## Why
Repeated alternate-screen entry can overwrite the saved inline viewport, and half-page scrolling can use a different height from the rendered transcript.
## What changed
- Make alternate-screen entry idempotent to preserve the inline viewport for restoration.
- Defer transcript reflow after raw output mode changes while an overlay is open, preserving queued history until the overlay closes.
- Use the last rendered content height for half-page scrolling, matching full-page scrolling.
## Testing
Add regression coverage for restoring the inline viewport and draft after closing the transcript with pending history and a raw output mode change, plus half-page scrolling when the rendered height differs from the terminal viewport.
GitOrigin-RevId: 30847df4b6383db26791ebda20470c9b169f9680
## Why
During an active turn, `/copy` could still offer the previous final response even after a new commentary message had completed.
## What changed
Record every completed agent message with non-empty visible Markdown for copying, including commentary. The picker can then offer the latest completed commentary as a whole response and expose its code blocks.
## Testing
Add a regression test and picker snapshot covering completed commentary during an active turn after a previous final response. Verify that selecting “Whole response” copies the commentary and that the picker lists its shell code block.
GitOrigin-RevId: 0ea1d5e3952ccac21f2ee951d482619de82f28e0
## Why
The TUI automatically canceled MCP user verification requests, preventing users from completing verification and approving them.
## What changed
- Show verification prompts for active and inactive threads, with actions to verify and approve or cancel.
- Run approved verification through the local app-server's `userVerification/verify` RPC and return the proof to the original request. Cancel on failure and show a warning in the requesting thread; remote workspaces remain unsupported.
- Deduplicate prompts, preserve foreground streaming when another thread requests verification, and surface queued prompts when returning from a side conversation.
- Cancel verification when its thread is discarded and ignore stale results after cancellation.
## Testing
Add RPC, routing, and snapshot tests covering successful verification, unsupported binaries and remote workspaces, cancellation and late proofs, prompt replay, side conversation switching, and foreground stream preservation.
GitOrigin-RevId: 2ae12f47c443e17de25f4ec033f6078ac28b1e03
## What changed
- Track verification parameters and attempt IDs with cancellation tokens so callers can reject stale results after cancellation, server resolution, or reconnect.
- Add `ResolveUserVerification` to send acceptance proofs or cancellation through MCP elicitation responses, omit proofs from session recordings, and remove resolved prompts from thread replay.
- Add typed verification error messages with safe fallbacks that omit raw provider diagnostics.
## Testing
Add unit coverage for attempt invalidation, duplicate attempt prevention, proof serialization, resolved prompt replay, and safe error messages.
GitOrigin-RevId: 3466c9a83fe5f512a861fec062bef10dcd3025c8
## What changed
Add a presentation-only `UserVerificationView` with explicit verify and cancel choices, request details, and a waiting state. Report decisions through a callback, suppress duplicate approvals while waiting, and allow cancellation before or during verification. Dismiss the view when its matching MCP elicitation request resolves.
Add a full-screen request details overlay that can be opened without making a decision. Wrap prompt text and long URLs for narrow terminals. The view is not yet connected to incoming verification requests.
## Testing
Add tests and snapshots covering prompt and waiting rendering, narrow layouts, long URLs, duplicate approval suppression, cancellation, matching request dismissal, and full-screen inspection and scrolling.
GitOrigin-RevId: de1ff80d0defb3707b641e9bfccff9e2b91255ec
## Why
Trimming the live voice transcript to its 1,024-byte window could restart
animations for retained words or skip animations for new text that repeats
existing text.
## What changed
Track discarded prefix bytes and render the retained text to identify which
tiles survive. Preserve their arrival times and animation phase so only new
tiles begin animating. Start fresh when the speaker changes or the retained
text no longer matches.
## Testing
Add regression coverage for repeated text, retained-word visibility, Unicode
and Markdown rendering, reduced motion, and replaced or changed-speaker windows.
GitOrigin-RevId: dd33f76441baa4d7787d0a9a1e72b281476acb4c
## What changed
Add `tui.show_server_version_notice`, enabled by default. Set it to `false` to suppress informational notices about older stable app servers at startup, on reconnect, and in the agents overview. Compatibility errors and version status remain unaffected.
Refresh the overview notice when local settings change, clearing pending notices when the setting is disabled.
