## What changed
- Group consecutive successful agent and unified-exec startup commands into a compact `Ran N commands` entry while preserving their full transcript.
- Flush command groups at interaction boundaries, after failures, and after 32 completed commands. Keep manual shell commands and failed or declined commands visible.
- Apply the same grouping rules when replaying thread history without duplicating command starts or disturbing unrelated active commands.
## Testing
- Add TUI coverage for live and replayed grouping, transcript preservation, failures, overlapping commands, group limits, and interaction boundaries.
GitOrigin-RevId: d6602a20201644012fcff3d6cecf4690024383a9
## Why
App-server request deserialization otherwise ignores unknown fields, so clients using the removed `permissionProfile` field could have their requested permission settings silently ignored.
## What changed
- Reject `permissionProfile` with an invalid-params error on `thread/start`, `thread/resume`, `thread/fork`, and `turn/start`.
- Direct clients to select a named profile through `permissions` instead.
- Continue accepting unrelated unknown fields for forward compatibility.
## Testing
- Cover rejection of the obsolete field on all four affected methods and verify that the connection remains usable.
- Cover successful `thread/start` requests that combine named `permissions` with an unknown field.
GitOrigin-RevId: a63764fb899bc5f212d60617dc32e911bde8073e
## What changed
- Probe the configured Responses inference endpoint with Codex's route-aware HTTP client, including configured proxy and custom CA behavior.
- Classify TLS, proxy authentication, proxy configuration, resolution, and timeout failures into actionable diagnostics.
- Report privacy-safe macOS system proxy state and suggest enabling `respect_system_proxy` when a configured proxy is otherwise unused.
- Preserve system-root fallback when a custom CA is invalid, and account for provider-specific API key configuration when selecting the probe route.
## Testing
- Cover inference endpoint selection, invalid custom CA fallback, proxy authentication failures, TLS classification, and macOS proxy reporting.
GitOrigin-RevId: c30a3ca5a332119e2b2f8c65341ef9b2251a28a2
## Why
Permission profiles written before the rename to `:workspace_roots` can still
contain `:project_roots`. Treating that token as unknown ignores its entries and
can drop filesystem restrictions.
## What changed
- Parse `:project_roots` as an alias for `:workspace_roots`.
- Cover deny rules and read-only subpath carveouts in legacy profiles.
GitOrigin-RevId: 10aafc9e15372d1a8bcc2dbcf3ad7cc987f4e67e
## What changed
Stop visiting remaining `ColumnRenderable` children once the render position
reaches the bottom of the available area.
GitOrigin-RevId: 5b7f2c657f65879119b1b840e82f47b1c5f9e3db
## What changed
- When the composer is empty in Vim normal mode, make the configured history-up binding restore the latest queued follow-up for editing.
- Remove the restored message from the queue so submitting the edited version replaces it instead of creating a duplicate.
- Preserve normal history navigation when the composer has text or a popup is active, and honor remapped Vim bindings.
## Testing
- Add TUI tests covering repeated edit-and-requeue cycles and a remapped history-up binding.
GitOrigin-RevId: 0b04dd964d3fc6fdcd10712aa4d5fd81cbbd2255
## What changed
- Carry `ShellEnvironmentPolicy` in each resolved `EnvironmentConfig` and use
the selected turn environment's policy for shell commands, user shell tasks,
and unified exec.
- Infer the policy from the thread configuration when an environment does not
provide its own resolved configuration.
- Redact the policy from `EnvironmentConfig` debug output because it can contain
explicit environment variable values.
## Testing
- Verify shell handlers and unified exec filter inherited variables according
to the selected environment while preserving its explicit overrides.
GitOrigin-RevId: 9f6a52aa4af60e5f17251a0e1b11e1926b779055
## What changed
- Define and export `RequirementsExecPolicy` from `codex-execpolicy`, alongside the
underlying `Policy` type.
- Re-export the type from `codex-config` so existing config consumers retain the
same API.
- Preserve its order-independent equality and `AsRef<Policy>` behavior.
GitOrigin-RevId: e94c56b36824d07f2bc7ba14ce40bdb770d4ab46
## What changed
- Add `/cd [path]` for changing an idle local session's working directory while preserving conversation history. Relative paths resolve from the current directory, and omitting the path selects `~`.
- Reload project configuration, instructions, permissions, keybindings, file search, and hooks for the destination before replacing the active session.
