## What changed
Add a `failure_reason` tag to failed TUI auto-start events in `codex.daemon.start`, distinguishing `install`, `spawn`, `early_child_exit`, `readiness_timeout`, and `other` failures. Preserve the original error diagnostics through a classified startup API.
Detect managed child exits during process identity recording and distinguish exits before readiness from readiness timeouts.
## Testing
Extend daemon tests to assert classification of installation failures, spawn failures, early child exits, and readiness timeouts.
GitOrigin-RevId: 7c626f278e9e7f2ecd61b3fd1a90829a113eb232
## What changed
- Remove automatic BuildBuddy configuration and credential forwarding from Bazel CI, release, SDK, and voice builds. Strip remote execution CI configs in the shared wrapper while retaining explicit remote configurations for local use.
- Use native Windows host tools and audio dependencies for Windows Bazel actions, forwarding the required toolchain and environment settings.
- Initialize message-board MCP servers through a per-session `OnceCell` so server startup does not hold the shared registry lock across an await.
- Expose the message-board test helper to the core Bazel package and update the runtime-auth test call for the `reauth` argument.
GitOrigin-RevId: 5d5c1f4d71fa841090dea8eec8006380981fb65b
## What changed
Add optional `contentTokenCount` metadata to `item/completed` notifications, carrying the producer-supplied token count for each completed assistant message in default and plan modes. Counts include any sampled footer and are `null` when unavailable.
Keep this telemetry separate from stored thread items and omit it from subsequent model requests. Update the protocol schemas and generated TypeScript and Python types.
## Testing
Add coverage for per-message counts, including zero, in default and plan modes; missing and malformed metadata; backward-compatible notification decoding; and exclusion from subsequent model requests.
GitOrigin-RevId: 35973037a42650fa2d7569da8e88cb81215cf971
## What changed
- With multi-backend support enabled, show the current host before the first submission and use `leader b` to cycle through available connections. Expose the shortcut as `tui.keymap.global.change_host`.
- Preserve the conversation name and composer draft, including cursor position, attachments, pending pastes, and literal versus shell-command interpretation of `!`.
- Save explicit host choices in user-only `tui.default_hosts`, scoped to the local project and user identity. Use the saved host for new conversations, falling back to the first available connection when it is unavailable.
- Prepare the destination and check directory trust before replacing the current conversation. Block switching during voice calls and active turns, and remove replaced blank conversations from the session overview.
## Testing
Add coverage for shortcut visibility and remapping, draft and name preservation, project/user preference isolation, unavailable-host fallback, destination trust and startup failures, and voice-call guards.
GitOrigin-RevId: def7b088951336bec8fe3962954fba9b861f91c6
## Why
Switching back to a running thread can lose the active turn's state after its `TurnStarted` notification falls out of the bounded replay buffer, breaking steering.
## What changed
Retain the evicted active turn and include it in replay snapshots when it is missing from the stored turns. Clear the retained turn when turns are replaced, the active turn completes, or the thread closes.
## Testing
Add a regression test that evicts the turn-start notification, restores the thread, and submits two steering messages while preserving a queued follow-up. A snapshot verifies the steering messages and queued input remain visible.
GitOrigin-RevId: a4302a2e0990b907207c229361cbcec68ebbbdc4
## What changed
- Add the disabled-by-default `tui_workspace` feature for the owned transcript view. At terminal widths of at least 100 columns, show the parent conversation beside its side conversation, with only the focused composer accepting input.
- Retain the inactive conversation's transcript, draft, and status, and restore reading and search state when switching focus.
- Keep drawing and input paused until history replay completes, while refreshing skills in the background.
## Testing
Add snapshots and regression tests for pane resizing and composer styling, retained streaming output, history search after replay, pending skills refreshes, and modal input protection.
GitOrigin-RevId: 68938f263353b0cd3a9e9562e06293bfc8251cc6
## Why
The keypress inspector could not display `ctrl-alt-c` or `ctrl-shift-c` because these keys bypassed the active view as if they were plain `Ctrl+C`.