## Testing
Add coverage for disabling and re-enabling overview notices, clearing pending notice state, and preserving remote version status. Extend reconnect and local-settings tests to cover the new setting.
GitOrigin-RevId: d50dcf4472ee221ce31cdd7ab2cd766f901a8039
## Why
Footer updates and transcript animation can trigger redraws before more audio arrives, consuming peaks too early and adding spurious quiet samples. Old peaks also linger in the meter after a channel becomes quiet.
## What changed
- Sample microphone and speaker peaks at most once every 100 ms, preserving accumulated peaks on early redraws and scheduling the next sampling frame.
- Clear each channel's meter history on its first quiet sample without clearing the other channel.
## Testing
Add regression tests for early redraw scheduling, peak preservation, independent channel silence, delayed sampling, and sampling after a conversation reset. Snapshot the meters at wide and narrow widths and after each channel becomes quiet.
GitOrigin-RevId: d7b116af2c099a2eaeb6db0d66bca93b230db970
## Why
Voice mute used a hard-coded `Ctrl+X` shortcut and footer hint, so keymap customization could not change or disable it.
## What changed
- Wire `tui.keymap.chat.toggle_voice_mute` into runtime keybindings and the keymap picker, supporting custom keys, chords, and unbinding.
- Keep `Ctrl+X` as the default, but let existing configured shortcuts and overlapping chord prefixes take precedence. Validate explicitly configured mute bindings for conflicts.
- Activate voice chords only when the microphone shortcut is available, excluding pagers and overlays.
- Refresh the voice footer when bindings change, showing the configured shortcut or `/voice mute` when unbound.
## Testing
Add regression tests for binding resolution, conflicts, voice chord context, and live keymap updates. Add footer snapshots covering custom keys, chords, and unbinding in muted and listening states at wide and narrow widths.
GitOrigin-RevId: ec9385f3956aa268bba34dcf2cc2b0c92a31bfec
## Why
Voice controls replaced the normal footer and could be truncated at narrow widths. Give them dedicated space while keeping the status line visible.
## What changed
- Render voice status, `ctrl+x` mute/unmute, and `/voice stop` above the draft, with separate microphone and Codex audio history meters.
- Keep control positions stable across mute states, prioritize stop at narrow widths, and hide the strip when vertical space is needed for the draft and cursor.
- Reflect actual microphone capture in the recording indicator, respect reduced motion, and allow muting during connection once the audio handle is available.
- Preserve speaker history when muting the microphone and clear speaker samples when playback is suppressed.
## Testing
Add layout and snapshot regressions for voice states, narrow and clipped composers, recording colors, independent audio histories, and status-line visibility. Extend coverage for audio intensity scaling and spoken transcript rendering.
GitOrigin-RevId: 9deb432654f4328cc8a577b8896eee088a0a1d5e
## What changed
- Render spoken user prompts with a bold red chevron, preserving its color during live transcript animation. Trim leading whitespace for display while retaining the raw transcript text.
- Underline and link file references such as `src/lib.rs:42` in spoken assistant transcripts using terminal hyperlinks. Preserve existing links and support Windows-style relative separators.
- Restrict generated file links to existing files with allowed extensions inside the workspace, rejecting hidden paths, traversal, and symlink escapes.
## Testing
Add rendering and transcript tests for the spoken marker, raw text preservation, file links, Unicode column offsets, and Windows-style paths, plus validation tests for rejected file destinations.
GitOrigin-RevId: 5fa180aa606acdc579a916441520602cb2bf3655
## What changed
Render live voice transcripts with a split-flap effect, a black background, and brief speaker-colored highlights as characters settle. Preserve settled characters when text is appended and include animation ticks in the active transcript cache key so frames refresh.
Respect `animations = false`, preserve Unicode graphemes and raw transcript text, and keep completed transcripts as ordinary history cells. Stop requesting animation frames once the effect settles.
## Testing
Add frame snapshots and regression coverage for row styling, speaker colors, appended text, reduced motion, Unicode width, frame scheduling, and unchanged final transcript history.
GitOrigin-RevId: 934f577c7279158f9161d6232634087ab32b0ea3
## What changed
- Add `Ctrl+X` to toggle the microphone for the active voice session on the current thread, with a footer hint and guards for modals, popups, and repeated key events.
