## What changed
Construct the worktrees entry in `experimental_features_popup_snapshot` with
its string feature key and mark it writable, matching the current
`ExperimentalFeatureItem` fields.
GitOrigin-RevId: c12cd3d472504777e77d21a13a276e1d2381e85f
## What changed
Remove guidance that told `send_message_to_user_async` to request missing
information, preferences, constraints, clarification, or approval. Keep the
tool focused on critical blockers, direction-changing findings, and replies to
user questions or status requests during ongoing work.
GitOrigin-RevId: c764ffc2b9c14e37467bd25ee3ed07407d550290
## What changed
- Add helper protocol requests to create a WebRTC offer, apply an answer, and report readiness once the ordered `oai-events` data channel opens.
- Support UDP and TCP candidates while bounding signaling size, remote candidates, inbound TCP streams, and WebRTC buffers. Redact session descriptions and peer errors from diagnostics.
- Close unexpected remote data channels and tear down the peer during helper shutdown, including when the parent pipe is lost during startup.
## Testing
- Exercise offer/answer negotiation and clean shutdown over real UDP and TCP sockets.
- Cover signaling validation, candidate and connection limits, early packet loss, slow TCP connection setup, and blocked-startup parent loss.
GitOrigin-RevId: 5f5e60a3a4d1d8eaca2e4724e66284f54061b6af
## What changed
- Save writable `/experimental` selections through `config/batchWrite`, including features that are not known to the local client.
- Refresh configured values after writes and surface timeouts, failures, and higher-priority overrides without changing the active task's settings.
- Serialize saves and discovery, let accepted writes finish after the popup closes, and retain uncertain selections for explicit retry.
## Testing
- Cover new server feature keys, server defaults, overrides, write and readback failures, timeouts, selected config profiles, and popup retry behavior.
GitOrigin-RevId: acee4e10cbb8c2fce9211e8fadd3cd67fa0eb1a5
## Why
Starting a replacement thread can fail while reading configuration or calling
`thread/start`. The active thread and any composed input should remain available
when that happens. Remote app servers also need new threads to use their own
effective defaults instead of stale client-side model settings.
## What changed
- Read effective server configuration before starting a replacement thread,
while preserving explicit model and reasoning-effort launch settings.
- Keep the current thread, configuration, subscriptions, and composer input
intact until `thread/start` succeeds.
- Fall back to local defaults when an older server does not support
`config/read`.
## Testing
Added coverage for server and managed defaults, explicit launch overrides,
remote working directories, older servers, and failures during configuration
reads or thread startup.
GitOrigin-RevId: 507a918ea2bf79c9f0adbb189bc611ecf57b757a
## Why
A pending remote control enrollment could prevent the app server from exiting
after stdio EOF, leaving resources such as thread writers held by the process.
## What changed
- Give remote control its own child shutdown token and cancel it before draining
RPCs when the stdio connection closes.
- Interrupt enrollment requests that require network access after shutdown has
begun, while still allowing in-memory or persisted enrollments to be enabled
and durably saved.
## Testing
- Cover stdio shutdown during a blocked enrollment and verify that another app
server can acquire the released thread writer.
- Cover durable enablement after shutdown with in-memory, persisted, and missing
enrollments.
GitOrigin-RevId: ef9ab49672f273a4cf8257188454a154c03088bd
## What changed
- Prefetch ChatGPT account eligibility in the background and cache it across TUI widget replacements.
- Show an application link when Daybreak is available but not enabled, an Astra-specific explanation for unsupported models, and neutral copy when access is already present or eligibility cannot be determined.
- Refresh eligibility after account changes and reconnects without changing the selected model or delaying refusal handling.
## Testing
- Cover eligibility responses, account changes, model-specific notices, fallback behavior, and rendered notice snapshots.
GitOrigin-RevId: 7ae8613a946cb46b8f0b46bf47e5e15ae258ed86
## What changed
Point the stable exec-server compatibility test at the pinned Codex 0.153.1
Linux x86_64 release and update the release archive checksum.
