## Why
Restored app-server threads can carry permission profiles that cannot be
represented without loss as legacy sandbox-mode overrides. Sending those
profiles as per-turn overrides can discard their original permission details.
## What changed
- Distinguish restored permission profiles from legacy per-turn sandbox
overrides.
- Preserve restored profiles while routing turns and changing to compatible
working directories.
- Reject `/cd` when a restored profile cannot be represented safely by a
legacy sandbox mode.
## Testing
- Cover retaining a restored read-only profile across `/cd` without a turn
override.
- Verify that lossy sandbox-mode projections are detected.
GitOrigin-RevId: 6143dca4b83ab4f59bab05f6a59b4fe841c56192
## Why
Delegated prompts should retain the authority of the TUI tool that sent them instead of being recorded as user input.
## What changed
- Start delegated `create_thread` and `send_message_to_thread` turns with a namespaced tool output and an empty user input list.
- Recognize delegated outputs from trusted Codex namespaces when building activity summaries.
- Render replayed delegation outputs in history and transcripts with their source task attribution, without adding them to composer history.
## Testing
- Cover turn request encoding, namespace filtering, activity summaries, and replayed history/transcript rendering.
GitOrigin-RevId: aeb2f5c8ad2f2a898c80e8fc791ed879a0ab655d
## What changed
- Add an optional `toolOutput` to `turn/start` for starting or steering a turn with a named function-call output instead of user input.
- Emit standalone outputs as `functionCallOutput` thread items, persist them in durable history, and include them in resumed threads.
- Validate that tool outputs have a name, are not combined with nonempty `input`, satisfy the text-size limit, and use supported image URLs.
## Testing
- Cover standalone tool-output notifications, model input, and resumed history in both legacy and paginated history modes.
- Cover the text-size limit for structured tool output.
GitOrigin-RevId: a1eeec7b9b7de67b1a1c5e829a54552b85ec118b
## What changed
- Return the number of directories flagged by successful Windows sandbox world-writable scans.
- Record that count in the `codex.windows_sandbox.world_writable_scan_flagged_directories` histogram for startup and warning-triggered scans.
- Tag each measurement with a `success` or `error` result, using a count of zero when the scan fails.
GitOrigin-RevId: 076160f36b1d62fa737f4b2d0318774e6c44a4b1
## What changed
- Add the `write_stdin_approval` feature flag, disabled by default, to require a fresh approval before sending non-empty input to an escalated unified-exec terminal.
- Route these reviews through hooks, Guardian, app-server, and the TUI as `writeStdin` approvals while keeping the parent command item unchanged.
- Preserve the terminal environment, launch directory, and escalation state across turns, and revalidate the process identity after approval before writing input.
## Testing
- Cover approval routing, policy decisions, process reuse, terminal identity preservation, app-server events, analytics, and TUI rendering.
GitOrigin-RevId: 4ba29eaae6208e934737ba078c96e589c7c2164d
## What changed
- Add `gg` and `G` motions to jump to the first and last buffer lines.
- Support the motions with delete, change, and yank operators, including dot-repeat for edits.
- Expose normal-mode and operator-motion bindings in the configurable keymap while preserving conflicting user bindings.
## Testing
- Cover buffer jumps, operator combinations, repeat behavior, chord routing, and custom remapping.
GitOrigin-RevId: 24a9178cf7964053aaf9a8cd268c5434dda0778e
## Why
App-server clients need the explanation and steering instruction returned with a
misalignment policy violation to offer a user-confirmed continuation. Missing or
incomplete details must continue to behave as a terminal block.
## What changed
- Parse optional misalignment classification, explanation, and steering details
from streamed and HTTP Responses errors and propagate them through core errors.
- Include the details in live app-server `error` and `turn/completed` payloads and
export the corresponding protocol schemas and TypeScript types.
- Keep explanations and steering messages out of serialized rollout events and
redact them from debug output.
- Document how clients can resume with `turn/start` after user confirmation.
## Testing
- Cover streamed, HTTP, and WebSocket-wrapped errors, including malformed and
classification-only details.
