## What changed
- Display input/output token counts and estimated credits and USD cost in task details. Prefer live token totals, falling back to complete totals from usage breakdowns.
- Fetch estimates for the selected task on a one-minute cadence for supported Business and Enterprise plans. Cache results, preserve prior nonzero estimates when a response reports zero, and stop fetching when the capability is unavailable.
- Clear cached usage and discard pending results on account changes, reconnects, or missed server events. Prioritize activity and usage over the original prompt when space is limited.
## Testing
Add a rendering snapshot and tests covering caching, stale results, unavailable usage, token resets, and incomplete usage breakdowns.
GitOrigin-RevId: b72c96053557389fdc723a70fab0dab841a52e49
## Why
The command center previously refused to open tasks managed by another app server, preventing users from viewing their saved history.
## What changed
- Fall back to a frozen, read-only history snapshot when attaching fails because another server owns the task. Preserve drafts and skip buffered request replay and paused-goal prompts while viewing.
- Keep the snapshot when reopening the displayed task, and allow explicit retry to attach once the other server releases it.
- Allow pasting into the command center while a read-only conversation is displayed, while keeping the conversation composer protected.
- Box the TUI startup future to keep it out of the CLI caller's frame.
## Testing
Add coverage for read-only history, draft and selection preservation, retry before and after ownership release, and history-read failure without leaving the current conversation. Assert that opening a read-only task does not start a turn and that the TUI startup future remains below 64 KiB.
GitOrigin-RevId: f1bdb5b2d9182079de4e53346a56742a4a02a1c7
## What changed
- Cycle task grouping through project, status, and model with `Ctrl+S`, and show the active grouping in the footer.
- Group tasks by model with the most recently updated tasks first within each group. Use `Unknown` for missing or empty model names.
- Display the model in task details and refresh it when thread settings change.
- In model grouping, dispatch new tasks without inheriting the selected task's working directory, matching status grouping.
## Testing
Add coverage for model grouping, selection preservation, navigation, and new-task dispatch across grouping modes. Update snapshots for model details and grouping hints.
GitOrigin-RevId: 429cf61c1e7438ba3b2f989d3ed14e12545856f7
## Why
Completed voice captions could disappear before their queued history insertion ran. Interleaved user and assistant updates could also hide the other speaker's caption and restart its animation.
## What changed
- Preserve separate live caption cells for both speakers, rendering the user above the assistant without restarting settled text.
- Render completed captions while history insertion is pending, then move them into history in one app event. Keep them visible when agent streaming delays insertion.
- Invalidate the transcript overlay when an interleaved caption is cleared.
## Testing
Add regression tests for caption visibility through deferred history insertion, settled animations with either speaker arriving first, and empty caption completion during active and stopping sessions. Update replay coverage to exercise the app's history handoff.
GitOrigin-RevId: 31de6fc74b6dc7ff148c554e3176bf3ee92dced9
## What changed
- Use literal model instruction templates and the standard fallback prompt, ignoring legacy personality variables. Retain catalog decoding compatibility and report `supports_personality` as `false` for generated model presets.
- Stop emitting `<personality_spec>` developer messages and assigning an implicit Pragmatic configuration default.
- Filter Friendly/Pragmatic overrides from TUI requests while preserving explicit `personality = "none"`. With `features.personality` enabled, this opt-out still strips the model's personality section.
- Refresh inherited model instructions for agent roles only when the personality opt-out changes, preserving custom instructions.
## Testing
Update coverage for literal legacy templates, deprecated overrides on turn start and resume, role instruction refresh, and forwarding the explicit opt-out through thread start, resume, and fork requests.
GitOrigin-RevId: 1391db4e565e010569f0885f80013d1f86b45825
## What changed
Use `windowsSandbox/setupStart` for elevated and unelevated setup, and handle completion notifications while retaining the pending approval preset and permission profile selection. Verify the effective sandbox mode before enabling Agent mode.
Keep input locked and setup pending when the start request times out or its response is lost. Block thread replacement during setup, ignore completion notifications for a different mode, and clear interrupted setup state with a restart message after reconnection. Preserve the fallback prompt when elevated setup fails and report unelevated setup failures.
Remove the TUI's direct sandbox setup helpers and sandbox-mode configuration writes.
