## Why
Completion timestamps always used a 12-hour clock, even when the host preferred 24-hour time.
## What changed
- Detect the clock preference from native settings on macOS and Windows, and from `LC_ALL`, `LC_TIME`, then `LANG` on Linux with glibc.
- Render completion times in the detected format, such as `14:32` instead of `2:32 PM`, for both live turns and restored history.
- Cache detection without changing the process locale, and retain 12-hour output when the preference cannot be determined. Recognize standard `C` and `POSIX` locales as 24-hour on Linux and Android.
## Testing
Add tests for locale precedence, unavailable locales, and clock pattern parsing, plus snapshot coverage for 24-hour timestamps with dates and line wrapping. Update completion timestamp normalization to handle both clock formats.
GitOrigin-RevId: eb338e67de627cbb992de16058884ece2b4b9ff7
## Why
Managed permission profiles take precedence over the legacy sandbox override, so a managed `:workspace` default can prevent temporary structured threads from starting with the required read-only permissions.
## What changed
Set `default_permissions` to `:read-only` when starting a temporary structured thread without a custom permission profile. Preserve existing custom profile handling.
## Testing
Add coverage for a managed `:workspace` default, verifying read-only permissions when allowed and rejection when read-only is disallowed. Extend recap request assertions to check the read-only sandbox and permission configuration.
GitOrigin-RevId: 865a0f67d81a6729622cb1889c50f17c0ef7f531
## Why
The command center's shortcut footer consumes several rows in narrow terminals, leaving less space for tasks. The overview also ignores attempts to dismiss it with `Esc`.
## What changed
- Keep primary actions in a single-line footer and show task and navigation shortcuts in a `?` help view.
- Respect configured bindings, suppress conflicting hints, and ignore key repeats when toggling help.
- Let the configured cancel key close help or cancel search and rename before dismissing the overview.
- Track overview dismissal while disconnected and clear stale connection notices after reconnecting.
- Use picker defaults for task action and error dialogs, and the theme accent color for agent status titles.
## Testing
Add coverage for help rendering, cancel navigation, custom shortcut conflicts, and overview dismissal during reconnection. Update snapshots for the compact footer and narrow layouts.
GitOrigin-RevId: 457b1e667dd87be2e8216936c5402eb6ab70fde1
## What changed
- Replace status totals with counted tabs for All, Needs you, Working, Ready, and Inactive tasks.
- Cycle filters with `Tab` and `Shift+Tab`, respecting configured task and list bindings. Combine status filtering with search and retain the active filter across refreshes.
- Keep a task visible while renaming it if its status leaves the active filter. Preserve the rename target and draft on failure, and reconcile selection when editing ends.
## Testing
Add coverage for filter navigation, narrow tab rendering, configured shortcut precedence, and rename cancellation, submission, and failure recovery after a status change.
GitOrigin-RevId: 935a8eadbd3fa970a573614ba653c13ff6541167
## What changed
- Show the active grouping in the header and place the search hint or active search/rename field above the task list.
- Move connection, worktree creation, refresh error, and server version notices to the footer, preserving the title and task counts. Give active key chord hints priority over notices.
- Clip long search and rename input at grapheme boundaries and position the cursor using the visible suffix.
- Show `Loading tasks…` while the initial task refresh is pending.
- Use standard picker defaults for the agent sign-in selection.
## Testing
Add regression coverage for long Unicode search and rename input, including combining characters, joined emoji, and cursor placement. Update layout snapshots and assertions for footer notices, key chord priority, and search editing during reconnection.
GitOrigin-RevId: 57da83c4c0beaa89fe88d3be03b468a9f2a739c6
## What changed
- Align task titles, status, and relative update times in columns, hiding metadata at narrow widths. Highlight the full selected row and show explicit empty states.
- Share grouped row layout between rendering and paging so `PageUp` and `PageDown` move by the visible viewport, account for group headings, and stop at either end. Support paging while searching.
- Show filtered group counts, shorten long project paths, and indicate additional rows above or below the viewport.
- Display system errors as `Error` and unloaded tasks as `Inactive` instead of `Finished`.
## Testing
Add a column-layout snapshot and paging regression coverage for short lists, multiple project groups, filtered tasks during reconnection, and boundary clamping. Update existing command center snapshots for the new layout and labels.
GitOrigin-RevId: b2bfaf26a48f7a02a48be6e1499357a79c09cede
## Why
Voice meters and partial user transcripts continued updating with `tui.animations = false`.
## What changed
- Hide microphone and speaker meter histories when animations are disabled, and size the composer to fit the remaining voice controls.
- Keep partial user transcripts out of the conversation until finalized while preserving transcript tracking and final history entries.
