## What changed
- Stage Cloud speed choices for the next new turn in the conversation, alongside pending model and effort selections. Update the displayed conversation speed after admission without changing the local default.
- Offer speed commands supported by the pending model. Clear an incompatible pending speed change with a warning when switching models.
- Carry `service_tier` through Cloud message requests, preserving omission to inherit the thread tier and explicit null to clear it. Translate `default` to null and reject tier overrides on queued requests.
## Testing
Add tests for Cloud speed toggling, model-dependent speed choices, admission-time updates, and preserving the conversation tier when selecting a model. Extend request and wire tests to cover service-tier values, explicit clearing, and queue rejection.
GitOrigin-RevId: b4daa701f1fe29593d90a938e60cc20cb980298a
## What changed
- Create WebRTC calls using the TUI's local provider and credentials, then attach the app server through `existingCall` with the returned call ID.
- Preserve the effective voice preference and share realtime prompt preparation and thread headers between call creation and the backend observer.
- Run negotiation asynchronously, cancel pending startup when voice stops, and ignore results from stale startup attempts.
## Testing
Update voice request and handoff tests for client-created calls. Add coverage ensuring that canceling and restarting voice attaches only the new attempt, including when an earlier result is already queued.
GitOrigin-RevId: b704976f4918dddd24a17fbaa868a7c62e81885b
## What changed
Rename `SidebarLayout::Chooser` to `SidebarLayout::Panel` and use panel helpers for geometry, transcript visibility, focus routing, and shortcut hints. Retain `chooser_focus()` for chooser-specific logic.
When changing panel focus, reuse the pane's visible content instead of explicitly selecting `SidebarContent::Chooser`. Update existing sidebar tests to use the renamed geometry helper.
GitOrigin-RevId: ee6180bad691da3a76bd23835077aeb11c7d969d
## Why
Unfocused chat panes reduced status content to a single dim line, hiding rows that were visible while focused.
## What changed
- Share status measurement, wrapping, rendering, and footer row allocation between the main conversation and side chats.
- Retain structured status content in inactive side chats so native and extension status lines can use the available rows and reflow when resized.
- Keep unfocused status content dimmed with hyperlinks suppressed, while respecting space reserved for the draft and footer hints.
## Testing
Add regression coverage for status reflow across split-pane focus switches and resizing, and update extension status coverage to verify multiple dimmed rows when unfocused.
GitOrigin-RevId: f4def37259fe106d6a3fac9fe4c6cc2d4972f244
## Why
A lost Cloud reply stream previously required reopening the conversation, even when it was idle. Recover the displayed conversation automatically while holding queued input until its reply stream is usable.
## What changed
- Add bounded retries for transient stream failures in the displayed, idle conversation, with credential and network-policy checks. Keep explicit reopen behavior when recovery is unavailable or fails.
- Enable HTTP/2 keepalive pings for Cloud connections.
- Queue input while disconnected and resume ordinary submission after recovery. Mark recovered history as potentially incomplete so an explicit reopen reloads missed turns while preserving drafts and reconciling pending submissions.
- Store retained input per backend and apply background settings updates to the owning backend's drafts.
## Testing
Add regression coverage for queued input during disconnection and extend resume and backend-handoff tests to cover history refresh, draft preservation, and retained settings.
GitOrigin-RevId: 3d753e53d3c0d594680a90cac8a75fe33b91e219
## Why
Command Center retains tasks across backend switches. Opening a retained task must use its owning backend, and restoring its draft must account for history or settings that changed while another backend was displayed.
## What changed
- Track each thread's first observed backend, reject conflicting ownership, and switch to the owning backend when opening a retained task. Require users to open tasks on other backends before running task actions.
- Keep discovery cursors, initialization, and pins per backend. Scope refreshes and usage requests to their owner, and handle background archive and delete notifications without consuming the displayed backend's pagination budget.
- Verify cached blank sessions are still idle and have no turns before reusing them, with a history-read fallback for older servers. Otherwise, resume saved history and preserve current server collaboration settings when restoring drafts.
- Use only interactive task-list pages for cloud discovery, which does not support the additional source filters.
## Testing
Add regression coverage for ownership conflicts, action routing, pins across backends, background removals, usage isolation, cloud discovery, and draft restoration with blank or populated history, including older-server fallbacks.
GitOrigin-RevId: 0d0913ec38dc16a839823008a4a84aa46ad8e6c6
## Why
Threads need a visible title while automatic generation is pending or fails. Hidden title-generation requests must also stay out of the foreground conversation, including during skill installation prompts.
