enabled or
disabled by feature requirements.
GitOrigin-RevId: d03802e2660f5cf6d940e8e718ec5c82ede7eab1
## What changed
- Handle app-server `turn/start` rejections for pending user turns as turn
errors instead of exiting the TUI.
- Finalize the pending turn, display the failure in the transcript, and resume
queued input handling.
- Add coverage that submits a turn to a missing thread and verifies that the
error is shown while the app continues running.
GitOrigin-RevId: 6d291ba62b9e50d49dd4e3d7c429e98c1f754680
## Why
Crossterm's Windows event backend expects Win32 input records. When the console
inherits virtual terminal input mode, or another console client restores it,
navigation keys instead arrive as literal escape bytes.
## What changed
- Keep the Windows console in input-record mode while the event stream is
polled, and disable focus-change reporting on Windows.
- Preserve and restore the console's original virtual terminal input setting
when the TUI shuts down.
## Testing
- Add unit coverage for clearing and restoring the virtual terminal input bit.
GitOrigin-RevId: 792b99e354fce357d51810a6c3b437e972ad11ce
## What changed
Redirect stdin to null when launching:
- `codex doctor --json` for uploaded diagnostic reports
- Git commands used by `codex doctor`
- ripgrep searches over rollout files
- the Windows sandbox setup refresh helper
This keeps these non-interactive subprocesses from reading Codex's inherited
input stream.
GitOrigin-RevId: 063d191b0b1b849d74b55a7d6ff2f0b3d5212c86
## What changed
- Accept an optional session name after `/new` or `/clear`.
- Set the requested name through the app server when starting the new thread and update the attached session with that name.
- Report naming failures in the chat while still attaching the newly created thread.
## Testing
- Cover named `/new` and `/clear` dispatch, app-server name persistence, and the existing unnamed `/clear` behavior.
GitOrigin-RevId: 570886abb4af522123f0693ce05d2415e1c0d902
## Why
Default read-only protections for project metadata should apply when paths such
as `.git`, `.agents`, and `.codex` exist, without causing sandbox setup to
materialize missing paths as ACL targets.
## What changed
- Add an optional `missing_path_behavior` to filesystem sandbox entries and
mark default project-metadata protections with `skip`.
- Preserve the behavior through permission transforms and exec/MCP protocol
serialization while keeping existing path wire variants stable.
- Ignore skip-missing entries when projecting configuration or Windows sandbox
overrides, while retaining explicit metadata carveouts.
## Testing
- Cover protocol round trips for path and special-path entries.
- Verify default metadata protections and Windows explicit carveout handling.
GitOrigin-RevId: 6df13dadacdd131c44aab9f15a967c81051355c1
## What changed
- Apply managed values for `sqlite_home`, `log_dir`, `model_catalog_json`,
`check_for_update_on_startup`, `allow_login_shell`, the report-submission
opt-in, and `windows.sandbox_private_desktop` to the runtime configuration,
with source-aware warnings when they override configured values.
- Expose these values through `configRequirements/read`, return them from
`config/read`, include them in session config locks, and show their sources in
the TUI config debug view.
- Reject app-server writes that overlap an exact managed requirement with
`configRequirementReadonly` while leaving unrelated sibling keys writable.
## Testing
- Cover runtime overrides, requirement API mapping, config reads and writes,
session lock serialization, cross-platform path URIs, and debug output.
GitOrigin-RevId: d4e23b6fd7775c1a6dfe2eab313cdcee50b07081
## What changed
- Add `shell_environment_policy.filters`, mapping environment-variable patterns to `include` or `exclude`, while continuing to accept the legacy `exclude` and `include_only` arrays.
- Merge filter keys case-insensitively across config layers so higher-precedence entries can override individual patterns. Switching representations replaces the other representation instead of combining them.
- Reject mixed, duplicate, or malformed filter definitions in enabled layers, config writes, and reloads, while retaining the previous session configuration when a reload is invalid.
- Make config-manager reads and writes representation-aware and preserve existing formatting when updating individual policy values.
## Testing
Add coverage for parsing, schema constraints, layered merging, validation and diagnostics, config writes, override metadata, and invalid session reloads.
GitOrigin-RevId: e15464bca53e6e7ef31fcc97537fda60ed5d670a
Compile `tui::restore` only on Unix, matching its use by the Unix job-control
suspension path.
GitOrigin-RevId: d0ce03def8905e94376ec7f5acf8d083d5dde05b
## What changed
- Add the optional `forceRefetch` boolean to `PluginListParams` and generated schemas.