- Skip footer updates caused solely by audio meter changes when animations are disabled, while retaining speaker activity transitions.
## Testing
Update transcript, replay, and rendering tests to cover hidden partial transcripts and finalized history. Adjust voice composer snapshots and clipped-layout coverage for the reduced height.
GitOrigin-RevId: fb1939d6d8b3edc60fdd0a33ba7798d37bd9337c
## What changed
Replace `tui.whimsy` with `[tui.effects]` preferences for `starfield`, `shimmer`, `welcome`, `effort`, `progress`, and `title`. Each defaults to `true` and remains subordinate to the `tui.animations` master switch.
Wire the preferences into composer effects, welcome artwork, status and loading text, progress indicators, and terminal-title animations. For example, disable shimmering text while keeping progress animations:
```toml
[tui.effects]
shimmer = false
```
Keep retired `tui.whimsy` entries loadable but ignore their value. Update the configuration schema to expose the new preferences.
## Testing
Add and extend coverage for independent shimmer and progress effects, master-switch precedence, welcome and starfield controls, terminal-title blinking, and strict configuration loading with the retired setting.
GitOrigin-RevId: 28b37ba52872133b8954543cabe9ff424147f1c5
## What changed
- Render a rotating Codex logo in unused space above the composer on fresh conversations, without moving content or the cursor.
- Fade and pause the logo while drafting or unfocused, hide it on alternate views, and dismiss it after submission or conversation activity. Respect disabled animations and stop after three rotations with a fade out.
- Replace the onboarding ASCII frame variants with the shared logo renderer, retaining a faded logo after the animation ends and allowing the existing shortcut to replay it.
## Testing
Add rendering and integration tests for logo placement, visibility, pause/resume timing, completion, and preservation of the draft, cursor, header, and footer. Add snapshots for fresh conversations and the onboarding welcome layout.
GitOrigin-RevId: b98c7dd10acea3ef25d6c1495ed22c24202d6280
## Why
Keep diagnostics accessible without adding warning rows to the live conversation or changing the composer layout.
## What changed
- Show a deduplicated warning count in the passive footer, yielding to interactive hints.
- Open warning details with `F2`, `/warnings`, or a click on the warning notice. Support navigation, scrolling, and copying individual diagnostics while preserving the draft.
- Retain startup, runtime, MCP, and deprecation diagnostics in the full transcript. Group MCP details by server and preserve warnings during replay.
- Respect existing custom bindings and chord prefixes when enabling `F2`.
- Show an immediate explanation when `/pets` is unavailable.
## Testing
Add regression tests and snapshots for warning counts, draft preservation, viewer navigation and copying, narrow layouts, terminal scrollback, and keybinding conflicts.
GitOrigin-RevId: 2bc586430da60347cfbaa5bf128bc48f7f9dc777
## Why
The startup composer accepted edits but ignored submission. Its first frame also preceded configured screen settings, and startup failures could leave typed text unavailable.
## What changed
- Honor configured submit bindings during startup, retaining one confirmation until the session and protected input screens are ready. Repeated submit keys do not duplicate the message; edits, `Esc`, disconnects, or destination changes cancel confirmation while preserving the draft.
- Apply local screen, status-line, keymap, and paste settings before the first editable frame. Anchor the composer at the bottom in owned-screen mode and retain the loading frame until resumed history is ready to render.
- Keep an in-memory recovery copy through submission acknowledgment. On startup failure, restore the terminal before printing unsent text, expanding paste placeholders and escaping terminal control characters.
## Testing
Add regression coverage for deferred single submission, configured key chords, cancellation, protected input, paste handling, draft recovery, initial screen settings, and loading-frame handoff, plus a startup layout snapshot.
GitOrigin-RevId: 1eb4c63027f7d59af5d42d8545cd5cb5c3594306
## Why
Composer suggestions and transient hints should preserve the draft and transcript context. Submitting a local command while reading older history should reveal its output.
## What changed
- Separate persistent status from transient footer hints in the owned transcript, sharing layout calculations for rendering, measurement, and cursor placement.
- Overlay command and mention suggestions on history without moving the composer; hide retained suggestions while transcript interactions own input.
- Show responsive, grouped shortcut help above the composer and let `Esc` dismiss it before interrupting a task or navigating history.
- Resume transcript following for submissions, slash commands, and last-response copy results while preserving the reading position during background updates.
- Reset transcript interaction state after prompt reverts and refresh retained usage information without rewriting terminal history.
## Testing
Add regression tests and snapshots for popup placement, clipped layouts, footer focus, shortcut dismissal, local-command scrolling, prompt reverts, and pagination while browsing prompts.