GitOrigin-RevId: ebbce8d61811ccea09adf7539cd7a85f24cbf97a
## What changed
- Add the experimental `worktrees` feature and a shared `--worktree` flag for new and forked `codex exec` sessions.
- Create each enabled session in a managed Git worktree, use that checkout as the session working directory, and bind the checkout to the new thread.
- Share the configured worktree pool with Desktop while leaving automatic cleanup disabled for CLI allocations.
- Reject unsupported commands, remote execution, ignored user configuration, ephemeral sessions, and use without the feature enabled before allocating a worktree.
## Testing
- Cover flag placement and inheritance, supported and rejected command combinations, worktree allocation and thread ownership, configuration gating, and compatibility with existing worktree-backed sessions.
GitOrigin-RevId: 011ff4639b09e8992c50d7b823df23e71798670e
## What changed
- Convert `codex-file-citation` directives in assistant Markdown into local-file links while preserving paths with Markdown-significant characters, Unicode, Windows separators, and location suffixes.
- Apply citation rendering consistently to streaming output, finalized messages and plans, and resume-picker transcript previews.
- Keep directives literal in code, HTML, existing links, reference definitions, escaped text, and generic Markdown rendering.
- Bound repeated parsing work for malformed directive candidates without limiting valid citations.
## Testing
- Add coverage for citation parsing and rendering across finalized, streaming, and resume-preview output, including malformed input and path edge cases.
GitOrigin-RevId: 5a0bfb3fc7ac21b7e8846fd170a349fb2d2d5e85
## Why
Leaving an alternate-screen overlay in inline mode could retain stale overlay
cells and leave conversation history scrolled out of view.
## What changed
- Invalidate the restored inline viewport after leaving the alternate screen so
the next draw repaints it against the main screen.
- Reflow transcript history once when a full-height inline viewport returns to
the shorter chat layout, including transitions not tracked by the agents
overview.
## Testing
Added regression coverage for repainting the restored composer and rebuilding
history exactly once after a full-screen overlay closes.
GitOrigin-RevId: c6d63299fd95731603d8b1d7f04afcd4b92c1681
## What changed
- Add a shared parser for assistant directives that handles quoted and unquoted attributes, embedded braces, escaped quotes, and malformed input consistently.
- Use the parser for Git action receipts and code comments, including Git actions that follow a rendered code comment on the same line.
- Parse `file://` links with `PathUri` so Windows drive and UNC paths render correctly regardless of the TUI host while preserving line and column anchors.
## Testing
- Add unit coverage for directive grammar and snapshot coverage for code comments, Git actions, and foreign Windows file links.
GitOrigin-RevId: 8252b3254b92ec6943096026e74c19160c4e24cc
## Why
A model-default config write can succeed even when a higher-priority configuration layer overrides the saved value, leaving the TUI's success message misleading.
## What changed
- Show a warning when saved model, reasoning-effort, or service-tier defaults are overridden.
- Preserve the active conversation's explicit selection while reporting the saved default's effective status.
## Testing
- Cover successful, overridden, and rejected writes against the app server's target config profile.
GitOrigin-RevId: 6720d66a58629447b71cd9363c9e08c1c5b9edc1
## What changed
Describe the `gpt-6-astra` Fast service tier as providing 2x speed with
increased usage.
GitOrigin-RevId: a5b470dc598d23aea312172986823212922219f9
## What changed
- Add the `codex-attachment-store` crate with storage-neutral attachment metadata, references, errors, and an asynchronous persistence interface.
- Provide an inline implementation that preserves attachment bytes as media-typed base64 data URLs.
- Inject the store into `ThreadManager`, expose it to consumers, and retain inline storage as the default for existing entry points.
## Testing
- Verify inline storage round-trips binary, text, PNG, and JPEG data.
- Verify attachment debug output redacts URLs while retaining file IDs.
GitOrigin-RevId: 7688dcd3c89d7540ed2398f3e7c63881fbfcda97
## Why
The voice helper previously supported only handshake and shutdown, without
validating that its packaged native runtime could be initialized safely.
