Commit Graph

8340 Commits

Author SHA1 Message Date
Charlie Marsh
c86b1be3cd Avoid cloning file changes in TUI diff rendering (#34224)
## What changed

- Consume and sort `DiffSummary` entries directly when building renderables.
- Borrow paths and `FileChange` values in the shared row representation used by line-based summaries.
- Share line-count calculation between both rendering paths.

GitOrigin-RevId: b02668074def7529ff39445e9970a1fec209f02b
2026-07-19 20:20:23 +00:00
Charlie Marsh
6a54efb76b Cache finalized Markdown history rendering (#34223)
## Why

Finalized Markdown can be rendered repeatedly at the same width while measuring and displaying transcript history.

## What changed

- Cache the latest rendered lines for finalized agent messages and proposed plans.
- Invalidate cached lines when the width, syntax theme, terminal colors, or color level changes.
- Keep visualization directives uncached because resolving their local files depends on current filesystem state.

## Testing

Add tests for cache reuse, render-state invalidation, raw Markdown rendering, and visualization cache bypass.

GitOrigin-RevId: ba08140041a229b8cb9d297de87dc7bb39ebfe5d
2026-07-19 20:16:35 +00:00
Charlie Marsh
d0516cfe4b Avoid buffering replay-irrelevant thread notifications (#34222)
## Why

Raw response items, realtime audio, and other notifications that the TUI does
not consume during replay can carry large payloads. Retaining them in each
thread's replay buffer wastes memory and can evict useful buffered events.

## What changed

- Skip replay buffering for notification types that are handled before routing
  or ignored during replay, while still updating turn and approval state.
- Borrow notifications when recording events for an active thread so routing
  does not require an extra clone.

## Testing

Add coverage that repeatedly sends large MCP progress and realtime audio
notifications and verifies that the replay buffer, pending approval, and active
turn state remain intact.

GitOrigin-RevId: 5b3414f1db7f3ae1feea4fe6c0275e4a7a1a4174
2026-07-19 20:12:27 +00:00
Charlie Marsh
854a82dbfd Track TUI command completion separately from output (#34218)
## Why

App-server command output deltas populate an exec cell before the command
finishes. Treating the presence of output as completion can therefore mark a
streaming command inactive too early and mishandle it when the turn is
interrupted.

## What changed

- Use the recorded duration, which is set when a command ends, as the exec
  call's completion marker.
- Preserve streamed output when marking unfinished calls as failed and render
  status lines only after completion.
- Keep a single aggregated output representation and render truncated output
  without collecting every line first.
- Append grouped exploration calls in place and coalesce adjacent reads while
  rendering without cloning the calls.

## Testing

- Add snapshots covering active streamed output, transcript output, and the
  resulting history entry after interruption.
- Add coverage for truncating newline-dense output.

GitOrigin-RevId: 420ac1e5fe1b9fcdbdaa5a8998f3e43a5b720254
2026-07-19 19:44:10 +00:00
Charlie Marsh
74bfbda9b5 Keep incremental rendering with visualization context (#34217)
## Why

Providing an inline visualization context forced every streamed Markdown update
to rerender the full response, even when the source contained no visualization
directives.

## What changed

- Preserve the stable rendered prefix when visualization context is available
  but no directive is present.
- Continue using canonical full rendering when the source contains a
  visualization directive.

## Testing

Added a regression test that verifies directive-free streams match full
rendering while advancing the stable source boundary.

GitOrigin-RevId: cd70d2ba052db822d474eba8619d04cedf4c0573
2026-07-19 19:37:14 +00:00
Charlie Marsh
aa982319c2 Speed up TUI Markdown layout (#34216)
## What changed

- Allocate Markdown table widths in bulk while preserving the existing column
  shrink priorities and balancing behavior.
- Reuse flattened styled-line data during adaptive wrapping and detect URLs
  across span boundaries.
- Remap wrapped terminal hyperlinks with a single forward scan.

## Testing

- Verify bulk table shrinking matches the previous one-cell-at-a-time results,
  including a token-heavy column with a million-character width.
- Cover URLs split across styled spans and multiple links on indented Unicode
  lines.