GitOrigin-RevId: 890147313d53f050503165a57610c381ffb93ef5
## What changed
- Make double `Esc` enter compact prompt browsing in the owned transcript view and inline overlay. Use left/right arrows to select prompts, up/down arrows to scroll, `Ctrl+T` to toggle details, and `Enter` to rewind and edit. `Esc` cancels browsing and restores the original reading position and presentation.
- Add a responsive browsing footer, a pinned prompt header for answer context, and contextual composer tips that respect `show_tooltips` and configured shortcuts.
- Load older history as prompt navigation needs it, preserve the selected prompt across pagination, and resolve rewind requests by cell identity. Reject remote prompt restoration when it contains local image paths or command syntax.
- Bound initial owned-transcript history loading to a budget of three screenfuls plus an item scan limit, independently of terminal scrollback settings.
## Testing
Add regression tests and snapshots for browsing, rewind, cancellation after resize and pagination, custom key bindings, search and selection precedence, offline input, prompt headers, composer tips, and history hydration.
GitOrigin-RevId: 1d9ef7b627f47c3def43e7aee7148b5909f6d357
## What changed
- Add incremental, case-insensitive literal search across transcript details, loading older history as needed. Use `F3` to start Find, or `/` in the transcript pager, and navigate matches in either direction. Closing Find restores the previous presentation and reading position.
- Add clickable activity detail controls and `F4` keyboard focus for inspecting individual activity groups in the owned transcript. Preserve expansion state as live activity becomes history.
- Expose configurable `global.find_transcript`, `global.focus_activity`, and `pager.find` bindings under `tui.keymap`. Let new defaults yield to existing custom bindings and show available completions for pending chords.
## Testing
Add regression coverage for Unicode matching, bounded scanning, paginated and changing history, selection during search, composer input isolation, activity controls, and custom shortcut conflicts.
GitOrigin-RevId: 5bcbcdfbca7c5c296c635ec9b079ccd7a908e336
## What changed
- Render transcript history and live output above the composer when `features.transcript_v2` is enabled and alternate-screen rendering is available. Handle scrolling, selection, copying, links, and older-history pagination in the main view.
- Add a clickable return-to-latest control with new-activity hints and temporary clipboard status. Let plain Enter return to latest when the composer is empty.
- Reflow retained transcript content during drawing and preserve the launch-selected screen mode across configuration reloads and session transitions, including `--no-alt-screen` restrictions.
- Enter the alternate screen with its first synchronized frame, and box CLI startup futures to reduce stack usage during session transitions.
## Testing
Add regression coverage for transcript layout, input routing, follow controls, clipboard status, and screen-mode persistence. Add a PTY test for the first alternate-screen frame and clean exit, and extend session-transition coverage through the CLI dispatcher.
GitOrigin-RevId: 1daf077826c7744b0f57399d10d159923dc87a97
## What changed
- Add mouse selection, word and line selection, drag autoscrolling, and keyboard selection with `Ctrl+Space`. Support copying selected text and opening links with a modified click.
- Anchor reading positions and selections to source text so resizing, streaming completion, and history pagination preserve the displayed content. Preserve hard line breaks, indentation, tabs, and graphemes when copying, while excluding display gutters and soft wraps.
- Rejoin activity groups split across history pages while retaining the reader's displayed revision.
- Distinguish confirmed clipboard writes from unconfirmed terminal requests, and retain native clipboard ownership after the transcript overlay closes.
- Manage mouse capture and keyboard modes across overlay transitions, editor handoffs, and suspend/resume.
## Testing
Add regression tests for selection during live updates and pagination, source-text copying across resize, clipboard confirmation and lifetime, and terminal mode restoration.
GitOrigin-RevId: 6b2438f576567cbba755b2405915a25acf009b8d
## Why
The TUI ignored dynamic tool items, and replayed tool activity could differ from live output. Concurrent tool completion also needs to preserve transcript order when writing to terminal scrollback.
## What changed
- Retain dynamic tool rows, update them when calls finish out of order, and mark unfinished calls interrupted when a turn ends.
- Queue terminal output behind unfinished dynamic tools and drain settled rows in bounded batches. Preserve queued output through stream consolidation, resize, and rollback without emitting it twice.
- Align replayed file changes, MCP results, and exploration groups with live rendering. Keep hidden reasoning and terminal interaction details within compatible activity groups, and preserve finalized plan fragments.
- Ignore stale history-page responses, bound turn metadata requests to missing turns, and insert older history after session headers. Keep hidden review prompts as activity-group boundaries.