## What changed
- Immediately display a Markdown-stripped, single-line excerpt of the first message, capped at 60 characters. Replace it with the generated title, or save the excerpt if generation fails or returns an invalid title.
- Give title threads explicit read-only permissions and request the `never` approval policy, subject to managed policy constraints. Keep blocking input requests on the hidden thread until timeout.
- Interrupt timed-out temporary structured turns before detaching them.
## Testing
Add coverage for provisional title replacement, fallback persistence, managed permission and approval policies, and hidden input requests. Add a terminal integration test that verifies title generation after choosing “Continue anyway” on a skill installation prompt.
GitOrigin-RevId: f408f3061e5e7f0d9d6bc1f2f9674303e9e68400
## What changed
Make “Yes, clear context and implement” save the approved plan as an app-server attachment and submit a short prompt referencing it. Add the experimental `thread/prepareApprovedPlan` request to verify that the fresh thread's executor can read the file and that its contents match the approved plan.
If the attachment cannot be written or read, inject the complete plan as `proposed_plan` tool output within the model's context and truncation limits. If the complete plan cannot fit, report an error and keep the current session. Clear the UI and switch threads only after plan preparation succeeds.
## Testing
Add TUI tests covering a large plan read from its attachment, complete fallback context when attachment writes or reads fail, and preservation of the original session when the fallback is too large. Snapshot the fresh thread's initial request.
GitOrigin-RevId: b717f30359256994c6efb3f4fe7f87aabe8936af
## What changed
Move permission selection into `codex-config` with a shared `PermissionConfig` representation for legacy sandbox settings and named profiles. Resolve selectors using config layer precedence while preserving explicit session profile selection and sandbox mode overrides.
Share legacy permission translation between config derivation and core loading, preserving merged workspace roots, network access, temporary-directory exclusions, and platform sandbox availability without modifying source layers or field origins.
## Testing
Add coverage for mixed selector precedence, merged legacy settings, unchanged source metadata, and the Windows read-only fallback. Extend the managed preferences loader test to verify settings merged across layers and the absence of an active named profile for legacy permissions.
GitOrigin-RevId: a435be7af38424ac33711e6a7557f52b9b672577
## Why
Narrow composer footers can clip hints or crowd out mode indicators and actions.
## What changed
Use a shared layout for navigation, actions, mode indicators, context, and warnings. Shorten or drop whole labels in priority order instead of clipping them. Add a second row when input modes and queue or active side-conversation actions fit separately but not together, keeping navigation and modes above actions.
## Testing
Add coverage for fullscreen and scrollback layouts, narrow Plan mode hints, active side-conversation actions, oversized goal indicators, and warning hit areas.
GitOrigin-RevId: 849a53d45ef1b36b40c52282e329b48ec7d7d12e
## Why
Long built-in status lines were truncated to a single row even when the footer had room for more content.
## What changed
- Wrap status text to the available width and row budget, preserving styles and hyperlink targets across rows.
- Show an unlinked ellipsis when content exceeds the available space.
- Refresh wrapped content when the status text, agent label, or width changes.
- Keep reasoning-effort transitions on one row and restore wrapping after the final animation frame.
## Testing
Add coverage for wrapping and hyperlink boundaries across footer layouts, content and agent-label updates, resizing, and wrapping restoration after an effort transition. Update transcript and startup snapshots for multiline status text.
GitOrigin-RevId: 30e0795c473efd62fc4d0dca4deb6029b625a9e8
## Why
Status content and footer hints need to fit within the composer's height budget while preserving room for editing and active search controls.
## What changed
- Share row allocation between composer measurement and rendering. Cap status and hints at two rows in inline scrollback, and scale the fullscreen cap from two to four rows with the available budget.
- Reserve space for active footer controls, give suggestions and image previews priority over additional status rows, and avoid reserving an empty hints row when status is enabled.
- Keep textarea row counts and scroll offsets as `usize`, saturating only the terminal height so very tall drafts remain scrollable with a visible caret.
## Testing
Add layout and snapshot coverage for constrained height budgets, status and hints, image previews, slash suggestions, and transcript search cursors. Add a regression test for rendering a draft beyond the `u16` row limit.
GitOrigin-RevId: 20fb0384ffc976dfd12e648004763feff0597dda
## Why
Composer hints could replace configured status content, and mode indicators and warnings reduced the width available to status extensions.