## Testing
Add regression coverage for uncertain setup responses, matching completion modes, blocked thread replacement with retained input, and interrupted setup during reconnection.
GitOrigin-RevId: 5ec1101a1a69b3f96f01fc2ba6a03112705f4918
## Why
The Windows TUI cannot configure a remote executor's sandbox. Required elevated sandbox setup also needs to reflect the local app server's readiness rather than the TUI's local setup files.
## What changed
- Restrict setup prompts and actions to local connections with local executors, including local daemon connections. Let remote servers own Agent permission selection, and warn when local and remote executors are configured together.
- Query `WindowsSandboxReadiness` at startup when elevated sandboxing is required locally, and track successful setup across chat widget replacement and reconnects.
- Restore pending initial input to the composer when mixed executors prevent required setup or a local connection goes offline.
## Testing
Add regression coverage for local, remote, and mixed host selection, remote Agent permission selection, pending input restoration with mixed executors, and setup state preservation during daemon reconnects.
GitOrigin-RevId: bd45b308ac3ae4c2489b0bd2ac5d7e12a7fc35d6
## What changed
Remove the `/personality` command, selection popup, tooltip, and associated settings update and persistence handlers. Stop sending a personality override with TUI user turns.
GitOrigin-RevId: 0549a1f9dcfd8118340fad4b60fd24d4eee7f93a
## What changed
Remove TUI-triggered world-writable scans at startup and during permission changes, along with their warning dialogs, acknowledgement handling, and scan telemetry. Permission selection and shortcuts no longer check for these warnings, and terminal color probing no longer waits for a startup scan.
GitOrigin-RevId: a8d2fb5de7f891dcae5261286743fe3a125b82aa
## What changed
Replace the selectable personality templates in the bundled `gpt-5.4` and `gpt-5.5` definitions with fixed friendly instructions. Personality selection becomes unavailable for these models in the TUI, and submitted turns omit the personality override. Remove personality overrides from Python SDK examples and the walkthrough notebook.
## Testing
Update core and TUI tests to cover fixed friendly instructions, ignored pragmatic updates, unavailable personality selection, and omitted turn overrides. Preserve coverage for selectable personalities in legacy catalogs, and add coverage for resumed legacy sessions and explicit empty instruction overrides.
GitOrigin-RevId: 869a71445584272405fcbd1325efc31c224808c8
## Why
A quiet sample cleared all earlier activity from that channel's voice meter, making recent speech disappear immediately.
## What changed
Let quiet samples scroll into the microphone and speaker meter history so earlier activity remains visible until it ages out.
## Testing
Update history assertions and the meter snapshot to cover quiet samples on each channel and the eventual return to silence after a full history window.
GitOrigin-RevId: 834157df28c9d2cfbe9fa17bbfaf32b81313a295
## Why
Starting a voice turn while the speaker is idle suppresses response audio until assistant captions arrive, preventing audio that arrives first from being accepted.
## What changed
Make speaker suppression conditional when user transcripts start a new turn. Keep idle output ready for audio while preserving interruption of active assistant output and older, uncaptioned speech that is queued or accepted.
## Testing
Add regression coverage for quiet turns with incremental or final-only user transcripts and for interruption of older pending speech across queue and caption states.
GitOrigin-RevId: 288d2071766a1d0c1b8c7a10c0ab434dc4d7cee1
## What changed
Promote `realtime_conversation` to stable and enable it by default, removing its experimental announcement. Update popup and tooltip tests to use explicit experimental voice fixtures now that the feature is stable.
GitOrigin-RevId: 4e947189f41de465d1f343e95100b26d6200db24
## What changed
Remove `thread/rollback`, its request and response types, generated bindings, and the core `Op::ThreadRollback` operation. Requests now follow the generic unknown-method rejection path. Document `thread/revert` as the alternative for paginated threads.
Keep historical `ThreadRolledBack` markers and legacy error deserialization so existing rollouts remain compatible with replay and migration.
## Testing
Adapt retained-context and Guardian history tests to append legacy rollback markers and resume threads, preserving coverage of surviving instructions, answers, and review history.