- Verify live app-server notifications expose resumable details without writing
the explanation or steering message to the rollout.
GitOrigin-RevId: 329258a444c2cd91d0c57ab1720830b33ddcfac5
## Why
Stopping a task from the agents overview may need to look up its active turn. Paginated threads should use the turn history endpoint instead of requesting embedded full history.
## What changed
- Read the thread without turns first to determine its history mode.
- Fetch the first turn page for paginated threads when the app server supports it.
- Fall back to embedded turn history for legacy threads and legacy server negotiation.
## Testing
Added coverage for paginated and legacy threads, including fallback after legacy capability negotiation.
GitOrigin-RevId: 44d506b19e32c6b3c27fac11fb748c23b8e47b5e
## Why
Users returning to a conversation need a short summary of its recent progress and next steps.
## What changed
- Generate a recap for eligible idle, unfocused conversations and add it to the transcript.
- Add `/recap` to request the same summary on demand, with visible progress and actionable errors.
- Keep recap requests bounded and isolated, reject stale results, and retry only automatic failures.
## Testing
- Cover automatic and manual generation, request eligibility, failure handling, loading-state cleanup, and temporary-thread configuration.
GitOrigin-RevId: 926a88d6996d67a42809ce2c4091b13fca882b52
## What changed
- Schedule recap eligibility checks when an unfocused thread changes, and cancel them when focus returns or recap state is replaced.
- Add bounded structured recap requests with stale-result rejection, normalized output, and one retry per turn revision.
- Harden temporary structured threads by reading the effective configuration and disabling all discovered MCP servers, tools, skills, and environment access.
## Testing
- Cover recap timers, focus changes, failed turns, output bounds, stale results, and retry behavior.
GitOrigin-RevId: eebf50059763928e9a2444b14d51648e0bdff4a8
## What changed
- Forward terminal focus changes through the TUI event stream and handle them across interactive screens.
- Track completed turns and recap eligibility across active, resumed, and switched threads.
- Add bounded recent-conversation prompt construction and a wrapping `Conversation recap` history cell.
- Cover focus timing, repeat eligibility, restored progress, UTF-8 prompt limits, and recap rendering with unit and snapshot tests.
GitOrigin-RevId: d7542c18b2bb1e72f5906f563898645bb526255f
## Why
Paginated thread history should be loaded incrementally through
`thread/turns/list` and `thread/items/list` instead of being fully reconstructed
in `thread.turns`.
## What changed
- Emit `deprecationNotice` when `thread/read`, `thread/resume`, or `thread/fork`
requests full history for a paginated thread.
- Direct clients to omit `includeTurns` for reads or use `excludeTurns: true` for
resumes and forks, then page history through the list APIs.
- Document the deprecation in the protocol schemas and app-server README.
## Testing
- Cover notices for paginated reads, cold and loaded resumes, and forks.
- Verify metadata-only requests, legacy threads, and rejected forks do not emit
the notice.
GitOrigin-RevId: 0d387b46d73608f90b7960120a54af4ef332e510
## What changed
- Report `Session archived: <thread-id>` after successfully archiving the current session.
- Show the session ID when no resume hint is available, including for non-fatal exits.
- Keep deleted-thread exits distinct from successful archive exits.
## Testing
- Add coverage for archive lifecycle handling and exit-message formatting.
GitOrigin-RevId: 1812374e4c74fa1b3f11feb323de18a9dbff745b
## Why
Stream animation ticks generated on a background thread can accumulate while the
TUI is busy, causing stale ticks to run after the animation stops or the chat
widget is replaced.
## What changed
- Replace the animation thread and `CommitTick` app event with a Tokio interval
owned by the foreground event loop.
- Delay missed ticks instead of replaying a burst, and let pending app events run
before animation work.
- Drop the interval when animation stops or the chat widget is replaced, while
preserving `CommitTick` session-log entries.
## Testing
Add a paused-time test covering stable pacing, missed ticks, restart behavior,
and chat-widget replacement.