## What changed
- Add an `initializeRuntime` protocol exchange that loads GStreamer and the
required plugins from physical package paths without opening audio devices.
- Restrict plugin discovery, registry access, and native library search paths,
and keep loaded libraries alive until the helper exits.
- Give initialization a dedicated deadline and terminate the owned helper when
initialization is cancelled or fails.
- Allow binary-only Rust targets to disable the default Bazel library target.
## Testing
- Cover helper-only packages, cancellation, and environment filtering.
- Add an ignored integration test for initialization from a relocated prepared
runtime and rejection of duplicate initialization.
GitOrigin-RevId: 8fff68fe26e52cb2e0722dc98fb5f124eddb0d4d
## What changed
- Add `PromptImageMode::HIGH_DETAIL` and `PromptImageMode::ORIGINAL_DETAIL`
constants with the standard resize limits.
- Use the shared modes during core image preparation instead of defining the
limits locally.
- Cover the dimension and patch budgets for both detail modes in the image
utility tests.
GitOrigin-RevId: 27fdc77719f23d2e8f1060886576b3be843a8491
## What changed
- Wait for the authenticated Noise handshake before sending the JSON-RPC
`initialize` request.
- Share the configured initialization timeout across the handshake and RPC,
while preserving the configured duration in timeout diagnostics.
- Record the handshake and initialization RPC as child spans of the existing
initialization span, and terminate transport tasks when handshake readiness
fails.
## Testing
- Cover stalled handshake timeouts and cleanup of the underlying WebSocket.
- Cover timeout reporting after the handshake has consumed part of the budget.
GitOrigin-RevId: c3eb5f7cfedd8d155fde5b7614fc2eb399ce337c
## What changed
- Add `openai.gpt-6-astra` to the Amazon Bedrock model catalog.
- Include its global and US cross-region variants in the Bedrock Runtime catalog.
- Preserve the bundled model metadata while applying Bedrock-specific capabilities and identifiers.
## Testing
- Cover catalog ordering, metadata, context-window overrides, and runtime routing variants.
- Add TUI snapshots for the Bedrock model and reasoning pickers.
GitOrigin-RevId: 25895174f00b85a738da5bb94ade82feaacb474c
## What changed
- Coalesce configuration, skill, sandbox, and MCP startup diagnostics into a single summary below the session header, including MCP and sign-in counts.
- Keep the complete warning text in the transcript and update the summary's transcript shortcut when key bindings change.
- Continue rendering warnings that arrive after work begins as inline history entries.
- Hide the MCP startup status row before a turn while preserving the configured interrupt shortcut.
## Testing
- Add coverage for warning ordering and deduplication, transcript details, MCP sign-in counts, resumed sessions, runtime warnings, reflow, backtracking, and interruption without a visible status row.
GitOrigin-RevId: 009657cf04f1d3a52270cf096eebf9db7513c040
## What changed
- Add the hidden `gpt-6-astra` model definition, including its reasoning levels,
tool capabilities, context limits, agent instructions, and review policies.
- Reorder existing model priorities around the new catalog entry and provide the
browser-use policy to the bundled auto-review model.
- Keep TUI snapshots pinned to `gpt-5.6-sol` and make Guardian coverage read the
policy from the model selected by each test case.
- Allow the expanded `models.json` through the repository blob-size check.
GitOrigin-RevId: 039b224b91ca35c8d894cf6d23568bc6dc18ceeb
## What changed
- Add `RemoteEnvironmentOptions` and `upsert_environment_with_options` so embedding hosts can attach trusted HTTP headers to remote exec-server WebSocket handshakes.
- Preserve the headers across session reconnects while redacting them from debug output.
- Reject invalid, duplicate, and WebSocket-controlled headers, and require `wss://` for non-loopback destinations.
- Connect header-bearing loopback WebSockets directly, with DNS results restricted to loopback addresses.
## Testing
- Cover header validation and redaction, delivery on initial connections and reconnects, and loopback destination enforcement.