GitOrigin-RevId: 24a6fd6fdace6ca948e613d67c130a3a7f8d1a4e
2026-07-19 19:33:31 +00:00
Charlie Marsh
3e2f79727a Avoid retaining decoded MCP images in history cells (#34206)
## Why

The MCP image output cell only renders a fixed placeholder, so it does not need
to keep the decoded image alive for the lifetime of the history cell.

## What changed

Decode image content to validate it, then return a marker cell without storing
the resulting `DynamicImage`. The rendered history output remains unchanged.

GitOrigin-RevId: b2c12d08e8ba281d2bb993a8524d338c26d52b96
2026-07-19 17:36:39 +00:00
Charlie Marsh
54994582b1 Avoid cloning buffered TUI history lines (#34204)
## What changed

Make the hyperlink-aware history insertion helper accept a slice and borrow
pending history batches when flushing them. This avoids cloning each batch's
entire `Vec<HyperlinkLine>` before insertion.

GitOrigin-RevId: 0bc86c33e2f047c62de60b7642899c4aaa4bb6b8
2026-07-19 17:32:53 +00:00
Charlie Marsh
4d7a5c7c73 Avoid liveness races when starting side conversations (#34199)
## Why

The `thread/started` notification for a newly forked side conversation can arrive after the fork response. Selecting the side thread in that window could incorrectly report that it was unavailable.

## What changed

- Seed agent navigation from the side-fork response before selecting the new thread.
- Skip redundant liveness and parent-title reads for side threads that already have local state, while preserving liveness checks for uncached agent threads.

## Testing

- Cover side-thread selection before `thread/started` is delivered.
- Verify uncached threads are still checked and regular forks still resolve their parent title.

GitOrigin-RevId: 1f9fb0586db8094bf5a2624bc4e1de06c9a783a1
2026-07-19 16:59:12 +00:00
Charlie Marsh
78fd2f2b28 Start side conversations without replaying inherited turns (#34198)
## What changed

- Fork side conversations with `exclude_turns` so their initial UI starts empty instead of displaying the parent thread's turns.
- Keep regular fork responses unchanged, including for ephemeral threads.

## Testing

- Add coverage that compares regular and side-conversation forks of the same saved thread.

GitOrigin-RevId: 662607e9f588c20a2e06656deefa5b70bde19cd2
2026-07-19 16:54:58 +00:00
Charlie Marsh
3dd3c5d08a Use the Markdown collector as the streaming source of truth (#34197)
## What changed

- Return committed byte ranges from `MarkdownStreamCollector` so the streaming controller can render and scan the collector's source directly.
- Transfer the complete source out of the collector during finalization, preserving the final unterminated line while removing the controller's duplicate source buffer.
- Cover finalization of an empty collector and update streaming tests to validate the collector-backed source.

GitOrigin-RevId: 0aca912c53080267a2d12ad397e548641171942a
2026-07-19 16:50:54 +00:00
Charlie Marsh
9dc372fbaf Avoid cloning thread data when rendering transcripts (#34194)
## What changed

Make `thread_to_transcript_cells` consume its `Thread` so transcript rendering can
move owned turn items, message content, IDs, and plan text into history cells
instead of cloning them.

GitOrigin-RevId: 80200ba8928a3ea0e91cbff8a13dd00e21432426
2026-07-19 16:46:58 +00:00
Owen Lin
0fb559f0f6 Support legacy views for paginated thread history (#34085)
## Why

Clients that use full-history resume or request full items in turn pages should
work consistently across legacy and paginated threads.

## What changed

- Materialize complete turns and items from the paginated projection for
  `thread/resume` and `thread/turns/list` when requested.
- Support `initialTurnsPage` during paginated resume, including merging a live
  active turn while preserving the requested page size and cursors.
- Keep metadata-only resume behavior and backwards cursors available through
  `excludeTurns: true`.

## Testing

- Extend app-server coverage for full paginated history, full item views, and
  initial resume pages on running threads.

GitOrigin-RevId: e340f44d631ce135895c95d7e1baa7bfecd86e71
2026-07-19 00:01:51 +00:00
nhamidi-oai
643de86a19 Add audio output support to dynamic tools and code mode (#34080)
## What changed

- Add `inputAudio` content items to dynamic tool responses, app-server events, thread history, and generated protocol schemas.
- Add an `audio()` code-mode helper that accepts inline data URLs, audio URL objects, and MCP audio blocks.
- Convert MCP audio blocks into model input when audio is supported, and replace unsupported audio with an explanatory text item.
- Reject non-data audio URLs and track audio item counts in dynamic tool analytics.

