## What changed
Add the hidden `codex git-credential` command to supply an existing file-backed ChatGPT login as an ephemeral Bearer credential through Git's `authtype` protocol.
Restrict credentials to HTTPS requests under `backend-api/codex/sites/git/` on `chatgpt.com` or `chatgpt-staging.com`, matching the configured origin. Check managed workspace policy and reject expired or changed logins before returning credentials. Ignore repository configuration when selecting authentication settings.
The helper does not refresh tokens or modify the saved login; `store` and `erase` are no-ops. Return `quit=true` when authentication is unavailable or fails so Git does not fall back to prompting.
## Testing
Add coverage for capability advertisement before login, reading only the first credential record, and declining personal access tokens without an authentication API lookup.
GitOrigin-RevId: 2f96af1eeb7d05e3d893367137103a7adbc02742
## Why
Converting message content to tool output previously reduced file-backed audio to a text file ID, losing its audio type.
## What changed
- Allow `input_audio` tool output items to carry either `audio_url` or `file_id`, preserving both forms during content conversion.
- Account for file-backed tool audio in history estimates and output truncation, and prepare only inline audio data.
- Reject uploaded audio in raw function and custom tool output injection, extending the existing requirement to submit uploaded audio through typed turn input.
- Regenerate app-server schemas and TypeScript/Python types while preserving the Python inline audio class name.
## Testing
Add coverage for tool audio wire-format round trips, repeated file audio sharing text and audio output budgets, and rejection of raw uploaded audio injection across messages and tool outputs. Extend Python SDK coverage for the inline tool audio shape.
GitOrigin-RevId: f4704466e6151662d2c8b8dc3f5ca2ab2f5710a2
## Why
Resuming an ID sequence from a persisted ID requires its allocation position before shuffling. Previously, IDs stored only their salt and shuffled value.
## What changed
- Store the allocation `ordinal` in `ModelFacingId`, expose `salt()` and `ordinal()`, and derive `JsonSchema`.
- Add `ModelFacingIdGenerator::starting_at()` and `next_ordinal()` so callers can resume with the original seed and salt at the next allocation position without a generator snapshot.
## Testing
Update serialization coverage for the allocation fields and add a test that resumes from a serialized ID across the three-digit pool boundary, matching the uninterrupted sequence.
GitOrigin-RevId: 6cbb725c0bd08356c0dc5458021b9bf58a489522
## Why
MCP config refreshes previously retained session app overrides, leaving connector approval changes unapplied in existing sessions.
## What changed
- Refresh explicit session `apps` overrides alongside `plugins`, allowing updated link approval settings to take effect on the next turn.
- Preserve overrides for omitted sections and restore inheritance when a section is an empty table.
- Validate app overrides and the effective app configuration, rejecting refreshes that expose invalid inherited settings.
## Testing
Add coverage for independent and combined app/plugin updates, clearing overrides, and rejecting invalid inherited app settings. Add an integration test verifying that changing a link's approval mode from `approve` to `prompt` requests approval before executing the next turn's tool call.
GitOrigin-RevId: 3fa36744a9ccd9e735e4cda7f061ccff1cf2a269
## Why
Background plugin cache refreshes fetched recommendations even when plugin recommendations were disabled.
## What changed
Pass the effective recommendation feature state into `PluginsConfigInput` and skip recommendation cache warming unless apps, plugins, and either `tool_suggest` or `recommended_plugins` are enabled. Installed-plugin cache refreshes continue independently.
Disable `tool_suggest` and `recommended_plugins` by default in core and app-server test helpers, with explicit overrides for recommendation tests.
## Testing
Update cache-warming and external-login recommendation tests to opt in explicitly. Update config RPC assertions to verify the test helpers' session flag overrides.
GitOrigin-RevId: dc04e2847c94e2b15842fcd95cc0cf1f104e1fac
## What changed
- Canonicalize home paths before sending sandbox provisioning and desktop registration requests.
- Resolve saved junction paths when restoring the sandbox owner, holding the setup lock and pinning target directories while validating existing sandbox accounts. Skip migration for retiring runtimes.
- Persist the resolved home and clear desktop home ownership so uninstall cannot delete a historical junction's target.