## What changed
- Give enabled status content a dedicated area below the composer in both inline and fullscreen layouts, preserving it during transient hint states.
- Keep shortcuts, queue hints, mode indicators, and warnings in the hint row.
- Measure extension status content at the full available width, allowing up to four rows while yielding space to the composer when height is limited.
- Suppress composer hints behind centered dialogs.
## Testing
Update layout assertions and snapshots for status persistence, extension resizing and clipping, warning placement, and reasoning-effort transitions.
GitOrigin-RevId: f11c2e4fb53c35b69c2fbdbe80cef31bb28faca4
## Why
A live parent thread continues receiving lifecycle notifications while its side chat has focus, so returning to it does not need another liveness read.
## What changed
- Skip the parent liveness read when returning from a side chat while the parent is still attached and online. Keep the read when reattachment is needed.
- Stop scheduling a deferred screen clear when handling a transcript reset that preserves the screen.
## Testing
Add regression coverage for parent `thread/read` requests with and without reattachment, and assert that side-chat navigation leaves no deferred screen clear.
GitOrigin-RevId: a07f161ec86b0ae51250c5a0156402d328c42bdf
## What changed
Add experimental `environments` fields to `turn/settings/update` and `thread/settings/update`. Turn updates apply to later steps of the running turn; thread updates apply to future turns. Omission or `null` preserves the selection, while `[]` clears it. Providing `cwd` in a thread update without an environment list selects the defaults for that directory.
Include the ordered environment selection in `thread/settings/updated`. Wait for Core to accept thread settings updates before returning success, and return rejections as request errors.
## Testing
Add integration coverage for attaching, replacing, preserving, and clearing environments; rejected updates; and the distinction between later steps and future turns.
GitOrigin-RevId: bfebeda57c676be94427aeb0c567c0b94fd9c387
## Why
Cloud conversations previously used the model returned on activation without exposing model discovery or supporting model changes from the TUI.
## What changed
- Fetch the account-scoped Cloud catalog on demand through `/v2/models`, independently of the submission and attachment queue.
- Let users stage a supported model and reasoning effort for the next new turn in the current conversation. Send these settings with the user message and show acceptance after successful admission.
- Show a loading picker when the catalog is empty, preserve compatibility with Cloud servers that lack discovery, and discard stale catalog results and selections when the account changes.
## Testing
Add coverage for catalog request parameters and queue bypass, deferred discovery and compatibility, model and effort serialization, admission outcomes, account invalidation, and opening the picker after discovery.
GitOrigin-RevId: 2cd0e7fe5f760d4da9258eefe9f0dcbcd23f9b07
## What changed
- Replace footer chord hints with a floating guide that shows available completions after a 350 ms delay, including custom prefixes.
- Share guide rendering across conversations, transcript overlays, the session picker, startup drafts, hook review, and daemon recovery. Preserve workspace-specific pane labels and filter startup drafts to supported actions.
- Adapt the guide to short inline viewports, retain `Esc` cancellation, and redraw when pending chords clear. Consume clicks on the guide so they do not activate controls beneath it.
## Testing
Extend tests and snapshots for delayed reveal, timeout, custom prefixes, compact and inline layouts, startup-safe completions, and picker redraws after chord completion or cancellation.
GitOrigin-RevId: afa2fe3ae1b5fbea4cd871c17d35206e749c842c
## What changed
- Add cloud archive and unarchive requests and support listing archived threads.
- Detach successfully archived threads and emit archive notifications. Report loaded cloud threads from live attachments rather than cached resume metadata, including after archive failures.
- Scope resume picker archive state and transcript previews by backend and thread so archiving a cloud session preserves a local session with the same ID.
- Limit cloud task archive cleanup to the selected thread, preserving child agents and their active session state, and update the confirmation text accordingly.
## Testing
Add regression coverage for archive acknowledgments, archived-thread discovery and restoration, attachment state after archive failures, same-ID sessions across backends, and preservation of attached child agents.
GitOrigin-RevId: bd155be85ee911375d4d326b18f9b5abe8e82b3d
## Why
Locally configured MCP servers may differ from those reported by the app server. Waiting for unreported servers can leave startup progress busy after the observed servers have finished.
## What changed
- Track startup progress from received server status updates, settling when no observed starts remain pending. Handle standalone outcomes after attachment or lag, deduplicate repeated diagnostics, and reactivate progress on new starts.