- Accept both omitted and enabled values without changing `plugin/list` behavior yet.
- Cover deserialization of the enabled value in the protocol tests.
GitOrigin-RevId: fd4145161e9779638bc0bf18118d5ab5b8478745
## What changed
- Map `.cu` and `.cuh` extensions to the C++ syntax definition so CUDA source
and header files receive syntax highlighting.
- Extend syntax lookup and rendered-diff tests to cover both extensions.
GitOrigin-RevId: 5484ea9e30f9e4df788b0079596ec0239e8ef8d5
Remove the unconstructed `AppCommand::Shutdown` variant, its helper, and its
pending interactive replay handling.
GitOrigin-RevId: 25e8ac7ebf2498a7d70ad1625d363395a9c6f578
## What changed
Remove the unused `RestoreMode` selection from `Tui::with_restored`. The helper
now always restores the terminal while keeping raw mode enabled, matching its
external-editor call site.
GitOrigin-RevId: b820aaaa933d7354d2a21b95900b059b3e8e2ac6
## What changed
- Add an optional opaque `providerId` to `externalAgentConfig/import` for analytics attribution, independently of the `migrationSource` selector.
- Include the provider ID in completed-import and import-failure analytics events.
- Have TUI imports identify their selected migration source as the provider.
## Testing
- Cover provider attribution in app-server import completion and failure tests and analytics serialization tests.
GitOrigin-RevId: 0ee7313a43652e5305939c526bf6b903a79334ad
## What changed
- Add `maxSessionAgeDays` and `maxSessions` to the external-agent config detection request.
- Apply the requested limits when discovering sessions from supported migration sources.
- Preserve the existing defaults of a 30-day maximum age and 50 sessions when either option is omitted.
GitOrigin-RevId: 46376e94b64f1f61d8776e34d82cdd2cdeb36ca0
## What changed
- Render the first line of a completed hook warning in the hook header using
`says:`, with any remaining lines indented below it.
- Keep the existing hook header when no warning is present and avoid rendering
warning entries a second time in the output body.
- Update hook event snapshots and the multiline warning test for the new layout.
GitOrigin-RevId: 291b556daf3b6fb64a99b090a6df1a222a18a736
## What changed
- Remove the `spawn_agents_on_csv` and `report_agent_job_result` tools and their agent-job runtime and state models.
- Drop the legacy `agent_jobs` and `agent_job_items` tables during state database migration.
- Keep `features.enable_fanout` and `agents.job_max_runtime_seconds` accepted as no-op compatibility settings while omitting them from the generated configuration schema.
## Testing
- Verify upgrades remove both legacy agent-job tables.
- Verify the removed feature and configuration keys still parse without taking effect.
GitOrigin-RevId: 8cc3337da78c67162229f02f40a747f503542646
## What changed
- Add `additionalContextLimit` to command hook configuration for events that can emit `additionalContext`.
- Apply the limit independently to each hook's context before it is sent to the model. Unset values retain the 2,500-token default, while `0` disables spilling for that hook.
- Expose configured limits through app-server hook and requirements responses, and show them in the TUI hooks browser.
## Testing
- Cover JSON and TOML parsing, discovery and hashing, per-hook spilling behavior, app-server responses, and TUI rendering.
GitOrigin-RevId: 55ddc2dbbdf9067dceee3e1968c03617bbf6bcea
## Why
Pending Guardian review state could outlive an interrupted or completed turn,
leaving stale review details visible during a following goal turn.
## What changed
- Clear pending Guardian reviews during both turn completion and finalization.
- Restore an active MCP startup header after cleanup, falling back to `Working`
when no MCP server is starting.
## Testing
Added coverage for interrupted and completed turns, including goal continuation
and overlapping MCP startup status.
GitOrigin-RevId: a15ed81a5d6005e9294089f4424a8dedbc6e9cb5
## Why
The TUI already receives skill metadata from the app-server protocol, but converted it into the core-skills model before using it.
## What changed
- Use `codex_app_server_protocol::SkillMetadata` throughout skill toggles, mentions, and input submission.
- Remove the protocol-to-core conversion and the TUI's `codex-core-skills` dependency.
GitOrigin-RevId: 43d43d74bfb67fc21ef11a0ca0592aa44b89a122
## What changed
Add a borrowed `Line` conversion and use it when rendering and measuring
hyperlink-aware history and pager content. This preserves line styling and
alignment while avoiding clones of the underlying span strings.
GitOrigin-RevId: c9cd6ff5ec63cd29719ea2ae51acede7364f2bd8
## What changed
- Add one-shot composer and status-line transitions when the active reasoning effort changes to Max or Ultra.