- Reject unsafe transitions, including active or queued work, background terminals, remote environments, untrusted destinations, and incompatible permission profiles.
- Add `/pwd` and its `/cwd` alias to display the current working directory, and discard asynchronous results left over from the previous directory.
## Testing
- Cover command parsing, aliases, default paths, session eligibility, transition failures, history preservation, destination policy loading, hooks, and stale events.
GitOrigin-RevId: 1a987c029f157a087ba02c0f26e022260409132b
## What changed
Load the persisted maxima for `updated_at_ms` and `recency_at_ms` with separate
scalar subqueries during state initialization. This restores each timestamp
counter independently when the maxima belong to different threads.
## Testing
Add a regression test that reopens the state database and verifies both
independent maxima are restored.
GitOrigin-RevId: aeb9cc005d52c4a02dc7a220a817e6d40c0e01d4
## What changed
- On macOS, inspect the hardware profile before opening a remote-control WebSocket and send `x-codex-host-device-kind: mac_mini` when the machine name is exactly `Mac mini`.
- Cache successful detection results, bound the profile lookup to two seconds, and omit the header on other platforms or when detection fails.
## Testing
- Add parser coverage for Mac mini, other machine names, empty profiles, and malformed profile data.
GitOrigin-RevId: d2a4589bec0c879957f14ab4a195fd54747cc122
## What changed
- Store the editor portion of `RuntimeKeymap` in an `Arc` so the chat composer
and its embedded textarea use the same keymap snapshot.
- Initialize the textarea from the composer's default runtime keymap and keep
custom binding updates shared between both components.
- Use copy-on-write when tests and binding resolution need to mutate editor
bindings.
## Testing
- Verify that applying custom editor bindings shares the same keymap allocation
with the composer and textarea.
GitOrigin-RevId: 7f3b0afd6cc784e23deee8819e5c2c37a3709c68
## Why
External editor buffers can contain the current composer text and should not be
placed in directories exposed as writable by a restricted filesystem policy.
## What changed
- Create editor buffer files under a protected `editor` directory, trying the
configured Codex home, the default Codex home, and a workspace fallback.
- Reject candidates that overlap writable roots or resolve through symbolic
links, while preserving external editor support for full-disk-write policies.
- Surface an editor error when no protected directory is available.
## Testing
Add coverage for writable roots, aliases, symbolic links, fallback selection,
temporary-directory grants, full-disk-write policies, and editor invocation.
GitOrigin-RevId: df1029d81b327678991ab84ffd1077f0e5855631
## Why
Endpoint protection products can interfere with Codex, but existing doctor reports do not identify them or explain which Codex exclusions need verification.
## What changed
- Detect supported endpoint protection products on macOS and Windows and add the results to the doctor environment report.
- Warn when detected products have unverified Codex exclusions, with product-specific remediation for CrowdStrike Falcon, BeyondTrust Privilege Management, Microsoft Defender, SentinelOne, and Jamf Protect.
- Distinguish complete, partial, and unavailable inspection results without requiring remediation when no product is detected.
## Testing
- Cover empty, unavailable, partial, single-product, and multi-product inspection results.
- Verify the structured JSON contract and human-readable report output.
GitOrigin-RevId: 684c69684ed73235d92d398f5294cc1b274278df
Encode each character into a stack buffer before appending it to the
decorated span, avoiding a temporary `String` allocation for every character.
GitOrigin-RevId: 72ec1ad5363391dffee089f04073d827d8c459bf
## Why
Callers need to associate host-owned state with a thread before Core starts it.
## What changed
- Add `ThreadManager::reserve_thread_id` and allow new threads to start with the reserved ID. Reject reserved IDs when resuming an existing thread.
- Let thread stores stage metadata for a reserved ID. The local store merges staged values into the first successful metadata update and then removes them.
- Clear staged metadata when an unmaterialized thread shuts down or is discarded, and require the state database for staging.
## Testing
- Cover reserved ID generation and resume validation.
- Cover metadata persistence, merging, rollout-compatible updates, cleanup, and invalid staging requests.
GitOrigin-RevId: 3f9bc48f0f7764011cc90ea01349e497dda0a9e3
## What changed
- Serve `GET /healthz` with a `200 OK` response over HTTP/1.1 and HTTP/2.
- Continue requiring HTTP/2 for all other requests so gRPC methods are not exposed over HTTP/1.1.