GitOrigin-RevId: b3da1becdf86b1869275aacb0ffc2817cee5af2e
## What changed
- Accept `disabledPluginIds` in `thread/settings/update` and `turn/start`. A supplied list replaces the saved selection; omission or `null` preserves it, and `[]` clears it.
- Return the selection in thread start, resume, and fork responses and `thread/settings/updated` notifications. Update generated schemas and client types.
- Restore disabled plugin IDs from the history retained at the requested fork boundary, preserving explicit overrides.
The selection persists across resume but does not yet filter plugin capabilities.
## Testing
Add coverage for replacing, preserving, and clearing selections without inference; turn-start notifications; resume; and fork boundaries across legacy and paginated history, with loaded and restarted parents. Add a core regression test for history restoration and explicit clearing.
GitOrigin-RevId: 654a8c2a0527228d422c0dd4919228447e2663db
## What changed
Carry optional `available_access_programs` metadata through model information, presets, caches, and the TUI, and expose it as `availableAccessPrograms` in app-server `model/list` responses. Update the generated JSON schemas, TypeScript types, and Python models.
Preserve the distinction between missing metadata and an empty `cyber` list. Ignore unknown cyber program names when reading the catalog so new server programs do not prevent older clients from loading it. Discovery metadata does not grant access; inference still enforces authorization.
## Testing
Add coverage for absent, null, empty, and populated metadata, unknown program names, and app-server serialization. Extend cache tests and verify that online refreshes persist changed access metadata even when the catalog ETag stays unchanged.
GitOrigin-RevId: b3ef5805c1c61b8d64b9b896c9c0a79120143667
## What changed
- Fade Astra stars over one second after 15 seconds from the first visible frame, or quickly on composer input, drafts, voice input, and popups. Disconnected key handling also dismisses the animation.
- Preserve placeholder and draft text, including spaces. Stop scheduling animation frames when unfocused or finished, while allowing the idle deadline to elapse without terminal focus.
- Hide the terminal cursor before repainting and cache its style to avoid redundant anchor repairs. Invalidate cursor state after screen transitions, external programs, resume, and caught-panic recovery.
## Testing
Add regression tests and snapshots for fade timing, input dismissal, focus changes, text preservation, and frame scheduling. Add cursor redraw tests and a PTY test for cursor visibility and shape restoration after a caught panic. Update the reconnect test to wait until both the draft and notification are visible.
GitOrigin-RevId: 0c9aaa13e6bde820f88e3757457063680d7921a3
## What changed
- Mark `worktrees` stable and enable it by default, removing it from `/experimental`. Point users who explicitly disable it to their Codex configuration.
- When a local daemon lacks `thread/backgroundTerminals/list`, block worktree creation and `/cd` with guidance to run `codex app-server daemon update` and restart Codex.
## Testing
Add regression coverage for unsupported local daemon methods, unrelated errors, embedded servers, and empty background terminal lists. Update feature-gating tests to disable worktrees explicitly and remove worktrees from the experimental menu snapshot.
GitOrigin-RevId: 3f21d0ebaa02da11a6aaa2e1ac615b4518fc98d8
## What changed
Assign thread colors deterministically from the full thread ID and the active syntax theme's accents. Use the same color for thread names and titles in the status line, status previews, agents overview, and resume/fork pickers, independent of renaming or list order.
Preserve thread colors when picker rows are selected and honor `tui.status_line_use_colors`. Load the configured theme before startup pickers render and refresh the cached palette when the theme changes. Fall back to the terminal's default color when no accents are available.
## Testing
Add unit and snapshot tests for palette extraction and refresh, default accent coverage, selected titles in both picker layouts, color suppression, and preview/footer consistency during automatic naming.
GitOrigin-RevId: 2b83a66bb3e80d4a1daea48ab9a86dbf2b525eef
## What changed
Add `serverCapabilities` to `mcpServerStatus/list` responses in both `full` and `toolsAndAuthOnly` modes, including thread-scoped reads. Return the initialized server's capabilities object, including its `extensions` map, or `null` when unavailable.
Capture capabilities during initialization so they remain available when tool discovery fails. Clear them on each new connection attempt and keep them independent of shared tool caches. Update the protocol schemas, generated TypeScript and Python types, and documentation.