## Testing

- Cover audio serialization, protocol round trips, thread-history conversion, MCP modality filtering, code-mode helper inputs, and invalid URL handling.

GitOrigin-RevId: 1ed52a8f9c62d4840fb71c5ec736b4a3566243d6
2026-07-18 23:22:13 +00:00
jiayuhuang-openai
312caf176a Seed realtime V3 sessions with initial text items (#34067)
## What changed

- Add an optional `initialItems` field to `thread/realtime/start` for seeding
  realtime V3 session history with `user`, `developer`, and `assistant` text.
- Encode the items in Frameless Bidi session bootstrap payloads for websocket
  and WebRTC transports while preserving existing payloads when the list is
  omitted or empty.
- Reject non-empty initial items for V1 and V2, more than 128 items, any item
  over 8,192 estimated tokens, or a combined total over 8,192 estimated tokens.

## Testing

- Cover protocol serialization, app-server forwarding, websocket and WebRTC
  payloads, empty-list compatibility, version checks, and size limits.

GitOrigin-RevId: 09af367f9a07543e3f8d59b7fa5387f932dc5a6a
2026-07-18 20:59:57 +00:00
Charlie Marsh
35eaf3ffb0 Avoid redundant TUI redraws while streaming (#34049)
## What changed

- Redraw assistant and plan stream tails only when a completed line changes the visible tail.
- Cache the first reasoning header and update the status indicator only when its visible state changes, while restoring the cached header if the indicator is recreated.
- Keep regular commit ticks able to clear stale stream tails.

## Testing

- Add coverage for unchanged partial deltas, changed newline-delimited tails, reasoning-header redraws, recreated status indicators, stale plan tails, and history-line draw scheduling.

GitOrigin-RevId: 9016175f97ef2db2edc2fd5ba13a4d731dc2d98c
2026-07-18 18:19:39 +00:00
Charlie Marsh
028edf8c1e Avoid resending the model for reasoning shortcuts (#34047)
## What changed

Update normal-mode reasoning shortcuts to emit only an
`UpdateReasoningEffort` event instead of reapplying the current model alongside
the new effort.

Extend the shortcut tests to verify that both increasing and decreasing
reasoning effort leave the model unchanged.

GitOrigin-RevId: cf5206a3a8e0a0bf66ecc2d0bfcc1ba44c98fead
2026-07-18 18:05:04 +00:00
Charlie Marsh
537e69ab66 Render streamed Markdown incrementally (#34045)
## Why

Streaming TUI responses repeatedly rendered the entire accumulated Markdown source for each committed delta, including blocks whose output could no longer change.

## What changed

- Retain rendered output for completed top-level Markdown blocks and rerender only the final mutable block as new source arrives.
- Track block boundaries during the existing Markdown parser pass and map them through table-fence normalization.
- Preserve canonical full rendering when source-wide state may affect earlier output, including reference link definitions and inline visualizations, and when the width or render mode changes.
- Append raw-mode lines directly while preserving blank lines.

## Testing

Added coverage that compares incremental output with full rendering across paragraphs, headings, lists, block quotes, code fences, tables, HTML blocks, links, visualizations, render-mode changes, and normalized table fences.

GitOrigin-RevId: 748171c4ed58923329b59c48ea3c2afa4819ec88
2026-07-18 18:00:51 +00:00
Felipe Coury
b8b61bc692 Handle compressed rollouts in doctor thread inventory (#34038)
## Why

The thread inventory check compared state database rows only with plain
`.jsonl` rollout files. Once a rollout was compressed to `.jsonl.zst`, the
check could report its canonical database row as stale and omit the rollout
from parity results.

## What changed

- Scan completed compressed rollouts and match them to database rows using
  their canonical `.jsonl` paths.
- Prefer a plain rollout when both plain and compressed siblings exist, and
  ignore compression temporary files.
- Keep unreadable compressed rollouts in the set of existing paths so they
  produce scan errors without also producing misleading stale-row reports.
- Use canonical paths when deriving legacy thread IDs and archived status.