## Testing
- Add TCP listener integration coverage for HTTP/1.1 and HTTP/2 health checks and rejection of HTTP/1.1 gRPC requests.
GitOrigin-RevId: ae7bbf56323fbc76769375a6d8e90653e8adc860
## Why
Forwarded network policy decisions are audit telemetry and should not be
written to the persistent state log.
## What changed
- Emit forwarded `codex.network_proxy.policy_decision` events on the
`codex_otel.log_only` target, keeping them available to OTEL log export while
excluding them from persistent logs.
- Assert the log-only target in the existing trusted-metadata audit test.
GitOrigin-RevId: 16d07c8f390245036e4fa092a876012ef2b2fdba
## What changed
- Report available space for `CODEX_HOME` and the active worktree, warning below 5 GiB and failing below 1 GiB.
- On Windows, report whether the active Git worktree is on a trusted Dev Drive and provide remediation when it is not.
- Run attached doctor reports against the conversation workspace, including workspaces recovered from persisted thread metadata, while keeping the subprocess anchored in `CODEX_HOME` so deleted workspaces do not prevent it from starting.
## Testing
- Cover disk thresholds, measurement failures, missing paths, conversation workspace selection, command construction, Windows volume detection, and human-readable output.
GitOrigin-RevId: 0a99f9d278717e7d19936ffc504984b3a0958c25
## What changed
- Display a dimmed `Resuming session…` or `Forking session…` status above the provisional composer based on the requested session action.
- Update or clear the status after session selection resolves, while preserving the composer height and any startup draft text.
## Testing
- Add snapshot coverage for resume and fork loading states and transitions back to a fresh session.
GitOrigin-RevId: 9d37b2d0e390d28dee310dd7a5b9fa992db2c25c
## Why
Thread settings can change while a turn is still active, including between sampling requests. Those updates should apply to the next turn instead of changing the model configuration partway through the current turn.
## What changed
- Snapshot the model, reasoning settings, service tier, approval settings, and model-attributed telemetry in `StepContext`.
- Build prompts, model requests, world state, tracing, and startup prewarms from that step-scoped snapshot.
- Share immutable model metadata between turn and step contexts.
## Testing
Added an integration test that pauses an active turn, updates its thread settings, and verifies that all requests in the active turn retain the original settings while the next turn uses the updates.
GitOrigin-RevId: c51352218e463dcc9b7338566d16742292c49fbf
## What changed
- Request paginated history when `codex exec` starts a persistent thread.
- Keep ephemeral threads unchanged and retry with legacy history when the configured thread store does not support pagination.
- Exercise paginated resume and fork persistence, including resumed history and fork ancestry without copying the source transcript.
## Testing
- Extend unit coverage for persistent and ephemeral thread start parameters.
- Add an integration test for the legacy-history fallback.
GitOrigin-RevId: 610a2db14524b127551e75b7aef541d44368f28a
## What changed
- Read optional workload identity context from `OPENAI_WORKLOAD_IDENTITY_CONTEXT` and forward it unchanged as the `workload_identity_context` token exchange field.
- Treat the context as sensitive by redacting it from session configuration debug output and removing it from model-reachable child environments.
- Include the context in workload identity session fingerprints so sessions with different values cannot share an exchange.
## Testing
- Cover request forwarding, debug redaction, session compatibility, and child-environment scrubbing.
GitOrigin-RevId: fb50700478cf54d9d604944a4ed3e77acc928a0f
## What changed
Remove the unused `codex-cli` dev-dependency and the no-op import that kept it
visible to `cargo-shear`. TUI tests continue to locate spawned binaries through
`codex-utils-cargo-bin`.
GitOrigin-RevId: ba5855590c6f0300845170f15f39d77c0611a60a
## Why
App directory data and in-flight requests can outlive the account, workspace, or thread that produced them, allowing stale apps to appear in the current TUI context.
## What changed
- Invalidate cached app data, dismiss the app picker, and start a fresh fetch when the account, workspace, or thread changes.
- Tag app directory fetches with their originating thread, workspace, and scope generation, and ignore queued requests or results that no longer match.
- Treat `AppListUpdated` notifications as revalidation signals instead of directly adopting their unscoped contents, with deduplication and a bounded error retry.
## Testing
Added coverage for stale request and result rejection, context invalidation, picker dismissal, and notification revalidation.