GitOrigin-RevId: f2e2b0456c8e33c13fd8ab4ee040a8b5c15e885d
## What changed
Add `install_global_metrics` as the public entry point for installing an
externally managed, non-Statsig `MetricsClient` during single-threaded startup.
The returned handle retains ownership of the installed exporter so callers can
flush and shut it down.
GitOrigin-RevId: 1108a0468588046e5cc8266d2af6143f14456d82
## What changed
- Emit a connection-scoped `deprecationNotice` when `review/start` uses
`delivery: "detached"`, including when validation later rejects the request.
- Preserve detached review behavior while directing callers to use `thread/start`
followed by an inline review for a separate review thread.
- Document the deprecation and migration options in the app-server protocol and
README.
## Testing
- Cover the notice for accepted and rejected detached reviews.
- Verify that omitted, null, and inline delivery do not emit the notice.
GitOrigin-RevId: 4234a09d2bb7ef8053091580175dc8cbe8d7512c
## Why
An empty tool map does not distinguish a successfully returned empty catalog from a server whose startup or tool discovery failed.
## What changed
- Add nullable `toolsError` to each `mcpServerStatus/list` entry when no catalog is available because startup or tool discovery failed.
- Keep `toolsError` null for returned catalogs, including cached and empty catalogs, and continue returning healthy servers when another server fails.
- Update the protocol schemas and generated TypeScript type.
## Testing
- Extend the app-server status integration test with a broken MCP server and verify its error without losing the healthy server's inventory.
GitOrigin-RevId: 30b4ca4d9a45cec6998f5f626d3fddbee90a525d
## What changed
Increment the `codex.windows_sandbox.private_desktop` counter when preparing a
Windows restricted-token sandbox execution, tagging it with whether private
desktop isolation is enabled.
GitOrigin-RevId: 1eb5e183b57e19753dc133dbe152eabe23dd2a23
## Why
Loaded threads can retain their previous configuration after a local plugin is
installed, preventing the plugin's bundled MCP servers and pending user-config
changes from taking effect in the current session.
## What changed
- Reload user configuration for loaded threads after installing a local plugin.
- Refresh MCP and hook runtimes only after the new configuration is applied.
- Keep installation successful if configuration reload fails, while logging the
failure.
## Testing
- Verify an installed plugin's MCP tool can be called from a thread that was
started before installation.
- Update the hook runtime test to verify installation applies a staged hook
configuration change to the loaded session.
GitOrigin-RevId: 63f5a5c7f16303e51cf940e8d9dc3b45c50ae2a9
## Why
Sandboxed commands inherit the user's controlling terminal. Without an explicit
restriction, a child can use `TIOCSTI` to queue input for the unsandboxed shell
that resumes after Codex exits.
## What changed
Append a `file-ioctl` denial for `TIOCSTI` after the shared Seatbelt policy
allowances used by `codex sandbox`.
## Testing
Add a macOS PTY integration test that first proves terminal input injection
works without the sandbox, then verifies Seatbelt rejects it with `EPERM`.
GitOrigin-RevId: 5a8b0a5b4fd980cc406ad184d04ceae9b0ea90e4
## Why
Guardian can reuse an opaque parent compaction only when the checkpoint's
recorded producer hash matches the scoring model. Missing or incompatible
provenance must not allow an asynchronous score or cached approval to omit
compacted context.
## What changed
- Record the producing model's compatibility hash on compaction history items
and expose the latest checkpoint hash through conversation snapshots.
- In thread-owned context mode, fail closed and require synchronous review when
checkpoint reuse is enabled but the latest checkpoint is incompatible or has
unknown provenance.
- Reject incompatible checkpoints in the sampler while preserving the legacy
context behavior.
## Testing
Add coverage for local, remote, resumed, compacted, and rolled-back histories,
including matching, mismatched, missing, and empty compatibility hashes.
GitOrigin-RevId: 1ce959cb276edc602fd7dfa442133c7fe5e53857
## Why
Legacy terminals encode `Alt` plus a character the same way as `Esc` followed
by that character. In Vim insert or replace mode, typing a command immediately
after `Esc` could therefore leave the composer in the wrong mode.