- Read effective MCP configuration through `config/read` to prevent task tools from shadowing the `codex_tui` namespace, including when configuration changes after startup.
- Use the same configuration reader to disable MCP servers for temporary structured threads.
- Remove client-side MCP requirement checks for the task-tools server and MCP requirements from debug configuration output, leaving enforcement to the app server.
## Testing
Update regression coverage for unreported local servers, startup rounds after lag, diagnostic handling, namespace conflicts, and server-enforced managed requirements.
GitOrigin-RevId: 370767b90ee55f8b0b1403872ef437d53257586b
## What changed
- Show a refusal status while preparing alternative suggestions and remove the pending notice above the composer.
- Clarify that choosing a rewrite starts a new chat with earlier context, and update overview suggestions to explicitly say users can ask Codex.
- Add an option to report safety-check concerns through the consent flow when reporting is enabled.
## Testing
Update safety recourse snapshots and extend coverage for reporting consent, returning to the picker, and Daybreak notices when enabled or unavailable for the selected model.
GitOrigin-RevId: 99f565ebec7064ec55d388e73acede2dfe639474
## Why
Opening a saved side chat waits for thread resume and history loading. Keep the chooser usable during that work and switch conversations only if the user still wants to open the chat.
## What changed
- Prepare saved chats in the background and show opening, waiting, and retry states in the sidebar. Allow cancellation and keep only the latest queued destination, with at most two preparations in flight.
- Ignore stale completions after navigation, archiving, disconnects, or backend changes, and release unclaimed subscriptions on their original connection.
- Preserve live events, settings, read receipts, and pending approvals received during loading. Anchor paginated history to the resumed snapshot to avoid overlap with live events.
- Carry held-key suppression across conversation switches.
## Testing
Add regression tests for retry and supersession, cancellation, stale completions, subscription cleanup, live updates during attachment, and held keys, plus snapshots for waiting and retry rows.
GitOrigin-RevId: 2c7d94482078f16895049ce79b242d3eb0d92f40
## Why
Title and content searches exclude attached threads, preventing clients from finding their saved conversations alongside ordinary threads.
## What changed
- Add `includeAttachedThreads` to `thread/list` and `thread/search`. For `thread/list`, require a non-empty `searchTerm` and preserve the usual provider and source filters.
- Expose `attachedToThreadId` on thread responses to identify the owning parent independently of fork and subagent lineage.
- Support inclusive searches through SQLite and filesystem fallback, repairing missing database entries with saved thread names during title searches.
## Testing
Add regression coverage for opt-in title and content searches, attached-parent metadata after restart, default search filters, filesystem searches without SQLite, and discovery and repair of unindexed title matches.
GitOrigin-RevId: ac12ec3c730ad7f1722bdf8e21600d17f12017f0
## Why
A failed side chat's opening prompt and image attachments could be restored into the parent chat's draft when dismissing the failure.
## What changed
Clear the pending opening message when sidebar chat creation fails, and stop restoring the opening message when side conversation creation returns an error.
## Testing
Update the sidebar chooser test to verify that dismissing a failed creation preserves the parent draft and a subsequent prompt without restoring the failed prompt or its image attachment.
GitOrigin-RevId: 1423786b2209e9441e0bc1504ffcf51e74ba7cde
## What changed
- Fold earlier commentary, reasoning, and tool activity beneath an expandable prompt control in the full-screen transcript, keeping partial and final answers visible.
- Label the control with completion timing when available, or a previous-message count otherwise. Keep tool groups independently expandable within the turn.
- Preserve assistant message phases during live completion and replay, and retain untimed completion markers to identify completed turns.
## Testing
Add transcript coverage for nested expansion, keyboard and mouse controls, narrow viewports, search anchor preservation, detailed mode, and legacy messages without phase or timing metadata.
GitOrigin-RevId: b17d9d7c870990178d76d12a13d463ff9c32b96c
## What changed
- Add `tui.collapse_turn_details`, disabled by default, and a “Collapse turn details” toggle in the full-screen settings panel.
- Summarize command executions with output-free labels, grouping multiple calls behind an expandable row. Keep full details available through transcript search and detailed view.
- Restore interruption notices at their turn boundaries when resuming and loading older history, including turns split across pages.
## Testing
Add coverage for live summary updates, expansion controls, search access to hidden output, settings visibility, and interruption ordering across history pages.
GitOrigin-RevId: 68987fb0239e39414dac383098acac190fc4f516
## What changed
- Let users press `Ctrl+S` in the report note editor to save a diagnostic ZIP locally without sending it to OpenAI, including when uploads are disabled. Keep `Enter` for sending reports when uploads are enabled.