## Testing

Added coverage for active and archived compressed rollouts, plain/compressed
siblings, metadata and legacy filename IDs, corrupt compressed data, and
compression temporary files.

GitOrigin-RevId: 2461376432194a4062beedbe875aa7002dd2049f
2026-07-18 16:14:48 +00:00
nhamidi-oai
56395bddaf Gate audio history by model input modalities (#33982)
## What changed

- Add `audio` to the model input modalities exposed by the protocol and generated app-server schemas.
- Preserve audio in prompts for models that advertise audio input, and replace historical audio with an omission marker for models that do not.

## Testing

- Cover prompt normalization with and without audio support.
- Extend the model-switching integration test to verify that switching from a multimodal model to a text-only model strips prior image and audio content.

GitOrigin-RevId: c18e47ad602720216303ff9abb5bca4d508391ee
2026-07-18 09:13:38 +00:00
Anton Panasenko
5c0e582c59 Add context to sampling retry logs (#33963)
## What changed

- Add structured `turn_id`, `retries`, `max_retries`, and `sampling_error` fields to sampling-stream retry warnings.
- Add a focused test that captures the warning and verifies its retry and error context.

GitOrigin-RevId: dea868875d162b3f97b3c8a256359278f7267c1c
2026-07-18 06:34:53 +00:00
pakrym-oai
d26a9bf671 Refresh bundled model metadata (#33961)
## What changed

- Set the bundled GPT-5.6 model variants' context windows to 272,000 tokens.
- Refresh model instructions and message configuration.
- Record reasoning-summary support and update skills, permissions, and auto-review metadata across the model catalog.

GitOrigin-RevId: 8be55124bf50af14756a174033a5cb362f4db714
2026-07-18 06:17:50 +00:00
Anais Killian
2895d82b5e Let users remember the working directory for resumed sessions (#33950)
## What changed

- Add `tui.resume_cwd` with `current` and `session` modes for resume and fork flows.
- Let users persist either mode directly from the working-directory prompt, while preserving one-time choices when no preference is configured.
- Apply the preference consistently during startup and in-app resume, honor explicit `--cd` overrides, and reject unsupported or unavailable directory choices with a clear error.

## Testing

- Cover configuration parsing and persistence, prompt behavior, startup and in-app flows, session metadata fallback, and remote workspace constraints.

GitOrigin-RevId: 7bf144c4b8c55bdb868cc8a71caf397c7740451a
2026-07-18 03:58:20 +00:00
pakrym-oai
82b294c73c Track permission instructions in world state (#33944)
## What changed

- Model permission instructions as a world-state section keyed by a stable hash of their rendered developer message.
- Re-emit permission context when its model-visible contents change or the retained fragment is missing, while avoiding duplicates when matching instructions already exist in history, including bundled developer messages.
- Normalize CRLF line endings when hashing world-state fragments so equivalent content produces the same snapshot.

## Testing

- Add snapshot coverage for unchanged, changed, absent, and unknown permission state.
- Cover bundled retained permissions and restored world-state baselines during rollout reconstruction.

GitOrigin-RevId: 7d8d212460c1690ca617859f66dcd825987f1e23
2026-07-18 02:45:55 +00:00
Adam Perry @ OpenAI
6bd3f5e3db Centralize SQLite connection configuration (#33938)
## What changed

- Add `SqliteConfig` as the shared entry point for read-write and read-only SQLite pools.
- Apply consistent WAL, synchronization, auto-vacuum, busy-timeout, logging, and pool-size settings to writable Codex databases.
- Route state runtime, audit, CLI, and test database connections through the shared configuration.

## Testing

- Run migration tests against temporary on-disk databases opened through `SqliteConfig`, including the concurrent-writer repair case.

GitOrigin-RevId: e3946b98bde04c47574532ac8b1a7bb2b03edd97
2026-07-18 02:06:13 +00:00
nhamidi-oai
23899f7cb6 Forward audio inputs to the Responses API (#33932)
## Why

Audio variants were available in the user-input protocol but were replaced with unsupported-input placeholders instead of being sent to the model.

## What changed

- Serialize audio data URLs as `input_audio` content and convert local `wav`, `mp3`, `m4a`, `webm`, and `ogg` files to labeled data URLs.
- Validate and canonicalize base64 audio before requests, enforce the 50 MiB input limit, and replace invalid, unsupported, or oversized audio with explanatory text.
- Preserve audio attachments when mapping response items back to user-message events and document the app-server input variants.