GitOrigin-RevId: f20930a0598a6abbdfb3c7826ec955346fe2da7a
## What changed
- Discover synchronous `mcp_tool` hook handlers and invoke their configured MCP server and tool through a supplied executor.
- Expand nested hook-event placeholders in MCP tool inputs while preserving JSON types, and process tool output through the existing hook output contract.
- Represent hook details as handler-specific metadata in `hooks/list`, including MCP server and tool fields, and show those details in the TUI hooks browser.
- Skip unsupported `SessionEnd` MCP hooks and runtimes without MCP invocation support with startup warnings.
## Testing
- Cover argument expansion, missing placeholders, MCP invocation and hook decisions, discovery warnings, `hooks/list` metadata, and TUI rendering.
GitOrigin-RevId: 295b845471fe92bd7ad7cd272fbcd2c3713912e0
## Why
Replacing every carriage return with a line feed turns each CRLF pair into two
line breaks when text is pasted into the TUI composer.
## What changed
Normalize CRLF pairs before converting remaining bare carriage returns, so each
pasted line ending becomes a single line feed while existing line feeds remain
unchanged.
## Testing
Add a regression test covering mixed CRLF, bare CR, and LF line endings.
GitOrigin-RevId: 86c66d2a52fae52c9ae58c2f24a49eed685b60be
## What changed
- Rebuild hook runtimes for loaded sessions when effective plugins change or a marketplace upgrade installs new plugin content.
- Refresh plugin-related caches and MCP runtimes alongside hooks after plugin mutations.
- Preserve each loaded session's current configuration while rebuilding its hooks.
## Testing
- Cover direct plugin upgrades, including subsequent turn and session-end hooks.
- Cover automatic marketplace upgrades for an already loaded session.
GitOrigin-RevId: fef64c68d652f300c7f3d88e81c5017459aa9a18
## What changed
- Represent `request_permissions` calls as shared approval actions and convert them into Guardian permission requests through the common approval path.
- Preserve turn cancellation while an automatic permission review is pending.
- Cover Guardian allow and deny decisions, cancellation without a user-approval fallback, and clean follow-up turns.
GitOrigin-RevId: 95d0df0288e232f32b162756aa7d64a30df7efa5
## What changed
- Add optional W3C `traceparent` and `tracestate` fields to relay frames.
- Copy trace context from JSON-RPC requests onto relay data frames.
- For encrypted requests split across multiple Noise records, attach the context only to the first record while keeping the request payload encrypted.
## Testing
- Cover trace propagation for both Noise relay paths, including fragmented encrypted requests.
GitOrigin-RevId: a61bbbefef31e2e7e93a43f439c5f296700feb7b
## Why
An environment connection can be available before its owner has supplied the
configuration for a particular thread attachment. Threads need to start without
blocking while ensuring turns do not use that attachment prematurely.
## What changed
- Accept `Pending` environment configuration and resolve each attachment only
after both its shared executor connection and owner configuration are ready.
- Add a `Failed` configuration state and `environment_failed` callback so an
owner can fail one thread's attachment without affecting other threads.
- Keep pending and failed attachments out of capability-root inspection and turn
environments, and allow failed attachments to recover through a ready update.
- Apply owner configuration before waking a waiting turn so its permission
profile, login-shell policy, capability roots, and tools are immediately
consistent.
## Testing
Add an integration test covering non-blocking thread startup, independent ready
and failed callbacks, waiting-turn resumption, installed capability and tool
configuration, and recovery from failure.
GitOrigin-RevId: d587e2025d584c867d782d470b18bf5a1a27b76c
## What changed
- Recognize `misalignment_policy_violation` errors from response streams and HTTP 400 or 403 responses.
- Preserve the upstream message, use a fallback for blank messages, and treat the error as non-retryable.
- Expose `misalignmentPolicyViolation` through the app-server protocol and generated schemas so turns fail with a typed terminal error.
## Testing
- Cover streamed and HTTP policy violations, fallback messages, retry behavior, and app-server turn completion.
GitOrigin-RevId: fd3485bf0be7bfe3d51c078bbc36a081692fd57f
## Why
Responses WebSocket fallback is session-scoped. A delegated session created
after its parent switched to HTTP could otherwise make another WebSocket
connection attempt.
## What changed
Disable WebSocket support for a delegated session when the parent session has
already fallen back to HTTP.
## Testing
Add a guardian review regression test that verifies only the parent's initial
WebSocket attempt occurs and the guardian request uses the HTTP response path.