GitOrigin-RevId: d0561d3f8962b5e05a728463e76aa8ec83cd5a31
## Why
Exiting a TUI connected to a persistent app server can leave work running, so
the existing session-exit summary does not explain how to reconnect or stop the
active turn.
## What changed
- Distinguish disconnects, interrupted turns, and removed threads when building
exit summaries.
- For daemon and remote sessions, report whether work may still be running and
print commands to reconnect or stop the current turn.
- Sanitize remote WebSocket addresses in displayed commands and preserve the
configured remote authentication environment-variable option.
- Keep the existing token-usage and resume summary for embedded sessions.
## Testing
Add coverage for daemon, remote, interrupted, embedded, archived, and deleted
session exits, including credential sanitization.
GitOrigin-RevId: 9cbbf9c7dd36423a5ed99909a2b4cb32e3e87712
## Why
Closed agent channels can retain stale in-progress turns, which can incorrectly
block `/cd` or cause unnecessary background-terminal checks.
## What changed
- Mark agents closed whenever a `thread/closed` notification is routed, including
for inactive event channels.
- Exclude closed agents from running-turn detection and background-terminal checks
during working-directory changes.
## Testing
Cover directory-change recovery with both a routed close notification and a
replay-only closed thread that contains a stale in-progress turn.
GitOrigin-RevId: 1072456056f8c1a1b751a52635470b0be160d76c
## Why
The active goal's elapsed-time label could become stale while the TUI was idle because it was refreshed only as part of a redraw.
## What changed
- Refresh the goal status indicator when the terminal-title timer fires.
- Request a redraw only when the displayed elapsed-time label changes.
## Testing
- Add a regression test covering the minute transition and confirming that an unchanged label does not trigger another redraw.
GitOrigin-RevId: f10a1c2334cf7a5f1d2ee90d7138114479998c8d
## Why
Terminal title animations only need to update the title, but each animation tick
previously requested a full TUI frame.
## What changed
- Track the next terminal title refresh deadline on `ChatWidget`.
- Have the foreground event loop refresh the title when that deadline expires.
- Clear the deadline when title animations are disabled or the configured title is
empty.
## Testing
- Verify spinner and action-required animations set the expected refresh deadlines.
- Verify refreshing an animated title does not enqueue a TUI draw request.
GitOrigin-RevId: 269347cd48de4ad9ba9a0aef9ed105c25d1a7dae
## Why
Windows Terminal and xterm.js can render a theme that differs from the
underlying console color table. Querying that visible theme through OSC shares
the console input queue with keystrokes, including input for security-sensitive
startup prompts.
## What changed
- Defer the Windows OSC color probe until protected startup decisions and the
world-writable workspace scan have completed.
- Preserve and replay unrelated console input records around the probe, while
removing only valid OSC 10 and 11 replies and retaining the console palette
as a fallback.
- Require an explicit confirmation key after shortcuts select trust, sandbox,
or world-writable warning choices, so a fragmented terminal reply cannot
accept them.
- Accept one- through four-digit OSC RGB components so the visible terminal
palette is applied across supported response formats.
## Testing
Added coverage for delayed startup scans, protected prompt confirmation,
console-record replay, bracketed paste and malformed OSC preservation, RGB
response parsing, and light-theme composer rendering.
GitOrigin-RevId: b8ae456fe32c701ba3af31e9cc452fc4e8bffa22
## What changed
- Record collaboration tool analytics for `send_message`, `followup_task`,
`interrupt_agent`, and `list_agents`, including receiver attribution, duration,
failures, and interrupted calls.
- Include these calls in per-turn subagent tool counts while keeping the existing
`subAgentActivity` output unchanged and omitting additional public collaborator
tool items.
- Extend the collaboration tool schemas with the new tool variants and the
`interrupted` terminal status.
## Testing
- Add an app-server integration test covering successful and failed calls,
receiver attribution, duration, prompt omission, activity items, and turn
counts.