## What changed
Require the modifier set to be exactly Control for the `Ctrl+C` exception when routing keys to active views. Keys with additional modifiers now reach the active view.
## Testing
Add regression coverage verifying that the inspector displays `ctrl-alt-c` and `ctrl-shift-c`, while plain `Ctrl+C` still closes it for either uppercase or lowercase `C`.
GitOrigin-RevId: cdad4dc73c096e6f07d1a951123db981c4837eac
## Why
Pressing `Esc` in the memory reset confirmation could also close the memories settings popup instead of returning to it.
## What changed
Stop forwarding `Esc` to a view's key handler when its cancellation handler has already handled the event, even if the view remains open.
## Testing
Extend the memory reset confirmation test to verify that the first `Esc` returns to settings and the second closes the popup.
GitOrigin-RevId: b842fdaed69a1ac2a6af6fc454e02be2ac8946e6
## Why
Saving a generated title awaited thread metadata reads and name writes in the TUI event handler, delaying its return to keyboard polling.
## What changed
Move automatic title persistence into the background title-generation task. Make metadata reads cancellable and serialize automatic writes with manual renames so a manual name takes precedence, including when an automatic write is already in flight.
## Testing
Extend title tests to check that completion dispatch returns immediately, canceled metadata reads finish, and manual renames wait for in-flight automatic writes. Retain coverage for saving titles to the originating thread after switching threads and preserving existing names.
GitOrigin-RevId: b284a06ca3f0fdcf22fd2fc87b07447f8ab754c0
## What changed
- Skip rendered-row counting during history hydration when there is no row budget or no next item page.
- Return early when checking history insertion prefixes if there is no active cell or the placeholder session header must remain active.
GitOrigin-RevId: 669ebf0ceb0fc01c8a7bfd8d2addbcbb6fc6a364
## What changed
Eligible interactive launches now start or reuse the shared daemon regardless of `features.daemon_auto_start`. Remote-control daemon eligibility also no longer checks this flag. Use `--no-daemon` to run without the shared background server.
Treat `daemon_auto_start` as removed: ignore configured values with a migration notice, ignore managed requirements with a warning, and hide the flag from experimental feature discovery. Remove its launch telemetry tag.
## Testing
Extend retired-feature requirement coverage and add a migration-notice snapshot. Update CLI and TUI integration tests for daemon startup and explicit `--no-daemon` usage.
GitOrigin-RevId: e0290e5acd4bc0169a0f71c3296c567e46269ce3
## Why
Streaming answers and plans need to wrap to the conversation's allocated width, which can differ from the terminal width. Resizing while reading earlier output should not report new activity unless new output has arrived.
## What changed
Reflow live streams when preparing the owned conversation layout, using its allocated width. Update the observed live revision after presentation-only reflow so it does not trigger `New activity`, while preserving notifications for unseen output.
## Testing
Add regression coverage for streaming answer and plan tables across width changes, including a narrow-layout snapshot, preservation of the reading position, and activity notifications when new output arrives before a resize.
GitOrigin-RevId: a9831c5a1a5ffb7477e7868d4ecca430d6ee50f3
## What changed
- Add `currentAccountOnly` to `thread/list` and `thread/search`, defaulting to `false`, and enable it for TUI history discovery, resume pickers, and task mentions.
- Mark newly created threads as account-scoped and require each recorded creator user or account ID to match the current login. Older threads and threads without creator IDs remain shared; API-key logins continue to see all local history.
- Preserve account scope through resume and revert, including fallback to original rollout metadata when an older binary drops the marker. Forks receive new-thread scope.
- Skip unreadable rollout headers in scoped discovery and filter search candidates before reading snippets. Direct access by thread ID remains available.
## Testing
Add coverage for account matching, shared legacy history, list page refilling, search pagination, API-key visibility, and scope preservation across reverts. Extend rollout lookup coverage to compressed active and archived files.