GitOrigin-RevId: 1345f8fe739f55975aef432045348eae5a9278d6
## Why
Environment attachments can either inherit configuration from their thread or
provide their own. Later thread setting updates must refresh inherited
configuration without overwriting attachment-owned permissions and capability
roots.
## What changed
- Resolve each attachment's configuration when it is selected and retain
whether it came from the thread or the attachment owner.
- Apply subsequent thread configuration updates only to thread-owned
attachments, while preserving ownership across snapshots and child threads.
- Keep the resolved configuration with the environment selection so runtime
consumers use a single canonical value.
## Testing
- Extend remote-environment coverage to verify that thread-owned permissions
follow thread updates while owner-provided read-only permissions remain in
effect.
- Cover configuration inheritance, attachment replacement, and owner-configured
capability roots.
GitOrigin-RevId: fe70c4be5f151432b69bf4b141e316faa89036ae
## What changed
- Treat plain, Shift-modified, and Windows AltGr character events as text-producing input for paste-burst detection.
- Exclude Super, Hyper, and Meta character events from paste bursts, flushing any pending text before handling them as shortcuts.
## Testing
- Add coverage for plain and Shift-modified spaces, shortcut-modified spaces, pending burst flushes, and platform-specific AltGr input.
GitOrigin-RevId: 3c43224966307fd014eb1586dce0c53ee56c75aa
## What changed
- Add a resolved `permission_profile` to each `EnvironmentConfig` and use the
complete attachment config for execution and capability-root selection.
- Let `Ready` environment configurations override thread permissions while
`FromThread` selections continue to inherit them.
- Restrict inherited Guardian environment profiles to read-only permissions.
## Testing
- Add coverage proving that a read-only environment blocks writes even when
the thread permits workspace writes.
- Update environment inheritance, Guardian review, and capability-root tests
for the resolved attachment configuration.
GitOrigin-RevId: 1a313b9e4892b1a579a0e880e322a782b4f6c0a7
## What changed
- Add a best-effort `network/policyDecision` notification for final domain and non-domain policy decisions made by executor-local proxies.
- Validate notifications against the active process on the controller and emit audit events with controller-trusted session and execution metadata.
- Reserve outbound RPC capacity so audit notifications cannot block control messages, and expose valid `chatgpt-account-id` header values for audit attribution.
## Testing
- Cover notification serialization, proxy decision capture, executor-to-controller delivery, trusted metadata handling, and reserved RPC capacity.
GitOrigin-RevId: a39f96a6b3d9401c03d54eaef5b9a6d3fe0da78b
## Why
Code Mode rendered document-local `$ref` values as `unknown`, hiding referenced
input and structured-output shapes from generated TypeScript declarations.
## What changed
- Resolve fragment-only JSON Pointer references against the root schema,
including escaped and percent-encoded pointer segments.
- Preserve `$ref` siblings as intersections and parenthesize unions used in
`allOf` intersections.
- Bound recursive and repeated expansion, intermediate rendering work, and
final output size, falling back to `unknown` when a limit is reached or a
reference cannot be resolved safely.
## Testing
Add unit coverage for recursive, escaped, nested-resource, dangling, and
oversized references, plus integration coverage for generated Code Mode tool
descriptions and MCP structured output types.
GitOrigin-RevId: 95c6aa32e25325b5be9359dfac3b3328e5e7a499
## Why
Backspace should let users remove Thai vowel and tone marks without deleting the
entire grapheme cluster.
## What changed
- Treat Thai nonspacing marks as individual backward-deletion boundaries.
- Keep embedded text elements atomic and preserve the existing behavior for
other grapheme clusters, including decomposed Latin text and joined emoji.
## Testing
Add coverage for successive deletion of Thai marks, cursor rendering after
deletion, unchanged non-Thai grapheme handling, and atomic Thai text elements.
GitOrigin-RevId: f4834183909d93f4b4dd92f5d93e89235dc2b621
## Why
Windows sandbox requests must preserve managed filesystem deny rules across every execution path and setup refresh. Unsupported policies should fail closed instead of allowing a command to run without the requested protection.
## What changed
- Resolve Windows filesystem overrides while constructing each sandbox execution request so both `shell_command` and `exec_command` enforce exact-path and glob deny-read entries.
- Carry resolved deny-read paths into Windows sandbox setup refreshes, including workspace-relative entries.
- Reject unelevated restricted-token requests that cannot enforce deny-read rules.