## Testing

- Add unit coverage for local-file conversion, data URL validation, size and format errors, event mapping, and attachment extraction.
- Add client tests that verify data URL and local audio payloads sent to the Responses API.

GitOrigin-RevId: f72cd6b6e43ab12757eeb47621b1d670594ac7d9
2026-07-18 00:26:24 +00:00
Owen Lin
bcdc695877 Track inherited paginated rollout prefixes (#33930)
## What changed

- Add `HistoryPosition` to identify a source thread and an exclusive rollout
  prefix by ordinal and JSONL byte offset.
- Add optional `history_base` metadata to `SessionMeta` so a thread can record
  an inherited prefix of another paginated rollout.
- Default missing `history_base` metadata to `None` and omit it when unset to
  preserve compatibility with existing rollout metadata.

## Testing

- Verify that legacy session metadata without `history_base` deserializes with
  no inherited history position.

GitOrigin-RevId: 3b2b07a2dfee793d3b37b0a60529f856f167dbc1
2026-07-18 00:06:49 +00:00
sayan-oai
15d7d2a733 Handle audio inputs and Bazel unit test arguments (#33929)
## What changed

- Exclude remote and local audio inputs from thread-history searchable text.
- Add a `unit_test_args` option to `codex_rust_crate` and forward it to the
  generated unit-test wrapper.

GitOrigin-RevId: f0aeb7f811163c3c80aa6f8ef4104650e698347c
2026-07-17 23:41:01 +00:00
Abhinav
3ac476bed2 Fix quoted hook commands on Windows (#33926)
## Why

Windows hook commands whose executable paths contain spaces fail when their
outer quotes are escaped during argument construction.

## What changed

- Pass hook command strings as raw arguments to the default Windows shell.
- Do the same for configured shells that use the case-insensitive `/c` flag,
  while retaining normal argument handling for other shells.

## Testing

Add a Windows regression test that runs a quoted `.cmd` hook from a directory
with spaces through both the default shell and an explicit `COMSPEC /c` shell.

GitOrigin-RevId: 0e7ce44203e01d3823daaaec750c2aeadfcd34b7
2026-07-17 23:24:26 +00:00
Felipe Coury
f896ab9f25 Render inline visualization links in the TUI (#33925)
## Why

Assistant-authored inline visualizations need a terminal fallback that lets users open generated artifacts in a browser.

## What changed

- Recognize `::codex-inline-vis{file="..."}` directives in assistant Markdown and replace them with browser links during streaming, finalized history rendering, and local transcript previews.
- Materialize visualization fragments in sandboxed viewer documents with a content security policy, while restricting artifacts to HTML files within the thread's visualization directory and limiting their size.
- Show an explicit unavailable message for invalid or missing artifacts, hide incomplete streaming directives, and preserve directive text in code blocks and user Markdown.
- Add a trusted file-link path for generated viewers without enabling arbitrary `file:` links in Markdown.

## Testing

Add coverage for directive rewriting, streaming and replay, artifact validation, sandboxed viewer generation, trusted terminal hyperlinks, and literal preservation.

GitOrigin-RevId: a666b4ebc82bb5798ad45bd137fd815d538e1de2
2026-07-17 23:19:12 +00:00
nhamidi-oai
97dbd01a3d Add audio variants to user input protocols (#33923)
## What changed

- Add remote and local audio variants to core and app-server user inputs, including generated JSON and TypeScript schemas.
- Preserve audio fields when converting app-server inputs and response content into thread items.
- Keep unsupported audio out of model requests, TUI rendering, text extraction, and truncated tool output, using explicit text placeholders where audio is submitted as a model input.

## Testing

- Cover app-server media conversion, unsupported-input placeholders, TUI omission, and tool-output truncation.

GitOrigin-RevId: 16152bf3af674575ce569764a8b472e032e7569d
2026-07-17 23:14:37 +00:00
Eric Traut
e98765c212 Allow selecting path-backed agents in the TUI picker (#33922)
## Why

Opening the agent picker stopped after adding status history whenever path-backed subagents were present, so those agents could not be selected from the picker.