- Show a recording dot in the terminal title's activity indicator while the microphone is listening, respecting title settings and clearing it when capture stops.
- Replace the microphone and speaker bars with compact Braille meters showing four recent amplitude samples.
- Briefly show `heard` when voice input interrupts speech, when animations are enabled.
## Testing
Add regression tests for shortcut routing, amplitude glyphs, interruption acknowledgment, and terminal title lifecycle, plus updated voice footer snapshots.
GitOrigin-RevId: e1dc0c1744667e646e0040e247c5a0409b416075
## What changed
- Add app-to-RPC tests for voice startup, shutdown, thread switching, speech delivery, and rejected or stale speech, using a recording app server without audio hardware.
- Cover session retries, typed and voice handoffs, reasoning visibility, and recovery of undelivered answers in focused chat widget test modules.
- Add transcript and buffered replay tests for caption reconciliation, partial transcript preservation, and voice output ownership across thread changes, with rendering snapshots.
GitOrigin-RevId: 8a76523907289f94f257fe97386db7d2e7f33ca5
## What changed
Show an older-service notice at startup and reconnect when both versions are official stable releases. Display it in conversation history or the agents overview, with wrapping and a compact fallback for small terminals.
For the implicit local daemon, suggest `codex app-server daemon update` and warn that updating may interrupt active or queued work. Suppress repeated notices for the same service and version pair, and defer fresh-session notices until session attachment.
## Testing
Add coverage for version notice eligibility, local-only update guidance, service identity, startup ordering, reconnect deduplication, and overview rendering at narrow and short sizes.
GitOrigin-RevId: e0a5b306e0a4d405544c5f6eaa72f77df6d68e6d
## What changed
Add `is_official_server_older` to check whether a stable TUI version is newer than the app-server version. Require both versions to contain exactly three numeric components without leading zeros, and return `false` for source builds (`0.0.0`), prereleases, and malformed versions.
## Testing
Add unit coverage for older, equal, and newer server versions, plus invalid versions in either argument.
GitOrigin-RevId: afcc90b56e188df1bf410c69ca238765b4658000
## Why
Lost tmux resize notifications can leave the TUI using stale terminal dimensions.
## What changed
Add a background size monitor for tmux on Unix that checks terminal dimensions every 500 ms and delivers detected changes as resize events. Queries run off the UI thread so a slow query does not block input.
Pause monitoring during terminal handoffs and discard samples invalidated by newer geometry or pause/resume transitions. Ignore unchanged, invalid, or failed samples, and stop monitoring without waiting for a blocked query.
## Testing
Add tests for missed-resize recovery and text wrapping, input responsiveness during blocked queries, stale sample rejection, pause/resume handling, nonblocking shutdown, and tmux-only activation.
GitOrigin-RevId: 461f09bf792f1d9760672dd33b125ecdf0ebd1e0
`TranscriptState` has no `had_work_activity` field. Remove the assignment
from computer tool call completion handling to fix the resulting compile
error.
GitOrigin-RevId: 2adb15a213992e40a58dc6f217d7ae8d64c48154
## What changed
- Add feature-gated `/voice`, `/voice mute`, and `/voice stop` commands with local WebRTC audio and app-server signaling.
- Show live transcripts, conversation status, and microphone and speaker levels. Preserve captions and undelivered answers across thread switches.
- Speak final answers from voice handoffs while keeping delegated reasoning and commentary hidden and typed answers unspoken.
- Retry eligible startup failures once and clean up voice sessions on thread switches and disconnects.
- Stop voice and block late handoffs after a misalignment policy violation. Remove realtime event payloads and spoken text from receipt and debug logs.
## Testing
Add coverage for voice command mapping, rejected starts, disconnect cleanup, delegated final-answer speech, late handoff rejection, and transcript and footer rendering.
GitOrigin-RevId: 11def1f86b0e023b21d0d92072d6636ccad89815
## What changed
Render adjacent `cua_repl` calls as a compact “Using computer” or “Used computer” group with action and failure counts. Show the current action while running, and prioritize failures and screenshots in completed previews while preserving their chronological order.
Keep full call arguments and output in the expanded transcript, with a `ctrl+t` hint for hidden actions. End groups at other history items and turn boundaries, preserve completed results when pending actions are interrupted, and use the same grouping for live events and history replay.