GitOrigin-RevId: e73eaa05c508261e5fc97e7d08d7881a31e04e22
## What changed
- Add Windows sandbox mode, private-desktop behavior, and legacy Landlock selection to each `EnvironmentConfig`.
- Centralize sandbox context construction on `TurnEnvironment`, preserving environment-owned permissions, paths, and backend settings while applying additional permission grants.
- Use the environment-derived context for project instructions, capability discovery, file uploads, and filesystem-oriented tools.
## Testing
- Verify capability discovery uses the selected environment's permission profile and sandbox backends when they differ from the thread defaults.
GitOrigin-RevId: 7ae2fed90c8ada950f2e8431e571e9b2c793c291
## What changed
- Add a `writeStdin` Guardian action carrying the approval, process, input, and working-directory details.
- Distinguish `command` and `writeStdin` execution approval requests while defaulting missing kinds to `command` for compatibility with older events.
- Render terminal-input review progress, denials, timeouts, and retry actions in the TUI, and record the action separately in analytics.
- Keep terminal-input reviews as child approvals so they do not change the parent command item's lifecycle or reconstructed history.
## Testing
- Cover Guardian serialization, app-server protocol conversion, command history reconstruction, analytics classification, and TUI review flows for terminal input.
GitOrigin-RevId: b083d5e2963bdd23b928644ec03c7eb68ebf2950
## Why
Clients need a bounded view of realtime conversations that preserves the order of speech, agent work, and turn lifecycle events without loading the full thread history.
## What changed
- Persist realtime session boundaries, transcript segments, and promoted agent items in paginated thread rollouts.
- Add the experimental `thread/timeline/list` API to page ordinary items, realtime items, and turn boundaries in canonical rollout order. Include `activeRealtimeSessionAtPageStart` so each page can be rendered independently.
- Emit typed `thread/realtime/item/started`, `thread/realtime/item/transcript/delta`, and `thread/realtime/item/completed` notifications around durable realtime items.
- Keep the existing `thread/items/list` response and legacy thread history behavior unchanged.
## Testing
- Cover mixed timeline pagination, realtime-session state at page boundaries, rollout replay, subagent history prefixes, transcript streaming, steering, and promoted agent artifacts.
GitOrigin-RevId: faa2c420192d63e060e8fb32446e3c797422656e
## What changed
- Generate a title suggestion from the latest substantive user and assistant messages when the TUI `/rename` prompt opens.
- Prefill the prompt with the result while keeping it editable and preserving any text the user enters before generation finishes.
- Bound and escape the conversation context, omit commentary and IDE context, and correlate responses with the active thread and prompt so stale suggestions are ignored.
## Testing
- Cover conversation selection and prompt construction, generated-title delivery through the embedded app server, loading and prefilled prompt states, stale responses, and preservation of manual edits.
GitOrigin-RevId: 1e7f1d5d4f6503ff9da0548388f610c446c130ca
## What changed
- Ignore `thread/started` notifications for ephemeral threads whose feature source is `system`, preventing hidden helper threads from entering TUI thread routing or refreshing the agents overview.
- Continue routing persisted system threads normally.
## Testing
- Add coverage for hidden and persisted system-thread notifications in the agents overview.
- Add generated-title normalization cases for wrapping quotes, trailing punctuation, and meaningful leading punctuation.
GitOrigin-RevId: e1ea48502b4f9aa7d5a187c7407df69c55abe2a9
## What changed
- Give unnamed TUI threads an immediate provisional title from the first user message, then replace it asynchronously with a normalized generated title.
- Preserve manual renames by applying a generated title only while the provisional title is still current, and keep automatic rename notifications out of the transcript.
- Run title generation in a bounded ephemeral structured request that preserves custom permission profiles, otherwise uses read-only access, and disables tools and MCP servers.
## Testing
- Cover prompt and response bounds, Unicode-safe truncation, title normalization, manual-rename races, silent automatic updates, permission preservation, and structured-response failures.
GitOrigin-RevId: 7ed73522f4f6c65a005f65f3a903974d8419e312
## Why
Multi-Agent V2 children are owned by their parent at runtime. Resuming an
unloaded child directly could rebuild it from caller-provided settings instead
of the parent's current authority.