## Testing
Add regression tests and snapshots for out-of-order tool completion, interruption, ordered scrollback emission, rollback, deferred usage updates, replay consistency, overlapping history, and repeated hidden prompts.
GitOrigin-RevId: a3636cfcf4c9c43a0a5bc52a842b80a7834f1409
## Why
Pressing `Home` while older transcript history is loading leaves a pending jump to the beginning. Subsequent navigation should supersede that jump so arriving history does not override the user's new reading position.
## What changed
Cancel the pending jump when scrolling, jumping to the latest entry, or navigating prompts in the read-only transcript viewer. Keep the in-flight history page by switching from `LoadingBeginning` to `LoadingOlder`. Handle navigation before the first draw as well as after rendering, while preserving pending jumps during passive highlight restoration.
## Testing
Add regression coverage for navigation after `Home` before and after the first draw, checking that arriving older history preserves the expected viewport. Extend prompt backtracking tests to verify that navigation clears the pending jump.
GitOrigin-RevId: 438c3289afee2719655b11dbc43a3ccb006a5fa3
## Why
Transcript-wide row offsets depend on content that can change during pagination, streaming, and resizing. Computing an exact scroll percentage also requires laying out offscreen history.
## What changed
- Replace the transcript overlay's generic pager with `TranscriptView`, tracking entry identity and a display-row offset through history updates and stream consolidation. Clamp offsets within the entry on resize or replacement.
- Render through bounded layout caches and show `100%` only when following the latest output with no unloaded history.
- Keep the reading position while `Home` loads older pages, then jump to the beginning when loading completes.
- Refresh animations whenever live output is visible, including while scrolled up.
- Reveal selected prompts when backtracking and highlight their text without reversing gutters or padding.
## Testing
Add regression coverage for reading anchors across pagination and live-output completion, resize and consolidation, prompt visibility and highlighting, navigation before the first draw, and avoiding offscreen formatting for the percentage indicator.
GitOrigin-RevId: 105cb66f93c742ee537152419060a87f55896b44
## Why
The transcript overlay separately generated cell content for height measurement and rendering. Active cells backed by external state could also leave the live tail stale when their revision key did not change.
## What changed
- Share retained text layouts between measurement and painting, and render only visible rows while preserving wrapping, styles, and hyperlinks.
- Reuse stable layouts across frames, invalidating them when width, animation, syntax theme, or terminal colors change. Bound retention by entry count and text size, allowing a single oversized entry.
- Refresh externally mutable cells each frame and bypass live-tail reuse when any active source is not cacheable.
## Testing
Add coverage for layout reuse, eviction, invalidation, and live-tail refresh without a revision change. Expand the transcript snapshot to cover styled text, wide glyphs, wrapping, and hyperlinks.
GitOrigin-RevId: 7dfb737e762f7f056a38774d956f618090809a62
## What changed
Move `TranscriptOverlay` from `pager_overlay.rs` into
`pager_overlay/transcript.rs`, preserving its implementation and re-exporting
it from `pager_overlay`.
Move transcript tests into `pager_overlay/transcript_tests.rs`, attach the
highlight tests to the new module, and update snapshot names and source paths.
GitOrigin-RevId: ff8e78e7a5d7cca86fdd0ab10b41156b04350a82
## What changed
Extract shared proxy setup into `credential_snapshot_proxy()` and split POSIX startup protection and inherited credential alias checks into separate tests, each with its own temporary directory and proxy. Preserve the existing assertions.
GitOrigin-RevId: 1799526c7c649c9bacd30a8cc4fa7038e70f192d
## Why
The external queue lifecycle test waits through watcher and retry intervals,
including explicit 11-second sleeps.
## What changed
Run the test on Tokio's current-thread runtime and use `advance_queue_poll()`
to pause time, advance it by 11 seconds, and resume it at polling boundaries.
This skips interval waits while keeping the clock advancing during real I/O.
GitOrigin-RevId: 0d1c3f53cc8b79559d6a20b5c9e70b58216e4b4d
## Why
Orphaned output mappings and pending calls from finished cells can exhaust recorder capacity, preventing fresh code mode calls from attaching complete executed tool call metadata.
## What changed
Reclaim output mappings without remaining cells when the mapping limit is reached. Under cell or pending-call pressure, evict finished cells without output mappings, invalidate their retained completion markers, and release their pending-call count. Preserve the cell being registered and keep late records until capacity pressure requires cleanup.
## Testing
Add regression coverage for preserving existing cells and late partial records under mapping pressure, and an integration test verifying that a fresh code mode call carries its executed calls, cell ID, and completion marker after orphaned mappings fill the recorder.
