## Why
Mermaid diagrams that cannot be rendered currently fall back to source without
explaining why the preview is unavailable.
## What changed
Show a dimmed notice above the preserved source when a completed Mermaid block
uses unsupported syntax, exceeds renderer size limits, or does not fit the
terminal width. Wrap the notice to the available width and preserve indentation
inside lists and blockquotes. Leave unfinished fences and disabled Mermaid
rendering without notices.
## Testing
Add coverage for fallback reasons, dimmed styling, source preservation, nested
indentation, and suppression of notices for unfinished fences and disabled
rendering. Update the streaming resize snapshot to include the width notice.
GitOrigin-RevId: 6ac7914b398c855e7aed3775ee0de70fb4484b78
## Why
Command execution analytics lack the observed sandbox backend. Older execution servers may omit this information, so an unknown backend must remain distinguishable from an explicitly unsandboxed process.
## What changed
- Carry optional `sandbox_type` metadata through command execution items and emit its metric tag as `sandbox_backend` in analytics.
- Propagate the observed backend through unified execution completion and failure events, including asynchronous exits.
- Preserve missing backend information as `None` and mark executed user shell commands as `Some(SandboxType::None)`.
- Exclude the metadata from serialized command items and generated schemas and TypeScript types.
## Testing
Extend tests for missing and explicit executor backends, backend propagation on failed execution, and analytics payloads, including platform-specific backend tags in app-server integration coverage.
GitOrigin-RevId: 178fe46824a6194910802ec02168ed40ee0b2019
Apply `secondary_text_style()` to the shortcut hint separator and label
so they use a readable foreground color instead of terminal-dependent dimming.
GitOrigin-RevId: 6cd9ced75deca9353c1224d3e5fefc6c4ad6ae8f
## Why
An async question notification can outlive its unanswered question and suppress the lower-priority turn completion notification.
## What changed
Clear pending `AsyncQuestion` notifications when collecting question drafts on completion, interruption, or failure, including the error-handling path. Completed turns can then queue their completion notification.
## Testing
Add regression coverage for all three turn outcomes and assertions for error handling and completion after dropped message deltas.
GitOrigin-RevId: 647b2b37acced431fc98fd4f5334c8973a0be241
## Why
Recovering question answers or interrupted input can cancel an active `Ctrl+R` search or overwrite its preview. Recovery should preserve the search while keeping the recovered input available on cancellation.
## What changed
- Apply background updates to the saved draft without changing the search query or visible preview, including when a query has no match.
- Restore the updated draft on `Esc` or `Ctrl+C`; discard it when accepting a history match. Keep search open when `Enter` has no match to accept.
- Capture the saved draft rather than the preview in draft snapshots, preserving attachments, mention bindings, and pending pastes.
- End search on an explicit fresh draft replacement so cancellation cannot resurrect discarded input.
## Testing
Add regression coverage for recovery on turn completion, failure, and interruption; accepting and canceling search after recovery; Vim undo/redo; pending paste preservation; and clearing drafts after a misalignment policy failure.
GitOrigin-RevId: d3de19bbbcdab2e461c19d47b2b7dca0b28f6ff3
## What changed
Clear pending asynchronous questions when a live turn completes, is interrupted, or fails, and append nonblank typed answers to the main composer in question order without submitting them. Preserve existing composer content and input restored after interruption, and retain large answers as paste placeholders.
Cancel history previews and pending Vim commands during recovery while preserving undo grouping and dot-repeat behavior. Skip recovery during replay and keep input cleared after a misalignment policy violation.
## Testing
Add regression tests and snapshots for open and collapsed drafts, buffered typing, answer ordering, repeated completion notifications, large pastes, interrupted queued input, and Vim undo/redo behavior. Update coverage for terminal errors and realtime question expiration.
GitOrigin-RevId: fec109fe8aecb0735a3a5410fbb063b5c5c6e9a1
## What changed
- Detect Terminal.app from primary and secondary device attributes during startup on Unix SSH sessions without a detected multiplexer. Ignore signatures inside bracketed paste and leave incomplete replies unknown.
- Use inline mode when Terminal.app is detected and `tui.alternate_screen` is `auto`. Apply the decision before the first startup frame and retain it for later configuration loads. Preserve explicit `always`, `never`, and `--no-alt-screen` overrides.