## Testing
Add a Windows junction test verifying that a saved alias resolves to its physical target and an already canonical path needs no migration.
GitOrigin-RevId: 9bac672273694e5a0353fec72a6bcba120e57255
## What changed
Move permission selection into `codex-config` with a shared `PermissionConfig` representation for legacy sandbox settings and named profiles. Resolve selectors using config layer precedence while preserving explicit session profile selection and sandbox mode overrides.
Share legacy permission translation between config derivation and core loading, preserving merged workspace roots, network access, temporary-directory exclusions, and platform sandbox availability without modifying source layers or field origins.
## Testing
Add coverage for mixed selector precedence, merged legacy settings, unchanged source metadata, and the Windows read-only fallback. Extend the managed preferences loader test to verify settings merged across layers and the absence of an active named profile for legacy permissions.
GitOrigin-RevId: a435be7af38424ac33711e6a7557f52b9b672577
## Why
An aborted turn could remain active, and a late abort for an unknown turn could interrupt a different turn with an explicit ID.
## What changed
Finalize the active turn after applying an abort. Only fall back to the active turn when the abort lacks a turn ID or the active turn has a generated ID.
## Testing
Extend regression coverage to verify that a late abort preserves a review turn's ID and completed status, and that repeating `turn/interrupt` returns `no active turn to interrupt`.
GitOrigin-RevId: 73072dda7879bd50b1013f4a0bbf1b68546f2619
## Why
MCP request metadata could forward a client-supplied `product_sku` to unrelated servers and connectors.
## What changed
Remove `product_sku` from turn metadata before forwarding it. For Node REPL-backed servers and the browser connector, populate it from the turn's `apps_mcp_product_sku` configuration, mapping unrecognized values to `other` and omitting empty or missing values.
## Testing
Add regression coverage for configured REPL and browser attribution, unrelated servers and connectors, unrecognized or absent configuration, and spoofed client metadata.
GitOrigin-RevId: bc24062526048ea1c1621099e609053cf167602f
## Why
Narrow composer footers can clip hints or crowd out mode indicators and actions.
## What changed
Use a shared layout for navigation, actions, mode indicators, context, and warnings. Shorten or drop whole labels in priority order instead of clipping them. Add a second row when input modes and queue or active side-conversation actions fit separately but not together, keeping navigation and modes above actions.
## Testing
Add coverage for fullscreen and scrollback layouts, narrow Plan mode hints, active side-conversation actions, oversized goal indicators, and warning hit areas.
GitOrigin-RevId: 849a53d45ef1b36b40c52282e329b48ec7d7d12e
## Why
Long built-in status lines were truncated to a single row even when the footer had room for more content.
## What changed
- Wrap status text to the available width and row budget, preserving styles and hyperlink targets across rows.
- Show an unlinked ellipsis when content exceeds the available space.
- Refresh wrapped content when the status text, agent label, or width changes.
- Keep reasoning-effort transitions on one row and restore wrapping after the final animation frame.
## Testing
Add coverage for wrapping and hyperlink boundaries across footer layouts, content and agent-label updates, resizing, and wrapping restoration after an effort transition. Update transcript and startup snapshots for multiline status text.
GitOrigin-RevId: 30e0795c473efd62fc4d0dca4deb6029b625a9e8
## Why
Status content and footer hints need to fit within the composer's height budget while preserving room for editing and active search controls.
## What changed
- Share row allocation between composer measurement and rendering. Cap status and hints at two rows in inline scrollback, and scale the fullscreen cap from two to four rows with the available budget.
- Reserve space for active footer controls, give suggestions and image previews priority over additional status rows, and avoid reserving an empty hints row when status is enabled.
- Keep textarea row counts and scroll offsets as `usize`, saturating only the terminal height so very tall drafts remain scrollable with a visible caret.
## Testing
Add layout and snapshot coverage for constrained height budgets, status and hints, image previews, slash suggestions, and transcript search cursors. Add a regression test for rendering a draft beyond the `u16` row limit.
GitOrigin-RevId: 20fb0384ffc976dfd12e648004763feff0597dda
## Why
Composer hints could replace configured status content, and mode indicators and warnings reduced the width available to status extensions.
## What changed
- Give enabled status content a dedicated area below the composer in both inline and fullscreen layouts, preserving it during transient hint states.
