Commit Graph
3074 Commits
Author SHA1 Message Date
liame-oai ec8251c545 Add experimental prediction forks that inherit parent context (#51884)
## Why

Prediction forks need to preserve the parent's effective context and request settings to maximize prompt-cache reuse.

## What changed

- Add `experimentalPredictionMode` to `thread/fork` for ephemeral forks of loaded, persisted parents. Reject configuration overrides, `path`, `lastTurnId`, and `beforeTurnId` in this mode.
- Inherit the parent's effective configuration, tools, environments, collaboration settings, disabled plugins, and persisted history.
- Enable `features.reasoning_effort_override` on the fork while preserving the parent's request-effort baseline, including when overrides were disabled on the parent.
- Report the fork's effective model, service tier, and reasoning effort in the response.

## Testing

Add coverage for matching parent and fork requests and prompt-cache keys across legacy and paginated history, invalid fork parameters, and reasoning-effort inheritance. Add a context snapshot for identical parent and fork continuations.

GitOrigin-RevId: 46b41f2ac331562b441dadff1a0a9f926c94880d
2026-10-08 00:09:03 +00:00
pash-openai eef4719927 Preserve line breaks and links in multiline async questions (#51866)
## Why

Rendering an entire question title as one terminal line removes line endings and misaligns hyperlink source ranges with the visible text.

## What changed

Wrap and annotate each logical line of asynchronous question titles separately, preserving blank lines and handling both LF and CRLF endings while retaining complete hyperlink destinations.

## Testing

Add a rendering regression test and snapshot covering multiline titles with code fences, Unicode text, and a URL. Check LF and CRLF rendering equivalence and hyperlink destinations at narrow and wide widths.

GitOrigin-RevId: ccd7256dbaed91ce98374e52b17d3a1b87645574
2026-10-07 22:55:00 +00:00
canvrno-oai 746103b592 Use readable plugin mentions without suppressing same-name skills (#51865)
## Why

Generated app IDs produce opaque plugin mention labels. A selected `@foo` plugin mention also prevented a separate `$foo` skill mention from being submitted.

## What changed

- Use eligible display names, such as `@Postman`, for plugins named `app-` followed by 32 lowercase hexadecimal characters, while preserving the plugin binding. Accept 1–64 ASCII letters, digits, underscores, or hyphens, excluding common environment variable names; otherwise retain the existing naming fallback.
- Only `$` mention bindings suppress automatic skill selection, allowing `@foo $foo` to submit both the plugin and the skill.

## Testing

Add naming tests for accepted display names and fallback cases, a composer snapshot verifying `@Postman` and its plugin binding, and a submission regression test for a plugin and skill sharing the name `foo`.

GitOrigin-RevId: aa8c98f293d12e62d32d43206e076cbe1fcb2a3b
2026-10-07 22:46:41 +00:00
Dmitriy Kovalenko 745d865521 Align Bazel release builds with Cargo and fix platform compatibility (#51848)
## Why

Bazel release builds need Cargo-compatible Rust and native build-script settings. Platform-specific issues also include Windows command-line limits, MSVC runtime conflicts with V8's allocator, and a missing V8 `__clear_cache` symbol on ARM64 musl.

## What changed

- Add `--config=release` settings for thin LTO, four target codegen units, and disabled debug assertions and overflow checks, with separate settings for build tools.
- Add opt-in Cargo release profile support for build-script optimization and debug information, preserving explicit C/C++ flags. Give optimized Bubblewrap builds `-O3`, debug symbols, and enabled native assertions.
- Statically link the MSVC CRT for Rust and C/C++ target and host dependencies, and disable SQLite intrinsics on x64 MSVC to avoid startup crashes on older CPUs.
- Let the Rust process wrapper read its arguments from a multiline parameter file to avoid Windows command-line limits.
- Select the ARM64 musl V8 archive containing compiler-rt builtins and raise the Rust recursion limit to `256` in the app-server client, exec, and TUI entry points for release compilation.

GitOrigin-RevId: 8f61e62b8735c36209ee92e04a0e0339a70badc5
2026-10-07 22:10:23 +00:00
pakrym-oai 406b0c4446 Enable instant interrupts by default (#51812)
## What changed

Enable `instant_interrupt` by default so new user input can preempt responses and yield foreground code-mode observations. Keep the feature marked as under development and update feature-policy tests to allow this exception.

Explicitly disable instant interrupts in core, TUI, and Python SDK tests that depend on responses completing before steering or processing subsequent input.

GitOrigin-RevId: a8cab2d6c445bfdbd10b0b2abcf7893d32ee8595
2026-10-07 19:42:35 +00:00
berkdeniz-oai b38942ce7c Preserve diagnostic reasons for MCP user verification failures (#51808)
## Why

User-verification cancellations previously discarded failure reasons, leaving MCP servers unable to distinguish user cancellation from unavailable approval, interruption, or invalid proof.