- Update the `crossterm` dependency revision and lockfiles.
## Testing
Add coverage for terminal signatures, fragmented and pasted replies, probe completion and timeout behavior, screen-mode overrides, and an inline startup snapshot.
GitOrigin-RevId: 9b937824b080f9bd6de29df1d9e84f42a698af46
## What changed
Extend an existing transcript selection with Shift-click while preserving its original anchor and selection unit. Allow continued dragging and repeated extension in either direction, including whole-word selections made by double-clicking. An ordinary click still starts a fresh selection.
## Testing
Add tests for extension in both directions, preservation of selection units, continued dragging, and ordinary-click reset, plus a snapshot of word-selection highlighting.
GitOrigin-RevId: e6208c1bc6260ac26e7cd1f81c752b2c0b375f36
## Why
Application network restrictions need to cover clients created by the TUI and `codex exec` before embedded app-server startup, and remain effective when configuration is rebuilt.
## What changed
- Introduce `EmbeddedNetworkPolicy` to share live policy between caller-owned transports and the embedded app-server.
- Apply loaded requirements before creating telemetry, background HTTP clients, and executor connections. Limit authentication and cloud configuration bootstrap requests to exact endpoints under local policy.
- Preserve the shared policy across TUI session changes, permission-profile rebuilds, and worktree cloud loaders so existing clients observe policy reloads and failures.
- Document application network policy behavior and transport coverage.
## Testing
Add regression coverage for policy activation, reload failure and recovery, retained policy across TUI rebuilds, rejected OAuth and cloud-policy redirects, and workspace network restrictions with `CODEX_API_KEY`. Also cover retaining the caller-selected project during embedded startup.
GitOrigin-RevId: 629009f087b8cb21fc34a1ee7ea6fe95d9e0f2b5
## What changed
- Load `application.network` requirements at startup and explicit config/account reloads, applying local policy before authentication and cloud configuration bootstrap.
- Block traffic when policy loading fails, cancel requests that a new policy no longer permits, and reject configuration loads based on superseded policy snapshots. Local requirements edits take effect on the next explicit reload or restart.
- Bind authenticated clients to the current account and revoke them when account ownership changes. Carry policy enforcement through backend requests, realtime connections, workload identity exchanges, and code-mode gRPC streams while preserving gRPC trailers.
- Treat denied credential refreshes as policy errors without retrying them or invalidating stored credentials.
## Testing
Add regression coverage for startup restrictions, reload ordering, cancellation after restrictive or malformed requirements edits, account revocation, gRPC destination denial, workload identity cancellation, and credential preservation after denied OAuth refresh.
GitOrigin-RevId: 0cb4c720a906397e9df06675f01ecf60d741101f
## Why
Codex could enable mouse capture even when the containing tmux session had mouse support turned off.
## What changed
- Probe tmux's `mouse` and `extended-keys-format` settings together, targeting `TMUX_PANE` when available.
- Suppress mouse capture when tmux explicitly reports `0` or `off`, and apply that policy across fullscreen and overlay input changes. Refresh the policy when entering or restoring the alternate screen.
- Preserve normal mouse behavior when the probe fails or the setting is unknown, and retain the keyboard-format fallback for older tmux versions.
## Testing
Add tests for pane targeting, explicit and unknown mouse settings, probe failures, keyboard fallback, and mouse-policy changes across fullscreen and overlays.
GitOrigin-RevId: 7bdd2759207b30a3877e983b489462de7c96e692
## Why
Destination restrictions and policy revocation must remain effective during redirects, response body reads, and established WebSocket traffic. Policy denials must also survive error handling so callers do not retry them or report a revoked operation as successful.
## What changed
- Route managed HTTP clients through a shared `RequestBuilder` and policy-aware execution, checking each redirect destination before route resolution and retaining a network permit while consuming response bodies.
- Guard WebSocket connection setup, reads, and writes with revocable permits, including independent wakeups for split readers and writers.
- Preserve `TransportError::Policy` through HTTP, SSE, and realtime error handling, and treat policy denials as non-retryable.
- Keep the supplied network policy in plugin startup HTTP requests and propagate response body failures from backend and plugin requests.
## Testing
Add regression coverage for rejection before connecting, revocation during redirect routing and streamed body reads, split WebSocket revocation, realtime writer error propagation, and revoked plugin upload responses.