GitOrigin-RevId: 8894d1283a962088fbf8cad60078cc0cd07aaf17
## Why
Persisted transcripts rendered tool calls individually and displayed reasoning differently from live replay. Enabling raw reasoning also replaced the summary instead of retaining it.
## What changed
- Group computer activity and compatible exploration commands across intervening reasoning, retaining details for the expanded transcript. Respect visible content, command failure boundaries, and turn boundaries.
- Separate paginated history at every turn boundary before filtering hidden items, while adding completion metadata only for successful turns.
- Keep persisted reasoning out of the compact display, preserve hyperlinks in detailed rendering, and append enabled raw reasoning to the summary. Preserve standalone reasoning Markdown in transcript exports.
- Add helpers to rejoin activity groups and attach reasoning across page boundaries using persisted item identities and turn adjacency.
## Testing
Add regression coverage for reasoning replay parity, computer groups split across history pages, turn boundaries, and grouped terminal input. Update export and raw-reasoning tests to verify retained summaries and Markdown.
GitOrigin-RevId: a716db571440f891cc2c6894ae93fbe0e149aed4
## Why
Loaded transcripts reduce several tool calls and file changes to basic status summaries, losing details available in live history cells.
## What changed
- Reuse rich history cells for completed commands, MCP calls, patches, agent activity, image generation, and notices.
- Add dynamic tool cells with bounded output previews while retaining arguments and full output in detailed and raw views.
- Preserve last-known statuses for incomplete calls, unavailable results, and declined or failed operations. Keep legacy command text and terminal interaction output when rich reconstruction is unavailable.
- Remove redundant move annotations from patch diffs and retain patch activity IDs.
- Filter untrusted control characters before emitting terminal scrollback, while preserving semantic hyperlinks.
## Testing
Add unit and snapshot coverage for compact and detailed tool rendering, status fallbacks, retained output, patch restoration, and control-character filtering with and without hyperlinks.
GitOrigin-RevId: 73d754262768cf6d91f3ea4040116bf93cf87784
## What changed
- Add compact renderers for commands, MCP calls, computer activity, patches, and plans, with bounded previews and retained transcript details.
- Preserve logical source text, styles, and hyperlink metadata across wrapping so transcript copying can exclude display gutters while retaining meaningful labels. Wrap diff text at grapheme boundaries.
- Add activity identities, ordered detail retention, and deduplicated warning metadata to history cells.
- Hide background terminal interaction notices from chat while retaining them in the transcript, and keep local image-only user messages visible without duplicating image placeholders.
## Testing
Add regression and snapshot coverage for compact previews, retained patch diagnostics, wrapped source text and hyperlinks, question-and-answer labels, and local image placeholders.
GitOrigin-RevId: fd82fadd8ed3418eaba2bc74c4327d9c63d7e997
## Why
Display wrapping removes whitespace and adds gutters, so rendered rows alone cannot reliably describe the original logical text. Streaming previews also need to detect source changes that leave visible rows unchanged.
## What changed
- Retain shared logical text, styles, exact byte ranges, and display margins alongside wrapped rows; remap hyperlinks using those ranges.
- Preserve source metadata through prompt, Markdown, and prefixed history rendering, including spoken artifact annotations. Clear it when split-flap animation replaces the text.
- Include source metadata when comparing streaming previews and agent or plan tails.
- Keep compound graphemes intact, preserve explicit span styles, and reuse first-fit wrapping results when safe.
- Use the lighter history prompt background for submitted messages.
## Testing
Add regression coverage for source ranges and styles across widths and gutters, distinct repeated lines, source-only streaming updates, compound graphemes, and equivalence between reused and generic wrapping results. Extend Markdown, spoken artifact, and animation tests to check retained source metadata.
GitOrigin-RevId: 9e60746642fc9a8f91c1abfe7c77eefc1fe421ab
## What changed
- Remove the legacy selection-list appearance and use shared full-width selection, filled tabs, wrapped hints, and separate overflow rows throughout.
- Give resume and fork pickers separate toolbar and search rows. Collapse spacing on short screens, keep the focused toolbar control visible on narrow screens, and prioritize labeled primary actions in the footer.
- Apply shared selection styling and contrast-aware text colors to session rows and metadata. Clear inherited selection colors and reversal from the transcript loading overlay.
- Preserve clipped-header notices alongside results in small approval dialogs.
## Testing
Add rendering assertions and snapshots for session selection contrast, reversed selection, loading overlay styles, compact metadata and action labels, and keyboard-focused toolbar visibility. Extend approval clipping snapshots to shorter terminal heights.
GitOrigin-RevId: 6e34b14f5528baf33e97ff6cf746107a1bbe69ab
## Why
Prompt layouts use inconsistent selection styles, and long content can crowd out choices and keyboard hints in small terminals.