## What changed
Recover ambiguous input as separate `Esc` and character events when Vim mode
can consume the escape. Preserve active `Alt` bindings, key chords, image
paste, agent navigation, enhanced-key terminals, and AltGr input.
## Testing
Add coverage for recovered Vim commands and for each shortcut and terminal
case that must retain its existing behavior.
GitOrigin-RevId: 3d8464d805f95f677cce5c46ae00338e611d776a
## Why
Guardian authorization reviews need host-verified `request_user_input` answers to
remain aligned with thread history across compaction, resume, and rollback.
## What changed
- Record verified question-and-answer pairs in retained thread context when
`GuardianThreadContext` is enabled, and source both local and delegated Guardian
review evidence from that context.
- Preserve complete answer records within the evidence budget. Mark authorization
context incomplete when records are unavailable or oversized, and defer cached
fast approvals in that case.
- Keep the existing runtime-only answer path for threads that do not enable the
thread-owned context.
## Testing
- Cover answer retention through compaction and resume, removal after rollback,
source-call eviction, oversized answers, delegated review evidence, and legacy
behavior.
GitOrigin-RevId: 01f6f4541515434a0d00fdde318ff59f2f8bd2eb
## What changed
- Pass the selected executor's `PathUri` through user command approval requests instead of converting the working directory to a host-native path.
- Make native-path permission helpers explicitly local and require executor-aware permission transforms to receive a `FileSystemSandboxPolicyContext`.
- Cover approved remote commands to verify that the approval request reports the selected remote working directory and execution resumes after approval.
GitOrigin-RevId: 0aa3042f2d7594af6c7d0abf31d7f99cf67d5556
## Why
When silent OAuth refresh cannot recover a rejected MCP tool call, the caller
needs the server's authentication challenge to initiate interactive login. The
rejected call must not be replayed automatically after refresh has failed.
## What changed
- Convert `401 Unauthorized` responses with `WWW-Authenticate` headers into an
MCP tool error containing `mcp/www_authenticate` metadata.
- Preserve multiple authentication challenges by combining all
`WWW-Authenticate` header values.
- Keep successful silent refresh behavior while avoiding replay when refresh
fails.
## Testing
Added coverage for successful and failed refresh, multiple authentication
headers, propagation through agent tool-call events, and no-replay behavior.
GitOrigin-RevId: c560cff6286d7ab09b1f5c6cf3618d4650cde47d
## What changed
- Add the disabled, under-development `guardian_thread_context` feature flag for selecting thread-owned context for Guardian reviewers.
- Expose the boolean setting in the generated configuration schema.
- Verify default, base configuration, and profile override resolution.
GitOrigin-RevId: c4878be96d12f4ccd84356df15d3e55f13ac141f
## What changed
- Add the creation-time `originator` to app-server thread responses and `thread/started` notifications.
- Persist originators in thread metadata and preserve the first recorded value across list, read, resume, rollout, and SQLite paths.
- Add an `originators` allowlist to `thread/list` for hosted backends. The local app-server accepts omitted or empty values but rejects nonempty filters.
## Testing
- Cover originator persistence across server restarts and list, read, and resume requests.
- Verify local `thread/list` handling for nonempty, omitted, null, and empty originator filters.
- Heap-allocate large TUI dispatcher futures in affected tests to keep them within the Windows test-thread stack.
GitOrigin-RevId: 73ad6e61b8fdd2d93a22d1f971723a19ec7be3fc
## What changed
- Add bounded detail previews for the selected task, including pending approval or user-input requests, live reasoning headings, and the latest agent message.
- Prefer the most urgent child task with useful detail while keeping the task list compact.
- Populate historical last messages from existing thread reads and update live details from already-delivered events without attaching to additional threads.
- Clear stale previews after reverts, event-stream gaps, reconnects, and thread lifecycle changes.
## Testing
- Add coverage and snapshots for attention requests, live activity, historical messages, stale refreshes, and attachment changes.