- Keep shortcuts, queue hints, mode indicators, and warnings in the hint row.
- Measure extension status content at the full available width, allowing up to four rows while yielding space to the composer when height is limited.
- Suppress composer hints behind centered dialogs.
## Testing
Update layout assertions and snapshots for status persistence, extension resizing and clipping, warning placement, and reasoning-effort transitions.
GitOrigin-RevId: f11c2e4fb53c35b69c2fbdbe80cef31bb28faca4
## Why
A live parent thread continues receiving lifecycle notifications while its side chat has focus, so returning to it does not need another liveness read.
## What changed
- Skip the parent liveness read when returning from a side chat while the parent is still attached and online. Keep the read when reattachment is needed.
- Stop scheduling a deferred screen clear when handling a transcript reset that preserves the screen.
## Testing
Add regression coverage for parent `thread/read` requests with and without reattachment, and assert that side-chat navigation leaves no deferred screen clear.
GitOrigin-RevId: a07f161ec86b0ae51250c5a0156402d328c42bdf
## Why
An accepted agent message may never appear in a later inference request or compaction snapshot. Rollout traces need to retain the delivery and its interaction edge even when the receiving agent makes no further request.
## What changed
Capture agent message payloads in `HistoryItemAccepted` events and create conversation items when those receipts are replayed. Reuse each item's ID when it later appears in a request or checkpoint, updating its body to the model-visible representation. Repeated receipts preserve that representation without duplicating the item.
## Testing
Extend the spawn-edge regression test to cover delivery before any child inference, stable item IDs across a later request, and preservation of trimmed content after a repeated receipt.
GitOrigin-RevId: c193d691e8240645800ce004c11f21e3f1c82915
## What changed
Expose history initialization and the effective history mode to thread-ready contributors. Add `EvidenceCursor::at_thread_ready` with paginated-history validation:
- Start new or cleared threads at position zero without requiring an existing rollout.
- Start resumed, forked, or supplied-history threads at the durable tail to avoid backfilling existing evidence.
- Skip the initial `SessionMeta` header when capturing evidence from position zero.
## Testing
Extend evidence tests to cover initialization before a rollout exists, capture of the first original record, rejection of resume without a rollout, and exclusion of existing records on resume.
GitOrigin-RevId: 32aa8e2afb71eb4e882b5f1fb107ac8616b33c8e
## Why
Submodule worktree scans can execute clean filters selected by task-writable Git configuration.
## What changed
Pass `--ignore-submodules=dirty` to `git status` in `get_has_changes_in_repo` to skip uncommitted submodule contents while retaining gitlink changes.
## Testing
Add a regression test that configures a submodule clean filter and verifies the repository change check does not execute it. The test also confirms that `git status` without the option executes the filter.
GitOrigin-RevId: 5330402f0354c3bf9613358575f8bedc9f312886
## Why
Code Mode needs a way to forward mixed MCP tool results while preserving their content types and order.
## What changed
Add `content(block)` and `content(iterable)` so callers can forward tool output with `content(result.content)`. Text, image, and audio blocks become their corresponding output items; resource links and embedded resources are serialized as text. Invalid blocks and encrypted text are rejected, and iterators are closed when a block is rejected.
Share MCP block conversion and image detail types with the protocol layer, while preserving existing `image()` and `audio()` input handling.
## Testing
Add coverage for mixed content ordering, iterator behavior and cleanup, invalid blocks, image metadata, short audio clips, and output suppression after exit. Add an integration scenario verifying that MCP text and image blocks reach the model in order.
GitOrigin-RevId: 83832ec6c530dd35ea1e3373680627997c6e13c1
## Why
Remote commands can use workspace paths from a different operating system. Preparing them on the client should preserve those paths and command arguments for the execution host.
## What changed
- Build exec-server requests directly, carrying the native command and sandbox context without applying the client's sandbox transform.
- Resolve workspace permissions and runtime read access in `SandboxManager` on the execution host, including helper binaries and validated managed-network CA bundles.
- Add explicit backend selection and required platform sandbox selection, rejecting launches when the required sandbox is unavailable.