GitOrigin-RevId: fba36700444c98a8364c09b4dc5452c4d78a90fb
## Why
Selecting text can pause following while the final transcript row remains visible. Clearing that selection could leave an unnecessary `esc latest` hint in place of the composer hints.
## What changed
Only show the return-to-latest footer for paused navigation when the transcript tail is out of view. At the bottom, show selection shortcuts without the earlier-history status, then restore composer hints when the selection is cleared, even if following remains paused. Preserve loading and retry hints.
## Testing
Add regression coverage for selection, clicking away, and scrolling at the bottom with partial and complete history, plus selection above the bottom. Verify retry hints with selected text and update activity expectations and the composer-gap snapshot.
GitOrigin-RevId: aeb2109244d6c3214c945abb51cf469087d03074
## What changed
Display a `voice` badge on the task whose session owns the running voice conversation, including when a child thread owns it. Refresh the overview after voice controls and realtime conversation resets so the badge clears when background voice closes asynchronously.
## Testing
Add snapshot coverage for a child thread owning voice and a regression test for clearing the badge after an asynchronous background voice close.
GitOrigin-RevId: 815dfad4ce1a31945d2dd0d3f9cecc5abfa419d6
## Why
Switching threads stopped the active voice conversation. Users should be able to view another task while continuing the call on its original thread.
## What changed
- Retain the voice owner's live widget and subscription in the background, routing voice controls, speech, and connection callbacks to that owner.
- Restore the live call and transcript when returning to its thread, without duplicating captions or letting background UI events affect the visible task.
- Preserve undelivered speech and defer background errors until the owning thread is shown.
- Stop background voice on shutdown, disconnect, or removal of the owning session.
## Testing
Extend regression and end-to-end coverage for thread switching during delegated speech, voice control routing, transcript restoration, caption deduplication, and cleanup on disconnect or archive/delete.
GitOrigin-RevId: ce010dce6fa8cd6fa44949a131f3f16e8cb80c4d
## What changed
- Handle voice toggle and mute shortcuts in `App`, and route `/voice`, `/voice stop`, and `/voice mute` through thread-scoped events that ignore requests for a different current thread.
- Allow function-key voice toggle bindings and chords beyond chat, including transcript browsing and search, while preserving existing surface bindings and raw key capture.
- Exit transcript browsing when toggling voice, avoid matching completed chords again, and preserve startup submission handling before dispatch.
## Testing
Add regression coverage for voice chords outside chat, binding conflicts, key capture, transcript browsing, mute dispatch, and startup submission cancellation with draft preservation.
GitOrigin-RevId: c4d110ca8a2e1840247a7fe84cd69c6b7cdb36d7
## What changed
Add `backend_reasoning_status`, disabled by default, to relay public reasoning summaries during active, server-managed realtime V3 delegations.
Use the last non-empty summary from each completed reasoning item, truncate it to 256 bytes at a character boundary, and append it as `[STATUS]` context on the `commentary` channel. Discard queued updates if their delegation is no longer active.
## Testing
Add an integration test covering enabled and disabled behavior, selection of the latest non-empty summary, exclusion of raw reasoning and partial summaries, and delivery without triggering `response.create` or changing the model's reasoning-summary setting.
GitOrigin-RevId: 75ce87dbbbab15a6d9d0ad0b23737738837192fd
## Why
User prompt URLs only received explicit hyperlink destinations when they required forced wrapping, leaving other URLs without those annotations.
## What changed
Annotate web URLs before wrapping user messages so their full destinations survive both adaptive wrapping and forced splitting of oversized URLs.
## Testing
Add a regression test and snapshot at widths of 120, 60, and 24 columns, checking URL destinations, line width limits, and matching display and transcript output, including a prompt with an image placeholder and a parenthesized URL.
GitOrigin-RevId: fccae7b76a3613776d7a663c41e699ebad7eebc1
## What changed
Reserve a blank row below a trailing recap when the transcript viewport has room. Keep this spacing in layout rather than selectable content, and omit it when a completed or live message follows the recap.
## Testing
Add snapshots covering recap tail spacing across terminal sizes, with and without a next action, and with completed or streaming follow-up messages. Verify that reflowed history retains a single separator between a recap and the following message.