GitOrigin-RevId: 5de4b8aa3bc5bf9653a40c44b827f7aa85c8cf89
## Why
The permissions menu needs to reflect the profiles and configuration requirements available in the active app-server scope, including remote workspaces.
## What changed
- Load permission profiles and configuration requirements asynchronously when opening the permissions menu, using the active thread working directory.
- Render loading, retry, empty-catalog, and unsupported-server states, and fall back to the legacy permissions menu when explicit profiles are not configured.
- Disable profiles rejected by server requirements or unavailable in the catalog. Remote custom profiles remain visible but cannot yet be selected.
- Bound pagination and request time, reject malformed catalogs, and ignore responses made stale by account, thread, or modal changes.
## Testing
- Cover local, session-only, remote, legacy, empty, unsupported, pagination, malformed-response, and timeout discovery paths.
- Add TUI tests for loading, failures, retries, empty results, remote catalogs, stale responses, and working-directory changes.
GitOrigin-RevId: 3e2ab53a4eae1179587d064f9a4c605765ea7880
## Why
Completion receipts for identical user messages could acknowledge the wrong
pending steer. When the receipt arrived while another thread was displayed,
the stale pending state could later be restored and resubmitted.
## What changed
- Assign each TUI submission a client message ID and pass it through turn start
and steer requests.
- Preserve pending steer IDs across thread input snapshots and match completion
receipts by ID, while retaining content-based matching for older app servers
that do not echo IDs.
- Acknowledge matching receipts for inactive threads before their notifications
can be discarded, including threads stored in the agents overview.
## Testing
Added coverage for identical steer receipts and for switching within and
between tasks before interrupting an active turn.
GitOrigin-RevId: 28bd80a735ff86cd7bf836f24b448e7499f0a902
## What changed
- Add `originator` to plugin measurement inputs and emitted analytics events.
- Populate it from the turn originator when recording plugin measurements.
- Extend analytics tests to verify the originator is preserved in event payloads.
GitOrigin-RevId: 9998f829760222fc690dc8a10324794b5da27220
## What changed
- Replace the command center's single-line new-task input with the shared chat composer, including multiline editing, paste handling, Vim mode, configured keybindings, cursor behavior, and input validation.
- Keep task drafts and editor state across dashboard refreshes and reconnects while separating composer focus from list, search, and rename actions.
- Preserve whitespace in dispatched task prompts, block submission while offline, and restore unsent prompts after dispatch failures when the composer is still available.
## Testing
- Add coverage for focus routing, draft retention, multiline pastes, custom keybindings, Vim mode, offline editing, failed-dispatch recovery, and responsive rendering.
GitOrigin-RevId: a609ae95d497cbae0ebcac4cdcc50fe49d74832a
## What changed
- Load the `/experimental` catalog from the running server for the active thread, with loading, empty, and failure states in the popup.
- Show beta features in server order and preserve server-reported names, descriptions, and configured values. Mark features as read-only when the local config writer cannot safely update them.
- Persist only changed, writable feature flags. Bound discovery with page-size and page-count limits, repeated-cursor detection, deduplication, cancellation, and a timeout.
## Testing
- Cover paginated discovery, malformed or unresponsive servers, popup cancellation, read-only controls, selective writes, and the new popup states.
GitOrigin-RevId: 1f49eb961c8ab220a466e15f032c1dc61ed86d38
## Why
Computer-use-only Guardian scoring should follow the active model's REPL
auto-review requirement, including when the model changes within a live thread.
## What changed
- Run computer-use scoring and fast approval decisions only when the active
model sets `node_repl_auto_review_required`.
- Invalidate prior or in-flight scores when a model switch skips scoring, so
switching back to a reviewed model cannot revive a stale decision.
## Testing
- Cover model switches for both `node_repl` and `cua_repl` MCP servers.
- Verify skipped scoring and stale-score rejection across requirement changes.