## Testing
Add coverage for extension capabilities surviving tool-discovery failures in both detail modes. Extend existing tests to check advertised extensions, absent capabilities after initialization failure, and serialization of unavailable capabilities as `null`.
GitOrigin-RevId: 8e9d67c10fac3a54e82bef8be5d99caaf82597d1
## What changed
- Check directory trust when dispatching tasks from Agent Command Center, resuming sessions, and opening loaded tasks.
- Return connected users to Agent Command Center when they cancel folder consent. Clear launch prompts and images on startup cancellation, and restore the composer draft when task dispatch is canceled.
- Reload local configuration after saving folder trust and review startup hooks before creating a new task.
- Label connected consent screens with “Back to Agent Command Center”; retain quit behavior for embedded sessions.
## Testing
Add a terminal integration test covering unknown and untrusted folders, server-authoritative trust, cancellation and retry, resumed tasks with changed directories, and hook review before task creation. Update consent-screen snapshots.
GitOrigin-RevId: db88d2113fd47bc4c57369cc20ebf3042e6fb7ab
## Why
Task details displayed prompts as plain text and flattened agent messages, losing Markdown formatting and layout.
## What changed
Render prompt and last-message previews as Markdown at the details panel width, using the source thread's working directory. Preserve newlines and tabs within the 512-character preview limit, strip other control characters, and unwrap Markdown fences around agent messages. Keep prompts limited to two rendered lines and wrap long code lines to fit the panel.
## Testing
Add snapshots for Markdown formatting, long lines, and tables; verify cached and live messages render identically; and test preview layout preservation, control-character filtering, and Unicode character limits.
GitOrigin-RevId: b605d3f5920f0d15cc7682f45988a2e933e00602
## Why
Retained voice captions were appended after replayed history, placing earlier speech after later typed turns when switching back to a thread.
## What changed
Anchor completed captions to the next live turn and restore them before that turn during replay. Handle buffered item, delta, and completion events even when the turn-start event has been evicted. Restore remaining captions at the end of replay.
## Testing
Extend regression coverage to verify caption order and avoid duplicates across repeated thread switches. Add coverage for inactive-thread captions replayed before a later buffered turn without its start event, with and without a message delta.
GitOrigin-RevId: 6860a649bdcdda4937afb3ab4bbd75cf4ea5b4e6
## Why
Resume and fork selection can change the working directory. Folder consent needs to cover the selected destination, and existing tasks in untrusted folders may retain settings and history loaded while trusted.
## What changed
- Move startup consent after destination selection and reload local configuration when trust is saved.
- Check both selected and saved folders for local daemon resumes, and reread the task after consent to catch working directory changes.
- Resolve local trust using project markers, Git roots, and normalized paths, honoring explicit working directory decisions and canonical path precedence.
- Offer restricted-folder consent without changing saved trust, with distinct wording for existing tasks that may retain configuration or hooks. Preserve remote checks scoped to explicit `--cd`.
## Testing
Extend trust lookup coverage for parent/child decisions, repositories without project configuration, path aliases, and custom project markers. Update restricted-folder snapshots and add an existing-task snapshot.
GitOrigin-RevId: caf8c70f1e953c4f7b4ddc89dd29bb1fd8ed62f1
## What changed
Allow `2` to confirm archiving a task and its child agents in the agents overview without an additional confirmation keystroke. Keep explicit confirmation for permanent deletion.
## Testing
Add a regression test verifying that `1` cancels and `2` dispatches the archive action, with both shortcuts closing the confirmation popup.
GitOrigin-RevId: 9a4b941f36a7876eccf9d8b0ea6a63e799f53b98
## Why
Starting a new session with `/new` or switching threads replaces the chat composer, losing the last editor kill or Vim yank.
## What changed
Transfer the kill buffer to the replacement composer, preserving both its text and whether it is characterwise or linewise. Yanked text remains available to paste within the same TUI session.
## Testing
Add regression tests for new sessions and root thread switches that delete a line with Vim `dd`, then paste it with `p` in the replacement composer and verify the text and rendered output.
GitOrigin-RevId: edb4790d4de7b7425de6ef6af4e2786f6a4771c1
## What changed
- Explain that folder settings can run code automatically and that the trust decision is saved. Label the actions “Trust and continue” and “Quit”, and show the Escape shortcut.
