## Why
Tests need to distinguish slow subprocess startup from operation timeouts and wait for asynchronous work before asserting results or cleaning up fixtures.
## What changed
- Synchronize subprocess readiness, queued-turn completion, and matching UI events; allow more time for cold startup and separate startup from shutdown deadlines.
- Adapt Windows fixtures and permission expectations, provide the voice-host test runtime DLL path, and normalize platform paths and animated status snapshots.
- Use current configuration permissions when changing directories in embedded TUI sessions, while retaining saved permissions for remote sessions.
- Allow the release prompt-prefix comparison to accept the exact image-tool description update that removes image detail options, and refresh the corresponding tool snapshot.
## Testing
Extend inherited-session metadata coverage to both legacy and paginated thread history, including persisted history mode and revision-aware resume.
GitOrigin-RevId: 0afb38403fc0adb0d83175344749584f0cdf9979
## What changed
- Add `currentAccountOnly` to `thread/list` and `thread/search`, defaulting to `false`, and enable it for TUI history discovery, resume pickers, and task mentions.
- Mark newly created threads as account-scoped and require each recorded creator user or account ID to match the current login. Older threads and threads without creator IDs remain shared; API-key logins continue to see all local history.
- Preserve account scope through resume and revert, including fallback to original rollout metadata when an older binary drops the marker. Forks receive new-thread scope.
- Skip unreadable rollout headers in scoped discovery and filter search candidates before reading snippets. Direct access by thread ID remains available.
## Testing
Add coverage for account matching, shared legacy history, list page refilling, search pagination, API-key visibility, and scope preservation across reverts. Extend rollout lookup coverage to compressed active and archived files.
GitOrigin-RevId: aa374f5e69165be5a71c0716ded1b105f5fb51e0
## Why
Managed command policies need to require a human decision independently of automatic review, hook allowances, and saved approvals.
## What changed
- Support `decision = "prompt-user"` in managed `requirements.toml` prefix rules, requiring a fresh, one-time human decision for matching commands.
- Add experimental `humanCommand` approval requests for clients advertising both `experimentalApi` and `requiredHumanApproval`. Accept only `accept`, `decline`, or `cancel`; reject commands when no capable client is available.
- Restrict responses to capable clients that received the request, and replay pending prompts to compatible clients on reconnect.
- Enable the capability in the TUI and update protocol schemas and client bindings.
## Testing
Add coverage for fresh decisions overriding saved allowances, hook allowances, and automatic review, plus child-thread approval routing and rejection of responses from incompatible or unrelated clients.
GitOrigin-RevId: 0b95ff6aab7f8a04b7298c8a4329d1fddf6a603e
## What changed
- Validate inherited options before and after the `queue` subcommand, with explicit errors for unsupported flags and positional prompts.
- Reject `--model` and `-c model=...` because queued messages use the thread's model.
- Allow `--cd` for local server startup, but reject it with `--remote`.
- Hide unsupported inherited options from queue help and clarify the scope of startup configuration overrides.
## Testing
Add regression coverage for unsupported options in both argument scopes, model configuration overrides, remote `--cd` conflicts, and queue help output. Preserve coverage for overrides that bypass a running local daemon.
GitOrigin-RevId: 703ba26f38930a01559847e66e1af3d0d338d1e9
## What changed
Add `codex queue --resume` to resume an unloaded thread after queueing a message through the local daemon or selected `--remote` server. Already loaded threads are left running. If resumption fails, emit a warning while preserving the successful queue result.
Read only the thread status when checking whether to resume, allowing remote metadata to contain paths from another operating system.
## Testing
Extend CLI integration coverage for unloaded threads consuming queued messages, archived thread rejection, and successful queueing when another server owns the thread and rejects resumption.
GitOrigin-RevId: cc8aa3c11a37e990da36e6ff9a17934f73322e7b
## What changed
- Add `attachToSource` to `thread/fork` to persist a fork attached to its source without emitting `thread/started`. Attached forks require local storage and cannot use `ephemeral` or `deferGoalContinuation`.
- Hide attached threads from ordinary listings and add `attachedToThreadId` to `thread/list` for explicit discovery, including empty threads. Keep this relationship separate from spawned-agent parent and ancestor filters.
- Persist attachment metadata in rollouts and SQLite so it survives restarts and database recovery. Reject source deletion until its attached threads are deleted.
## Testing
Add coverage for legacy and paginated history, restart and missing or corrupt database recovery, filtered listings and pagination, resume, conflicting options, and deletion safeguards across store instances.
GitOrigin-RevId: 589f3174fc36f6054e75d65818360695645a5913
## Why
Clients displaying a saved manual thread order need to list the remaining threads without repeating those already loaded separately.
## What changed
Add optional `excludedThreadIds` to `thread/list` and the generated protocol bindings. Apply exclusions before the result limit, refilling pages until the requested limit is reached or history is exhausted while preserving existing filters and ordering. Clients must send the same exclusions on each page.
Accept up to 100 entries, counting duplicates toward the bound. Reject invalid IDs or oversized lists with JSON-RPC error `-32602` rather than truncating them. Omitted, null, and empty lists preserve existing behavior.
## Testing
Add integration coverage for page refill across database-only and scan/repair paths, archived threads, sort directions, and project/section scopes. Cover duplicate and unknown IDs, the 100-entry boundary, invalid input, and preservation of section order.
GitOrigin-RevId: e9a884e642ae25d166aff7e275469d1d43179c6c
## Why
Session commands with `--remote` should use the selected server's authentication and execution environment, even when the caller has workload identity configured and cannot read its identity token.
## What changed
Connect `queue`, `archive`, `unarchive`, and `delete` directly to the explicit remote app server after validating configuration. Skip caller credential and runtime initialization, use remote thread parameters, and preserve the caller's working-directory override.
## Testing
Add end-to-end coverage with an unreadable caller identity token to verify queued turns use the server's API key and remote archive, unarchive, and deletion operate on the selected server. Add configuration-validation coverage for all four commands and `--no-daemon` rejection coverage for remote unarchive and delete.
GitOrigin-RevId: 5da7abbb40506cd754a8863e1a9d8fad9b1f09a9
## What changed
- Add `codex queue --thread <THREAD> --message <TEXT>` to submit a text message through the `thread/queue/add` app-server API.
- Resolve active sessions by UUID or exact name across interactive, exec, and custom sources, and reject ambiguous names.
- Support local and explicit remote app servers while reporting incompatible servers and configuration overrides instead of silently changing the target.
- Reject empty messages and image attachments.
## Testing
- Add CLI coverage for remote submission, validation, unsupported servers, and local-daemon routing.
- Add session lookup and queue tests for stale, non-interactive, custom, and duplicate session names.
GitOrigin-RevId: 44c233f752b63a85c85b92fa6da303336e4ddeca
Dmitriy Kovalenko