## What changed

- Carry a bounded `openai/userVerificationReason` value in response `_meta` for verification failures, declines, and cancellations across the TUI, app server, and MCP client.
- Preserve recognized reasons and classify invalid responses, missing or invalid proofs, response errors, closed response channels, interruptions, and unavailable approval.
- Discard unknown reasons and unrelated metadata. Keep proof material out of decline and cancellation responses, and keep display messages and raw error diagnostics out of response metadata.

## Testing

Add and update tests for typed failure propagation, metadata filtering, invalid proofs, response-channel failures, interrupted requests, and unavailable approval, including TUI RPC and native MCP response coverage.

GitOrigin-RevId: 6b7f855ce8eb13e759b5b86d0dc2b1afdfcff7b3
2026-10-07 19:28:14 +00:00
Celia Chen 87be737b66 Advertise Ultrafast for GPT-6.1 Sol on Amazon Bedrock (#51794)
## What changed

Add the `ultrafast` service tier to bundled catalogs for `openai.gpt-6.1-sol` on Bedrock Mantle and `global.openai.gpt-6.1-sol` and `us.openai.gpt-6.1-sol` on Bedrock Runtime. This exposes `/ultrafast` for these models while keeping tier selection opt-in.

## Testing

Extend catalog, app-server, core request, and TUI tests to cover GPT-6.1 Sol tier discovery and selection across all three model IDs, including toggling back to the default tier and honoring custom catalog commands.

GitOrigin-RevId: b5bbde8615b73a1d73eb16db7952b10d044b9fa6
2026-10-07 18:32:50 +00:00
Brent Traut 1fbe15c962 Add thread ID exclusions to thread/list (#51595)
## Why

Clients displaying a saved manual thread order need to list the remaining threads without repeating those already loaded separately.

## What changed

Add optional `excludedThreadIds` to `thread/list` and the generated protocol bindings. Apply exclusions before the result limit, refilling pages until the requested limit is reached or history is exhausted while preserving existing filters and ordering. Clients must send the same exclusions on each page.

Accept up to 100 entries, counting duplicates toward the bound. Reject invalid IDs or oversized lists with JSON-RPC error `-32602` rather than truncating them. Omitted, null, and empty lists preserve existing behavior.

## Testing

Add integration coverage for page refill across database-only and scan/repair paths, archived threads, sort directions, and project/section scopes. Cover duplicate and unknown IDs, the 100-entry boundary, invalid input, and preservation of section order.

GitOrigin-RevId: e9a884e642ae25d166aff7e275469d1d43179c6c
2026-10-07 06:07:47 +00:00
Ian MacLeod eb2d3c6416 Preserve live TUI settings when configuration reloads fail (#51510)
## Why

Live preferences can be newer than the last successful configuration load. Starting a new thread after a reload failure could overwrite those preferences with stale settings.

## What changed

Carry local settings alongside the new-session configuration, retaining the live settings when reloading fails and applying the staged settings when the new thread starts. During resume and agent selection, replace staged local settings only when the directory-trust check actually reloads configuration.

## Testing

Add a regression test that changes a live rendering preference, writes invalid `config.toml`, and verifies that loading a new thread's configuration preserves the live local settings.

GitOrigin-RevId: 4ac3c70de6d627e1609cc0a5d4ba5df5a61a8b20
2026-10-06 23:19:16 +00:00
Eric Traut 7298a6e020 Add shared task pinning to the agent command center (#51500)
## What changed

- Use `p` to pin or unpin the selected task, with a configurable `agents.toggle_pin` binding.
- Display pinned tasks first in a `Pinned` group, preserving shared section order and applying search and status filters.
- Load pins from the shared thread section, including tasks outside the recent-task window, and refresh after pin changes. Disable pinning when the server does not support shared sections.

## Testing

Add coverage for shared pin/unpin state, paginated pin discovery and refreshing pins on reopen, shortcut dispatch and duplicate-action suppression, and pinned-group and custom-help snapshots.

GitOrigin-RevId: d1a2cab6642d059c3c8df8480b5c59a10c493936
2026-10-06 23:04:26 +00:00
Adam Perry @ OpenAI c9870d0157 Use PathUri for skill identity and path matching (#51482)
## Why

Skill selection and disabled-path matching need to recognize equivalent Windows paths across case and separator differences while preserving literal spaces, `%`, and `#` in native filenames.

## What changed

- Carry `PathUri` through skill metadata, discovery mappings, filesystem lookups, disabled-path sets, and invocation analytics.
- Match linked skill mentions and TUI selections by parsed path identity.
- Use `LegacyAppPathString` for app-server skill paths and regenerate schemas and SDK types, preserving native path strings on the wire.
- Preserve native catalog display paths and ordering. Keep host filesystem probes and configuration writes restricted to host-compatible paths.