## Testing
Add unit and snapshot coverage for live/replay parity, grouping boundaries, out-of-order completion, interruption, failure and screenshot previews, full transcript details, and narrow-terminal and Unicode rendering.
GitOrigin-RevId: 8e61ccf4c9f6d1a4d56d674a6d41ca5160d42c82
## What changed
Replace horizontal turn separators with dim completion metadata after the final answer, including plain conversational answers. Show local completion times such as `done 2:32 PM`, adding the date for other days and the year for other years. Retain `Worked for` durations above sixty seconds and runtime metrics, and wrap metadata on narrow terminals.
Restore saved completion metadata when resuming conversations or loading older history. Keep each footer after its turn's items and deduplicate it across repeated notifications and overlapping pages. Only live completions fall back to the current time when a saved timestamp is unavailable. Failed, interrupted, and in-progress turns do not receive success footers.
Avoid submitting queued input or emitting completion notifications while replaying history.
## Testing
Add unit and snapshot coverage for timestamp formatting, duration thresholds, muted styling, narrow layouts, live and replayed completions, missing metadata, and pagination boundaries with overlapping pages.
GitOrigin-RevId: 308c35c6720720da43c9a391aa5a68c1b231c9a5
## What changed
- Let approval extensions choose between cached approval, synchronous review, and a user prompt for tool and permission requests, while core enforces mandatory Guardian and fresh-review requirements.
- Carry an optional `review_reason` on Guardian assessment events and use it to trigger strict-review notifications, retaining the fallback for older events.
- Require synchronous review when cached evidence has an unusable encrypted parent compaction.
## Testing
Add regression coverage for manual prompts and cached approvals with non-UTF-8 working directories. Update approval contributors in existing tests to use the decision API.
GitOrigin-RevId: a4e66416070bdaa881daa41429c49021629f44c1
Set `SessionTarget::cwd` to `None` in the remote resume permission-override
and CLI fork startup tests to match the struct's required fields.
GitOrigin-RevId: d1e7a2e6b7ae3dda17ef062984917861c12fdeff
## Why
Session transitions need stack headroom for embedded-server initialization and configuration loading. Running them inside event dispatch risks exhausting the TUI thread's stack.
## What changed
- Queue `/resume` and valid `/cd` requests for processing after event dispatch returns.
- Reject additional `/cd` requests while one is pending, and recheck the source session, working directory, idle state, and remote-environment restrictions before applying it.
## Testing
Add a Unix PTY regression test that exercises `/resume`, worktree conversation forks, `/cd`, and new worktree conversations through the real TUI event loop. Update the directory-change test to verify that dispatch queues the request without immediately changing configuration.
GitOrigin-RevId: 4950921931dfaba9e55e6bb04f98f7ba64b72122
## What changed
- Carry the working directory from `thread/list` and `thread/read` in session selections, and use app-server metadata to resolve resume and fork directories.
- Use the model reported by thread reads and thread-started notifications when restoring session state.
- Remove TUI helpers that read session IDs, working directories, and models directly from rollout files or the state database. Picker selection now requires a thread ID in the selected row.
## Testing
Extend picker coverage to verify that selections preserve the working directory, and add a snapshot asserting that switching to a read thread displays the server-reported model.
GitOrigin-RevId: c9d13e1e56ea2139d3e96344d72ca9ee2de73396
## Why
The TUI's local provider configuration can differ from the active thread's provider, causing `/status` to show misleading provider details.
## What changed
- Use the server-provided model provider ID in `/status` and update it when attaching to a thread.
- Omit the provider row until a thread is configured, and display IDs such as `openai` instead of provider names and base URLs.
- Remove runtime provider URL resolution from TUI startup and the associated widget state.
## Testing
Add regression coverage for provider display before session configuration, thread switching, and server settings updates. Update status snapshots to show server provider IDs while preserving usage-link behavior based on the server's authentication requirement.
GitOrigin-RevId: 87214b4fd971f63835e382557969e4fc3b602745
## Why
Client defaults can override the fork destination's model and reasoning effort or trigger a migration prompt for a stale model.
## What changed
- Omit implicit model and reasoning effort overrides during CLI fork startup, while preserving explicit launch settings.
- Skip the model migration prompt and service tier inference when the fork's model is left for the server to resolve.
- Initialize unspecified reasoning effort from the forked session's response.