GitOrigin-RevId: aa374f5e69165be5a71c0716ded1b105f5fb51e0
## Why
MCP startup alone should not block `/fork`, and rejecting a fork while foreground work is pending should preserve the draft and its image attachments.
## What changed
- Defer `/fork` draft consumption until dispatch validates the thread state, as for `/review`.
- Allow `/fork` during MCP startup when no user turn or review is pending or running, and clear the composer after validation succeeds.
- Preserve drafts and attachments when these commands are rejected in side conversations.
## Testing
Extend regression coverage for `/fork` and `/review` draft preservation during MCP startup, successful fork dispatch and composer clearing, rejection during an active review, and attachment preservation in side conversations.
GitOrigin-RevId: d152ba6659e4507d8750cb6bd3073d9f8b293538
## Why
Accepting the startup update prompt exits before connecting to an app server, so launch telemetry previously reported `unconfirmed`.
## What changed
Record `app_server_mode=update_requested` when handing off to the updater. Continue recording `in_process`, `local_daemon`, or `remote` after a successful connection, and use `unconfirmed` for other early exits.
## Testing
Extend the launch telemetry test to verify exactly one recording for a connection, an update handoff, or an early return.
GitOrigin-RevId: 10dd29246218e1a86a396ab073305402a0b44d38
## What changed
Add `BackendSessions` helpers to name the displayed listening backend, find the first listening backend, and cycle through listening backends in registration order. Cycling wraps around, skips closed streams, and excludes the current backend. Display names use `Local` for the initial session and `Backend N` for additional sessions; a closed displayed stream has no name.
## Testing
Extend backend session tests to cover cycling with a single backend, wraparound across three backends, and skipping a closed stream.
GitOrigin-RevId: e8f3fcc38a178b6b91d385d65d899fdd042062c5
## What changed
- Group threads needing approval first in `/subagents`, mark them with `(needs approval)`, and initially select the first waiting thread.
- Refresh the open picker and approval notice as requests and agent metadata change, preserving the selected thread when rows move.
- Use consistent agent labels across the picker and approval notice, preferring agent paths and using UUID suffixes to distinguish unnamed agents.
- Track approval requests that arrive before thread metadata and refresh pending approvals after reconnecting.
## Testing
Extend the picker test and snapshots to cover approvals arriving while the picker is open, agent paths arriving later, and selection staying on the same thread after reordering.
GitOrigin-RevId: b7dd943d151ce98d1978f7c6b9f5e16903b9075b
## What changed
Split conversation rendering into preparation, painting, and post-draw steps. Use the supplied conversation bounds for transcript wrapping, composer layout, suggestion overlays, cursor placement, and the empty-state animation.
Preserve surrounding text and image placements during input-triggered redraws. Keep centered dialogs relative to the full viewport and restore neighboring content when they close.
## Testing
Extend regression tests and add a snapshot for conversations rendered at an offset, covering selection, link hit testing, cursor placement, scroll preservation, neighboring images, and dialog dismissal.
GitOrigin-RevId: 0dbca3f8d1064f2d58856c3bc77a4dab1c099cdd
## What changed
Detect GNU screen via `STY` when `TMUX` is absent and wrap OSC 52 clipboard sequences in DCS passthrough strings. Split the sequence into 252-byte chunks to stay below screen's older 256-byte string limit while forwarding one continuous OSC 52 sequence to the outer terminal.
Prepare the terminal sequence in the clipboard worker and retain it for deferred delivery.
## Testing
Add coverage for short text and a longer Unicode payload, checking that each passthrough chunk stays below the limit and that reassembling the chunks reproduces the complete OSC 52 sequence.
GitOrigin-RevId: 1a042ed4fed817179e98459f4f4b2b847b160721
## What changed
Keep unpinned tasks ordered by descending update time within each status group as tasks arrive, change status, or refresh. Clearing a search or status filter also reflects timestamp changes to hidden tasks.
Keep pinned tasks at the top of their respective status groups in pin order, and mark their titles with 📌 instead of placing them in a separate Pinned group when grouping by status.