## Testing

Add regression tests for Windows path identity and disabled-skill matching, literal filename characters, catalog resource reads, native path ordering, and foreign-path analytics normalization.

GitOrigin-RevId: c212916dc9fef0e7616542726e107f0d6a313267
2026-10-06 21:29:35 +00:00
Charlie Marsh 0b863c69f5 Preserve URL destinations in wrapped hook details (#51473)
## Why

The hooks browser rendered detail URLs as plain text. Long URLs in hook commands can wrap or be truncated, so their visible text may omit part of the destination.

## What changed

Render web URLs in hook details as terminal hyperlinks, preserving the complete destination across wrapped lines and truncated text. Keep truncation ellipses outside the links.

## Testing

Add a regression test and snapshot for a wrapped, truncated hook command URL, checking that linked cells retain the complete destination and the ellipsis remains unlinked.

GitOrigin-RevId: 488562266bd5ef880c03bf313bc4cfa7d3104c7b
2026-10-06 19:52:29 +00:00
Charlie Marsh b0a5191bd6 Preserve clickable URLs in TUI selection rows (#51472)
## What changed

Render web URLs in selection labels and descriptions as terminal hyperlinks, preserving their complete destinations when text wraps or is truncated. Carry hyperlink ranges through two-column layouts and keep truncation ellipses outside links.

## Testing

Add regression assertions and a snapshot covering wrapped and single-line rows, prefixed labels, descriptions, and wide Unicode characters. Verify that visible URL fragments retain complete destinations and ellipses are not linked.

GitOrigin-RevId: 9d50b3ced79cbd29200e48a676445ec169d60758
2026-10-06 19:52:03 +00:00
Charlie Marsh 4854cfa643 Preserve clickable URLs in pending input previews (#51471)
## What changed

Render web URLs in pending steers, rejected steers, and queued follow-up messages as terminal hyperlinks. Preserve the complete destination when the visible URL is clipped to the preview width.

Add `HyperlinkRows` to render already-wrapped rows without changing their spacing or row count, clipping text and hyperlink ranges to the viewport.

## Testing

Add regression coverage for complete URL destinations across all three preview sections, plus snapshots for oversized URLs and clipping overflow text and the edit hint in a narrow preview.

GitOrigin-RevId: 959df27bba381b1b3895f5a86cc2ecb1419806b1
2026-10-06 19:51:39 +00:00
Steve Coffey b0a6b8d86f Record resolved model and reasoning effort in sub-agent activity (#51463)
## What changed

Add `model` and `reasoningEffort` to `subAgentActivity` items for multi-agent v2 spawns. Capture startup settings before the child begins its turn and resolve the reported effort against model metadata, including model defaults, while preserving the child's configured effort.

Carry these fields through live notifications, persisted activity, thread history, and legacy rollout migration. Update the JSON schemas and generated TypeScript and Python types. Older records and other activity kinds retain null values.

## Testing

Add coverage for resolved spawn settings matching the child's request across legacy and paginated history, preserving configured effort, forwarding metadata through events and history, and reading and migrating older records without the new fields.

GitOrigin-RevId: a9e4241ae21bb8db1ead293f78ffba8257cca0ae
2026-10-06 19:29:40 +00:00
Charlie Marsh 414d165b47 Preserve wrapped help links in Windows sandbox prompts (#51459)
## What changed

Render help text in Windows sandbox setup and fallback prompts with `HyperlinkText` so each wrapped URL fragment links to the complete destination. Strip OSC 8 sequences when rendering popup snapshots to keep assertions focused on visible text.

## Testing

Add a regression test covering both prompts at 40 columns, asserting that every linked cell retains the complete destination and the visible link text remains intact. Include a snapshot of the wrapped setup prompt.

GitOrigin-RevId: 98bd60f04ab3ec8d6552a0b74b9637cce26169d5
2026-10-06 19:12:40 +00:00
Charlie Marsh 858aea3449 Make URLs clickable in user verification prompts (#51458)
## What changed

Render user verification titles and request details with `HyperlinkText` so URLs carry terminal hyperlinks, including in the waiting-for-verification view.

## Testing

Extend the narrow-prompt regression test to verify that wrapped URLs retain their full hyperlink targets before and during verification. Strip OSC 8 annotations when comparing visible text in snapshots.

GitOrigin-RevId: 9b2fba963c028eaa2b177220b0487364b44d04bb
2026-10-06 19:12:16 +00:00
Charlie Marsh e44b9bb3da Preserve status usage hyperlinks when the URL wraps (#51457)
## Why

The ChatGPT usage URL in the status card loses its terminal hyperlink when it wraps across lines in a narrow terminal.

## What changed

Attach the usage URL destination to each underlined span so every wrapped fragment remains clickable.

## Testing

Extend status hyperlink coverage at widths of 24, 42, and 120 columns to verify that linked fragments reconstruct the full URL and all point to the same destination.