- Add a restricted state to `TrustDirectoryWidget` with an “Open restricted” action and a disclosure of which project features remain disabled. Skip trust persistence for this state. Onboarding still initializes the widget with `restricted: false`.
## Testing
Add a restricted-folder rendering snapshot and a test that accepting or cancelling the restricted widget does not persist trust. Update existing trust snapshots and the interactive startup safety test for the revised prompt.
GitOrigin-RevId: d913f5624ac7c24ff1a16c19b5889573ab2752e6
## Why
Linux voice needs system ALSA plugins and enough buffering to accommodate PipeWire graph cycles without losing capture samples. Voice startup failures also need actionable diagnostics without exposing native error details.
## What changed
- Build and bundle GNU voice helpers and runtimes with primary Linux musl release archives, and sign the archives. Keep Python wheels free of these libraries to preserve `manylinux_2_17` compatibility.
- Discover ALSA plugins in fixed system directories and increase Linux capture and playback buffering to support larger PipeWire graph cycles.
- Report voice failures by stage, preserve negotiation timeout classification, and discard native error sources. Suppress the misleading `requested` closure message after failure cleanup.
- Add explicit Windows MSVC, pkgconf, and CMake toolchain configuration and preserve host architecture in native build environments.
## Testing
Add coverage for Linux release assembly, ALSA plugin discovery, PipeWire capture and playback, classified startup failures, failure cleanup rendering, and Windows build environment handling.
GitOrigin-RevId: d805eace96a669ce3a4489f12e2db6f68f9f7f53
## Why
Deleting a session, canceling an archived session resume or fork, and pressing `Esc` in a conversation open in another app previously exited the TUI. Local daemon and remote connections can instead return to the command center to select another conversation.
## What changed
- Return to the command center after successful deletion on local daemon and remote connections. Shut down side conversations before deletion and clear the deleted thread's local state.
- Return to the command center when an unarchive prompt is canceled, discarding startup input intended for the canceled resume or fork. Keep explicit quit actions and embedded server exit behavior.
- Make `Esc` open the command center from a conversation open in another app. Reselecting that conversation preserves its read-only snapshot and draft; `R` explicitly retries attachment.
- Update deletion confirmation text and keyboard hints to reflect these destinations.
## Testing
Add lifecycle tests for deletion success and failure, side conversation cleanup, unarchive cancellation and quitting, and read-only snapshot preservation. Add snapshots for command center navigation hints and deletion confirmation.
GitOrigin-RevId: 55a96358edb7af73949877a515614943bdc73643
## Why
Managed new-thread defaults could overwrite model, reasoning effort, and service tier settings from an explicitly selected profile.
## What changed
- Treat effective profile settings as explicit launch choices when applying managed defaults. A profile setting for either `model` or `model_reasoning_effort` opts out of both managed values; `service_tier` remains independent.
- Count a profile setting only when it supplies the highest-precedence active value, so settings shadowed by project configuration do not block defaults.
## Testing
Add regression coverage for profile precedence at startup, session replacement, and background task creation, plus custom-provider profiles, service tiers, unrelated profile settings, and project settings that shadow profiles.
GitOrigin-RevId: 98f036b8b7059bab8598283600dbc6967c71d3e3
## Why
Unrecognized settings can be silently ignored, leaving typos or deprecated configuration unnoticed.
## What changed
- Collect warnings for unrecognized fields in effective configuration and requirements layers, including unknown feature keys in configuration.
- Report sources and field names without configuration values, show up to three entries, and provide migration hints for `network_proxy`, `allowed_permissions`, and `include_view_image_tool`.
- Emit project-specific warnings when starting a thread and suppress repeated startup warnings in the app server and TUI.
## Testing
Add coverage for merged configuration, disabled layers, startup and project warning delivery, omission of configuration values, and warning deduplication.
GitOrigin-RevId: 464cef87882502b19865ae10b50b6f82defb7296
## Why
Audio queue saturation and processing delays could terminate voice sessions. Muted sessions also need outgoing audio to keep the peer alive.
## What changed
- Drop stale or excess incoming, capture, render-reference, and playback audio so fresh audio can resume. Reset affected processing state while preserving queue bounds and mute generations.