GitOrigin-RevId: f9552931fac4eabd7d72c2b312ffba717257e9e1
## What changed
Add `openai.gpt-6-sol` and `openai.gpt-6-luna` to the Bedrock catalog, including `global.` and `us.` variants for Bedrock Runtime. Make GPT-6 Sol the default and provider fallback model, preferring its global variant for Runtime. Retain the existing models and update model picker ordering.
## Testing
Extend catalog and provider tests to cover the new models, metadata, ordering, and default selection. Update thread-start tests for supported model preservation and fallback behavior, and refresh Mantle and Runtime model picker snapshots.
GitOrigin-RevId: 5ce646e384353ae26cdfc4ea4e7c049ac61e698c
## What changed
- Add “Inspect activity” to the shortcut help’s Session section, using the runtime `focus_activity` binding (`F4` by default) and hiding it when unbound.
- Remove the passive activity footer hint so composer hints remain available. Keep previous, next, details, and back controls while activity is focused, shortening them to fit the available width.
## Testing
Add snapshot coverage for default, remapped, and disabled activity shortcuts. Update footer coverage to verify the absence of passive hints and interactive controls at 20, 32, and 80 columns.
GitOrigin-RevId: 52ca6f4992778cd3cf3eebe163d533e69a8dabeb
## What changed
- Add `gpt-6-sol` and `gpt-6-luna` catalog entries and refresh model descriptions.
- Offer migrations from `gpt-5.5`, `gpt-5.6-sol`, and `gpt-5.6-terra` to `gpt-6-sol`, and from `gpt-5.6-luna` to `gpt-6-luna`.
- Retarget retired `gpt-5.4` and `gpt-5.4-mini` selections to GPT-6 Sol and Luna, respectively.
- Recommend `gpt-6-luna` in the rate-limit switch prompt.
## Testing
Extend migration tests to cover the new targets, their default reasoning effort, and prompting again after a previously acknowledged migration to an older target. Update model-picker and rate-limit prompt snapshots.
GitOrigin-RevId: d3a093d18ce44a903383504ab8f5cbbc911d602d
## Why
An empty composer hint row already separates activity from the input. Adding another separator wastes transcript space, especially in short terminals.
## What changed
Reserve the extra separator only when copy status text, a follow control, or a fitting hint occupies the shared row and the viewport has room. Recalculate the transcript layout in the same frame when adding that separator, and use a shared timestamp for copy status visibility and expiry.
## Testing
Extend snapshots for running turns with no hint, follow controls in short terminals, and copy status text at narrow widths and limited heights. Update resize assertions to check that the draft and caret remain stable relative to the terminal bottom.
GitOrigin-RevId: a73894063b759ec6b9a25f720e0e8007516109c8
## What changed
Remove trailing periods from concise built-in option descriptions and disabled-option explanations, and simplify wording across TUI menus. Share the built-in permission preset descriptions between permission pickers.
Document the convention in `codex-rs/tui/styles.md`, including normal punctuation for descriptions with multiple sentences and preservation of externally supplied descriptions.
## Testing
Update menu assertions and rendering snapshots for the revised copy and line wrapping.
GitOrigin-RevId: 3231d25484178452ab001af5ddc982460d14f94a
## Why
Compaction companion records do not represent all resume state, including the last started turn and previous turn settings. The selected multi-agent runtime also needs a persisted value when no companion turn context is present.
## What changed
- Add optional `resume_metadata` to `CompactedItem`, recording the multi-agent version, last started turn ID, and previous turn settings. Preserve the distinction between absent metadata and explicitly empty values while retaining compatibility with older records.
- Capture this metadata under the settings persistence lock alongside the compaction checkpoint.
- Rewrite inherited metadata to use the child agent's runtime, and clear previous turn settings when the child must rebuild context.
- Clear pending continuation state before delivering acceptance of standalone settings updates, while holding the persistence lock.
## Testing
Add coverage for metadata round trips with empty values, legacy reader compatibility, checkpoint companion records, inherited fork metadata, and continuation invalidation while settings event delivery is blocked.
GitOrigin-RevId: f30b7feaa7e2fdb5b65fc3c53b37fd7a7fe27903
## What changed
Render unordered bullets as `•` and task markers as `☐` or `☑`, preserving ordered numbering and continuation indentation in streaming and completed Markdown. Add `tui.rendering.lists`, enabled by default; setting it to `false` retains hyphen bullets and textual task markers.