- Reject recursive globs rooted at a filesystem root unless `glob_scan_max_depth` bounds their expansion.
## Testing
Added coverage for deny-read enforcement through both command runtimes, setup refresh resolution, restricted-token failure, and bounded root-level glob scans.
GitOrigin-RevId: 33dfa4d1a45b14850cbf58f9173717e3e707d9bf
## What changed
Return early from `mark_buffer_hyperlinks` when none of the supplied lines
contain hyperlink metadata, avoiding unnecessary paragraph layout work.
GitOrigin-RevId: bdd6727f3dab7cef87646f97ac955e848cfcfee2
## What changed
- Define `PermissionProfileSnapshot` as a protocol model and re-export it from
`core-api`.
- Store snapshots directly in core permission state while continuing to apply
constraints to their concrete `PermissionProfile`.
- Preserve active profile identity and profile-declared workspace roots without
the core-only resolved profile variants.
GitOrigin-RevId: cc5e03908e62054cde5de691faa47e471f2e1af5
## What changed
- Normalize both tool invocations and subscription filters before matching them.
- Treat missing and empty namespaces as aliases for the `functions` namespace while preserving the namespace reported with each invocation.
## Testing
- Add a gRPC service test covering missing, empty, and explicit default namespaces on both sides of a filtered subscription.
GitOrigin-RevId: 409326f8ee6b3ab9a6ff5ceca0693558bc9c364d
## Why
The TUI reads the account to determine login status, then bootstrap reads the
same account again during startup.
## What changed
- Preserve the login-status account response and pass it to app-server
bootstrap, avoiding the second account request.
- Discard the prefetched response when onboarding or a resume-directory prompt
allows authentication to change, when a picker replaces the app-server
session, or when the model provider changes.
## Testing
- Verify bootstrap reuses a prefetched account without issuing another account
request and retains its account metadata.
- Verify normal bootstrap still reads the account when none was prefetched.
- Verify matching resume directories skip the interactive prompt.
GitOrigin-RevId: 8da1b9104b9e7f048c4254399b126116798d641a
## What changed
- Add `LoaderOverrides::ignore_project_config` to bypass project-root discovery and all project configuration layers.
- Keep other configuration sources, including session overrides and cloud configuration, active when the override is set.
## Testing
- Add a config loader test that verifies project configuration is not loaded or parsed while session and cloud values remain effective.
GitOrigin-RevId: b9aa44de526354fad6b900d6ae8d9b5fb8f700bb
## What changed
- Forward notification text to the session delegate without applying the previous 1,024-byte limit or appending a truncation suffix.
- Update the gRPC host integration test to verify that oversized multibyte notification text is delivered unchanged.
GitOrigin-RevId: 9a9e24b359a07540f70ec4e98b28524db3f7a4a0
## Why
Routine state such as history, logs, sessions, or temporary files does not mean
that the default account can authenticate. Treating any non-pristine Codex home
as configured can show the composer before onboarding is complete.
## What changed
- Base the startup decision on authentication-relevant state instead of requiring
an empty Codex home. Existing credentials, configuration, workload identity,
managed configuration, or a running local daemon continue to keep the composer
visible.
- Treat an unreadable or ambiguous home conservatively and keep the composer
visible.
- Allow onboarding when the legacy `--search` flag is the only configuration
override.
## Testing
Expanded startup preflight and draft tests to cover existing home state,
credential sources, workload identity markers, daemon state, ambiguous paths,
and search-only overrides.
GitOrigin-RevId: 76837e3fd6aa714f2a7f72d191088a3faae23515
## Why
On a pristine default installation, the provisional composer can appear before
first-login onboarding takes over the terminal.
## What changed
- Detect pristine local installations conservatively, accounting for existing
Codex state, custom homes, access tokens, system configuration, and managed
configuration sources, including macOS managed preferences.
- Keep the composer hidden and ignore draft input until onboarding completes,
while still allowing startup cancellation with `Ctrl-C` or `Ctrl-D`.
- Reveal the configured composer after onboarding for normal new-session
launches; resume and fork pickers retain their existing startup flow.
## Testing
- Cover pristine and existing home layouts, environment credentials, system and
managed configuration, inaccessible state, onboarding input suppression,
cancellation, and the transition to the composer.
GitOrigin-RevId: c1a47ea3ba7c1ff1dd229895c0362b6dd9bfd713