## Testing
Update ordering tests and snapshots to cover arrivals, status transitions, rediscovered tasks, filters, pins, and adjacent selection after hiding tasks.
GitOrigin-RevId: 2f3320a17b1932294f421dd28af848f0e0be45ef
## What changed
Bundle the started thread, configuration, and local settings in
`PreparedFreshSession`, and move session activation into `adopt_fresh_session`.
The helper preserves input state, switches threads, applies settings, names the
session, and attaches the chat widget with a caller-supplied presentation.
`start_fresh_session` delegates to the helper with
`ThreadAttachPresentation::Fresh`, preserving its existing behavior.
GitOrigin-RevId: c4fdb6b5024a024f6baa48610e62a8e6628de30a
## Why
The session picker can list conversations from multiple backends, but selecting a conversation owned by another backend was rejected.
## What changed
- Resume selected conversations through their owning backend, preparing the destination before replacing the current conversation. Preserve drafts and restore the destination's settings, account state, model catalog, and workspace services.
- Block backend switches during an active turn and retain the current conversation when destination preparation fails.
- Queue background backend requests until that backend is displayed, removing requests that are resolved or disconnected. Isolate background events from the displayed conversation while continuing to deliver notifications to a background voice session.
- Track backend ownership for thread detachment, startup results, and reconnect attempts.
- Remove the `yaml-rust` advisory exception from `codex-rs/deny.toml`.
## Testing
Add regression coverage for backend handoff errors, detaching through the source connection, clearing stale provider errors, deferred request delivery and cleanup, and voice-session closure on a background backend.
GitOrigin-RevId: 1bba84f16831af1d5295c1404f48803ce0608d3d
## What changed
- Add terminal file hyperlinks to viewed image filenames and transcript paths, including older history loaded through pagination.
- Enable links only for local workspaces outside SSH sessions. Require a local regular file with a recognized image extension on both the original and resolved paths, and reject Windows reparse points.
- Preserve links when summaries are truncated or transcript paths wrap.
## Testing
Add coverage for local versus remote workspace links and for hyperlink destinations and column ranges in compact and expanded image rows.
GitOrigin-RevId: a7dff255c280ad4e609644e6f5ef5e130d9a55fb
## What changed
- Add tab switching with keyboard navigation and a `.viz-carousel` variant picker with previous/next controls and screen reader announcements.
- Support touch tooltip toggling and tooltip triggers inside shadow roots.
- Refresh typography, tables, buttons, and form controls; add widget and progress styles and larger touch targets.
## Testing
Add a viewer snapshot test covering embedded tab and carousel scripts, generated control markup, and selected CSS rules.
GitOrigin-RevId: 3b85ef816fe307e8ac9903f176a0b81430e48f3f
## What changed
- Allow audio inputs to carry uploaded file references via `fileId` in the app-server API and `file_id` in model content, preserving existing inline audio shapes and Python class names.
- Preserve mixed inline and file-backed audio ordering through history reconstruction and migration, and budget file-backed audio conservatively when duration is unknown.
- Keep uploaded audio disabled at runtime: reject it before inference or raw history injection, preserve accompanying text, and prevent rejected attachments from reaching follow-up or resumed requests.
## Testing
Add coverage for wire-format round trips, SDK compatibility, mixed audio history ordering, and rejection during turn start, steering, task completion, and raw injection.
GitOrigin-RevId: 70895c47a2494c0c9936348ad1250eb1b7b892a6
## What changed
Move OpenAI API key, Amazon Bedrock, and Google Cloud Vertex AI options under “Sign in another way” during onboarding. Keep ChatGPT and device code sign-in on the main menu, and let `Esc` return from the alternative methods menu.
Guard activation keys across menu transitions so holding `Enter` or a numeric shortcut cannot advance through multiple steps or save a prefilled API key without a fresh confirmation.
## Testing
Add regression coverage for held activation keys and update onboarding tests and snapshots for submenu navigation, provider availability, and returning with `Esc`.