## What changed
- Route child reloads through their loaded immediate parent and reject direct
cold resume when that parent is unavailable.
- Preserve the child's recorded model, provider, reasoning effort, and role
while inheriting the parent's execution policy and MCP extensions.
- Validate cached environments against the parent, intersect local permission
profiles, and reject stale remote or workspace-root configurations.
- Keep paginated cold-resume token usage attribution when attaching to the
reloaded child.
## Testing
Add coverage for owner validation, nested-parent reloads, permission and
environment changes, role instruction restoration, paginated usage replay,
and app-server child resume behavior.
GitOrigin-RevId: 84014762bcdb57f94fc23974c9c1af55dc1babf1
## Why
A Multi-Agent V2 child can finish after the parent turn that spawned it, so its
successful completion needs to remain associated with that parent turn in
notifications and history.
## What changed
- Add `completed` to `SubAgentActivityKind` and emit the corresponding started
and completed item events on the spawning parent turn when a child succeeds.
- Persist completed activity as a canonical turn item in both legacy and
paginated history, and expose it through app-server history and schemas.
- Render completed activity as terminal in the TUI without counting it as a
separate tool call or tool-runtime event.
## Testing
- Cover successful completion in legacy and paginated history, late updates to
completed parent turns, TUI rendering, analytics, and rollout tracing.
- Verify that terminal child errors do not emit completed activity.
GitOrigin-RevId: 6c71eb8b10e7327611c6af84f70e294e27d94d02
## What changed
- Include matching Codex tasks in the `@` mention popup when the active thread supports task tools, prioritizing tasks from the current working directory.
- Submit selected tasks as bounded live thread references so Codex can load their contents with `read_thread`.
- Preserve task mentions across composer history and thread start, resume, and fork flows.
## Testing
- Add coverage for task search and capability propagation, popup selection and rendering, submission encoding, history round-trips, and reference validation and limits.
GitOrigin-RevId: 17502be91bf6d4b01745668829eb69fb318cb5b9
## Why
The TUI rejected app-server dynamic tool calls as unsupported, so agents could
not inspect or manage other Codex tasks through a TUI session.
## What changed
- Add the `codex_tui` tool namespace for listing, reading, waiting on, creating,
forking, messaging, renaming, archiving, and restoring tasks.
- Handle tool calls through existing app-server thread operations, with bounded
inputs and responses and cleanup when calls complete or the TUI disconnects.
- Route delegation tools through an authenticated local MCP server with explicit
approval prompts, while respecting configured and managed MCP policies.
- Fall back to starting threads without dynamic tools when connected to an older
app server that does not support them.
## Testing
Add coverage for tool schemas and response bounds, task lifecycle operations,
approval-gated MCP transport, namespace dispatch, cancellation, and legacy
app-server fallback behavior.
GitOrigin-RevId: c782c11f0a3edceb3fa6909a4b92d6ce01a6eed3
## What changed
- Cover live and replayed patch approvals recovering their file changes for the full-screen pager.
- Verify scrolling, resizing, dismissing and reopening the pager, and accepting or canceling a request exactly once.
- Document why approval requests recover diff contents from the matching stored item.
GitOrigin-RevId: 0b1ef25998aa466409ea79731e2c913a6d42388a
## Why
MCP inventory can be cached or collected separately from a thread's live
connections, so tool availability alone does not describe the current runtime
state.
## What changed
- Add a nullable `runtimeStatus` to `mcpServerStatus/list` for thread-scoped
requests, covering not-started, starting, connected, authentication-required,
failed, cancelled, and disabled connections.
- Observe published connection state without starting or reconnecting servers,
and return an unknown status when no thread is supplied or the active
configuration no longer matches the published registration.
- Show connection state and tool counts in the compact `/mcp` view while
retaining the detailed inventory in `/mcp verbose` and compatibility with
servers that omit `runtimeStatus`.