## What changed
- Apply shared picker surfaces, selection highlights, accent colors, and shortcut styling across approval, question, startup, and session prompts.
- Reuse numbered picker rows with wrapping and selected-item visibility. Bound folder paths to preserve trust disclosures and choices, prioritizing the repository root when space is limited.
- Give multiline prompts a shared layout for rendering and cursor placement, with Escape hints that reflect Vim mode.
- Present local providers as vertical choices with inline status, adding arrow-key and `j`/`k` navigation plus `1`/`2` selection shortcuts.
## Testing
Add snapshots and regression tests for narrow and short viewports, long trust paths, multiline cursor placement after resizing, selection styling, provider shortcuts, and confirmation behavior.
GitOrigin-RevId: 89bb133dfa0d085d568a3a84473afd9e2fb20838
## Why
Narrow completion popups can hide distinguishing filenames, parent paths, or category tags. Unified mentions also need a stable result viewport across searches and filters.
## What changed
- Use shared selection styling and `›` markers across command, file, skill, and unified mention popups.
- Give unified mentions a fixed-height picker layout with a header, filter tabs, query display, scroll indicators, and keyboard hints.
- Bound mention name columns to leave room for parent paths and measure alignment in terminal cells.
- Truncate file paths while retaining filenames and recalculating visible fuzzy highlights, preserving the full path for insertion.
- Keep category tags visible when skill and app descriptions are hidden.
## Testing
Add snapshots and assertions for narrow and clipped layouts, scrolling, empty filters, full-row selection styling, Unicode column alignment, long paths, preserved file selections, and category tags.
GitOrigin-RevId: 54c34cc2472b43bac22011206efed3041eb77308
## What changed
- Apply shared picker styling to apps, plugins, settings, skills, hooks, and multi-select views, with full-width selection highlights and compact key hints.
- Share row measurement and layout helpers, show scroll indicators, and let optional spacing yield on short screens to keep selected rows visible.
- Wrap headers and footers, simplify search fields, and use a compact hooks event table at narrow widths.
- Reserve plugin result rows while filtering and cap the plugin name column width.
## Testing
Add regression coverage for selected rows in short multi-select views, compact hooks navigation, and checkbox, preview, and overflow rendering. Extend experimental-feature and memory-reset wrapping snapshots to narrower widths and update affected popup snapshots.
GitOrigin-RevId: 0eedbbff307c84cc858629e578091bbbd59b2423
## Why
Menu layouts and hints vary across TUI flows, and mismatched measurement and rendering widths can clip subsequent choices when descriptions wrap.
## What changed
- Apply shared picker styling across selection menus, with stable columns, descriptions hidden when space is tight, and compact hints derived from configured key bindings.
- Measure rows at their actual rendering width, including caller insets, so wrapped options receive enough space.
- Wrap model menu headers and shortcut capture content, and use the shared panel surface for shortcut capture.
- Indicate clipped headers in non-searchable menus and show the configured `view all` shortcut only when the view supplies one.
## Testing
Add regression tests and snapshots for wrapping boundaries, narrow picker layouts, configured selection and cancellation keys, and clipped approval headers. Verify that copy/export actions retain complete payloads and composer drafts.
GitOrigin-RevId: 8416bcd3c66b6cd15db3f9c1804f5f005b7964c1
## Why
Theme colors and dimmed text can lose contrast against terminal and shaded backgrounds. Pickers also need to keep controls and the selected result visible when space is limited.
## What changed
- Add shared blue accents and contrast-aware foregrounds that account for painted backgrounds and terminal color depth, with terminal-default fallbacks for limited palettes.
- Apply readable colors to footer text, status lines, prompt attachment labels, and diff content. Remove dimming from syntax-highlighted diff text so it does not undo contrast correction.
- Use compact shortcut labels such as `ctrl+c`, emphasize complete key combinations, and separate composer footer actions with ` · `.
- Add an opt-in picker presentation with full-width selection, filled tabs, separate overflow indicators, and navigation based on visible rows. Enable it for `/keymap`, reserving result space to keep controls stable across filtering and tab changes.
## Testing
Add regression tests and snapshots for contrast after palette conversion, shaded diff backgrounds, shortcut typography, picker resizing and pagination, Unicode tab truncation, and stable `/keymap` geometry.
GitOrigin-RevId: f3c71879d3bcc4e3b29d70e63cf377dea5914916
## Why
Server version notices previously required both versions to be stable releases, leaving prerelease and local clients without notices about differing background services.
## What changed
- Use semantic version parsing to distinguish older servers from version mismatches.