- Keep a tier-specific prompt accent after the transition, including a distinct Ultra prompt glyph.
- Preserve drafts and footer priority, avoid replaying effects for restored or unchanged settings, and disable motion when animations or sufficient terminal color support are unavailable.
## Testing
- Add unit and snapshot coverage for animation frames, prompt accents, status-line transitions, narrow layouts, terminal palettes, restored sessions, and reduced-motion behavior.
GitOrigin-RevId: 6da1d501d228d0cf1144b3d211d5d1304a06f447
## Why
Large command streams, including commands that never emit a newline, can make an active TUI cell grow without bound.
## What changed
- Retain live output in full up to 1 MiB, then preserve the first and last 50 completed lines plus the current partial line.
- Bound individual long lines while preserving UTF-8 boundaries, visible head and tail content, and ANSI rendering around omission markers.
- Show omitted line and byte counts in previews and transcripts. Final command output still replaces the bounded live preview when execution completes.
## Testing
Added unit and snapshot coverage for chunk boundaries, split CRLF sequences, newline-free and UTF-8 output, truncated ANSI sequences, retained-output limits, and preview and transcript rendering.
GitOrigin-RevId: 3cf3cc862db686f20ac09b1f6e7f9dc6d264e6eb
## What changed
- Encapsulate aggregated command output behind APIs for total and retained line
counts, reversible preview iteration, and full transcript iteration.
- Build truncated command previews from the retained head and tail lines while
preserving the logical omitted-line count.
- Cover head/tail rendering for long streamed agent and user-shell output.
GitOrigin-RevId: 54b23a19e4639e24c5e4778082edbbc6484ecf80
## Why
During TUI startup, `hooks/list` holds the global config queue while an
uncached `model/list` request may also take time. Waiting for
`configRequirements/read` before submitting the model request prevents these
operations from overlapping.
## What changed
Submit `model/list` and `configRequirements/read` together during bootstrap so
the model fetch can overlap the config requests. Preserve the request-specific
error context and update the session state after both requests succeed.
GitOrigin-RevId: 69a866e6d2fd4798b914dd000456194f49fcfef6
## Why
Sizing, rendering, and cursor placement can query the same chat widget layout
multiple times in one frame, repeatedly measuring active transcript cells.
## What changed
- Build one chat widget renderable tree per frame and reuse it for sizing,
rendering, and cursor placement.
- Cache each flex child's desired height by width for the lifetime of that tree.
- Reuse the bottom pane's renderable directly instead of forwarding each
renderable operation through a wrapper.
## Testing
- Verify flex layouts measure a child once across frame passes and remeasure it
when the width changes.
- Verify a chat widget frame measures its active transcript cell once.
GitOrigin-RevId: 5ad1a6711f4011c699b5d002b13dc3319cb4db8e
## What changed
- Move lifecycle and approval payloads into either the interrupt queue or the
immediate handler instead of cloning them for both branches.
- Borrow MCP elicitation request metadata while constructing the corresponding
form, and consume apply-patch changes after collecting notification paths.
## Testing
- Add a history replay test confirming deferred MCP start and completion events
remain FIFO after streaming finishes.
GitOrigin-RevId: 84ed34f6ff173463a1da016dc140405392c0ba45
## What changed
- Record when committed streaming content contains an inline visualization directive and keep using the canonical full-source renderer afterward.
- Restore directive state during full recomputes and clear it when the streaming renderer is reset.
- Cover directive tracking with and without visualization context, including a raw-to-rich render mode switch.
GitOrigin-RevId: 17786851d6dad6805240b79072fcbd0bb441874a
## What changed
- Remove unused APIs and test helpers across the Rust workspace.
- Route Linux sandbox test setup through the shared exec request path.
- Drop dependencies that became unnecessary after the cleanup.
GitOrigin-RevId: 48fd9b2b1575bad7add0819786b4d8ec88d8486f
## What changed
- Skip loaded-subagent backfills for fresh and forked threads, which cannot have pre-existing descendants.
- Keep the backfill after resuming a thread so agent navigation is populated immediately.
- Reuse thread status collected during backfill when opening the agent picker, avoiding duplicate `thread/read` requests while preserving liveness from live event channels.
## Testing
- Add a WebSocket-backed session lifecycle test that records app-server requests across fork, fresh-session, resume, and agent-picker flows.
GitOrigin-RevId: 604742b3cb495da12c97908d7a0ffa4ebc6a6da3
## Why
The transcript overlay cached every committed cell's height. Cells whose content changes after insertion, such as refreshed status output or newly available visualizations, could outgrow that cached height and be clipped.