GitOrigin-RevId: 516421380763f48da8af63b4d374e2b352722ddb
2026-10-06 19:10:59 +00:00
Charlie Marsh 4b5c111349 Make banner URLs clickable across wrapped lines (#51452)
## What changed

Render URLs in TUI banner titles and descriptions as terminal hyperlinks, preserving the full destination when a URL wraps across lines.

## Testing

Add a regression test that checks hyperlink destinations for a wrapped URL and snapshots the visible banner layout.

GitOrigin-RevId: 1b1957570c1c0940a60f5a202648b0eeed5b95e1
2026-10-06 18:52:05 +00:00
Charlie Marsh 5da229e54d Make URLs in the TUI warnings viewer clickable (#51451)
## What changed

Render web URLs in warning details as terminal hyperlinks, preserving the full destination when a URL wraps across lines or the viewer scrolls.

## Testing

Add a regression test for hyperlink destinations after wrapping and scrolling, plus a snapshot of a warning containing a wrapped URL.

GitOrigin-RevId: 6500e6129a95b2dea8e8f53296ca056e63196a57
2026-10-06 18:51:41 +00:00
Charlie Marsh eb2a33aa18 Make URLs clickable in MCP elicitation prompts (#51450)
## What changed

Render web URLs in TUI MCP elicitation prompts as terminal hyperlinks. Preserve the full destination when a URL wraps across lines, while retaining the existing styling for answered and unanswered prompts.

## Testing

Add a regression test that verifies each linked cell of a wrapped URL targets the complete URL, including its query string, and a snapshot of the rendered form.

GitOrigin-RevId: 74baabbee6b72b695e1534d694296a3352f7e47d
2026-10-06 18:51:15 +00:00
Charlie Marsh 44fe0289c6 Make URLs clickable in TUI user input questions (#51449)
## What changed

Render web URLs in `request_user_input` question text as terminal hyperlinks. Preserve the complete destination when a URL wraps across rows, along with explicit newlines and blank lines in the question.

## Testing

Add a regression test that checks each linked fragment retains the complete URL, including its query string, and snapshots the wrapped question layout.

GitOrigin-RevId: 473c8a8a00797c0b353a9cdb762dea2c718d9190
2026-10-06 18:47:46 +00:00
Charlie Marsh bc3ebcb77d Preserve clickable URLs in TUI approval headers (#51439)
## What changed

Render command, permission, patch, and MCP elicitation approval headers with `HyperlinkText`, which annotates web URLs and preserves their full destinations across wrapping and clipping.

## Testing

Add a regression test covering wrapped URL destinations in all four header types, plus a snapshot of the wrapped command approval header.

GitOrigin-RevId: 7f6b79484c9297cd03514da2d6805b0d239fee63
2026-10-06 18:16:18 +00:00
Abhinav 8e23d1836f Show hook status messages as titles in the hooks browser (#51433)
## What changed

Replace generic `Hook 1` labels with trimmed `status_message` titles, falling back to `Unnamed hook` when the message is missing or blank. Show aligned, dimmed row numbers alongside the titles and retain trust-status suffixes.

Render rows with `Paragraph` to preserve full-row selection styling and per-span dimming, including titles containing wide characters and emoji.

## Testing

Add snapshot and buffer assertions for title trimming, blank and missing messages, wide characters, selection styling, and dimmed indices. Update snapshots for long-title truncation and scrolling across two-digit row numbers.

GitOrigin-RevId: a9b20ea91e7252b6399d1c8a9fa849186f16a651
2026-10-06 17:52:52 +00:00
Eddie Chen cfc946f4e1 Expose and persist turn lineage across the app server (#51415)
## Why

Clients starting delegated work need to attribute descendant turns to the original turn and retain that attribution through completion and history reads.

## What changed

- Accept optional `parentTurnId` and `rootTurnId` in `turn/start`, and expose `rootTurnId` on returned turns and lifecycle notifications.
- Default new turns to their own root when none is supplied. Preserve the active turn's root when steering, ignoring incoming lineage fields.
- Carry root IDs through completion, interruption, recovery, and fork boundaries, and persist them for paginated history reads. Leave unknown roots null in older history.
- Update protocol schemas and generated TypeScript and Python bindings.

## Testing

Extend coverage for default and explicit roots, steering without changing lineage, interrupted and recovered turns, history reads after restart in both history modes, nested fork pagination, and compatibility with older database writers.

GitOrigin-RevId: f1a570a12bd11742929fd2e8b017e5d35aa07dcb
2026-10-06 16:56:39 +00:00
Eric Traut ff9ab4aed9 Suppress repeated image paste presses in legacy terminals (#51411)
## Why

Legacy terminals report key auto-repeat as new presses, which can trigger repeated image pastes when presses accumulate during a slow paste.

## What changed

Suppress repeated `Ctrl+V` and `Alt+V` image paste presses within a sliding 250 ms window, refreshed after each suppressed press and after a paste completes. Clear suppression on other ordinary key presses or key release events so a fresh paste can proceed immediately.