## Testing
Extend request tests to cover foreign workspace paths, Unicode arguments, and empty arguments. Extend the remote process test on Unix to verify that restricted reads allow the sandbox helper and validated CA bundle while denying an untrusted certificate file.
GitOrigin-RevId: 5fc02ac4208912ecefb80a212742389afc14ac05
## Why
Gateway sign-in needs a way to complete authentication over SSH or when no local browser is available.
## What changed
- Prefer device authentication for gateways that support it in SSH sessions, headless Linux environments, or when no browser handler is available.
- Check the selected session's provider and complete required gateway sign-in before requesting models, including when resuming a thread.
- Display the verification URL, one-time code, and cancellation instructions. Handle sign-in results, cancellation, and connection failures while the prompt is open.
- Skip device login for older servers that do not support it while preserving errors from current servers.
## Testing
Add protocol tests for early sign-in completion, connection loss, provider selection, resumed threads, and legacy-server compatibility, plus snapshots of the device prompt and gateway sign-in loading text.
GitOrigin-RevId: 4f3675ab2fc7fccafbad17796c72a7736ebb86b5
## What changed
Add experimental `environments` fields to `turn/settings/update` and `thread/settings/update`. Turn updates apply to later steps of the running turn; thread updates apply to future turns. Omission or `null` preserves the selection, while `[]` clears it. Providing `cwd` in a thread update without an environment list selects the defaults for that directory.
Include the ordered environment selection in `thread/settings/updated`. Wait for Core to accept thread settings updates before returning success, and return rejections as request errors.
## Testing
Add integration coverage for attaching, replacing, preserving, and clearing environments; rejected updates; and the distinction between later steps and future turns.
GitOrigin-RevId: bfebeda57c676be94427aeb0c567c0b94fd9c387
## Why
Cloud conversations previously used the model returned on activation without exposing model discovery or supporting model changes from the TUI.
## What changed
- Fetch the account-scoped Cloud catalog on demand through `/v2/models`, independently of the submission and attachment queue.
- Let users stage a supported model and reasoning effort for the next new turn in the current conversation. Send these settings with the user message and show acceptance after successful admission.
- Show a loading picker when the catalog is empty, preserve compatibility with Cloud servers that lack discovery, and discard stale catalog results and selections when the account changes.
## Testing
Add coverage for catalog request parameters and queue bypass, deferred discovery and compatibility, model and effort serialization, admission outcomes, account invalidation, and opening the picker after discovery.
GitOrigin-RevId: 2cd0e7fe5f760d4da9258eefe9f0dcbcd23f9b07
## Why
When a workspace has an unreadable ancestor, PowerShell can start with `$PWD` unset and its filesystem drive at the root, breaking relative paths.
## What changed
Prefix PowerShell commands in the MXC sandbox with a guarded workaround that restores the location from the process working directory when `$PWD` is unset. Preserve locations already initialized by startup or a profile.
## Testing
Extend the MXC PowerShell integration test to cover an unreadable ancestor, checking that `$PWD` matches the process working directory, relative file access works, and the parent and sibling file remain inaccessible.
GitOrigin-RevId: 4fb067db52a7f3c6e819169016fe6bd104a277a1
## Why
User-configured model catalogs can supply Guardian prompt templates that omit policy slots or add conflicting instructions. Managed rules need a trusted template to reach the reviewer.
## What changed
- Use the bundled Guardian policy template when managed policy or additional rules are present, while preserving explicit host-provided templates.
- Remove `auto_review.extra_policy` and `auto_review.experimental_policy_template` from configuration and the schema. Warn when they are used, directing additional rules to `guardian_extra_policy` in managed `requirements.toml`.
## Testing
Add regression coverage for managed rules with user-supplied catalog templates, explicit host templates, and migration warnings for the removed settings.
GitOrigin-RevId: 7f00bfaa85051272ed70ceb2fcb64ffc297b8755
Pass `can_save: true` when opening the consent dialog and assert that the
popup displays “Include logs and session history?”.
GitOrigin-RevId: d6035a9a1b3e5114a6e92a6fd31547f02c4980fc
## Why
Waiting for host acceptance of a service-tier update in the submission loop can block interrupts while the host receipt is pending.