GitOrigin-RevId: b5aa56e48f10b490cc8f04b5d4288d21b76d2c61
## Why
Deleting `Yes` from `Yes! I agree.` should leave an ordinary message, without entering shell mode or treating the remaining `!` as a shell command on submission.
## What changed
- Activate shell mode when an edit inserts a leading `!`, rather than when deletion exposes one.
- Use the composer's shell-mode state to classify submissions and preserve that state when restoring the same draft.
- Keep input with whitespace before `!` in normal text mode.
## Testing
Add regression coverage for literal-bang submission and queueing, editing and rendering, Vim repeat and undo/redo, and cancelled history search. Update paste and startup-submission tests to distinguish literal bangs from shell commands.
GitOrigin-RevId: 05002c3e07edb47e0882465ad91b39d317d2c663
## Why
Clients need to refresh section membership and ordering when another client moves a thread.
## What changed
Broadcast `thread/section/changed` after a successful `thread/section/move`, including moves within the same section. Send the response before the notification, and include `threadId` and the destination `sectionId`, using `null` for removal. Failed moves do not emit the notification.
Add the notification to the protocol schemas, TypeScript exports, and Python SDK models and registry, and document its behavior.
## Testing
Add a WebSocket integration test with separate writer and observer clients covering section insertion, reordering, removal, and a failed move.
GitOrigin-RevId: 128ba7eddc9aae8e3bac766f47e4a2c55c64a6a5
## Why
Collapsed patch details should remain accessible while an approval prompt is open, and reviewing them should not leave the transcript stuck behind new output after approval.
## What changed
Allow clicking transcript disclosure controls while a modal prompt is open. When expanding details during patch approval interrupts following the latest output, resume following once that approval ends or advances to another patch. Preserve manual scrolling and text selection instead of automatically jumping to the latest output.
## Testing
Extend patch approval coverage with an inline expansion snapshot and checks for queued approvals and subsequent output. Add a regression test that preserves manual scroll position when approval ends.
GitOrigin-RevId: 249aa6bb2a84364a8cb111454fa5b6a3dce218b3
## What changed
- List sessions from listening backends and the displayed session's backend using their existing connections.
- Give picker views distinct request ID namespaces while keeping connection ownership and event handling with the live sessions.
- Start multi-backend listings without a working-directory filter, since local and remote workspaces cannot share a single path filter.
## Testing
Add coverage for distinct picker request IDs, preserving the live event stream after picker shutdown, listing all providers after a provider switch while retaining the remote working-directory filter, and clearing the pending cursor when a source fails late.
GitOrigin-RevId: a0b8780e1f86dc187f088080d9213afe8e18f77f
## What changed
- Detect Rex from `TERM_PROGRAM=rex` or `TERM=xterm-rex` and report its name in terminal diagnostics.
- Enable Kitty graphics for pets in Rex.
- Use the detected terminal identity for Rex's label-only web links, extending that behavior to detection through `TERM`.
## Testing
Add Rex detection coverage for both environment variables and include Rex in the web-link rendering and Kitty graphics support tests.
GitOrigin-RevId: b237e8a6b3af50a55080573dc1e0badc2c139b42
## Why
`Ctrl+L` discarded the retained transcript along with the terminal display, making earlier exchanges unavailable in the detailed transcript.
## What changed
Keep earlier exchanges accessible through `Ctrl+T` while starting a fresh terminal display with a new header. Treat that header as the boundary for compact scrolling, pinned prompts, and resize replay so cleared content stays hidden in the normal view. Allow the detailed transcript to load older history after clearing.
## Testing
Extend the `Ctrl+L` regression test and add a detailed-transcript snapshot covering retained exchanges, draft preservation, older-history loading, and cleared-content visibility after resizing and replay.
GitOrigin-RevId: f1eb73e903a7957cedafb52678c607858fb2d77f
## What changed
- Show a blue unread dot in both session picker layouts using backend read states.