## Testing

Add regression coverage for repeated presses, window expiry, and resetting suppression on another key press or a key release. Update the shortcut remapping test to release the key between image pastes.

GitOrigin-RevId: 45abc056e5bda47d1c9704702e369e63dcce29db
2026-10-06 16:41:53 +00:00
Eddie Chen 551bd409eb Preserve turn attribution across recovery and compaction (#51402)
## Why

Recovering an interrupted turn replaced its original trigger with `retry` and restored only its root lineage from model context. Turns suspended before that context was written could lose their attribution entirely.

## What changed

- Persist regular-turn attribution in `TurnStartedEvent` and compaction resume metadata, including the trigger, parent and root turn IDs, and initiating agent path.
- Restore matching attribution during recovery, keep unknown triggers absent, and retain the model-context root fallback for older records.
- Reconstruct attribution from surviving turns across rollback and late completion or abort events, and clear inherited attribution when spawning a forked agent.

## Testing

Add coverage for repeated cold recovery, suspension before context persistence, legacy rollouts, fresh attribution on subsequent turns, compaction checkpoints, rollback, and late terminal events.

GitOrigin-RevId: 85b5763e8fbd48a1ea2c07cfda8196e63c2cd33a
2026-10-06 15:50:27 +00:00
Charlie Marsh 594283af5c Make URLs in asynchronous question titles clickable (#51391)
## What changed

Render web URLs in TUI asynchronous question titles as terminal hyperlinks, preserving the full destination when a URL wraps across lines or is partially clipped. Exclude trailing question punctuation such as `)?` from detected URLs while preserving balanced parentheses and query strings.

## Testing

Add a rendering regression test and snapshot for a wrapped URL, checking complete hyperlink destinations at full and reduced heights. Extend URL detection tests for trailing question punctuation and balanced parentheses in query strings.

GitOrigin-RevId: 6c9a807466d7b7e3a23bc6e86aae8410ae378161
2026-10-06 15:13:05 +00:00
dpatel-oai 7ac954ea24 Enforce Fast and Ultra Fast policies independently (#51253)
## Why

Fast mode previously gated both Fast and Ultra Fast, preventing policies from allowing one while disabling the other.

## What changed

- Add the default-enabled `features.ultrafast_mode` flag and enforce it independently of `features.fast_mode` in service-tier selection, requests, and agent prewarming.
- Filter TUI service-tier commands and selections by the corresponding policy and model catalog support.
- Report `supportsIndependentSpeedModes: true` from `configRequirements/read` and update the protocol schemas and generated bindings. Retain the shared Fast gate when connecting to older servers that omit this capability.
- Preserve legacy cloud speed denials by translating `rbac-fast-mode` fragments with `fast_mode = false` into a denial of both modes, while retaining higher-priority enterprise overrides.

## Testing

Add coverage for all four Fast/Ultra Fast policy combinations in requirements responses and request routing, agent prewarm inheritance, TUI command visibility and saved selections, and legacy cloud denial normalization and override precedence.

GitOrigin-RevId: 147e08524c4b228ea9d46b25a9f8aa64c359e169
2026-10-06 03:35:55 +00:00
rb-oai 8b6bb1c77d Add a partial answer message phase (#51241)
## Why

Assistant answer text may be followed by more output or tools. A distinct `partial_answer` phase lets callers represent this separately from commentary and a terminal `final_answer`.

## What changed

- Add `MessagePhase::PartialAnswer` and expose `partial_answer` in the app-server schemas and generated TypeScript and Python types.
- Keep the TUI working indicator visible after partial answers and exclude them from the thread history's final-answer summary field.
- Route partial answers to the speakable channel in realtime V3 BEM-tag mode.

## Testing

Add coverage for phase preservation through serialization, input-message conversion, and SSE item start/completion events. Extend TUI snapshot coverage to verify that partial answers keep the working indicator visible while final answers hide it.

GitOrigin-RevId: 1ae3ad9264b6e36ae1cbe6b93df3d345ab4460e6
2026-10-06 02:57:15 +00:00
Eric Traut 2f412e60d7 Remove default model labels from TUI model pickers (#51235)
## What changed

Remove `SelectionItem::is_default` and stop appending `(default)` to model picker entries. Keep the `(current)` marker and explicitly label the workspace owner notification prompt's negative option as `No (default)`.

## Testing

Update the model selection popup snapshot to reflect the removed label and adjusted column spacing.

GitOrigin-RevId: 1f8b85f896541ef7354d5979b4244d7df4b867d6
2026-10-06 02:49:06 +00:00
Eric Traut 80e0b51c9e Make session lookup pagination stable and report listing failures (#51230)
## Why

Session activity can move unread threads ahead of a pagination cursor, and timestamp-only cursors can skip threads with equal creation times. Either can prevent a session label lookup from detecting duplicate labels. Database failures must also remain distinguishable from an exhausted listing.