## What changed
Move the host acceptance wait out of the submission loop while keeping explicit thread settings replies pending until acceptance completes. Report handoff failures to the caller while preserving the locally committed settings, and allow a subsequent explicit request for the same tier to retry a failed handoff.
## Testing
Add a WebSocket regression test covering interrupts with pending host receipts, failure reporting, same-tier retries, and continued thread operation after startup caller cancellation.
GitOrigin-RevId: 1b27d156eba3ebb47e717a987f41f4f595635be8
## Why
Holding the session MCP gate during `tools/list` blocks other runtime access. Releasing it requires preventing stale refresh results from publishing after configuration or authentication changes.
## What changed
- Capture the Apps client under the session gate, then release the gate before fetching tools.
- Validate runtime and authentication state before publishing the shared cache and client catalog; retry a superseded refresh once.
- Wait for in-flight Apps refreshes before capturing model tools, preparing Apps calls, or shutting down the runtime.
## Testing
Add regression coverage for stale refreshes after runtime invalidation or logout, publication validation after call preparation drains, and a model step that waits for refreshed Apps tools while MCP status queries remain available.
GitOrigin-RevId: 42d4be8c4a9218933f8e3d07fc7f32f2da9cbd9d
## Why
MCP tools marked with `readOnlyHint: true` could still require approval in automatic mode when `destructiveHint` was also true.
## What changed
Give `readOnlyHint` precedence over `destructiveHint` and `openWorldHint` when deciding whether annotations require approval. Explicit prompt mode and strict automatic review continue to require their respective approval checks.
## Testing
Update unit tests for conflicting annotations, prompt mode, and strict automatic review. Extend app integration coverage to verify that read-only calls proceed while writes prompt in both automatic and writes approval modes.
GitOrigin-RevId: 11a930b857886bf41d09fd54c3a38607ae3d1b4e
## What changed
- Replace footer chord hints with a floating guide that shows available completions after a 350 ms delay, including custom prefixes.
- Share guide rendering across conversations, transcript overlays, the session picker, startup drafts, hook review, and daemon recovery. Preserve workspace-specific pane labels and filter startup drafts to supported actions.
- Adapt the guide to short inline viewports, retain `Esc` cancellation, and redraw when pending chords clear. Consume clicks on the guide so they do not activate controls beneath it.
## Testing
Extend tests and snapshots for delayed reveal, timeout, custom prefixes, compact and inline layouts, startup-safe completions, and picker redraws after chord completion or cancellation.
GitOrigin-RevId: afa2fe3ae1b5fbea4cd871c17d35206e749c842c
## What changed
- Add cloud archive and unarchive requests and support listing archived threads.
- Detach successfully archived threads and emit archive notifications. Report loaded cloud threads from live attachments rather than cached resume metadata, including after archive failures.
- Scope resume picker archive state and transcript previews by backend and thread so archiving a cloud session preserves a local session with the same ID.
- Limit cloud task archive cleanup to the selected thread, preserving child agents and their active session state, and update the confirmation text accordingly.
## Testing
Add regression coverage for archive acknowledgments, archived-thread discovery and restoration, attachment state after archive failures, same-ID sessions across backends, and preservation of attached child agents.
GitOrigin-RevId: bd155be85ee911375d4d326b18f9b5abe8e82b3d
## Why
CRT argument escaping adds literal backslashes before quotes in `cmd.exe /c` scripts, breaking quoted paths and executable names.
## What changed
Serialize single-script `cmd /c` invocations with `/s /c` and an outer quote pair, preserving the script's quotes. Share this handling across Windows sandbox process creation, ConPTY, and MXC execution requests.
## Testing
Add a regression test for `certutil -hashfile` with a quoted path containing spaces, and update the command-line test for a quoted PowerShell executable.
GitOrigin-RevId: 32b4b7b55f6af4dba206813eac150310f37ae1d4
## Why
Locally configured MCP servers may differ from those reported by the app server. Waiting for unreported servers can leave startup progress busy after the observed servers have finished.
## What changed
- Track startup progress from received server status updates, settling when no observed starts remain pending. Handle standalone outcomes after attachment or lag, deduplicate repeated diagnostics, and reactivate progress on new starts.
- Read effective MCP configuration through `config/read` to prevent task tools from shadowing the `codex_tui` namespace, including when configuration changes after startup.