- Send paced, generated Opus silence while muted, without using device or processing buffers.
- Add fixed helper exit stages and session failure categories to default TUI logs without logging raw native errors, SDP, or device error text. Preserve observed helper exit status for shutdown.
## Testing
Extend tests to cover decoded mute silence and RTP sequence continuity, recovery after stale audio and queue saturation, and shutdown after observing helper output closure. Verify the helper's exit stage when the parent pipe closes during blocked startup.
GitOrigin-RevId: 17d580a72acd4423fb0b4f5107d9b541b964d069
## Why
The TUI should respect the host's accessibility preference even when `tui.animations` is enabled.
## What changed
- Read the system motion preference once at launch on macOS, Windows, and Linux. Changes to that preference require restarting the TUI.
- Suppress animations when reduced motion is requested without changing saved configuration. Preserve configured behavior when detection is unavailable, and limit the Linux portal query to 250 ms.
- Use the effective animation setting for voice controls and transcripts, and honor system reduced motion in the startup composer.
## Testing
Add tests for animation preference resolution and preservation of saved settings, plus composer snapshots without sparkles at widths of 40 and 80 columns.
GitOrigin-RevId: 3ea4e721ae23220a040a06123a27286a8c8f1c7c
## Why
Command center failures need to remain visible while users retain their task selection and composer draft, including when a task is already managed by another app server.
## What changed
- Show action errors above the retained dashboard with a return option and a clear explanation for tasks open elsewhere.
- Keep the dashboard open until task attachment succeeds, and return to the conversation when selecting the already displayed task.
- Offer “View unsent task” in a pager when restoring a failed submission would overwrite newer input.
- Show task refresh failures inline and clear the notice after a successful refresh.
## Testing
Add regression tests and snapshots for attachment conflicts, preserved selection and drafts, successful attachment, inline refresh recovery, unsent task viewing, and visible action failures.
GitOrigin-RevId: 19670c5ea506414a835296141004db567b0cafef
## What changed
- Support `model_provider` and `model_providers` in managed requirements. Required selection overrides local and session configuration; each required provider definition replaces the corresponding local entry, including its authentication and headers.
- Merge provider requirement fragments before validation, preserving source-relative `auth.cwd` paths. Reject invalid cloud provider definitions before replacing the cached bundle, including unsupported Bedrock overrides.
- Expose `modelProvider` and `modelProviders` through the configuration requirements API and generated schemas. Reject writes to managed provider settings and omit their local origins, including for provider IDs containing dots.
## Testing
Add tests for requirement precedence, authentication fragment merging, path resolution, cloud cache preservation, and read-only configuration RPCs. Integration tests verify that model discovery and inference use the required gateway and ChatGPT authentication without leaking local headers, and that provider requirements survive configuration rebuilds.
GitOrigin-RevId: d1448604d4ef5662ebb5df7b693712d3b8ad6d54
## Why
Reopening the agent command center focused the composer, requiring an extra focus change before browsing tasks.
## What changed
- Focus the task list when opening the overview from a session or returning after task lifecycle actions. Keep composer focus when starting directly in the overview.
- Fall back to the composer when no visible tasks remain, after discovery and pending metadata have resolved.
- Preserve unsent drafts and explicit focus changes across populated refreshes.
## Testing
Add regression coverage for requested focus, draft and cursor preservation, arrow-key and Vim navigation, and empty-list fallback while metadata is pending. Add a snapshot of the reopened overview with list focus.
GitOrigin-RevId: 8713eadc4a2a72e2db4a962184d43c4028c7178d
## Why
The TUI has no voice picker, and realtime start requests omit the voice preference. Voice selection also needs to reflect the active project's effective server settings, which can differ from cached local settings.
## What changed
- Add `/voice settings` with the server's voice catalog and current effective selection, falling back to the built-in catalog when unavailable.
- Save `realtime.voice` through the app server and reread effective settings before confirming the selection. Report save failures and overrides.
- Resolve the effective voice for each realtime start. Apply selections to the next voice conversation without interrupting live audio, and retain compatibility with servers that lack `config/read` or return unknown voice names.
## Testing
Add picker and confirmation snapshots, plus request tests covering persistence, server defaults, catalog fallback, unknown voices, config read failures, overrides, and project settings after thread switches.