## What changed

- Resolve session labels using database-only listings ordered by `CreatedAt`, with thread IDs breaking timestamp ties. Accept unique matches across pages with valid timestamp-and-ID cursors, while retaining ambiguity errors for older cursors that cannot establish uniqueness.
- Preserve timestamp index ranges for database continuation queries and timestamp-only cursors for listings that may fall back to the filesystem.
- Propagate database-only listing and name-resolution failures. Keep best-effort name enrichment for ordinary listings and retry latest-session lookup with scan-and-repair after a database-only error.
- Keep loaded sessions selectable in the resume and fork pickers when a later page fails, stop further pagination, and display `Could not load more sessions`.

## Testing

Add regression coverage for creation-time continuation after session activity, cursor query plans, filesystem fallback, database and name-query errors, cross-page label uniqueness, older server cursors, and selection after picker pagination failures.

GitOrigin-RevId: 264ab2e69b8ad12d9edaa31fd253cb9805a46a90
2026-10-06 02:14:22 +00:00
rhan-oai d63a9b8344 Remove legacy personality template metadata (#51223)
## What changed

- Remove `instructions_variables`, its protocol type, and unused personality templates. Continue accepting older catalogs by ignoring their legacy variables.
- Report `supports_personality` as `false` in app-server model listings and TUI model presets.
- Preserve pinned model metadata and base instructions when only personality settings change. Reuse Guardian review sessions across friendly and pragmatic settings, while keeping the `none` opt-out distinct.

## Testing

Update coverage for legacy catalog deserialization, personality override notifications, opt-out behavior during model switches, and preservation of instructions and history on resume.

GitOrigin-RevId: bee8a263ef84046301888d02347f43929ececce9
2026-10-06 01:46:33 +00:00
yunhan-wei 4171362e44 Preserve review targets and scope misalignment continuation metadata (#51217)
## What changed

- Carry opaque `review_target` values through misalignment errors and expose optional `reviewTarget` in the app-server protocol and generated clients. Preserve the value verbatim and redact it from debug output.
- Keep target-based `misalignment_override` metadata on turn requests, preserve it across steering updates, and exclude it from compaction and external MCP metadata. Reject overrides from global Responses metadata while retaining legacy timestamp behavior for per-turn overrides.

## Testing

Extend coverage for error propagation, debug and rollout redaction, steering preservation, and metadata filtering. Verify that automatic compaction omits the review target while turn requests before and after compaction retain it.

GitOrigin-RevId: 8c1abb076a206ff5927a4acc31bd25e3efc2bff9
2026-10-06 01:26:11 +00:00
viyatb-oai 7aa8f51049 Reject sandbox-writable bubblewrap executables from PATH (#51211)
## Why

Bubblewrap discovery probes executables before confinement. Excluding only the command's current directory leaves candidates in other writable roots eligible to run outside the sandbox.

## What changed

- Filter canonical `PATH` candidates using the filesystem policy and effective user permissions, including writable ancestors, symlinked roots, and full-disk write access. Preserve protected system installations while rejecting replaceable paths.
- Select the launcher with the command's permissions before the proc-mount preflight, retaining the bundled bubblewrap fallback.
- Use the effective permission profile and policy working directory for startup warning probes.

## Testing

Add unit coverage for writable roots, symlinks, read-only carveouts, replaceable parents, and full-disk policies. Add Linux integration tests showing writable `bwrap` candidates are neither probed nor launched, including when the command runs in a workspace subdirectory or uses managed networking with full-disk write access.

GitOrigin-RevId: 188c9f45e727eaace062f5abb1205dc23fdf3c51
2026-10-06 00:58:19 +00:00
Brian Lee 5ad6891696 Gate CLI Daybreak controls and selection behind an opt-in feature (#51207)
## What changed

Add `features.cli_daybreak`, disabled by default, to gate Daybreak controls and automatic access-program selection in the TUI and `codex exec`. Apply the gate to resumed sessions and background task turns, and hide `/daybreak` when disabled. Explicit `--cyber-access-program` overrides remain available.

## Testing

Extend tests to cover disabled controls, history replay, foreground and background turn requests, exec resume/fork behavior, and explicit access-program overrides with the feature disabled.

GitOrigin-RevId: ae96a4a8c7ab97c619716b9f39ea9f295df6e5a6
2026-10-06 00:16:44 +00:00
Eric Traut 0d3868a30c Wait for SIGCONT when resuming the TUI (#51192)
## What changed

Install a temporary `SIGCONT` handler and unblock the signal during `Ctrl+Z` suspension. After sending `SIGTSTP`, wait for the handler to confirm resumption, returning a timeout error if no confirmation arrives within the bounded wait.

Restore the previous signal handler and thread signal mask, resume terminal stderr handling, and reapply terminal modes even when suspension fails. Propagate signal setup, delivery, and restoration errors to the caller.