- Apply the attachment consent choice to both destinations, clarify the disclosures, and show the saved archive path on completion.
- Require a local app server for ZIP saves, report unsupported servers with an upgrade hint, and stop before collecting a note when no report destination is available.
## Testing
Add coverage for ZIP creation with and without log consent, no upload requests on save success or failure, destination availability, keyboard actions, and saved-path receipts. Update report UI snapshots.
GitOrigin-RevId: cbc0142988840e5e3f6475f31678915bf25d56a2
## Why
Switching to a model whose access metadata excludes Daybreak can leave Daybreak enabled and block subsequent turns.
## What changed
Automatically turn Daybreak off when a model switch or catalog refresh confirms that it is unavailable for the selected model. Persist the disabled preference for the thread and new threads, and warn that prior cybersecurity context may still cause refusals. Switching back to a compatible model leaves Daybreak off until the user re-enables it with `/daybreak`.
Require explicit access metadata before disabling Daybreak, and recheck the selected model before applying a queued change.
## Testing
Extend session lifecycle coverage for pending model discovery, supported and unknown models, persisted disabling, and subsequent turns using the standard access program. Add a snapshot of the model-switch warning.
GitOrigin-RevId: 6c294939d854c7176ed9a346e8ea806ffcf6f715
## What changed
Mark `untrusted_as_tool_output` as stable and enable it by default. Untrusted additional context, such as browser information and goal objectives, now reaches the model as `function_call_output` items in the `agent` namespace instead of user messages. Setting `features.untrusted_as_tool_output = false` preserves the message format.
## Testing
Update core, app-server, TUI, and Python SDK test expectations for the default output format. Cover context persistence, deduplication, goal continuation, and explicit opt-out behavior.
GitOrigin-RevId: 30828351e2ed584928f6055b6dcf276d8288c0fb
## What changed
Submit asynchronous question answers through Cloud's start-or-steer admission path when a turn is running, and use start-if-idle submission otherwise. Resolve the submission intent against the session mode so local and remote sessions retain their existing behavior.
Apply normal message admission handling to Cloud answers, clearing accepted replies and restoring rejected replies to the composer.
## Testing
Add a regression test covering accepted and rejected Cloud question replies, including the submitted answer and client message ID, composer state, and absence of extra requests.
GitOrigin-RevId: 757556e8a11bc148a92cde8ca05fe06aa291ee2c
## Why
URLs in fullscreen Markdown transcripts could split across rows even when the full URL would fit on its own row.
## What changed
Mark non-code Markdown lines containing URL-like text with the `UrlAware` wrap policy so transcript layout preserves fitting URLs on a single row.
## Testing
Add a regression snapshot showing a documentation URL moving intact to the next row after introductory text. Update the conversation snapshot and copy-on-select test dimensions for the changed wrapping.
GitOrigin-RevId: 4812c83483cff412406a71ae6745977c5384c7da
## Why
After Cloud thread history is replayed in the TUI, notifications for the same completed assistant items can render their text again.
## What changed
Track completed assistant items rendered from Cloud history by turn and item ID, and ignore subsequent starts, text deltas, and completions for those items. Apply this tracking when resuming threads and replaying thread snapshots, while allowing unfinished items and new turns to continue streaming.
## Testing
Extend the Cloud resume picker test to cover repeated notifications for completed messages, continued streaming in an active turn, and responses in a later turn. Retain coverage for queued user message reconciliation without resubmission.
GitOrigin-RevId: 1a829a2964586d876339c7c759022e4d366c8b2e
## Why
A queued cloud stream disconnect can outlive a successful reopen of the same conversation, causing an obsolete reconnect error to reach the TUI.
## What changed
Represent cloud reply stream losses with `AppServerEvent::ThreadStreamDisconnected` and filter queued losses superseded by a successful attachment to the same thread. Preserve losses for other threads and any newer disconnects; failed reopen attempts do not supersede pending losses.
Continue displaying current stream disconnects through the TUI's error notification handler.
## Testing
Add regression coverage for successful and failed reopens, disconnect ordering across threads, and TUI handling of disconnect events from the active and foreign backends.
GitOrigin-RevId: 640332b817970717fc816ab5a32bf658c01233bf
## Why
Failed Cloud turns can contain an error without any items. Loading history through item pages alone can omit these older failures from the full transcript.