GitOrigin-RevId: 46aec4d017bea8f135b435bcd769b87369b8ce95
## What changed
- Add a configurable `agents.resume` action, bound to `Ctrl+O` by default, that opens the session resume picker from the agent command center.
- Preserve command-center state when the picker is cancelled, and preserve per-thread composer and queued-input state when switching sessions.
- Keep resume failures within the command-center flow and wrap footer shortcuts on narrow terminals.
## Testing
- Add coverage for picker cancellation, active-session selection, resume failures, per-thread input restoration, custom keybindings, and narrow footer layout.
GitOrigin-RevId: 59159f838a0c642200cd164e3af45b0971d29bf8
## What changed
- Add `application.network` managed requirements with exact-domain allow/deny
rules, default-enabled behavior, domain normalization, and normal managed TOML
precedence.
- Return the policy separately from agent network requirements through the
experimental `configRequirements/read` API. The endpoint reports the policy
but does not enforce it.
- Export the new protocol types and schemas, and document the TOML format.
## Testing
- Cover parsing, validation, normalization, layered precedence, and cloud
requirement composition.
- Verify app-server responses, defaults, separation from agent policy, and
rejection of invalid domains.
GitOrigin-RevId: 563eeed296d9748430b819797204a44a8db92f3b
## What changed
- Honor `McpOAuthRefreshMode::Coordinated` for streamable HTTP MCP connections by letting RMCP refresh and persist credentials through the pinned credential store.
- Reread credentials while holding the refresh lock, persist refreshed tokens before retrying requests, and serialize login and logout writes with in-flight refreshes.
- Keep OAuth preparation outside MCP operation and handshake deadlines, and allow refresh persistence to finish if the initiating caller is cancelled.
## Testing
- Cover coordinated startup refresh, concurrent refreshes, `401` retries, credential mutation races, provider timeouts, and caller cancellation.
GitOrigin-RevId: 100ae788048087be23e26bb43f868b1fcebb007a
## Why
Misalignment policy failures pause the current chat. When the server provides findings and a continuation request, users should be able to inspect them and explicitly decide whether to proceed.
## What changed
- Add a `Review findings` flow that shows the detailed explanation and quoted continuation request in an overlay.
- Require explicit acknowledgement before starting a continuation turn, while preserving the active approval and sandbox settings.
- Keep ordinary input blocked and reject stale, replaced, invalid, or duplicate continuation attempts.
- Label the overlay shortcut as `q close` to match its behavior.
## Testing
- Add TUI tests covering findings review, explicit confirmation, successful and failed continuation, stale findings, duplicate events, and invalid continuation data.
GitOrigin-RevId: 36a738adf272f95db92eaee5712fb00061d0fa52
## What changed
- Keep `!`, `/`, and `?` prefixes literal in plain-text composers instead of activating command modes or shortcuts.
- Preserve buffered characters when changing Vim mode, cancelling a draft, or pressing Enter during a paste burst.
- Show over-limit errors in embedded composer footers, retain the rejected draft, and schedule redraws when the message expires.
- Clear stale validation errors when replacing a draft or switching form fields.
## Testing
- Add coverage for literal prefixes, buffered typing, single-character paste lines, retained over-limit drafts, and clearing validation errors between fields.
GitOrigin-RevId: ed9d5b2c087abdfefd92d93033ea1c20211d56d7
## Why
Selected plugin MCP servers may be skipped after the optional startup grace
period. When a user explicitly mentions a plugin or MCP server, the turn should
continue waiting so the requested tools are available to the model.
## What changed
- Track explicitly mentioned plugin IDs and MCP servers across later samples,
steered input, and same-turn restarts.
- Require matching selected-plugin MCP servers to finish startup before
capturing the tool catalog, while leaving unmentioned servers optional.
- Match `plugin://` identities independently of display names and ignore
targeting query parameters such as `app` and `browserFamily`.
## Testing
Added coverage for linked and structured plugin mentions, direct and batched
capability discovery, delayed environment attachment, steering, and same-turn
restarts.
GitOrigin-RevId: c509ef8df45df1a7edb0da6afdb2682dc53a4de8