## Testing
- Cover runtime status transitions, deferred and disabled servers, closed
transports, configuration changes, protocol compatibility, and TUI rendering.
GitOrigin-RevId: e3bb6efe652f0fa8b3c97d5c53e4729b3a87cd91
## What changed
- Open a picker for `/copy` with the whole response plus each fenced code block and blockquote from the latest response.
- Label code blocks by language, show content previews, and preserve source whitespace and nested quote Markdown when copying an individual target.
- Keep the picker from disturbing terminal scrollback or queued input, retain clipboard leases, and avoid writing copied content to the session log.
## Testing
- Add coverage for target extraction, picker navigation and cancellation, exact copied content, plan responses, queued input, scrollback preservation, clipboard failures, and session logging.
GitOrigin-RevId: 77a35bc99f4f45932d39914f9a709b30fe8cd7c2
## Why
Draining every queued active-thread event in one foreground pass can overrun the
frame budget. Buffered thread events can also race ahead of queued replay and
startup app events, causing the TUI to switch views before the corresponding
history and operations have been applied.
## What changed
- Bound active-thread draining to one target frame interval and leave remaining
notifications queued for a later frame.
- Prioritize queued app events over active-thread events so replay state is
applied before buffered closures or other thread notifications.
- Block startup input only for pending requests, rather than ordinary queued
notifications whose draining yielded at the frame deadline.
- Leave selected side-thread closure handling to the foreground event loop.
## Testing
Added tests covering deadline-limited notification draining and foreground
handling of a selected side thread closing.
GitOrigin-RevId: 41080d3df13ca308eec1ea0fbb0ba067a4640c4c
## What changed
- Add unbound `previous_permission_mode` and `next_permission_mode` actions to
`tui.keymap.chat` so users can configure shortcuts that cycle through the
available built-in permission modes.
- Apply shortcut selections only to the active session, without writing them
to `config.toml`, and report update failures in the transcript.
- Exclude modes disallowed by managed requirements or platform safety checks,
reject printable-key bindings, and ignore these bindings in project config.
## Testing
- Cover mode cycling, unavailable modes, session-only updates, server errors,
stale threads, keymap validation, and project-config sanitization.
GitOrigin-RevId: c3cfdf1e732b7b7bfe8f53fcac19a37e593bbfab
## What changed
- Add experimental `mcpServer/event/stream/start` and `mcpServer/event/stream/stop` requests for hosted apps, plus `mcpServer/event/stream/notification` forwarding.
- Scope subscriptions to the owning app-server connection and subscribed thread, enforce unique IDs and a per-connection limit, and clean them up when the thread is unsubscribed or the connection closes.
- Wait for the MCP active notification before completing startup, retry streams that close immediately, and terminate them when authentication or hosted runtime ownership changes.
## Testing
- Add an app-server integration test covering activation, event forwarding, duplicate subscription rejection, and explicit cancellation.
GitOrigin-RevId: 8a6fc1615adfc5af7e67def3b824fa5909ab3e7b
## Why
A newly started thread may not have materialized its rollout before the TUI
receives `ThreadStarted`. Trying to infer session state from that path can wait
through rollout reader retries even when a lifecycle response already provided
the authoritative session.
## What changed
- Preserve session state already stored for a known thread instead of inferring
it again from `ThreadStarted`.
- Continue updating agent-picker metadata from the notification.
- Restrict fallback session inference to newly observed `ThreadStarted`
notifications that do not already have session state.
## Testing
Added a startup test that verifies a known thread routes `ThreadStarted`
immediately, retains its configured session, buffers the notification, and
updates agent metadata when the rollout does not exist yet.
GitOrigin-RevId: 7ed98fb46df17566c4a61ac677f60fc8d94f7321
## Why
Starting an archived session with `codex resume` or `codex fork` stopped with
guidance to run a separate `codex unarchive` command first.
## What changed
- Detect archived-session startup failures and offer to unarchive and retry the
requested operation.
- Allow the user to cancel without modifying the archived session.