## Testing
Add snapshot coverage for nested, ordered, quoted, and wrapped task lists, plus code and escaped markers. Add character-by-character streaming tests that compare incremental and emitted output with full rendering, with list rendering enabled and disabled.
GitOrigin-RevId: df9209d8c42f277dd2a2d7073ea19a6feb7dd706
## Why
Several TUI views hard-code 24-hour timestamps even when the detected system preference is 12-hour time.
## What changed
Use the existing `ClockFormat` preference for rate-limit and spend-control reset times, usage notices, backend banners, reset-credit expiration times, analytics timestamps, and expanded session details in the resume picker. Capture the preference when constructing views and preserve existing timezone handling, including analytics' UTC labels.
## Testing
Add coverage for midnight, noon, and next-day reset labels in both clock formats, plus 12-hour analytics rendering with UTC labels. Update snapshots for status, banners, usage notices, reset-credit details, and expanded sessions, including narrow-width layouts. Pin test fixtures to explicit clock formats for deterministic output.
GitOrigin-RevId: 73c36d603ddc4eb7800614650a14c6f2961f8b70
## Why
In read-only sessions with an external writer, `Esc` could enter prompt backtracking or be consumed by a scrolled transcript instead of returning to the agent command center.
## What changed
- Exclude external-writer views from prompt backtracking and let `Esc` navigate away from scrolled transcripts. Active search and selection still consume `Esc` first.
- Close the legacy transcript overlay without starting a backtrack preview or changing the retained draft.
- Allow `Esc` to open the agent command center while disconnected, showing a stale-list notice with reconnect status instead of requesting a refresh.
## Testing
Add regression coverage for normal, scrolled, detailed, and offline read-only views, command-center snapshots, and retained-draft preservation when closing the legacy transcript overlay.
GitOrigin-RevId: e2623d25dd4b4beea13b6f517932280168113dce
## Why
Status symbols in the agents overview retained their status color when selected, making their styling inconsistent with the rest of the selected row.
## What changed
Apply the row's selection style to its status symbol while preserving status colors for unselected rows.
## Testing
Extend rendering tests to assert and snapshot selected status symbol styles across status variants, and verify that an unselected idle symbol retains its cyan color.
GitOrigin-RevId: a5163841bed80d6d43e7c62a7596c6e48b9dc886
## Why
Automatic daemon launches could silently fall back to embedded mode when shared feature settings differed from the session's requirements. Changing those settings affects other clients, and restarting the server may interrupt active or queued work.
## What changed
- Offer interactive choices to run without the daemon, restart with the required settings, or cancel. Default to cancel and require explicit confirmation for restart.
- Allow restart only for managed daemons with a feature mismatch, then recheck compatibility once. Noninteractive required-daemon failures return an error with `--no-daemon` guidance; optional attachment retains its fallback behavior.
- Preserve saved feature overrides on startup and require confirmation before applying requested shared-feature disables, including on fresh starts.
- Merge confirmed settings under the lifecycle lock, persist changes after the old process stops, and avoid restarting when the saved overrides already match.
## Testing
Add recovery-menu snapshots and confirmation tests, compatibility tests for required and optional attachment, daemon ownership and settings-preservation tests, and CLI terminal tests for cancellation, embedded fallback, confirmed restart, and disabling shared features.
GitOrigin-RevId: d50a6cf7e476b9647237431e8fc0fc6041ed17db
## Why
`/import` was unavailable in remote sessions and when connected to the local app-server daemon. Shared servers also broadcast import completions from other clients, which must not clear this client's pending import or report its completion.
## What changed
- Allow external setup migration through the connected app server in both session types.
- Detect setup using the active thread's working directory, or the remote working-directory override before a thread starts. Use home-only detection when no remote directory is available.
- Track the returned `import_id` and only clear the pending import and report completion for a matching notification.
- Skip refreshing configuration from local disk after import completion in remote workspaces.
## Testing
Add shared-transport coverage in embedded and remote modes for detection with and without a working directory, retrying failed imports, rejecting overlapping imports, and matching interleaved completion notifications queued before the import response.