## Testing
Add a startup regression test that changes server defaults after bootstrap and verifies that `thread/fork` proceeds without a migration prompt, model or reasoning effort overrides, an inferred service tier, or a `config/read` request.
GitOrigin-RevId: 858f0fe3c72b90bdcaf31b400144d37af5bc6ed7
## Why
Device-authenticated verification needs an app response outside automated approval and review. Previously, MCP user-verification requests were always cancelled.
## What changed
- Add typed `openai/userVerification` elicitations carrying a title, description, and challenge through core and app-server.
- Route verification to one connection enabled by trusted host activation. Restrict responses to that owner, exclude requests from replay, and cancel on disconnect or authentication changes, including account switches away and back.
- Return proofs in `content`, discard response metadata, and cancel malformed acceptances. Suppress verification response logging and analytics, and send only a generic verification notice to realtime.
- Keep the mode experimental and exclude it from stable schema exports. Capability advertisement remains disabled, and the TUI cancels verification requests.
## Testing
Add coverage for owner isolation, disconnect and authentication races, proof response handling, automated-review bypass, inactive-host cancellation, stable schema filtering, and realtime payload exclusion. Update the MCP integration test to verify that an activated request holds the tool until the client responds.
GitOrigin-RevId: c8c7b6691a3f7756682bbcca9def1df0d1feb906
## Why
The permissions picker displayed profiles from the connected app server but disabled selection of remote custom profiles.
## What changed
- Enable named profile selection through `thread/settings/update` and track pending selections until server confirmation.
- Use pending or confirmed server permissions for subsequent turns, preserve profiles across forks and prompt edits, and reconcile pending selections on reconnect.
- Block conflicting permission changes and forks while selection is pending. Preserve input when selection fails and report unsupported app servers.
- Reject working directory changes while a remote named profile is active.
## Testing
Add regression coverage for profile selection, turn permissions, pending-selection guards, prompt-edit profile preservation, reconnect reconciliation, and profile inheritance in forks and side conversations.
GitOrigin-RevId: 76e9bb7b4d631b1066974da013d9915a89dc54a7
## Why
Local permission settings could overwrite a remote task's saved server settings when resuming or forking, including its named permission profile.
## What changed
- Omit permission overrides from remote resume requests and remote fork requests that inherit saved settings.
- Reject explicit permission overrides when resuming or forking remote tasks, including overrides from session flags and selected configuration profiles.
- Refresh restored runtime permission and approval overrides after a remote resume so settings from the previous task do not persist.
- Carry the selected fork permission mode through retries after unarchiving.
## Testing
Add regression coverage for restoring saved server permission profiles, approval policies, and approval reviewers across resume and fork; rejecting explicit remote resume overrides; and clearing stale restored runtime overrides.
GitOrigin-RevId: 465c0444df380553e50ddbeeceff9dc64e5bf9c1
## Why
Selecting the first matching session name can target the wrong conversation when labels are duplicated. Session commands also need to accept preview text when no explicit name is set.
## What changed
- Share app-server label lookup across resume, fork, archive, unarchive, delete, and queue commands, matching the trimmed name or fallback preview.
- Reject distinct matching sessions across collections and source filters, and require a UUID when pagination prevents verifying uniqueness.
- Revalidate listed candidates with `thread/read`, skip unusable local rollouts, and retain compatibility with older servers that cannot read unloaded threads.
- Show ambiguous resume errors in the TUI without replacing the current conversation.
- Disable implicit local daemon reuse with `--oss`.
## Testing
Add regression coverage for name and preview lookup, provider filtering, duplicate labels across pages and collections, stale rollouts, older-server compatibility, queue ambiguity, and preserving the current conversation after an ambiguous resume.
GitOrigin-RevId: e2766276a16140fb674c9640f7050c11ac0d0f6f
## Why
Stamped Rust binaries consume workspace status files containing build user,
host, and timestamp values. These unrelated values prevent remote cache reuse
when building the same commit across developers and CI workers.
## What changed
Generate a compiler environment file containing only `STABLE_GIT_COMMIT` through
a small stamped template action. Use it for `codex`, `codex-tui`, and
`codex-voice-host`, with Rust binary stamping disabled so their build metadata
input changes only when the embedded commit changes.
Rename the crate macro option from `stamped_binaries` to
`binaries_with_build_commit` and add `bazel_lib` for template expansion.