- Use the same configuration reader to disable MCP servers for temporary structured threads.
- Remove client-side MCP requirement checks for the task-tools server and MCP requirements from debug configuration output, leaving enforcement to the app server.
## Testing
Update regression coverage for unreported local servers, startup rounds after lag, diagnostic handling, namespace conflicts, and server-enforced managed requirements.
GitOrigin-RevId: 370767b90ee55f8b0b1403872ef437d53257586b
## Why
`thread/sample` previously required the source's latest turn to finish before it could be sampled.
## What changed
Add `allowInProgressTurn`, defaulting to `false`, to sample a snapshot of the latest turn while the source continues running. The requested turn must still be the latest, but source history changes during sampling no longer invalidate the result when this option is enabled.
For an in-progress snapshot, include a context note explaining that the source was not stopped and pending tool calls may appear as `aborted` in the copy. Suppress the copy's default interruption message.
## Testing
Add coverage for sampling running turns in legacy and paginated history modes, including pending tool calls and mid-turn compaction. Verify that the source continues independently and that finished-turn samples retain their existing context.
GitOrigin-RevId: 771b979bf677e4ff0686476bfaf21aff92f7e7ac
## What changed
Allow GCP Responses requests to use `incremental_tools_legacy`. When enabled, tool declarations are sent through `additional_tools` inputs instead of the top-level `tools` array.
## Testing
Extend Vertex request coverage to check incremental tool declarations, including namespaces, tool search, and `exec_command`. Add GCP cases to the scenario that verifies tool catalog updates are appended without rewriting history, with incremental tools enabled and disabled.
GitOrigin-RevId: 8f4c02f8d62575e24e695d6fae0472a09625409f
## What changed
- Show a refusal status while preparing alternative suggestions and remove the pending notice above the composer.
- Clarify that choosing a rewrite starts a new chat with earlier context, and update overview suggestions to explicitly say users can ask Codex.
- Add an option to report safety-check concerns through the consent flow when reporting is enabled.
## Testing
Update safety recourse snapshots and extend coverage for reporting consent, returning to the picker, and Daybreak notices when enabled or unavailable for the selected model.
GitOrigin-RevId: 99f565ebec7064ec55d388e73acede2dfe639474
## Why
Opening a saved side chat waits for thread resume and history loading. Keep the chooser usable during that work and switch conversations only if the user still wants to open the chat.
## What changed
- Prepare saved chats in the background and show opening, waiting, and retry states in the sidebar. Allow cancellation and keep only the latest queued destination, with at most two preparations in flight.
- Ignore stale completions after navigation, archiving, disconnects, or backend changes, and release unclaimed subscriptions on their original connection.
- Preserve live events, settings, read receipts, and pending approvals received during loading. Anchor paginated history to the resumed snapshot to avoid overlap with live events.
- Carry held-key suppression across conversation switches.
## Testing
Add regression tests for retry and supersession, cancellation, stale completions, subscription cleanup, live updates during attachment, and held keys, plus snapshots for waiting and retry rows.
GitOrigin-RevId: 2c7d94482078f16895049ce79b242d3eb0d92f40
## What changed
Expose `discover_authorization_metadata` using RMCP and the existing OAuth HTTP adapter with a caller-supplied HTTP client. Return published authorization-server metadata, including discovery through protected-resource metadata, while excluding synthesized legacy endpoints. Return `None` when authorization metadata is unavailable and propagate discovery errors.
## Testing
Add tests for published versus synthesized endpoints, discovery failures and issuer mismatches, and discovery through a separate authorization server without sending credentials.
GitOrigin-RevId: b273067bb3b33d11301ae0e2017b28cd8e25b548
## Why
Title and content searches exclude attached threads, preventing clients from finding their saved conversations alongside ordinary threads.
## What changed
- Add `includeAttachedThreads` to `thread/list` and `thread/search`. For `thread/list`, require a non-empty `searchTerm` and preserve the usual provider and source filters.
- Expose `attachedToThreadId` on thread responses to identify the owning parent independently of fork and subagent lineage.
- Support inclusive searches through SQLite and filesystem fallback, repairing missing database entries with saved thread names during title searches.