GitOrigin-RevId: 864ed9fe87e5c554da79907ed80a01f0c9948392
## What changed
- Request installed-plugin metadata with `includeExtensions=true` and carry optional `extensions` through the cache into `PluginSummary`.
- Add typed declarations for global, settings, thread, and file entrypoints, quick actions, settings tools, icons, and search mention providers. Update JSON schemas and TypeScript and Python bindings.
- Accept supported snake_case aliases and emit camelCase fields. Discard incompatible extension declarations without invalidating the installed-plugin inventory.
## Testing
Add an integration test covering extension metadata preservation, field normalization, and unknown entrypoint and quick-action types across live and cached `plugin/installed` reads. Update pagination assertions to require `includeExtensions=true`.
GitOrigin-RevId: b73b0d13c151a30dc1fb9cda70b5cd6d7e3e2441
## Why
Clients with a gateway sign-in UI need to control when browser authorization starts and inspect credential readiness before making authenticated requests.
## What changed
- Add `initialize.capabilities.explicitGatewayOauth` to require explicit login while allowing existing credentials to refresh. Preserve automatic authorization for clients that omit the capability, and prevent later connections from undoing explicit opt-in.
- Add `account/gatewayOAuth/read`, `account/gatewayOAuth/login`, and `account/gatewayOAuth/cancel`, plus `account/gatewayOAuth/changed` notifications. Send the authorization URL only to the initiating connection and cancel its login on disconnect.
- Check gateway authentication before returning cached results from `model/list`, with restart guidance when provider settings have changed.
- Update protocol schemas, TypeScript and Python bindings, and document capability probing and the sign-in lifecycle.
## Testing
Add tests for passive readiness reads, credential reuse after login, token exchange failures, cancellation and immediate retry, connection ownership, legacy versus explicit login, and model-list authentication checks.
GitOrigin-RevId: a26e116a62c9f3db84dc238a40b7f4e816eb1594
## Why
Aligned equations and common optimization notation previously fell back to TeX source. Scripts without Unicode equivalents also prevented otherwise supported expressions from rendering.
## What changed
- Add display layouts for `aligned` and `\boxed`, preserving fraction geometry and alignment with surrounding math.
- Stack sum limits and `\underset`/`\overset` annotations in display math, with compact forms for inline math and nested arguments.
- Support `\substack`, uppercase `\mathcal`, and single-grapheme `\widehat`.
- Preserve scripts without Unicode equivalents using explicit grouping, such as `x_{gpt}` and `x^{q+1}`.
- Keep layouts bounded and retain source fallback for unsupported input or expressions that do not fit.
## Testing
Add snapshots and regression tests for optimization models, display limits, grouped scripts, fraction alignment, narrow-width fallback, malformed input, and layout bounds. Add streaming coverage comparing character-by-character output with complete rendering at wide and narrow widths in rich and raw modes.
GitOrigin-RevId: 83937880a309375f472228368ebe885d4f50bf9c
## Why
Conversations open in another app disable the composer. Let users continue in an editable fork while the original conversation remains owned by that app.
## What changed
- Add an `f`/`F` shortcut and footer hint to the locked conversation view, preserving local drafts and queued prompts in the fork.
- Show “Forking conversation…” while a fork is pending, block additional key input, and discard buffered input after forking from the locked view.
- Replace the previous session summary after a fork with “Fork created. You can continue here.”
- Keep the locked view and draft intact if the fork request fails.
## Testing
Add tests for shortcut ownership and modifiers, repeated input, editable forks that preserve drafts and queued prompts without taking the source lease, and failure recovery. Add snapshots for fork progress, completion, and the updated footer.
GitOrigin-RevId: 2ecdb0b7fc7e82d8295097faa567995d7a2f7d92
## What changed
Promote `daemon_auto_start` to stable and enable it by default for eligible interactive launches. Remove its entry from `/experimental`.
## Testing
Update daemon startup, `--no-daemon`, and startup failure tests to exercise the default without explicitly enabling the feature. Disable daemon startup in unrelated TUI and path-safety test fixtures.
GitOrigin-RevId: 107d71108b96d09431148d7d61f10c6381929e05
## What changed
Default `tui.fullscreen_transcript` to `true`, including when the `[tui]`
section is absent, and apply the same default to the first frame. Update the
configuration schema to match. Alternate-screen restrictions still take
precedence, and `tui.fullscreen_transcript=false` restores terminal scrollback.