## What changed

- Continue into the picker after rendering status for path-backed subagents.
- Skip duplicate liveness refreshes for path-backed threads and display non-primary agents by their canonical path when available.

## Testing

- Add a snapshot test that opens the picker for a path-backed agent and verifies that selecting it emits `SelectAgentThread` for the expected thread.

GitOrigin-RevId: 1668bb7817ce4e13c91d85c4d7ddab31c04c97b3
2026-07-17 23:11:07 +00:00
Eric Traut
d4982d0a33 Preserve sub-agent liveness in the agent picker (#33921)
## Why

Opening the agent picker could clear a successful spawn hint before the new
sub-agent had emitted a turn event, making a running agent appear stopped.

## What changed

- Treat active turns and matching completion events as authoritative liveness
  transitions while leaving an empty event store unchanged.
- Remember terminal liveness so delayed activity cannot revive a stopped agent;
  only a new turn can mark it running again.
- Ignore `Interacted` activity when deriving agent liveness.

## Testing

Added coverage for empty stores, stale and current completion events, completed
snapshots, delayed activity, and subsequent turns.

GitOrigin-RevId: 462539d8134a5d3520dbd41edb44b3251f50ead5
2026-07-17 23:07:40 +00:00
thomas
3a06748458 Allow publishing plugins through share updates (#33908)
## What changed

- Accept `LISTED` discoverability in `plugin/share/updateTargets` and forward it to the remote plugin sharing API.
- Update the generated JSON schemas and TypeScript type with the new enum value.

## Testing

- Add an app-server integration test that publishes a workspace plugin and verifies the `LISTED` request and response.

GitOrigin-RevId: 978f4b94b318e772bf80347e58dd5b1d2819a653
2026-07-17 21:29:51 +00:00
Owen Lin
c1862b8db4 Add occurrence search for paginated threads (#33907)
## What changed

- Add the experimental `thread/searchOccurrences` app-server method for case-insensitive literal search across visible user messages and final assistant messages without replaying the thread.
- Return paginated snippets with UTF-16 match ranges and `thread/turns/list` cursors for navigating to each matching turn.
- Index persisted item types to efficiently select searchable messages from paginated thread history.

## Testing

- Add an app-server integration test covering pagination, steering messages, final-answer selection, Markdown normalization, and UTF-16 offsets.

GitOrigin-RevId: e80160e0f83eb4e5db8de862307085093bee362b
2026-07-17 21:24:26 +00:00
viyatb-oai
9f6c29e281 Launch managed network proxies on remote executors (#33906)
## Why

Remote executions need managed-network proxy listeners in the executor so their
loopback proxy addresses are reachable by the launched process.

## What changed

- Add a capability-gated exec-server protocol field for executor-local proxy
  launch configuration, including network policy, audit metadata, and execution
  attribution.
- Start the proxy while preparing a remote process, replace inherited proxy
  environment variables with its local addresses, and derive the sandbox
  context from its listeners.
- Keep the proxy alive until inherited output streams close, then shut it down.
- Reject unsupported remote settings such as MITM and credential injection.

## Testing

- Cover configuration round trips and rejection of unsupported settings.
- Verify executor-local startup, blocked-domain enforcement, protocol
  compatibility, and proxy lifetime through process closure.

GitOrigin-RevId: c984f54e3e600aa9ebcbf8cf4574046e2c199d11
2026-07-17 21:20:14 +00:00
Charlie Marsh
7ed19a9758 Batch persistent history reads during reverse search (#33905)
## Why

Reverse search fetched persistent history one entry at a time, making a deep or unsuccessful search require a lookup for every older entry.

## What changed

- Keep the newest-entry probe lightweight, then scan older persistent history in bounded batches.
- Cache batch results by absolute offset and preserve continuation cursors across repeated searches.
- Ignore stale responses, retry failed batch reads a bounded number of times, and restore the draft without reporting a false “no match” state when history is unavailable.

## Testing

- Cover batch continuation, caching after query changes or cancellation, stale metadata, retry exhaustion, and thread routing.
- Verify that scanning 1,024 entries uses one single-entry lookup and eight batch lookups.