- Render the confirmation in the alternate screen when available and preserve
inline terminal context when `--no-alt-screen` is set.
- Preserve `--no-alt-screen` whether it appears before or after the `resume` or
`fork` subcommand.
## Testing
- Cover confirmation, cancellation, retry behavior, and unrelated startup
failures for both resume and fork.
- Add prompt interaction and terminal rendering coverage, including narrow and
inline viewports.
GitOrigin-RevId: 382cdbd15b5d12c091e554d6d3a2f9b3589654f4
## Why
Paste placeholders and deferred slash-command parsing can hide the meaning of an input until it is expanded or a session is configured. Draining such input as an ordinary message can accidentally treat pasted text beginning with `!` as a shell command or lose `/plan` behavior.
## What changed
- Track paste-expanded inputs that begin with `!` as literal model input through history, queue editing, retries, and startup queues.
- Defer `/plan` parsing when session or model state is unavailable, then submit it in plan mode with shell escapes disabled.
- Drain queued input only after session configuration, and keep later queued prompts pending when an initial prompt cannot be submitted.
- Suppress queue auto-send before applying a replayed thread session so input from the outgoing thread is not submitted during restoration.
## Testing
Add coverage for direct, recalled, edited, interrupted, rejected, startup-queued, and plan-mode paste flows, including placeholder collisions and rejected initial images.
GitOrigin-RevId: d482220d8df21754f166fea5b54e9945f622a978
## Why
Approval and item IDs can collide across concurrent threads. Tracking pending app-server approvals by ID alone can therefore resolve, submit, or dismiss a request from the wrong thread.
## What changed
- Key command execution, file change, and permissions approvals by both thread ID and approval ID.
- Route approval responses through the originating thread and require the thread to match when processing resolution notifications or dismissing approval prompts.
- Canonicalize parseable thread IDs so equivalent UUID representations still match.
## Testing
- Cover colliding approval IDs across threads, mismatched resolution notifications, prompt dismissal, and response routing for primary and background threads.
GitOrigin-RevId: c2d899a1e4b6a6413c78a0595a5311f5fabb9815
## What changed
- Add an optional `delivery` field to agent message events and app-server
`agentMessage` items, with `"async"` identifying a user-visible message sent
without ending the current turn.
- Preserve the marker through legacy event conversion, thread history
materialization, replay, and generated JSON and TypeScript schemas.
- Require delivery of async agent message completion notifications on the
in-process app-server transport.
## Testing
- Cover preservation of async delivery metadata in thread history.
- Cover delivery-required classification for async agent messages.
GitOrigin-RevId: f92ba25de1293ee271404badfdf0d117d6530329
## What changed
- Show a description and the destination paths affected by each file-change approval.
- Include both source and target paths for moves, format cross-platform paths for display, and show `unavailable` when change details are missing.
- Recover file changes from buffered events and thread snapshots so live and replayed approvals retain their destination details.
## Testing
- Add coverage for active and replayed approvals, moved and cross-platform paths, and the missing-destination fallback.
GitOrigin-RevId: 24f90b313fd8643f90cbead1504c788b140d7fed
## Why
When the app server reports a misalignment policy violation, the TUI must stop the affected chat rather than allow more work to continue in it.
## What changed
- Finalize the active turn, clear queued and draft input, disable the composer, and reject further operations and interactive requests for the stopped chat.
- Interrupt an active side conversation when its parent reports the violation, and prevent queued turns, forks, approvals, or goal resumption from restarting work.
- Show a non-dismissible precaution view that directs users to start a new chat or resume another one, with agent command center navigation for remote sessions.
## Testing
Added coverage for stopped-chat behavior, parent/side-thread handling, blocked goal resumption, navigation actions, and narrow and remote-session rendering.
GitOrigin-RevId: 0268c46a19294a17765ea4099f389f15ffaaf030
## What changed
- Add the experimental `autoApprovalReview/strictReviewRequired` app-server notification with the review's `threadId`, `turnId`, and `startedAtMs`.
- Emit it when Guardian v2 leaves an approval review in progress because the action risk is elevated or its score is stale.