GitOrigin-RevId: 1a7e10e982b1f6b2c7c7d75362a01989409b3b4d
2026-10-05 22:41:53 +00:00
pakrym-oai c9253c4977 Send base instructions as Responses input messages (#51156)
## What changed

Move base instructions from the top-level `instructions` field into a prefixed `developer` message in `input` for standard Responses requests, matching Responses Lite. Remove the field from HTTP and WebSocket request types and assign instruction messages stable IDs derived from the thread and instruction text.

## Testing

Extend standard and Responses Lite tests to cover instruction message serialization, stable IDs, and resume consistency. Update WebSocket tests to verify that changed instructions trigger a full request without `previous_response_id`.

GitOrigin-RevId: e2de4b8e30a9339377fac133ceda981abd1a112b
2026-10-05 18:52:51 +00:00
jif c8949e55c2 Ignore stale refresh responses in agents overview tests (#51064)
## Why

Aborting a refresh task cannot retract a response already queued for delivery. The test helper could consume that stale response and return before the replacement refresh completed.

## What changed

Make `finish_overview_refresh` skip responses whose request ID does not match the active refresh. Extend the lifecycle test to queue an invalidated response before removing a task, exercising the wait for the replacement refresh.

GitOrigin-RevId: 97341681682e8dce9a9512fbcc1d5c0351b084f5
2026-10-05 09:51:15 +00:00
Eric Traut c2f7fe89d8 Use server model defaults for connected TUI fresh starts (#50913)
## Why

Fresh starts connected to an app server can bootstrap with stale client model settings before reading the server configuration. An empty model catalog can also prevent startup even when managed new-thread defaults provide a model.

## What changed

- Read server configuration before model bootstrap for fresh starts using a local daemon or remote server without an explicit profile.
- Preserve explicit model and reasoning-effort overrides, clear implicit client settings when `config/read` is unsupported, and allow managed new-thread defaults to supply a model when the catalog is empty.
- Use the launch directory for local daemon configuration reads and the server directory for remote reads.

## Testing

Update startup-default tests to cover managed model selection with an empty catalog. Strengthen the reconnect test with a stale client model and an assertion that `config/read` uses the server directory.

GitOrigin-RevId: 8fe1485c6e66c8d46560b34d904ce1724458993a
2026-10-04 16:57:01 +00:00
Eric Traut afb436df8b Honor server reasoning summary defaults in new TUI threads (#50811)
## Why

New embedded TUI threads forced reasoning summaries off when no summary was explicitly configured, overriding the model's default. Client settings could also override the destination server's reasoning summary configuration.

## What changed

Use the same launch override handling for embedded and remote thread starts so server configuration and model defaults determine reasoning summaries. Forward explicit profile and command-line choices for `model_reasoning_summary` and `features.concurrent_reasoning_summaries`, preserving both enabled and disabled values.

## Testing

Extend coverage for model defaults reaching Responses requests, concurrent summary delivery, direct startup, and replacement sessions with profile and command-line overrides.

GitOrigin-RevId: c60e33d077298d7a89d6b95f94b1292c175d6c77
2026-10-04 07:12:06 +00:00
Eric Traut e57fc9ea5a Prune TUI snapshots and consolidate behavior tests (#50808)
## What changed

- Remove redundant snapshot fixtures and selected rendering test cases across the TUI.
- Replace several full-output snapshots with direct assertions on messages, popup state, status indicators, and rendered content.
- Consolidate slash-command aliases, command-prefix selection, category titles, and hook events into shared test loops.
- Use shared snapshots for the setup import prompt and paginated transcript overlay across platforms.

GitOrigin-RevId: 461e30ebaf70ba930d91a135d2fc598ee4f04f27
2026-10-04 06:46:50 +00:00
Eric Traut ab45264919 Preserve review lifecycle ordering on failure (#50804)
## Why

A review can fail before the UI receives the event that enters review mode. Failed-turn completion also needs to preserve the running indicator when a queued `/review` has already been submitted and is awaiting startup.

## What changed

- Emit the review-entry lifecycle before starting the review task, after aborting existing tasks and clearing connector selection.
- When a live failed-turn completion repeats an already handled error, refresh task state only if no user turn is pending startup, and continue processing queued input.

## Testing

Add regression tests for lifecycle ordering on a server-overload response and for preserving the running indicator while a queued review awaits startup after a failed turn.

GitOrigin-RevId: 0f91d3d1a1a983542c54c2686630de9c232321b1
2026-10-04 06:35:16 +00:00
Eric Traut 8f82b8a31c Use the managed daemon for eligible remote-control launches (#50803)
## What changed

Make plain `codex remote-control` start or reuse the managed daemon and enable remote control when daemon auto-start is enabled and the environment is eligible. Fall back to the foreground server when no managed backend is available or Windows restricts detached launch.