## Testing
Update configuration and startup tests for the new default, including an empty
`[tui]` section and `--no-alt-screen`. Adjust PTY tests to cover default fullscreen
entry and explicit opt-out to terminal scrollback.
GitOrigin-RevId: e460dcd058d52c50da2abc5113bbb678e845d5fc
## What changed
Add nullable `httpOrigin` to `McpServerStatus`, derived from the effective configured endpoint for both configured and plugin-provided servers. Return only the HTTP(S) origin, excluding credentials, path, query, and fragment; return `null` for stdio transports, invalid URLs, and non-HTTP(S) schemes. Update the generated protocol schemas and TypeScript and Python types.
## Testing
Extend status integration tests to cover configured and plugin-provided HTTP servers, verify that endpoint paths and query parameters are omitted, and assert `null` for a stdio server. Update protocol tests to check null serialization and compatibility with older inventory responses.
GitOrigin-RevId: 033ebdeefe829e3a48b2d4ab7d8866dac4cda5c5
## Why
A queued close notification from an old runtime can arrive after the same thread has been resumed. Because thread IDs survive reloads, handling that notification can incorrectly exit the TUI or switch away from the displayed thread.
## What changed
Confirm the displayed thread's status with `thread/read` before handling its close notification. Ignore the notification if the thread is still loaded. Bound verification to five seconds and retry an internal server error once.
If verification fails, reconnect remote sessions. Preserve close handling for embedded sessions, unreadable unpersisted threads, and servers that do not support the request.
## Testing
Add regression tests for stale and genuine close notifications, plus disconnects, timeouts, transient and persistent server errors, embedded-session fallback, and unsupported requests.
GitOrigin-RevId: 783433b11ed268aed521f3b2cc4d0aa3a36a3836
## Why
Dragging horizontally along the top or bottom transcript row could trigger autoscroll, moving the text under the pointer while selecting it.
## What changed
Require vertical pointer movement from the initial press row before selection autoscroll can begin. Remember that movement so a vertical drag can return to its starting edge and still autoscroll, and preserve the original pointer row across wheel scrolling.
## Testing
Extend regression tests and snapshots for horizontal selection at both edges, stable selected text across repeated ticks, wheel scrolling before the first drag, and autoscroll after a vertical drag returns to its starting edge.
GitOrigin-RevId: e13f3a80adbead1eecbeb281301667c8e12e1541
## What changed
- Add `auto_review.extra_policy` and the managed `guardian_extra_policy` requirement to supply policy text alongside the resolved tenant policy. Nonblank managed values take precedence; blank values are ignored.
- Render the additional text through `{{ extra_policy }}` in Guardian reviewer templates and append it to the tenant policy for Guardian v2 classification before truncation.
- Preserve placeholder-like text inside supplied policies literally.
## Testing
Add coverage for configuration precedence, blank values, template substitution, and classifier prompts, plus a scenario verifying that managed tenant and extra policies reach the Guardian reviewer together.
GitOrigin-RevId: 180d8d716c63fe96a92ec5bfbd22db4ddccd4f1f
## What changed
- Persist producer-recorded item start and completion times in thread history, preserving existing non-null values on updates.
- Return nullable `startedAtMs` and `completedAtMs` Unix millisecond timestamps from `thread/items/list`, and update the generated schemas and TypeScript and Python types.
- Leave timestamps unknown for existing rows and older writers.
## Testing
Add coverage for exact timestamp persistence, protocol round trips with present and missing timestamps, paginated item responses, and compatibility with older database writers.
GitOrigin-RevId: 894853481085782ff54db1704799e41446d15e51
Change `R to Retry` to `r to retry` in the TUI notice and update the
corresponding rendering snapshots.
GitOrigin-RevId: f7971ba0f76ac446a5fea53b44390f65aa965be4
## Why
The 999-byte response budget and blanket string truncation could discard assistant answers alongside supporting history. Thread lists could also lose entries when shortened to fit the budget.
## What changed
- Raise the response budget to 8,000 bytes and remove the separate 2,000-character cap on assistant messages in `read_thread` and `wait_threads`.
- Compact oversized read responses around each turn's latest assistant message, and retain every wait target and returned list entry with pagination cursors intact.