## Testing
Add regression coverage for opt-in title and content searches, attached-parent metadata after restart, default search filters, filesystem searches without SQLite, and discovery and repair of unindexed title matches.
GitOrigin-RevId: ac12ec3c730ad7f1722bdf8e21600d17f12017f0
## Why
The existing loopback listener mode does not provide the stdin/stdout transport needed by OpenSSH's `ProxyCommand`.
## What changed
- Relay one SSH session over HTTP/3 CONNECT with `--environment-id ENV --port PORT`, defaulting to the public Portals gateway and port 22. Also accept an explicit `--proxy-url` with `--target ENV:PORT`.
- Require ChatGPT OAuth login, enforce cloud configuration and application network policy, and restrict OAuth credentials to the built-in gateway origin. Leave SSH authentication and host-key verification to OpenSSH.
- Preserve binary stdio, propagate input half-close, exit on gateway EOF, and report rejected CONNECT requests by HTTP status without exposing arbitrary peer error text.
- Require ERS-issued v2 tunnel JWTs for Portals listener mode unless OAuth mode is selected, and reject older ERS tunnel JWTs during credential updates.
- Disable UDP segmentation offload for SSH tunnels on Linux to avoid stalled bulk transfers on affected paths. Document an OpenSSH configuration example.
## Testing
Add coverage for argument validation, gateway routing, credential boundaries, JWT startup and renewal checks, binary relay and half-close behavior, gateway EOF and rejection, and cloud policy enforcement before gateway connection.
GitOrigin-RevId: 0d9afbddef01748efcc1c4b88f7e19923deff7e1
## Why
The Windows `notify` backend wakes every 100 ms even when idle.
## What changed
- Patch `notify` 8.2.0 in Bazel to wait indefinitely for events or control requests.
- Wake the watcher when configuration requests are queued and share ownership of the wakeup semaphore with `Arc<OwnedHandle>`.
## Testing
Add a Windows regression test that verifies file changes are reported after unregistering one directory and registering another on the same watcher.
GitOrigin-RevId: b53b3c8bc514008554fdeffaef3f7bf8305a4803
## Why
Reference-backed forks can lack a local opening user message, causing them to disappear from thread listings or lose their inherited preview when a new turn is written. Compaction can also remove the opening message from the model context used to prepare a fork.
## What changed
- Persist inherited previews and preserve them when recording new turns and merging thread-list metadata.
- Include reference-backed forks with inherited history in thread listings before their first local message.
- Recover opening previews from transcript history within the requested fork boundary when compaction omits them from model context.
- Use the shared `user_message_preview` helper when deriving previews from rollout items.
## Testing
Extend thread-fork integration tests to check previews in listings before and after a new turn, after reopening, and when forking at a boundary after compaction.
GitOrigin-RevId: 5962cf71ea7104f07c9013cc77259b105e4c60d7
## Why
A failed side chat's opening prompt and image attachments could be restored into the parent chat's draft when dismissing the failure.
## What changed
Clear the pending opening message when sidebar chat creation fails, and stop restoring the opening message when side conversation creation returns an error.
## Testing
Update the sidebar chooser test to verify that dismissing a failed creation preserves the parent draft and a subsequent prompt without restoring the failed prompt or its image attachment.
GitOrigin-RevId: 1423786b2209e9441e0bc1504ffcf51e74ba7cde
## What changed
- Fold earlier commentary, reasoning, and tool activity beneath an expandable prompt control in the full-screen transcript, keeping partial and final answers visible.
- Label the control with completion timing when available, or a previous-message count otherwise. Keep tool groups independently expandable within the turn.
- Preserve assistant message phases during live completion and replay, and retain untimed completion markers to identify completed turns.
## Testing
Add transcript coverage for nested expansion, keyboard and mouse controls, narrow viewports, search anchor preservation, detailed mode, and legacy messages without phase or timing metadata.
GitOrigin-RevId: b17d9d7c870990178d76d12a13d463ff9c32b96c
## What changed
- Combine adjacent tool calls into one expandable summary, including calls that move from live output into history. Label successful command groups with summaries such as `Explored files` and `Ran 2 commands`.
- Include web searches in tool groups, hide duplicate provisional search entries, and show a single completed search directly. Preserve its reading position when it completes.