- Acknowledge the transcript's observed revision after rendering it in a focused terminal, then update the unread indicator from the response.
- Key cached transcripts by backend and thread, reload them when unread revisions differ, and ignore canceled transcript results.
- Include turn errors in transcripts.
## Testing
Extend picker tests to cover unread indicators, selection colors, acknowledgments after rendering, and turn error display.
GitOrigin-RevId: edad152ed3f7086dfd3b2e8245d62febc5c9322b
## What changed
- Display blue filled dots for unread results and gray hollow dots for read idle tasks, preserving status text on narrow rows.
- Load unread state with thread listings and update markers from read-state notifications and refreshes.
- Acknowledge the observed receipt revision when a conversation is rendered in a focused, unobstructed view, including read-only snapshots, without clearing newer results.
## Testing
Extend rendering snapshots and tests for stale unread markers and read-only snapshot receipts.
GitOrigin-RevId: 2dc676c3ffe1e887a5bbf131c88891057386ffc8
## What changed
- Show draft attachment thumbnails in reference order in inline and fullscreen views on supported terminals with local workspaces. Display a `+N` count for attachments that do not fit, and preserve editable image references when previews are unavailable or space is limited.
- Refresh previews when attached files change, apply image orientation metadata, and clear frame graphics before terminal handoffs, screen switches, and shutdown.
- Finish CLI subcommand dispatch before polling interactive TUI events.
## Testing
Add a regression test and snapshot covering thumbnail order, overflow, resizing, attachment deletion, file replacement, and fallback behavior in both inline and fullscreen views.
GitOrigin-RevId: 1ea7c89e089cecc390e145c1790b6ede8bad8d5e
## What changed
Replace the duplicate `AttachedImage` type with `LocalImageAttachment`. Return borrowed attachment slices and move attachment vectors directly when taking submissions or capturing history-search drafts, avoiding conversion and cloning. Use `local_image_paths()` in request-user-input and MCP elicitation drafts to copy only the paths they need.
GitOrigin-RevId: b19451f633a479893fc97b8e2b51eb6b38838235
## Why
Embedded app-server sessions disabled task tools and exposed only worktree tools through MCP, preventing tasks from using tools such as `set_thread_title`.
## What changed
- Expose task tools and available worktree tools together under the `codex_tui` MCP namespace, replacing the embedded session's `codex_worktrees` namespace.
- Allow embedded sessions to dispatch `codex_tui` dynamic tools when MCP is not configured, while retaining the MCP requirement for delegation tools.
- Persist local task-tool reference capabilities for embedded sessions as well.
## Testing
Update coverage for embedded dynamic-tool namespace dispatch and task-tool availability after starting and resuming threads. Extend the model-driven worktree test to rename another task through `set_thread_title` and snapshot the combined MCP tool set.
GitOrigin-RevId: 31f37df69b4e86045953cad418a95c04cd1f35ec
## Why
The agent command center previously required a shared background server, preventing embedded sessions from opening it and rejecting `codex agents --no-daemon`.
## What changed
- Allow `codex agents --no-daemon` to use an embedded app server and open the command center without a shared server.
- Route `codex agents` through the normal daemon startup, eligibility, and compatibility checks, including embedded fallback where applicable.
- Return embedded sessions to the command center when canceling directory trust or archived-session confirmation.
## Testing
Add CLI coverage for `--no-daemon` before and after `agents`, plus an integration test that verifies embedded mode is used even when a daemon is running. Update archived-session tests to expect cancellation to return to the command center.
GitOrigin-RevId: 3bdf18a00456eae2e4d38103d12126e039d44119
## Why
Command-center navigation required a shared app server, leaving embedded sessions without the same way to switch between chats. Archiving or deleting an embedded session also exited the TUI.
## What changed
- Enable command-center navigation and session listing for embedded sessions, including navigation from read-only conversations and the safety precaution menu.
- Return to the command center after archiving or deleting a session.
- Retain thread subscriptions when forking, including on embedded servers.
- Confirm before quitting an embedded server would stop running sessions or side conversations.