- Export the notification through the Rust, TypeScript, and JSON schema surfaces and route it to the associated thread.
## Testing
- Cover strict-review reason tracking for elevated and stale risk scores.
- Verify that high-risk approval routing emits one notification whose identifiers and timestamp match the review-started event.
GitOrigin-RevId: e65352894520bfb756c75b2c95e2e149f9767bb2
## What changed
- Add `tui.keymap.global.open_agents`, defaulting to `alt-a`, to open the shared agents overview.
- Add an `agents` keymap context for search, new task, rename, stop, and grouping actions.
- Expose the new actions in the keymap picker and render dashboard hints from the resolved bindings.
- Preserve existing custom `alt-a` bindings by disabling the new default when it would conflict.
## Testing
- Cover remapping, reserved keys, conflicts, and compatibility with existing bindings.
- Verify that configured dashboard shortcuts act on the selected filtered task.
GitOrigin-RevId: 98c48a332e06cb96dbf0e59647ce7959d45b9988
## Why
Some managed filesystem permission profiles cannot be represented by the
legacy app-server sandbox policy without changing which paths are accessible.
## What changed
- Require legacy sandbox conversion to preserve the filesystem policy's
semantics, and reject unsupported profiles with an actionable error.
- Keep queued follow-up messages and safety-buffered retries intact when
permissions are rejected, resuming queued input only after a compatible
profile is selected.
- Cover compatible profiles, lossy restrictions and write roots, turn-start
handling, and safety-buffered retries with regression tests.
GitOrigin-RevId: 345cc2a839206b2b1997e8981feb59f91b6975cc
## What changed
- Add `codex agents` to open the shared agents overview without creating a new session.
- Start the local background app server automatically on Unix, or connect to a server supplied with `--remote`.
- Reject invocation-specific session overrides that cannot apply to shared sessions.
- When the overview is opened from an embedded session, offer to start the background server without moving or interrupting the current session.
## Testing
- Cover command-line parsing and rejection of incompatible overrides.
- Snapshot the embedded-session background-server prompt.
GitOrigin-RevId: 60845dfebc48d820dc4ff090626d30452127f062
## What changed
- Let users start tasks, open root sessions, rename tasks, and stop active work directly from the agents overview.
- Show details for the selected task on wide terminals and limit the overview to root sessions while still reflecting background activity.
- Preserve draft input and pending server requests when switching sessions so running roots and their subagents can continue in the background.
- Apply the selected project's working directory when dispatching from project grouping, including remote workspaces.
## Testing
- Expand overview rendering and interaction coverage for root filtering, dispatch, search, selection, renaming, and responsive input.
- Cover switching away from roots with running subagents and retaining background server requests.
GitOrigin-RevId: b7b0d33b7ecc077498efb756a0ad2fd425158b17
## What changed
- Add `/agents` to open a full-screen dashboard of loaded root sessions from the shared app server, with subagent status reflected in each root session.
- Support search, navigation, and grouping sessions by project or status.
- Refresh the dashboard when relevant thread notifications arrive, while preserving its selection and view preferences.
- Show a clear message when the dashboard is unavailable with the embedded app server.
## Testing
- Add coverage for dashboard rendering, status grouping, persisted view state, and restoring the conversation viewport after closing the dashboard.
- Cover `/agents` command discovery and dispatch from parent-owned threads.
GitOrigin-RevId: 6651f4c47358116e1809da3ac8844a5842026a95
## What changed
- Use `/subagents` consistently for the subagent picker and status UI, removing the `/agent` alias.
- Rejoin already-loaded subagent threads without overriding their existing settings.
- Route notifications and approval requests only to the active thread or its known subagents, discard unrelated startup events, and avoid replaying resolved approvals.
## Testing
- Add coverage for filtering buffered startup events, dropping resolved approvals, preserving owned subagent approvals, and resuming threads without setting overrides.
GitOrigin-RevId: b4e597f7cd4756faccf31d8b964e7a172f5ab0eb
Eric Traut