GitOrigin-RevId: d47e3da6c1164053c5be9d1da0f5932f2a09261f
## Why
Persisted turn-start events lack the originating root turn ID, so they cannot directly associate child turns with the root turn that initiated them.
## What changed
- Add optional `root_turn_id` to `TurnStartedEvent`. Use the inherited root turn ID when available, otherwise the turn's own ID.
- Centralize turn-start emission for regular turns, shell commands, and manual compaction so they record attribution consistently.
- Carry attribution into `ThreadHistoryTurnChange` when processing turn-start events and retain it through completion in the history builder.
- Keep older records compatible by defaulting missing attribution to `None`.
## Testing
Add coverage for root and child turn attribution, persistence when tool collisions fail a turn before sampling, history change propagation, and deserialization of older turn-start records.
GitOrigin-RevId: 54a80b828ca7d1c4c19f13d468c01d052e1b9130
## What changed
- Add `thread/attachment/add`, `thread/attachment/list`, and `thread/attachment/remove` to manage durable resource references without loading the owning thread or changing conversation history.
- Identify attachments by thread, `attachmentType`, and `identityKey`. Repeated adds return the existing attachment; repeated removals succeed without emitting another update. Listing supports cursor pagination.
- Broadcast `thread/attachment/updated` after creation or deletion, after responding to the requester. Serialize attachment mutations with thread lifecycle operations and reject stores that do not support attachments.
- Update protocol schemas, TypeScript and Python bindings, documentation, and TUI notification handling so attachment updates do not add untracked threads to the agent picker.
## Testing
Add coverage for unloaded threads, pagination, idempotent addition and removal, reattachment, invalid inputs, unsupported stores, response-before-notification ordering across clients, and TUI notification routing.
GitOrigin-RevId: 0d29cf903afd4e931a70a9cf96300475213b34aa
## What changed
- Add `Ctrl+E` to archive the selected task and its child agents, and `Delete` to permanently delete their history. Both actions require confirmation, with Cancel selected by default.
- Expose `agents.archive` and `agents.delete` in keymap configuration and the shortcut picker. Default bindings yield to existing custom bindings and chords.
- Show progress while requests run, keeping rendering responsive and blocking task switching. Refresh overview state afterward and keep the dashboard open when the current task is removed.
- Report failures and preserve the current attachment and draft when a rejected operation leaves the task loaded.
## Testing
Add coverage for confirmation and cancellation, active and background task removal, child-agent attachments, stale refresh invalidation, failure recovery, and draft preservation. Add progress input-isolation tests, shortcut conflict tests, and snapshots for confirmation, errors, progress, and keymap rendering.
GitOrigin-RevId: b327bb8834699d0058f9ffb903ace525ae270500
## What changed
- Add `Ctrl+W` to hide the selected task without stopping it. Hidden tasks stay hidden through activity and metadata refreshes until explicitly resumed or the TUI restarts.
- Expose `agents.hide` in keymap configuration and the shortcut picker, and let the default binding yield to existing custom shortcuts.
- Wrap overview footer hints while keeping shortcuts and their labels together when they fit.
## Testing
Add coverage for hiding filtered tasks across statuses, visibility through activity and refreshes, explicit resume, existing keybinding compatibility, and custom chord footer rendering at narrow widths.
GitOrigin-RevId: 980726e1095b8d5bad8901be919decdde8c0f925
## Why
Pressing `Esc` in the agents overview task list dismissed the overview or
exited Codex when no primary thread existed, instead of returning to the draft.
## What changed
Make list cancellation return focus to the composer, including while
reconnecting, preserving the draft and cursor position.
## Testing
Add regression coverage for returning from the list to the composer with Vim
mode enabled or disabled, both online and reconnecting. Verify draft and cursor
preservation, resumed text entry, and the absence of app events.
GitOrigin-RevId: 8920677c42b0c9ff5023979e198f069abcfcf54b
## What changed
Replace duplicated footer wrapping in the MCP elicitation and request-user-input overlays with `wrap_hint_rows`. Preserve whole-hint grouping, display-width and separator accounting, oversized hints, and the single empty row for empty input.
## Testing
Add unit tests for Unicode display widths, whole-hint wrapping, oversized hints at zero width, and empty input.