- Construct large startup and event-loop futures outside their callers' stack frames before boxing them.
## Testing
Add regression coverage for embedded session switching with background approvals and draft restoration, plus confirmation before quitting with a running side conversation. Update navigation, archive/delete, fork, and UI snapshot tests for the new behavior.
GitOrigin-RevId: 96bac48cccf85b685b58934d23dd1db93b663751
## Why
Archiving or deleting a thread in the command center shuts down side conversations belonging to other threads.
## What changed
Limit side conversation shutdown to those whose parents belong to the affected thread's known subtree. Proceed once those conversations close successfully, even if unrelated side conversations remain. Continue shutting down all side conversations on exit.
## Testing
Extend the delete lifecycle test to verify that an unrelated side conversation remains open after deletion.
GitOrigin-RevId: f27efcd1fc49cf5c617c9fa454d83eed91ae185f
## Why
Switching model providers can hide saved chats from resume lookup or prevent them from opening. Keep their history readable when the server rejects resuming because of a provider mismatch, missing configuration, or policy conflict.
## What changed
- Include all providers in the resume picker, named resume lookup, and `resume --last`, while retaining provider filtering for fork lookup.
- Open chats with provider errors as read-only history and show an explanation with recovery shortcuts: `c` to continue in a new chat, `n` to start fresh, and `Esc` to choose another chat.
- Continuing in a new chat prepares an editable, unsent prompt referencing the saved conversation.
- Preserve drafts and rejected prompts or steers, suppress automatic submission, and retry provider admission when reopening the chat.
## Testing
Add coverage for cross-provider discovery, read-only history, configuration recovery, continuation drafts, rejected input recovery, error rendering, and Escape handling during transcript browsing.
GitOrigin-RevId: 5aaa7a404b9a6231101599adef18d2f1e4a8020a
## Why
Cyber access program selection was restricted to the `openai` provider ID, preventing custom providers from accepting explicit program selections.
## What changed
- Add `capabilities.cyber_access_programs` to provider configuration and preserve it through remote thread configuration. Default to enabled for `openai` and disabled for other provider IDs, with explicit overrides taking precedence.
- Use the capability when forwarding `access_programs.cyber` and determining Daybreak availability in exec and the TUI. Refresh TUI eligibility when the server changes the selected provider.
- Preserve authentication, API-key feature gates, and catalog access checks; the capability does not grant program access.
## Testing
Add coverage for capability defaults and overrides, configuration round trips, custom-provider requests with both authentication types, API-key feature gating, compaction, WebSocket response reuse, exec selection, and TUI provider changes.
GitOrigin-RevId: 579f7c33c9e857ff5fedd08311aa8e3129740c1f
## What changed
Allow shared network constraints in `[permissions.network]` in `requirements.toml`, alongside `[permissions.filesystem]`. Apply them throughout configuration loading, network approvals, Windows sandbox policy validation, and `configRequirements/read`, and show their source in `/debug-config`.
Retain `[network_proxy]` and `[experimental_network]`, but reject mixing either with `[permissions.network]`, even across requirements layers. Preserve independent network and filesystem precedence and source attribution, and report unknown nested network fields.
Reserve `network` as a managed requirements table name and reject empty or profile-shaped tables with migration guidance. Profiles named `network` remain valid in `config.toml`. Document that policy publishers must keep using `[experimental_network]` until all readers support the chosen replacement.
## Testing
Add coverage for layered constraints and source attribution, conflicting spellings, profile-name migration errors, unknown-field diagnostics, and cloud validation. Extend API, project discovery, network approval, and Windows policy tests to cover `[permissions.network]`, and verify managed proxy settings remain independent of disabled feature configuration.
GitOrigin-RevId: 994dfca9abf5a7aea914276c0ded8b40d7ed0372
## What changed
- Add “System proxy” to `/experimental` for opting into macOS or Windows system proxy settings. Keep `respect_system_proxy` disabled by default.