GitOrigin-RevId: 21d0f2e3df97670a4c2cdbc3d1972cd14cc5b439
## Why
Managed worktree transitions run through the event handler into the large synchronous `ChatWidget` constructor. Split this work so each stage runs on a fresh event-loop stack.
## What changed
- Queue worktree setup, checkout completion and configuration loading, session transition, and widget attachment as separate stages with boxed futures.
- Recheck the source session before transitioning and report retained checkout cleanup instructions when the transition cannot proceed.
- Keep the old configuration paired with the old widget until attachment, and protect input during the handoff.
## Testing
Update worktree lifecycle and submission tests to drain the deferred stages explicitly and assert that checkout creation starts before completion.
GitOrigin-RevId: 0435f56d08bf3a6392d35b5c1cfdcc0f1fe02753
## What changed
Add a searchable “Browse worktrees” option to `/worktree` for local repositories with worktrees enabled. List checkouts from the repository's configured pool, show owner metadata, and let users resume an owner thread or copy a worktree's working directory.
Load worktrees asynchronously and discard results after the loading popup is dismissed or the request context changes. Ignore actions from stale requests and offer copying when owner metadata is missing or invalid.
## Testing
Add popup snapshots and tests for search, resume and copy actions, stale results, and disabled local worktree operations. Extend lifecycle coverage to verify discovery from repository subdirectories and handling of missing or invalid owner metadata.
GitOrigin-RevId: 2b7e694a133278da640b6bb275fd5c1202b271c7
## Why
Binaries that do not consume build identity should not have their cached compilations invalidated by Git revisions or build timestamps.
## What changed
Add `stamped_binaries` to `codex_rust_crate`, defaulting to an empty list. Only listed binaries enable stamping and receive `STABLE_GIT_COMMIT`. Opt in `codex`, `codex-tui`, and `codex-voice-host`.
GitOrigin-RevId: 9bcac29f98f20129c988f696ce5b98057be7a158
## Why
Directory-scoped session lookup misses conversations in linked worktrees of the same repository. Managed worktree creation also runs synchronous Git work on the TUI event loop.
## What changed
- With `worktrees` enabled for local sessions, include corresponding directories across linked checkouts in resume and fork pickers and `--last` lookup. Group them together in the agents overview and show checkout paths for picker entries from another worktree.
- Validate shared Git metadata and backlinks, preserve relative working directories and logical path aliases, and reject directory symlink escapes. Keep the expanded directory filter stable across pagination until the listing restarts.
- Fall back to the originally requested directory when an older daemon rejects an array-valued `cwd` filter.
- Create managed worktrees on a blocking worker, check transition blockers before allocation, and revalidate the source session before switching. Report retained checkout paths and cleanup instructions if the transition cannot complete.
- Start the in-session picker server in a separate task to avoid exhausting the TUI event future's stack.
## Testing
Add coverage for linked-checkout discovery, feature gating, picker selection and rendering, project grouping, pagination stability, and legacy daemon fallback. Extend worktree lifecycle tests to cover running-agent blockers and recovery after the source session changes during creation.
GitOrigin-RevId: 4a8a36c0dba3d32d72600f2edf8258a29fb4cb07
## Why
Background tasks launched from the agents overview could use client model settings instead of the server defaults for the destination directory.
## What changed
- Read `config/read` for the task's destination before starting the thread, preserving explicit launch settings and applying managed new-thread defaults.
- Use the server's model provider for embedded sessions when no model or provider override is set. When the server clears the model and fast mode is enabled, resolve the fallback model from the server catalog.
- Restore the prompt and show an error if settings cannot be loaded. Keep the existing fallback for older servers that do not support `config/read`.
## Testing
Add request-level tests for local and remote destinations, model and provider selection, explicit and managed defaults, fast-mode fallback, and prompt recovery after a configuration read failure.
GitOrigin-RevId: 50c84fba964463303442dd849e1280bcd5b4f467
## Why
Resuming a conversation that is open in another app fails with an active-writer error. Allow users to inspect its transcript and retry after closing it in the other app.
## What changed
- Fall back to a read-only history snapshot on active-writer conflicts during startup and session selection.
- Replace the composer with an explanatory notice, `R` to retry, exit shortcuts, and the configured transcript shortcut.