GitOrigin-RevId: 4d8ead0acbfa3bf9241baedb86d2476566d26ebc
## What changed
Allow `Right` to open the selected task from the task list or an empty, focused composer. Preserve editor keybindings and guard against pending input, active popups, and offline state. Keep metadata editing unaffected and show the shortcut in navigation hints.
## Testing
Add regression tests for opening the current or highlighted task, preserving cursor movement and renaming, and preventing navigation while offline. Update snapshots to cover the new hints.
GitOrigin-RevId: 9fc01b62ad0829b964509ae6286a041fc4936b9d
## Why
`/archive` exits the TUI even when connected to a local daemon or remote app server, interrupting access to other tasks.
## What changed
- Keep the TUI running after a successful archive on local daemon and remote connections, and reopen the agent command center.
- Shut down side conversations before archiving, then clear the archived thread's local state, transcript, and unsent draft.
- Preserve exit-on-archive behavior for the embedded app server and remove the exit promise from `/archive` help and confirmation text.
## Testing
Add coverage for local daemon and remote connections, including side-thread cleanup, archive requests, cleared session state, and the resulting command center snapshot. Retain coverage for embedded archive success and failure.
GitOrigin-RevId: 36c61ec76a13a3fc1b5d6725e3b8f42a97fe6793
## What changed
- Mark `realtime_conversation` as experimental, keeping it disabled by default, and label it “Voice conversations” in `/experimental`.
- Add an announcement directing users to enable the feature, restart Codex, and run `/voice`.
- Hide server-discovered voice entries and the announcement when the client lacks native voice runtime support.
## Testing
Add tests and snapshots for voice discovery and announcement visibility with and without runtime support, and update the experimental features popup snapshot.
GitOrigin-RevId: 709655f3733cb88191eb78b40ac1f67e27c9816e
## Why
Unanswered questions from the previous prompt remain visible after a new follow-up. Clear them when the user moves on to new work.
## What changed
- Clear pending questions when a model prompt is submitted or queued, and when a review starts. Clear again on queued prompt delivery to remove questions that arrived while waiting.
- Retain seen question IDs so replay cannot restore cleared questions.
- Track question answers separately from prompts through queues, retries, thread restoration, and reconnects so delivering an answer preserves other pending questions.
- Preserve questions for local commands and rejected submissions.
## Testing
Add regression tests for immediate and queued follow-ups, replay suppression, slash prompts, reviews, rejected input, and answer preservation across delivery and recovery. Add a snapshot of the composer after questions are cleared.
GitOrigin-RevId: 76353c6ee098c1505678ac43b1dc6391ea9fa738
## What changed
Remove the TUI command introduced in https://github.com/openai/codex/pull/11512 for granting sandbox read access to additional directories, along with its event handlers and non-elevated read-root grant helper.
## Testing
Enable the existing voice command popup snapshot test on Windows as well as macOS.
GitOrigin-RevId: 8a3a06b76749420101e34aa6587a8beab8eb5fdd
## Why
Saved model selections can outlive their bundled catalog entries and still need migration guidance.
## What changed
- Remove `gpt-5.2` and `gpt-5.4-mini` from the bundled model catalog.
- Preserve migration from saved `gpt-5.4-mini` selections to `gpt-5.6-luna` when the old model is absent, while respecting catalog-provided migration metadata.
- Update tests and snapshots to use current models or explicit test fixtures, and remove the obsolete prompt fixture.
## Testing
Extend migration tests to cover catalog metadata precedence, saved selections, replacement model and reasoning-effort persistence, acknowledged prompts, and missing or hidden migration targets.
GitOrigin-RevId: 82beea504cc4a15699677c28a61ec0939af3069c
## Why
Rendering the voice strip over sparkle stars can leave voice indicators with a star's color even when their glyphs are unchanged.
## What changed
Render the voice strip after effort ignition and before sparkle effects so stars skip its text and preserve its styles.
## Testing
Add a regression test comparing all nonblank composer cells, including their styles, across 80 sparkle frames while confirming stars still appear. Add a snapshot of the active voice composer.
GitOrigin-RevId: 48774408646c1281df3a6f7b1e12ab9d03a1babd