Add `codex remote-control --no-daemon` to explicitly run the foreground server, and honor the top-level `--no-daemon` flag. Reject this flag with `start`, `stop`, or `pair`. Keep `--json` and launches with configuration overrides or unsupported environments on the foreground path.

GitOrigin-RevId: cb28ae3f6074993b748660972c3cb7cbf6612c2f
2026-10-04 06:28:20 +00:00
Benjamin Carlsson b8dceb0d4f Open slash commands from empty drafts in Vim Normal mode (#50788)
## Why

Pressing `/` in Vim Normal mode starts a composer search, even when the draft is empty. Allow this key to open slash commands directly on an empty draft.

## What changed

When slash commands are enabled, a standalone `/` on an empty draft switches to Insert mode, inserts `/`, and opens command completion. Preserve Vim search behavior for nonempty drafts, `?`, and pending operators.

## Testing

Add a snapshot test for the Insert mode transition and command picker. Exercise Vim slash-command entry in the transcript overlay test across terminal sizes, and extend command sparkle coverage to Vim mode.

GitOrigin-RevId: 806c2f6b841190ccdc1a258f88dfa590773ba33a
2026-10-04 04:33:42 +00:00
Benjamin Carlsson acf9818fae Remember Command Center grouping across launches (#50786)
## Why

Command Center previously reset to project grouping on startup, losing the user's selected grouping.

## What changed

Save grouping changes to `tui.agents_overview_grouping` in the client’s user configuration and restore the saved choice at startup. Support `project`, `status`, and `model`, with `project` as the default. Report save failures in Command Center while keeping the selected grouping active.

## Testing

Add tests for cycling through and persisting all grouping modes, preserving unrelated settings in a custom configuration file, displaying save errors, and restoring saved grouping during startup.

GitOrigin-RevId: fd56dfecb4b79cfa8439f54420ce58cc0ed66ec7
2026-10-04 04:25:31 +00:00
Eric Traut f365d5754b Restrict TUI MCP startup notifications to owned threads (#50781)
## Why

MCP startup notifications from unrelated threads could create TUI event channels, allowing subsequent approval requests from those threads to appear in the current session.

## What changed

Check the parent of an untracked subagent before accepting its MCP startup notifications. Read thread metadata with bounded retries for threads that are not yet found or loaded, and ignore notifications unless the parent belongs to the TUI.

Share thread ownership checks across notification and approval routing, including side threads.

## Testing

Extend approval-routing coverage to verify that owned subagent approvals are preserved both before thread-start notifications and after MCP startup notifications, while unrelated threads do not create event channels or display approval prompts.

GitOrigin-RevId: 6f78f237f7441aadf10b491ed191357df75c3a6a
2026-10-04 03:51:52 +00:00
Benjamin Carlsson dde5f8c5ae Allow /archive while a turn is running (#50764)
## Why

`/archive` was disabled during a running turn, preventing users from archiving the current session until the turn ended.

## What changed

Enable `/archive` during a running turn and warn in the confirmation dialog that archiving will stop the current turn. Cancelling the dialog leaves the turn running.

## Testing

Extend confirmation tests to cover both idle and running sessions, add a snapshot of the running-turn warning, and verify that cancellation leaves the task running without emitting archive events or operations.

GitOrigin-RevId: c7c530aa671b5f04e5dc2a637e3d27a81d98d8bf
2026-10-04 02:32:39 +00:00
Benjamin Carlsson cd7d9e128c Show unavailable slash commands when searched in side conversations (#50756)
## Why

Side conversations hide unavailable slash commands, leaving users without an explanation when searching for a known command.

## What changed

- Show matching unavailable commands as disabled rows with the reason `not available in a side conversation`. For example, `/arch` now shows a disabled `/archive` entry. Keep these commands hidden from the unfiltered `/` menu.
- Rank available matches first and skip disabled rows during keyboard selection and completion.
- Prevent `Tab` from queuing input when only disabled matches are visible, and insert `/` normally when no selectable command is present.

## Testing

Add a rendering snapshot and regression tests for unavailable command discovery, navigation, available command completion and queuing, blocked queuing of unavailable matches, and slash insertion.

GitOrigin-RevId: 7160b308ca57a24a5dcb6e2686b5248a8eb4b6a7
2026-10-04 01:36:25 +00:00
Eric Traut 3e238776e8 Show model and reasoning effort near the top of task details (#50727)
## What changed

- Display reasoning effort alongside the model in the agents overview, using `Unknown` when unavailable.
- Place model, reasoning, project, and usage information before attention details, activity, and the last message.
- Truncate long model and reasoning values with an ellipsis to keep each on one line.

## Testing

Update overview snapshots for the new layout and extend fixtures to cover a known model and long model and custom reasoning values.

GitOrigin-RevId: 1f36e5e1e0ccf09a851f8982bbbe4fbc7d9c7461
2026-10-03 22:13:55 +00:00