- Shorten only content fields when further reduction is needed, preserving valid JSON and protocol values such as IDs, cursors, phases, and statuses. Mark compacted responses and shortened content with `truncated`.
- Request archived thread pages at the requested limit without retrying with smaller pages to meet the response budget.
## Testing
Add regression coverage for oversized wait responses with Unicode and escaped text, list entry and cursor preservation, and an oversized read whose assistant answer survives into the next model request. Extend read and wait tests to verify assistant messages longer than 2,000 characters are retained when they fit.
GitOrigin-RevId: 459fa522d02fbe4cd877b9afe8e66c9358b7bbce
## Why
Activity indicators and queued input previews could separate usage notices and
reading controls from the composer.
## What changed
- Reserve the shared hint row below activity and previews in the owned transcript
layout, and use its rendered position for hints and reading controls.
- Clip spacing and hints before activity and previews when vertical space is tight.
- Fit usage notice details within half the row, allowing the shortest complete
warning to use more space on narrow terminals.
## Testing
Expand regression tests and snapshots for running turns, queued inputs, multiline
drafts, short terminals, follow-control clicks, and hidden actionable banners.
Cover five-hour and weekly usage notice width thresholds.
GitOrigin-RevId: e73b3614839ce35c5b0a009901514627a77d4190
## What changed
- Disable default features for `sentry`.
- Disable default features for `syntect`, explicitly enable `parsing`, `plist-load`, and `regex-onig`, and switch `two-face` to `syntect-onig` in `codex-rs/tui`.
- Remove the resulting unused dependencies from the Cargo and Bazel lockfiles, including Actix, Sentry integrations, `ureq`, and `yaml-rust`.
GitOrigin-RevId: b3ca6610fdc60ab99909660f56099fbb4093b9c5
## Why
Chat analytics displayed raw credit strings, exposing values such as `0E-10` for plan-covered tasks and unnecessary trailing decimal zeros.
## What changed
Format ordinary credit amounts with two decimal places and thousands separators. Round directly from decimal digits to avoid floating-point rounding errors, so `1.005` becomes `1.01`. Normalize zero to `0.00`, while preserving the original strings for nonzero sub-cent amounts and values outside the safe conversion range.
## Testing
Add assertions for decimal and scientific notation, signed zero, rounding boundaries, tiny adjustments, and large values. Update the chat analytics snapshot to cover a plan-covered task showing `0.00` credits.
GitOrigin-RevId: f946cb408c2c37291447f90de02ebbb557fbc662
## What changed
- Describe GPT-5.6-Sol as a reliable agentic workhorse for everyday tasks and change its catalog `priority` from `6` to `4`.
- Describe GPT-5.5 as a proven previous-generation model for coding and general work.
- Refresh model picker, migration prompt, and agent tool snapshots to reflect the catalog updates.
GitOrigin-RevId: b39f51c22862b8cef585ed76f3973c9f4b670c27
## What changed
Add a Voice entry using the configured `toggle_voice` binding (`F8` by default). Show it only when voice commands are enabled and no side conversation is active.
## Testing
Update footer and shortcut overlay snapshots to include the Voice entry.
GitOrigin-RevId: ba92f5af1ce1a06d9700d31dcc90e5acb1613803
## What changed
- Replace the built-in orchestrator skill provider with a host-supplied cloud provider, using `cloud` authority and `c` root aliases in skill tools and prompts.
- Add `cloud.skills.enabled`, defaulting to true but requiring a supplied provider. Keep `orchestrator.skills` accepted as a legacy no-op setting, and remove the app server's automatic orchestrator provider registration.
- Discover cloud skills once per turn during cancellable startup. Serve catalog snapshots to prompts and tools without triggering discovery or retries.
- Scope cached catalogs and resources to authentication state. Preserve them on refresh failures within the same scope, invalidate them when that scope changes, and reject late discovery or read results from replaced cache generations.
- Reuse executor discovery catalogs only when successful discovery inputs and bundled-skill settings match.
## Testing
Add coverage for per-turn refresh, skill removal, same-account failures and reconnects, authentication changes, and stale in-flight results. Update configuration and tool tests for cloud authority, provider gating, and resource reads without an executor.
GitOrigin-RevId: c57e38ec7dcc880c0d4c8a2995adfd3e28301079
Eric Traut