- Update doctor’s macOS proxy guidance to point to `/experimental` and `codex features enable respect_system_proxy`, and tell users to restart Codex after changing the setting.
## Testing
Add snapshots for the experimental setting and doctor guidance, plus a Responses test verifying that `x-codex-beta-features` includes `respect_system_proxy` only when enabled.
GitOrigin-RevId: caa3e1a7cbe222069f35022b06c59da578b8a4dd
## What changed
Append pasted text to the skills search query and immediately refresh the filtered list. Normalize whitespace for a single-line query and ignore whitespace-only pastes.
## Testing
Extend the filtering test to cover pasting after typed text, verify the rendered search results with a snapshot, and check that whitespace-only pastes leave the view unchanged.
GitOrigin-RevId: fa82d2b5f1c78a7c3a7f61fc2d4f24c94c960386
## Why
The startup command list was shown even when tooltips were disabled.
## What changed
Show the getting-started help only when `show_tooltips` is enabled. Keep regular tooltips and model-change notices suppressed on the first session event.
## Testing
Extend the first-event test to cover both tooltip preferences and update the startup header snapshot.
GitOrigin-RevId: 7b4a043737053f1a078cb21528dc459f0cfd762b
## Why
Managed command policies need to require a human decision independently of automatic review, hook allowances, and saved approvals.
## What changed
- Support `decision = "prompt-user"` in managed `requirements.toml` prefix rules, requiring a fresh, one-time human decision for matching commands.
- Add experimental `humanCommand` approval requests for clients advertising both `experimentalApi` and `requiredHumanApproval`. Accept only `accept`, `decline`, or `cancel`; reject commands when no capable client is available.
- Restrict responses to capable clients that received the request, and replay pending prompts to compatible clients on reconnect.
- Enable the capability in the TUI and update protocol schemas and client bindings.
## Testing
Add coverage for fresh decisions overriding saved allowances, hook allowances, and automatic review, plus child-thread approval routing and rejection of responses from incompatible or unrelated clients.
GitOrigin-RevId: 0b95ff6aab7f8a04b7298c8a4329d1fddf6a603e
## What changed
- Add the disabled-by-default `tui_extensions_statusline` feature to render configured status items and their picker preview through a shared UI tree renderer.
- Support text, HTTP(S) links, rows, spacers, dividers, and gaps with rendering budgets, text sanitization, and width-aware truncation that keeps the ellipsis outside hyperlinks.
- Use plain text for the extension status line and hide the picker's theme color toggle while preserving the saved color preference.
## Testing
Add coverage for tree serialization and URL validation, Unicode widths, hyperlink clipping, picker previews, color preference preservation, and token usage updates across renderer switches.
GitOrigin-RevId: a6b87c2b1096765d61296d73e142834fcd53ceee
## Why
Footer hyperlinks must follow their text when the status line is truncated or animated. Inferring link targets from underlined cells loses that association, and Unicode width differences can shift links onto the wrong cells.
## What changed
- Carry explicit hyperlink ranges with status-line content through footer layout and reasoning-effort transitions.
- Fit content to the space allocated beside right-hand indicators, keeping the truncation ellipsis outside links.
- Measure and truncate rendered graphemes consistently while preserving source columns for transcript tab expansion.
- Box the composer's footer state to reduce its stack footprint during session navigation.
## Testing
Add regression tests for clipped links after halfwidth katakana and Arabic prefixes, hyperlink positions during effort transitions, and narrow status rows beside the Plan mode indicator.
GitOrigin-RevId: ede62690e191daefc85f38e637f9bcc9796268b7
## What changed
Return the cached built-in runtime keymap when `TuiKeymap` matches the default configuration, avoiding repeated keymap resolution. Keep custom configurations on the existing resolution and validation path.
## Testing
Add a startup regression test that edits `config.toml` after the directory-trust read and verifies that `thread/start` uses the updated `service_tier`, including with an embedded app server.
GitOrigin-RevId: 0c079c96cb2925c1367782e289595c637612e2cc
Eric Traut