GitOrigin-RevId: efc791fcbd5290050af703dd31c5c21b33240e23
2026-07-17 21:16:07 +00:00
jiayuhuang-openai
025db22058 Route realtime V3 handoffs by response channel (#33903)
## What changed

- Add `codexResponseHandoffMode` to `thread/realtime/start` for V3 sessions, with `thinking` as the default and `commentary` and `bemTags` routing modes.
- Map BEM `analysis` and `commentary` output to the commentary channel and `final` output to the speakable channel, while preserving the original BEM envelope. Unrecognized output falls back to speakable.
- Mark explicit speech appends as speakable and stop adding the legacy `"Agent Final Message"` prefix to V3 handoffs. V1 and V2 continue to ignore the new setting.

## Testing

- Cover channel selection for every routing mode, streamed BEM header parsing, fallback behavior, explicit speech, and V1 compatibility.

GitOrigin-RevId: 1974578257488f2914b252c9c1990ba38831c96b
2026-07-17 21:12:40 +00:00
Charlie Marsh
161748a68e Add bounded batch lookups for message history (#33902)
## What changed

- Add a public cursor-based API that reads history entries newest-first from an absolute offset.
- Bound batches to 128 rows and 64 KiB while allowing a single oversized row so pagination always makes progress.
- Reuse validated byte positions for unchanged, uncapped histories, and fall back to offset scans when files are rewritten or capped.
- Preserve offsets for malformed rows and return them without parsed entries.

## Testing

Add coverage for pagination, row and byte limits, oversized and malformed rows, file rewrites, capped-history trimming, appends, and log identity changes.

GitOrigin-RevId: 57e52a4ac150cd15a5bdc3fef8a351a1f2eb0e3c
2026-07-17 20:52:42 +00:00
Eric Traut
50b8213385 Support ChatGPT-branded Desktop app builds (#33901)
## Why

The Desktop app can use Codex or ChatGPT branding while retaining stable platform identities. CLI discovery and TUI handoff should not depend on a single display name or hardcoded executable path.

## What changed

- On macOS, search for both `ChatGPT.app` and `Codex.app`, and accept only bundles with the `com.openai.codex` identifier.
- On Windows, detect installs by their package app ID and resolve the `codex` protocol executable from the AppX manifest before handing off a TUI session.
- Use “Desktop app” consistently in CLI and TUI user-facing text.

## Testing

Add coverage for selecting a ChatGPT-named Codex bundle and rejecting the classic ChatGPT bundle.

GitOrigin-RevId: b84a56eb6e960712152e1a9b023ab530ec9a354a
2026-07-17 20:46:18 +00:00
brisebois-oai
bc5c9161b4 Expose plugin installation interstitial requirements (#33896)
## What changed

- Add nullable `mustShowInstallationInterstitial` metadata to app-server
  `PluginSummary` responses.
- Preserve the remote service value through catalog, installed-plugin cache,
  list, read, and share-list paths.
- Return `null` for local plugins and remote responses that omit the field so
  clients can fail closed when the policy is unavailable.

## Testing

- Cover `true`, `false`, and missing values across remote summary paths and
  app-server plugin endpoints.

GitOrigin-RevId: db79702ee2bfa800a9910d64d933bcabecb3ce70
2026-07-17 20:02:51 +00:00
Abhinav
7bd44085e1 Add SessionEnd hooks for thread teardown (#33895)
## What changed

- Add the `SessionEnd` hook event to hook configuration, protocol schemas, analytics, and the hooks browser.
- Run matching hooks for root threads during shutdown, including app-server archive, delete, idle unload, and graceful shutdown. Flush the transcript first and provide the session ID, transcript path, working directory, and `reason: "other"`.
- Keep teardown bounded: hook output is advisory, the default timeout is one second, configured timeouts are capped at three seconds, and async hooks run synchronously with a warning.

## Testing

- Cover transcript availability, matcher selection, timeout normalization, ignored control output, subagent exclusion, archive/delete ordering, and graceful shutdown of multiple loaded threads.

GitOrigin-RevId: 5d19a658677a137caf836ed5042dcb43f5eb6d1a
2026-07-17 19:58:56 +00:00
pakrym-oai
b9680065b0 Track realtime conversation state in world state (#33893)
## What changed

- Represent whether realtime is active as a persisted world-state section.
- Emit start and end instructions from world-state transitions, including when
  reconstructing context after resume.
- Retain existing realtime start fragments and avoid emitting another start when
  custom instructions change while realtime remains active.