- Block input and freeze active command and MCP animations while viewing the snapshot. Preserve initial prompts and existing drafts for a successful retry.
- Keep the subscription when retrying the same thread and preserve read-only state across thread switches and reconnects.
## Testing
Add regression tests for conflict detection, history viewing, draft preservation, same-thread retry without unsubscribing, exit shortcuts, and notice and frozen-tool rendering.
GitOrigin-RevId: fa864cc73143cad9139c22e33b7958569eec20cf
## Why
Enabling background rollout migration disabled the TUI's cached legacy resume shortcut, even when the rollout maintenance lock could prevent migration during resume.
## What changed
Allow embedded sessions to use the shortcut regardless of migration feature settings when they acquire the maintenance lock and revalidate that the thread still uses legacy history. Hold the lock through `thread/resume` so the response can safely include turns. Remove the session's cached startup migration setting.
## Testing
Update the regression test to cover all four combinations of startup and workspace migration settings, checking lock acquisition before metadata revalidation, a two-request resume, and nonempty history.
GitOrigin-RevId: cf525a6edb813050469dff39b83e5e61214485a1
## Why
Fresh startup could use saved client model and reasoning settings that differ from the app server's effective configuration. A cleared server model could also leave startup using a stale client model from bootstrap.
## What changed
- Reuse the new-session defaults reader at startup to load `model` and `model_reasoning_effort` through `config/read` before `thread/start`, using the appropriate embedded or remote working directory.
- Preserve explicit CLI and selected-profile settings, then apply managed new-thread defaults with the existing precedence rules.
- When the server has no configured model, select the startup model from its model catalog, falling back to the bootstrap default if the catalog is empty.
- Fall back to local defaults when older servers do not support `config/read`; stop startup before thread creation on other read failures.
## Testing
Add request-level tests for defaults and override precedence, working-directory selection, cleared-model fallback, request ordering, unsupported servers, and read failures.
GitOrigin-RevId: e094ba5d5501fdb34c393a0117b34dd93d8d4f2b
## What changed
- Add `/worktree` to start a fresh conversation or fork the current conversation into a new managed checkout.
- Offer current-checkout and new-worktree choices for `/new` and `/fork`, preserving optional conversation names. Enable these choices for local Git repositories when the `worktrees` feature is enabled.
- Load destination configuration, bind the checkout to the replacement thread, and inherit conversation history only when forking.
- Reject creation from explicitly untrusted sources and require an idle primary session without queued input. Refuse forks when developer instructions differ, with guidance for removing the unused checkout.
## Testing
Add picker snapshots and tests for command availability, named selections, fresh versus forked history, destination configuration, worktree ownership, and feature and trust checks.
GitOrigin-RevId: d6c83e00217660aacf2a6d92acad50b506607e0b
## What changed
Route the TUI's subagent and memory enable prompts through server config writes for new threads, leaving the current thread unchanged. Report success, configuration overrides, or failures after the write completes, and clarify the scope in the prompts.
Write both `features.memories` and the legacy `features.memory_tool` key for compatibility with older app servers.
## Testing
Extend tests to cover writes to the selected server config, preservation of current settings, legacy memory key updates, and managed configuration overrides. Update prompt snapshots and verify that confirmation emits the new save event.
GitOrigin-RevId: ec331db675b38102851899a4aa878d6fe8e9606e
## What changed
- Add `RealtimeWebrtcSession` and cloneable handles for startup, answer negotiation, audio controls, level meters, and error reporting.
- Open devices after answer negotiation and apply the latest controls before enabling audio. Preserve subsequent control transitions in order and close the session if the command queue fills.
- Cancel pending work on explicit close, external cancellation, or final handle drop, with a shared runtime keeping helper reaping alive.
- Add audio-state polling to consume microphone and speaker peaks and detect helper, device, or connection failures.
- Check packaged helper/runtime availability and initialize build information in the standalone TUI for the helper handshake.
## Testing
Add unit and helper-process integration tests covering startup control ordering, queue overflow, cancellation, helper reaping and loss, package availability, SDP debug redaction, and peak accumulation, clamping, and consumption.
GitOrigin-RevId: 458cd80353697f7411cee785f380d1d53aef8416
## Why
An initial `/apps` request failure with no cached or partial app list left the popup showing “Loading apps...”.