## What changed
- Add a `FullTranscript` hydration scope that fetches remaining Cloud turn metadata in pages of 100 after loading items.
- Deduplicate overlapping turn pages while preserving chronological order and already loaded items.
- Use the new scope for session transcripts while retaining `Complete` hydration for exports.
## Testing
Add a regression test covering older itemless failures, overlapping turn pages, repeated pagination cursors, transcript ordering, and item-only exports.
GitOrigin-RevId: 51183e35984aa0183d044061768555bb6f5d1189
## What changed
- Show latest user-prompt previews beneath saved side-chat titles, fetching previews only for visible entries when the chooser refreshes.
- Keep cached chats available during discovery, show loading and refresh status, and offer an inline retry action on failure.
- Preserve the selected chat across list updates and prevent asynchronous changes or held activation keys from opening an unintended entry. Account for preview rows in paging and mouse selection.
- Explain that side chats become available after the first main-chat message, and let `Ctrl+C` dismiss the chooser while preserving the main draft.
- Separate tabs with noninteractive gaps and improve hover styling for tabs, overflow arrows, and the add button.
## Testing
Extend integration tests and snapshots for discovery failures and retries, refreshed prompt previews, activation guards, variable-height paging, draft preservation, and tab hover states across light, dark, and fallback colors.
GitOrigin-RevId: 34423f5aeccb566682f7aa219f54ca5c7c8304fb
## Why
Command center search only filtered tasks already loaded for browsing, leaving older tasks undiscoverable without manually loading more history.
## What changed
- Scan history on the active backend for case-insensitive matches in task names, previews, and working directories, using a separate paging cursor for each query.
- Add loading, retry, and `Show more matches` states. Cancel superseded searches and ignore stale results.
- Keep history matches separate from browse results and restore the previous selection when leaving search.
- Preserve the original task preview for search while displaying the latest prompt in task details.
## Testing
Extend discovery and command center tests to cover older history matches, fresh queries after browse pagination is exhausted, selection restoration, actions on search results, loading and retry states, and separate original previews and latest prompts.
GitOrigin-RevId: 9864ee006a14bd232e9cfd7ab2ee099c84667597
## Why
Clients attaching to a shared app server can miss startup notifications and have a different local MCP configuration. Waiting for locally configured servers can leave the TUI stuck in a busy state.
## What changed
- Track only reported MCP servers for shared app servers and subagents, settling startup once observed starts complete.
- Handle standalone terminal updates without reopening startup, while reporting failures and cancellations even when their starts were missed.
- Suppress duplicate diagnostics until an observed retry or notification lag, and include all received outcomes in each active round's summary.
## Testing
Add regression coverage for attachment before, during, and after startup; idle keyboard behavior after startup settles; terminal-only failures and cancellations; and repeated failures after retries or notification lag.
GitOrigin-RevId: e19f23c212f2f3cee1adeb5c3b94a508aa599242
## What changed
Only allow the cancel action to dismiss the agents overview when a chat is displayed or a startup thread is pending. Hide the `esc back` footer hint when there is no chat to return to, while retaining back hints for help and metadata editing.
## Testing
Add coverage for returning to a chat that is still starting and for pressing Escape in the overview after cancelling folder trust. Update snapshots and test setup to reflect whether a chat is available.
GitOrigin-RevId: af259330eb2a743fde449bbbd47c7f0eb6fa937e
## What changed
Show a startup warning when the active model matches the CLI model override but is missing from the ChatGPT model list, for ChatGPT accounts using the OpenAI provider. Suggest checking the spelling or choosing another model with `/model`, while preserving the selected model and submitting queued startup input.
Reuse the transcript-visible warning helper for this notice and existing usage warnings.
## Testing
Extend the startup test to check the warning text, preserved model selection, and queued input submission.
GitOrigin-RevId: bb1e8c415346bf271e25ef4e8571c13b4bc2c8c8
## Why
Custom-provider sign-in previously required a saved gateway configuration and stopped at an error when none existed.
## What changed
- Add “Create a custom provider or gateway” to the sign-in picker, reusing the settings form and provider-write handling.
- Return to the picker after saving, highlight the new provider, and require explicit selection before setting it as the default and completing sign-in.
- Preserve entered fields after validation failures and keep the focused field or Save action visible in short terminals.
- Use consistent custom-provider and gateway wording across sign-in, settings, and validation messages.