- Compare stable clients against older releases, including prereleases. Compare prerelease clients by precedence within the same release line and report other release lines as different.
- Report differing versions for local clients (`0.0.0` or versions with build metadata). Ignore malformed versions.
- Show the corresponding `older than` or `different from` notice and `<` or `≠` overview indicator, while preserving `/daemon` guidance and the `show_server_version_notice` setting.
## Testing
Add version-policy tests and notice snapshots covering prerelease ordering, local builds, mismatches, and malformed versions. Add daemon tests for notice suppression and manual update guidance without scheduling an update.
GitOrigin-RevId: 29df4713a7dbcbddcf30d56995a8496e7e8d0c6a
## Why
Filesystem helpers use a `pre_exec` callback to close inherited descriptors on macOS, forcing a fork before execution. Native spawning needs to preserve that isolation and support the socket used for file descriptor transfer.
## What changed
- Launch filesystem helpers through `codex_utils_pty::Command`, using `posix_spawn` with `POSIX_SPAWN_CLOEXEC_DEFAULT` on macOS and returning native launch errors without a fork fallback.
- Extend the shared command wrapper with explicit descriptor and fallback policies, socket-backed stdin, and custom `argv[0]` support.
- Add `Child::wait_with_output` to drain stdout and stderr concurrently, retain kill-on-drop behavior on cancellation, and keep output pipes open until the child exits.
## Testing
Add regression tests for fork-free sandboxed reads, writes, and file descriptor transfers; sandbox denial of outside paths and symlink escapes; descriptor isolation; bidirectional socket stdin; custom `argv[0]`; executable-format errors; and output-pipe lifetimes.
GitOrigin-RevId: d49c00787f30ec0bc196f9e066a0770fc8151152
## Why
The native macOS backend cannot inspect every setting or callback on a Tokio command. A shared, constrained launch API makes the supported settings explicit for both backends.
## What changed
- Replace `spawn_child` with `codex_utils_pty::Command`, enforcing an explicitly supplied environment, piped stdio, and kill-on-drop behavior.
- Add `ProcessMode::Inherit` and `ProcessMode::NewGroup`, honoring the selected mode in native macOS and Tokio spawning.
- Share the `Child` wrapper across platforms and migrate local MCP server launching to the new API, retaining its new process group and Windows suspended-spawn support.
## Testing
Adapt the existing macOS spawn compatibility and child lifecycle tests to the new API. Add a regression test that checks inherited and new process groups with both backends.
GitOrigin-RevId: 3e7a401659e3a8a94a13c4ff58d67bdcd2eea33d
## What changed
Expose the shared `Child` type and `spawn_child` function from `codex-utils-pty`, and update the MCP stdio transport to use them. Move the existing macOS spawning implementation and its tests into the utility crate, preserving platform-specific spawning, piped stdio, and kill-on-drop behavior.
GitOrigin-RevId: 26c2fb2f22cdba907aa9d18cab7dc8c4ac1c909e
## Why
Shared thread instructions can change after an action is generated but before Guardian reviews it. Polling the live provider during review can give the reviewer different instructions from those applied to the action.
## What changed
Initialize Guardian reviewers with the user and thread instructions captured in the review session reuse key, keeping the review tied to the applied snapshot.
## Testing
Add a regression test that updates and removes shared instructions between action generation and review in a running descendant thread. Verify that the worker picks up each change, Guardian uses the applied instructions, and instruction changes create new reviewer sessions even while ancestor threads remain idle.
GitOrigin-RevId: 4980762bc7b6646a1691a43be93c71a7dc611ec6
## What changed
Reduce the initial recent-session seed from 20 to 10, alongside loaded sessions. Use a shared `RECENT_SESSION_LIMIT` for pagination, collection, and final truncation.
## Testing
Update the overview test for the 10-session limit and add a snapshot of the recent-session list after restart.
GitOrigin-RevId: f315f4848e8d2091eb229cfdc3c02932aaf7ba8c
Pass `Platform::native()` to `build_config_state` in the standalone network
proxy to satisfy its required executor OS argument and validate socket paths
for the host platform.
GitOrigin-RevId: d3ce8c513a3a6c5ffea6522d8b830deb40f1dfc8
## Why
Subagents inherit applied instruction snapshots, so later provider updates do not reach running descendants. Hosts need an explicit way to share current thread instructions across an agent tree.
## What changed
- Add `ThreadInstructionsProvider::share_with_subagents()`, defaulting to `false`. Opted-in descendants refresh instructions at their next model-request boundary.
- Retain shared providers across root unloads and descendant reloads. Let a resumed root replace the provider for surviving descendants, or preserve their last shared instructions when it supplies a non-sharing provider.