## What changed
Replace the loading popup with a generic failure message and a `Retry` action. Retrying forces a refresh and restores the loading state while the request runs.
## Testing
Add a regression test and snapshot covering the error display, omission of raw request errors, and retry transition back to loading.
GitOrigin-RevId: 9b1974dbc5065a6d3695d881f216f8060d4381a9
## Why
`--worktree` previously supported only `codex exec` and `codex exec fork`. Interactive sessions need the same managed checkout support, with configuration and policy resolved for the destination before starting a turn.
## What changed
- Enable `codex --worktree` and `codex fork --worktree <session-id>` behind the `worktrees` feature, restricted to local sessions. Interactive forks require an explicit session selector.
- Resolve interactive and exec worktree forks from the session's latest saved working directory unless `--cd` is supplied. Keep relative `--add-dir` paths anchored to the invocation directory.
- Load interactive destination configuration before telemetry and login policy initialization, and bind checkout ownership before the first turn.
- Reject explicitly untrusted sources, including when destination cloud policy or refreshed configuration reveals distrust. Retain unbound interactive checkouts after startup failure and report manual recovery instructions.
## Testing
Add CLI integration and TUI tests for startup and named forks, destination instructions and configuration, ownership before the first request, trust enforcement, and retained-checkout recovery. Extend exec coverage for saved fork directories, explicit `--cd`, relative writable roots, and cloud policy rejection.
GitOrigin-RevId: 371583f7feca73b218a4ff188b2b85812c8439e6
## Why
`/copy` only offered the last assistant response and its code blocks or quotes, leaving `/status` output unavailable in the copy picker.
## What changed
After `/status`, offer the whole status as plain text, the model, the full directory path, and the thread name and session ID when present. Preserve the displayed status fields across repeated copies and include refreshed rate limits in whole-status copies.
Return to assistant-response copying after a later user message, assistant response, or command other than `/copy`. Rename the picker to “Copy to clipboard”.
## Testing
Add snapshots and regression tests covering status text and field selection, missing fields, full directory paths, repeated copying, refreshed limits, and returning to response copying after subsequent turns and commands, including queued commands.
GitOrigin-RevId: 9424cdca9753c834971992ca29494161957b50c4
## Why
Seeding recent history for the agents overview should not trigger a startup filesystem scan for unindexed rollouts.
## What changed
Set `use_state_db_only` to `true` on the overview's initial recent-thread list requests so they use only the state database.
## Testing
Extend the shared overview regression test with a newer, unindexed rollout and verify that the overview still contains the expected indexed history and loaded threads.
GitOrigin-RevId: b20861bef5b49fa2aa2a3b0953f069528b6f0c4f
## What changed
- Retain question drafts, selections, expanded state, and handled message IDs across thread input restoration and reconnects. Preserve buffered live questions during session refresh without replaying their message text.
- Enable history recall and search in question answers, honoring updated key bindings and stripping image attachments and placeholders from recalled entries. Preserve Vim mode when an answer is not accepted.
- Let forward navigation past the last question restore the latest queued message as an editable main composer draft. Keep working status and queued messages visible alongside questions.
- Show a countdown for newly arrived collapsed questions and clear it when the question editor is opened or used.
- Disable question submission and skipping while the thread is unavailable.
## Testing
Add regression tests and snapshots for draft restoration and replay deduplication, history search and key bindings, queued-message editing, countdown rendering, and question layout with working status.
GitOrigin-RevId: de016120a979db860fd0d4b8098b322b312b7d84
## Why
Async questions with suggested choices only accepted those choices. Allow users to write an alternative answer directly in the question pane.
## What changed
- Append an editable Other choice. Typing or pasting opens it, while number shortcuts still submit named choices.
- Preserve custom drafts when switching choices, reject blank Other submissions, and distinguish the input from a suggested choice named Other.
- Support Vim editing and search in question inputs while keeping arrow keys available for choice navigation.
- Wrap custom answers inline, cap the editor height, and keep the input visible in narrow layouts.
## Testing
Add interaction tests and snapshots covering custom answer delivery, draft preservation, selector key repeats, blank answers, remapped shortcuts, Vim editing and search, and narrow or wrapped layouts.
GitOrigin-RevId: 0e9aa9fcd2410e8da25f5ca43bdef94cbb9253b8