## Testing
Add onboarding tests and snapshots for an empty picker, creation, validation retries, short-terminal rendering, and explicit default selection. Extend app-server coverage for rejecting the reserved `ollama-chat` provider ID.
GitOrigin-RevId: 339ac5807c5eecdae08df4dbd89874ea7c764d35
## What changed
- Add configurable `sidebar_up` and `sidebar_down` actions to cycle through tabs with wraparound while the sidebar has focus. Default leader shortcuts use `Shift-Tab` / `Tab`, `Up` / `Down`, and `k` / `j`.
- Support mouse-wheel tab switching over the tab strip and clickable overflow arrows when tabs do not fit.
- Show previous/next tab shortcuts in the leader HUD and keymap picker, and preserve pane zoom when switching tabs.
## Testing
Extend sidebar interaction tests and snapshots to cover overflow arrows, mouse-wheel navigation, leader shortcuts, repeated custom bindings, draft preservation, and scroll handling where the leader HUD overlaps the tab strip.
GitOrigin-RevId: 39ccb40f40560d1be850397f9597e765caa996a3
## What changed
- Save side chats as attachments to their parent conversation when local workspace history supports them, and let users reopen them from the sidebar after a restart.
- Show chat names or first-prompt previews in sidebar labels, and allow saved side chats to be renamed with `/rename`.
- Add tab close buttons, middle-click closing, and the configurable `close_sidebar_tab` shortcut, defaulting to `Ctrl-X W`. Closing a saved chat keeps it available in the picker; archiving removes it from Side chats.
- Confirm actions that stop running work, discard unsent input, or lose temporary history. Delete saved TUI side chats when deleting their parent conversation.
## Testing
Add coverage for reopening saved side chats after restart, archive handling, close confirmations, and preventing close-confirmation keys from accepting a replacement approval dialog.
GitOrigin-RevId: 3d47533d007286a7354660c08df13a83dd48d5d7
## Why
Security reminder requests need to use app-server's active authentication and HTTP runtime, with results bound to the login that fetched them.
## What changed
- Add `account/securitySetup/read`, returning an optional notice with account and user IDs, plus generated protocol schemas and bindings.
- Fetch reminders in app-server only for a matching saved ChatGPT login. Return `notice: null` for ineligible, unavailable, or timed-out reads, and discard results when the login changes during the request.
- Route TUI reminder reads through the new method while retaining notice validation and identity checks. Unsupported servers produce no reminder.
## Testing
Add coverage for shared runtime use across restarts, ineligible authentication modes, and login changes during a fetch. Update TUI coverage for unavailable, unsupported, and mismatched notices.
GitOrigin-RevId: 426fee7ce98df17970957c06876881bc5b005196
## Why
An inherited turn can suppress a fork's configured developer instructions, leaving the first side-chat request without its developer policy.
## What changed
- Move shared side-conversation instructions and the history boundary into `codex-context-fragments`.
- Inject the developer policy before the user-role boundary when creating a TUI side-chat fork, while retaining the configured instructions.
- Distinguish attached and temporary policies, applying the worktree restriction only to temporary side chats.
- Add guidance to set up recurring monitors in the main chat or a new chat because temporary side chats cannot run scheduled updates.
## Testing
Add a TUI integration test that checks the first side-chat model request contains the policy and boundary. Add a core request-history snapshot covering an attached side chat that preserves inherited context, policy, and its prior answer after resuming from disk.
GitOrigin-RevId: 889cb317dc3327457cd9ef0879ec9f77dbfaeeba
## Why
Cloud messages previously accepted only plain text, and switching a draft to Cloud waited for session preparation without processing composer input.
## What changed
- Support ordered text and image parts in Cloud submissions and user-message summaries, preserving attachment placeholders, image detail, and client message IDs.
- Accept inline data URLs and uploaded file IDs, including image-only messages. Reject invalid references and text spans locally, and cap encoded image requests at 3.75 MiB while retaining the existing plain-text limit.
- Keep the composer editable and redraw the TUI while Cloud prepares a conversation. Carry the latest draft, attachments, and Vim mode into the destination, retain drafts on failure, and prevent submission to the outgoing session during the handoff.
- Preserve buffered paste input and pending clipboard reads across the handoff, with connection and failure hints.
## Testing
Add regression coverage for image wire encoding, receipt identity, validation and size boundaries, draft editing during successful and failed handoffs, clipboard completion, Vim state, and attachment recovery after rejected submissions.