- Keep providers scoped to their root tree and preserve snapshot-only instructions for root forks and isolated sessions, including Guardian reviews.
## Testing
Add coverage for child and grandchild instruction updates and clearing, provider replacement after root restart, lazy descendant reloads, default snapshot inheritance, and isolation between roots and Guardian sessions.
GitOrigin-RevId: 44c9fb7fe9ae1f96156bdf3c47ab6c4a81bd65e9
## Why
Package context propagation was limited to verified `codex-command-runner.exe` processes, preventing other packaged callers from passing their OS-assigned identity to sandboxed children.
## What changed
Use the current process's OS package identity to decide whether to preserve desktop app context in both regular and ConPTY sandbox launches. Remove executable-name and staged-runner verification from this decision.
Reject callers without package identity when `CODEX_WINDOWS_REGISTERED_CORE=1`; otherwise, unpackaged callers continue without preserving app context.
GitOrigin-RevId: 52eb2fe33c8746d898b5d7ebf53bd001a55b5506
## What changed
Send an `async-question` notification when new unanswered questions arrive, honoring existing notification settings and taking priority over turn completion. Show a shortened question title for a single question or a count for a batch. Empty batches, duplicate deliveries, and replayed history do not trigger notifications.
## Testing
Add tests covering live arrival, replay and duplicate suppression, notification settings, priority over turn completion, batch summaries, and long-title truncation.
GitOrigin-RevId: 205dc3ff5461c2166159af5143b0ca7279a87f42
## Why
Allow the network policy proxy to run without a full Codex permissions profile.
## What changed
- Add `codex-network-proxy --config <PATH>` to load a standalone JSON file containing a `network` object and run the proxy independently of Codex.
- Require `network.enabled = true`, limit configuration size to 1 MiB, and reject unknown fields, including nested MITM hook fields, and trailing JSON values.
- Enable HTTPS MITM automatically for limited mode or configured `mitm_hooks`, while supporting explicit `mitm` configuration.
- Document the standalone configuration and invocation.
## Testing
Add tests for MITM defaults, dynamic policy keys, unknown fields, and trailing JSON values. Add a regression test that verifies `wait()` promptly returns an error when either the HTTP or SOCKS listener fails.
GitOrigin-RevId: ba20b9c3022b16abaa5597f473c418cfc06c18ee
## What changed
- Support an optional cloud provider alongside executor plugins, refreshing its thread-scoped catalog at each regular turn when plugins are enabled.
- Use cloud connector metadata for app attribution without starting cloud-declared MCP servers.
- Scope cached catalogs to authentication and Apps availability. Retain the previous catalog on discovery failure within the same scope, clear stale catalogs on auth changes, and reject results completed under outdated credentials.
- Add a cancellable regular-task startup phase that reconciles MCP before discovery and reapplies contributor state afterward without invalidating resource caches.
## Testing
Add regression coverage for per-turn refresh, empty catalogs, discovery failures, plugin disabling, auth changes during discovery, MCP reconciliation and cancellation, and cloud app attribution alongside executor MCP tools.
GitOrigin-RevId: 8469eb109ea316e21cbc4122c52ad8000caeef03
## Why
Implicit temporary-directory grants can bypass filesystem restrictions and
protected project metadata. Moving an ancestor can also relocate protected
paths beyond their pathname exclusions.
## What changed
- Route process scratch access through the normal Seatbelt exclusion rules so
it respects unreadable paths, read-only paths, and protected project metadata.
- Protect the parents of both logical symlink paths and their resolved targets
against relocation.
- Apply privileged daemon socket protections after all grants, deny access to
the socket directory itself, and prevent ancestor removal or renaming while
allowing sibling writes.
GitOrigin-RevId: f4cbcf5867e204b0cded0812aac1851b3d444328
## What changed
Add an `auth_mode` tag to `codex.remote_models.fetch_update.duration_ms`: `api_key` when a provider API key is configured or API key authentication is active, `chatgpt` for other available authentication, and `none` when neither applies. Start the timer after retrieving authentication.
GitOrigin-RevId: 7aa8f3af4a9fe38fc903fa2c8698b537b692850a
## What changed
Set `turn_trigger` to `exec` for exec turns and `user` for TUI turns when sending `turn/start` requests.
## Testing
Extend exec resume and embedded TUI tests to check `x-codex-turn-metadata`, including thread IDs, the TUI turn ID, and the expected triggers. Update the active-turn steering test to verify that user steering preserves the original `goal` trigger.
GitOrigin-RevId: 56125f64b5c47e7c538663d748b3a5f404e68316
Eric Traut