- Refresh summaries as history changes while preserving pinned content during selection and reading.
## Testing
Add regression coverage for web search completion, grouped search expansion, loading older history during selection, and command completion with an expanded summary.
GitOrigin-RevId: 98f4e0c49cbf8014c25874cf47d1c0c92ee6b30d
## What changed
- Add summary labels for MCP and dynamic tools, computer activity, terminal interactions, file edits, images, plan updates, agent calls, and historical tool fallbacks.
- Keep tool output out of summaries and give summaries disclosure identities even when their cells have no activity IDs.
- Bring focused disclosure headers into view and show `expand` or `collapse` in the footer, including for search-expanded entries.
## Testing
Add assertions for tool labels, a transcript snapshot verifying that image-generation output stays hidden, and coverage for expanded and collapsed footer hints.
GitOrigin-RevId: 076b8d74c17f26b10aa8221c65b8b38dbb5ad5ea
## What changed
- Add `tui.collapse_turn_details`, disabled by default, and a “Collapse turn details” toggle in the full-screen settings panel.
- Summarize command executions with output-free labels, grouping multiple calls behind an expandable row. Keep full details available through transcript search and detailed view.
- Restore interruption notices at their turn boundaries when resuming and loading older history, including turns split across pages.
## Testing
Add coverage for live summary updates, expansion controls, search access to hidden output, settings visibility, and interruption ordering across history pages.
GitOrigin-RevId: 68987fb0239e39414dac383098acac190fc4f516
## What changed
- Let users press `Ctrl+S` in the report note editor to save a diagnostic ZIP locally without sending it to OpenAI, including when uploads are disabled. Keep `Enter` for sending reports when uploads are enabled.
- Apply the attachment consent choice to both destinations, clarify the disclosures, and show the saved archive path on completion.
- Require a local app server for ZIP saves, report unsupported servers with an upgrade hint, and stop before collecting a note when no report destination is available.
## Testing
Add coverage for ZIP creation with and without log consent, no upload requests on save success or failure, destination availability, keyboard actions, and saved-path receipts. Update report UI snapshots.
GitOrigin-RevId: cbc0142988840e5e3f6475f31678915bf25d56a2
## What changed
Use eligible installed marketplaces as Git clone references to avoid fetching objects already available locally. Limit fetch negotiation to the recorded installation commit so local branch revisions are not advertised, and use `--dissociate` to keep the upgraded checkout self-contained.
Enable reuse only with Git 2.20 or newer and a recognized release version. Fall back to a fresh clone if reference cloning fails, and retain existing ref and sparse-checkout behavior.
## Testing
Add coverage for installation-commit negotiation, exclusion of local branch revisions, self-contained object stores, fallback with older or unknown Git versions and shallow references, and Git release parsing.
GitOrigin-RevId: 8d0f6a4bed7e7e2a3136e3912ba2f92150be9354
## Why
Switching to a model whose access metadata excludes Daybreak can leave Daybreak enabled and block subsequent turns.
## What changed
Automatically turn Daybreak off when a model switch or catalog refresh confirms that it is unavailable for the selected model. Persist the disabled preference for the thread and new threads, and warn that prior cybersecurity context may still cause refusals. Switching back to a compatible model leaves Daybreak off until the user re-enables it with `/daybreak`.
Require explicit access metadata before disabling Daybreak, and recheck the selected model before applying a queued change.
## Testing
Extend session lifecycle coverage for pending model discovery, supported and unknown models, persisted disabling, and subsequent turns using the standard access program. Add a snapshot of the model-switch warning.
GitOrigin-RevId: 6c294939d854c7176ed9a346e8ea806ffcf6f715
## What changed
Return first-party provider models in catalog order while retaining priority-based default selection and existing filtering. Apply this ordering only to provider-origin catalogs for the OpenAI provider using Codex backend routes or `model_catalog_url`. Bundled, configured, and third-party catalogs retain priority ordering.
## Testing
Add coverage showing that catalog display order can differ from priority order while the recommended model remains the default. Update custom-provider coverage to verify priority ordering with a reversed catalog response.
GitOrigin-RevId: 9c2361e070ba424c092a282ca7f1cf9952d270b3
Colin Young