GitOrigin-RevId: 0cbcde0ab89ba961780b5f88456057e6b6a19cd5
## Why
Regular chats start MCP servers eagerly even when cached tool definitions are available and the servers go unused. Allow those chats to use the cached catalog and defer eligible stdio servers until first use.
## What changed
- Add the disabled-by-default `mcp_lazy_stdio_startup` feature and expose it through experimental feature configuration.
- Defer cached stdio servers in regular chats when enabled, while keeping servers that require a live startup connection eager. Required servers with `startup_readiness = "catalog"` may defer; explicit reconnects remain eager.
- Announce the full eager startup batch before terminal statuses and exclude dormant servers from the initial startup summary. Update TUI tracking so deferred servers can report startup independently in later rounds.
## Testing
Add scenario coverage for a cached server staying dormant during unrelated work, starting on first use, and refreshing tool definitions and visibility. Cover required live startup, eager event ordering, experimental feature configuration, and TUI status handling.
GitOrigin-RevId: 74075fcd4f26c8c79b5901b6a8cb03fdb9e35a7f
## Why
Enabling `tui_extensions_status_line` routed configured status lines through a plain-text extension renderer and hid the “Use theme colors” option in the status line picker.
## What changed
Always use the native status line renderer for configured items and their live picker previews, preserving theme colors and pull request links regardless of the extensions flag. Always expose the theme color option in the picker, and clarify that the flag enables experimental MCP status line providers.
## Testing
Update coverage to require native status line content across extensions flag changes and exercise the live picker preview with the flag enabled. Retain checks for pull request hyperlinks and color preference preservation.
GitOrigin-RevId: bce7df5696c2bd3583d3ef99c43e7a2014e17294
## What changed
- Add the disabled-by-default `gateway_setup_wizard` feature to let users choose a saved custom gateway during eligible local sign-in onboarding.
- Save the selection as `model_provider`, restart the embedded app server with that provider, and complete required primary authentication and gateway OAuth before starting the first chat.
- Show gateway loading and configuration errors, browser sign-in links, and an OAuth retry action. Respect provider policy and launch overrides.
## Testing
Add coverage for onboarding eligibility, saved gateway selection and persistence, and gateway error and OAuth screens. Add a terminal integration test verifying that the selected gateway receives the first chat with authentication.
GitOrigin-RevId: 92bd2da3abd28d6c2274c91b2d7561bf359f0ca0
## What changed
- Extract helpers for image paste shortcuts, paste-burst ticks, restricted draft edits, and composer activity detection.
- Thread `ShellPrefixHandling` through text insertion and pending-input flushing.
- Return a configuration rebuild future that does not borrow the app or base configuration.
## Testing
Add a regression test covering image paste while `!` is buffered: Enter preserves the draft during the paste burst, and subsequent submission includes the image and literal `!` without running a shell command.
GitOrigin-RevId: fb9a3c8a70aed524c65022f2c0910ce2ad11d4d2
## What changed
Pass the local project's GitHub origin to cloud prewarming so new cloud threads can provision a repository checkout. Preserve the attached local project when switching backends and resolve its origin for each thread start.
Normalize supported GitHub origins to credential-free HTTPS URLs and select a repository-specific cloud working directory. Unsupported origins retain the blank environment behavior. Keep project metadata outside the app-server wire protocol, and fix HTTP Git URL parsing so query strings and fragments cannot be mistaken for authority text.
## Testing
Add coverage for project routing, origin normalization and rejection, managed environment encoding, local project retention, and Git URL credential stripping.
GitOrigin-RevId: 5859769965faf060461ccc1cbb3fd48f8e2f2155
## Why
The sidebar chooser used hard-coded keys and hints instead of configured list bindings, limiting navigation and making custom shortcuts inconsistent.
## What changed
- Use configured list actions for chooser navigation, acceptance, and cancellation, including key chords, page movement, and jumps to the first or last choice. Show the configured shortcuts in footer and retry hints.
- Place “New side chat” first and group existing chats into compact rows with a count and optional thread colors. Keep the selected chat visible in short panes.
- Highlight inactive side-chat tabs on hover while preserving the selected tab's styling. Redraw when the hovered tab changes and suppress hover highlighting during pane resizing.
## Testing
Extend interaction tests and snapshots to cover custom acceptance chords, `j`/`k` navigation, paging, and tab hover styles and redraws with either pane focused, including the fallback when terminal colors are unavailable.
GitOrigin-RevId: bad992b3786215dcb5569acfc72af8841fad949d
Benjamin Carlsson