## Testing

- Add snapshot coverage for absent, unknown, active, and inactive realtime state
  transitions.
- Cover realtime start and end updates plus resuming with changed custom start
  instructions.

GitOrigin-RevId: ec670b8132b0f1c9317738bfdeb272069927d91d
2026-07-17 19:33:52 +00:00
rtaylor-oai
24e9b849fa Limit rollout metadata reads to headers (#33892)
## Why

Callers that only need session metadata should not scan an entire rollout or fail on an unreadable tail after valid metadata.

## What changed

- Read session metadata directly from the rollout line reader, stopping as soon as it is found for both plain and compressed rollouts while preserving pre-header and validation behavior.
- Bound the doctor thread inventory scan to the first 64 non-empty header lines. Prefer the metadata thread ID and retain the validated filename fallback for legacy rollouts without metadata.

## Testing

- Cover invalid UTF-8 tails, compressed rollouts, pre-header records, metadata and filename ID mismatches, the scan boundary, legacy fallback, and unusable headers.

GitOrigin-RevId: 49576bd2877942e64082ce5ed057ecc848c025ec
2026-07-17 19:20:08 +00:00
jif
f24e695470 Centralize thread MCP connections in McpRuntime (#33889)
## What changed

- Add a thread-owned `McpRuntime` that atomically publishes connection-set
  replacements and owns shutdown.
- Route `McpResourceClient` snapshots and cache keys through that runtime so
  extension clients observe refreshed MCP servers.
- Keep model-step configuration snapshots separate from ownership of live MCP
  connections.

## Testing

- Add coverage that captures an extension's session resource client, refreshes
  the MCP server configuration, and verifies that the existing client sees the
  newly published server.

GitOrigin-RevId: 351b2e25594b8eb6b91e50ff8d06b7d49768ae1c
2026-07-17 18:43:14 +00:00
charlesgong-openai
b99cc315fd Report CLI as the external agent config import source (#33883)
## Why

The TUI import request used the selected migration source as the identifier for
the product initiating the import, conflating two distinct protocol fields.

## What changed

Set `source` to `cli` for imports initiated by the TUI while continuing to pass
the selected adapter through `migrationSource`.

GitOrigin-RevId: 7b00728464cb1d4e478ac4aa6b18f7254d2e5152
2026-07-17 18:24:26 +00:00
pakrym-oai
cf4c8cab7c Track collaboration mode instructions in world state (#33876)
## What changed

- Model collaboration mode as a world-state section whose persisted snapshot is
  the active mode.
- Emit collaboration instructions when the mode changes, while ignoring
  instruction text changes within the same mode.
- Restore persisted collaboration instructions when they are missing from
  retained history, including after a fork.

## Testing

- Add snapshot coverage for initial, unchanged, changed, and unknown mode state.
- Cover retained-history restoration and same-mode instruction changes.

GitOrigin-RevId: ffd1683499f09acef6516b0bfcb5bcb4d3f28df4
2026-07-17 17:22:39 +00:00
jif
1fc15cc9a9 Remove unused TUI collaboration mode indicators (#33872)
## What changed

Remove the unused `PairProgramming` and `Execute` footer indicator variants and their label and styling branches. Keep `Plan` as the only `CollaborationModeIndicator` rendered by the TUI.

GitOrigin-RevId: 5f3e6c8ff50a04d41dd5fc342cf1347a7e4f78fe
2026-07-17 16:59:25 +00:00
jif
f57467275c Remove the redundant borrowed line wrapping helper (#33870)
## What changed

Remove `word_wrap_lines_borrowed` and use the general `word_wrap_lines` API for
borrowed line slices. Drop the duplicate helper-specific tests while retaining
coverage of borrowed iterator wrapping through the general API.

GitOrigin-RevId: aa55a6180705a676bf82ea66c9ba0fe15d00a5fe
2026-07-17 16:39:16 +00:00
jif
771d9d7d26 Remove stale ignored core tests (#33868)
## What changed

- Remove the ignored explorer-role test for role-specific model and reasoning defaults.
- Remove two ignored unified exec tests for timeout capping and completed-session cleanup.

GitOrigin-RevId: 39386546c7628c2e1cf713139cd09fd0bf172700
2026-07-17 16:35:01 +00:00