## What changed
- Let history cells declare whether their transcript height is stable, and remeasure dynamic cells on later overlay renders.
- Preserve cached heights for stable cells when appending a committed cell instead of rebuilding all renderables.
## Testing
- Cover status output growing after a rate-limit refresh.
- Cover a visualization link replacing its unavailable placeholder.
- Verify that appending a cell preserves cached measurements for stable cells.
GitOrigin-RevId: 03e7166cb94d7353c9b89bff8abb3b7ccb84a6bb
## What changed
- Consume and sort `DiffSummary` entries directly when building renderables.
- Borrow paths and `FileChange` values in the shared row representation used by line-based summaries.
- Share line-count calculation between both rendering paths.
GitOrigin-RevId: b02668074def7529ff39445e9970a1fec209f02b
## Why
Finalized Markdown can be rendered repeatedly at the same width while measuring and displaying transcript history.
## What changed
- Cache the latest rendered lines for finalized agent messages and proposed plans.
- Invalidate cached lines when the width, syntax theme, terminal colors, or color level changes.
- Keep visualization directives uncached because resolving their local files depends on current filesystem state.
## Testing
Add tests for cache reuse, render-state invalidation, raw Markdown rendering, and visualization cache bypass.
GitOrigin-RevId: ba08140041a229b8cb9d297de87dc7bb39ebfe5d
## Why
Raw response items, realtime audio, and other notifications that the TUI does
not consume during replay can carry large payloads. Retaining them in each
thread's replay buffer wastes memory and can evict useful buffered events.
## What changed
- Skip replay buffering for notification types that are handled before routing
or ignored during replay, while still updating turn and approval state.
- Borrow notifications when recording events for an active thread so routing
does not require an extra clone.
## Testing
Add coverage that repeatedly sends large MCP progress and realtime audio
notifications and verifies that the replay buffer, pending approval, and active
turn state remain intact.
GitOrigin-RevId: 5b3414f1db7f3ae1feea4fe6c0275e4a7a1a4174
## Why
App-server command output deltas populate an exec cell before the command
finishes. Treating the presence of output as completion can therefore mark a
streaming command inactive too early and mishandle it when the turn is
interrupted.
## What changed
- Use the recorded duration, which is set when a command ends, as the exec
call's completion marker.
- Preserve streamed output when marking unfinished calls as failed and render
status lines only after completion.
- Keep a single aggregated output representation and render truncated output
without collecting every line first.
- Append grouped exploration calls in place and coalesce adjacent reads while
rendering without cloning the calls.
## Testing
- Add snapshots covering active streamed output, transcript output, and the
resulting history entry after interruption.
- Add coverage for truncating newline-dense output.
GitOrigin-RevId: 420ac1e5fe1b9fcdbdaa5a8998f3e43a5b720254
## Why
Providing an inline visualization context forced every streamed Markdown update
to rerender the full response, even when the source contained no visualization
directives.
## What changed
- Preserve the stable rendered prefix when visualization context is available
but no directive is present.
- Continue using canonical full rendering when the source contains a
visualization directive.
## Testing
Added a regression test that verifies directive-free streams match full
rendering while advancing the stable source boundary.
GitOrigin-RevId: cd70d2ba052db822d474eba8619d04cedf4c0573
## What changed
- Allocate Markdown table widths in bulk while preserving the existing column
shrink priorities and balancing behavior.
- Reuse flattened styled-line data during adaptive wrapping and detect URLs
across span boundaries.
- Remap wrapped terminal hyperlinks with a single forward scan.
## Testing
- Verify bulk table shrinking matches the previous one-cell-at-a-time results,
including a token-heavy column with a million-character width.
- Cover URLs split across styled spans and multiple links on indented Unicode
lines.
GitOrigin-RevId: 24a6fd6fdace6ca948e613d67c130a3a7f8d1a4e
## Why
The MCP image output cell only renders a fixed placeholder, so it does not need
to keep the decoded image alive for the lifetime of the history cell.
## What changed
Decode image content to validate it, then return a marker cell without storing
the resulting `DynamicImage`. The rendered history output remains unchanged.
GitOrigin-RevId: b2c12d08e8ba281d2bb993a8524d338c26d52b96
## What changed
Make the hyperlink-aware history insertion helper accept a slice and borrow
pending history batches when flushing them. This avoids cloning each batch's
entire `Vec<HyperlinkLine>` before insertion.
GitOrigin-RevId: 0bc86c33e2f047c62de60b7642899c4aaa4bb6b8
