## Why
`/ps` previously showed only the first line of each background command, hiding useful details when a command began with an opening parenthesis.
## What changed
Render LF and CRLF line breaks as `↵` in command previews. Include subsequent lines within the existing 80-grapheme limit, and show the truncation marker only when the command exceeds that limit.
## Testing
Update snapshot coverage for multiline commands, including parenthesized commands and CRLF line endings, and add a snapshot for a multiline command exceeding the preview limit.
GitOrigin-RevId: 92544e5636821fc94bc1ca4af389c3c646127c0e
## What changed
- Stop sending `includeExtensions=true` when fetching installed plugins and remove extension metadata from remote plugin models.
- Remove `PluginSummary.extensions` and the associated extension declaration types from the app-server protocol.
- Update generated JSON schemas, TypeScript and Python bindings, and precomputed protocol exports to match.
GitOrigin-RevId: 56509437b6bdf58d99badff68e86bcf7f09fe036
## Why
Tool suggestions could pass unchecked `install_url` values to the app link view for opening in a browser.
## What changed
Reuse the external URL validator to require HTTPS URLs with a host and no embedded credentials. Decline suggestions with invalid URLs on the requesting thread without showing a popup.
## Testing
Add a regression test covering malformed URLs, unsupported schemes, embedded credentials, and a valid HTTPS URL. Verify that rejected suggestions leave the popup unchanged and resolve on the requesting thread, while the valid URL opens on confirmation.
GitOrigin-RevId: e47bf09868ec81aeaf1ffed8330039b69c60e093
## Why
Queued voice answers could reappear as text under a newer question when speech failed, the pending queue overflowed, or voice stopped, including answers already spoken as paraphrases.
## What changed
Filter recovered and replayed speech by the current input generation, preserving that generation across conversation resets. Keep text fallbacks for answers still awaiting turn completion so delayed user transcripts do not discard unspoken answers.
## Testing
Add regression coverage for paraphrased answers, queue overflow, stop and replay, failed delivery for current versus superseded input, and delayed transcripts.
GitOrigin-RevId: b7b230910bf4fdb4ae93f7de8ca2222a19c55d7f
## What changed
- Recognize `promax` in authentication, account responses, and backend rate limits; update generated schemas and client types.
- Display `prolite` as “Pro”, `pro` as “Pro (More)”, and `promax` as “Pro (Max)” in account labels, status, and analytics.
- Include Pro Max in experimental context eligibility, paid-plan tooltips, and usage-limit guidance for purchasing credits.
## Testing
Extend coverage for Pro Max plan parsing, account and rate-limit responses, experimental context eligibility, and plan display names. Update the login token test to expect “Pro (More)”.
GitOrigin-RevId: 197e00fa7a99cbce125c8f1d43a451ec1ed5c1fb
## What changed
Show the startup tip beneath the session header in the fullscreen transcript, with wrapping on narrow terminals. Remove rotating tips and startup announcements from above the composer, leaving that area for usage warnings.
## Testing
Add startup transcript snapshots at 80 and 32 columns and assert that compact tooltip rendering preserves styled links. Update usage-warning tests to verify composer geometry and recovery without rotating tips.
GitOrigin-RevId: b5e79a46147d112cd50802b0702537deb9b87001
## Why
Saved model selections can outlive their catalog entries. Removing GPT-5.4 needs to preserve a migration path without applying it to other providers that may still support the same model slug.
## What changed
- Remove `gpt-5.4` from the bundled catalog and `openai.gpt-5.4` from the Bedrock catalogs, including GovCloud.
- Add fallback migration prompts to GPT-6 Sol for saved GPT-5.4 selections on OpenAI and Amazon Bedrock. Scope fallback migrations, including the existing GPT-5.4 Mini migration, to their owning providers while honoring catalog metadata.
- Update tests that depend on bundled GPT-5.4 metadata to use GPT-5.5 or explicit model overrides.
## Testing
Extend migration tests to cover catalog metadata precedence, acknowledged targets, missing or hidden replacements, and preserving the provider while saving the replacement model and its default reasoning effort. Update Bedrock catalog assertions and picker snapshots.
GitOrigin-RevId: f739795da423b9622db2a416be6c52b01b8e7a71
## What changed
Connect the existing composer suggestion UI to generation when `tui.prompt_suggestions` is enabled. Request suggestions after successful live turns with known reasoning-summary settings, skipping replayed or duplicate completions and turns with queued follow-ups.
Generate suggestions in hidden, ephemeral forks of the completed turn, preserving conversation context and exposed live settings. Keep fork events out of the visible conversation and reject requests for user interaction. Cancel generation after 30 seconds, interrupt unsuccessful requests, and unsubscribe temporary threads.
Clear suggestions on new submissions, thread changes, reconnects, and feature disablement. Let Escape dismiss suggestions before entering backtrack mode.
## Testing
Add tests for live-turn eligibility and deduplication, preserved request prefixes and settings, hidden fork behavior, startup cancellation, and timeout cleanup.
GitOrigin-RevId: 92ddf3b06448adcc6f4330914cbd8102bff98046
## What changed
Add `tui.prompt_suggestions`, defaulting to `false`, along with suggestion request state, a generation prompt, and strict parsing of single-line suggestions up to 240 characters. Suggestion generation is not connected yet.
Keep suggestions outside the draft and render them dimly in an empty, focused composer. `Tab` accepts a suggestion for editing, a separate `Enter` submits, and `Escape` cancels pending suggestions. Respect active key bindings, popups, attachments, paste bursts, and interactive transcript footers; ignore stale results and cancel suggestions when a task starts.
## Testing
Add parser tests, composer interaction tests, and snapshots covering acceptance, dismissal, stale results, input precedence, wrapping, and transcript search layout.
GitOrigin-RevId: 868001a0fc3e6fd8c11ef1650aabc477fa36e03d
Normalize the legacy setting so existing `tui.whimsy` values control the
starfield effect. If both keys appear in the same config layer, the explicit
`tui.effects.starfield` value takes precedence.
GitOrigin-RevId: 2884dbd643690d500ed8d1493ce47950d93d6ab3
## What changed
- Make `LocalThreadStore` default to paginated history while retaining explicit legacy mode.
- Explicitly use paginated history for Guardian review sessions and allow in-memory stores to create paginated threads.
- Rename full-history resume, fork, and subagent helpers to identify them as legacy APIs, and document the paginated alternatives.
- Reject `thread/revert` for ephemeral threads and prevent the TUI from replaying or attaching to ephemeral agent threads.
## Testing
Add coverage for preserving the default and explicitly selected history modes and conversation context across restart, and for retaining context after rejected ephemeral reverts. Extend Guardian checkpoint coverage across both history modes and verify that saved reviews use paginated history.
GitOrigin-RevId: 870239eb3757018159ee4f230a009c97d38ac5b7
## Why
Transcript selections were copied as plain text, losing the formatting of rendered Markdown when pasted.
## What changed
- Retain semantic Markdown annotations through rendering, wrapping, and streaming, then serialize selected text with balanced markup.
- Preserve inline formatting, web links, headings, lists, blockquotes, and hard breaks in Markdown clipboard payloads.
- Keep code-only and other literal-only selections as plain text. In mixed selections, escape user prose and fence code, tables, and tool output to preserve their literal content.
## Testing
Add unit tests and Markdown/HTML snapshots covering partial selections, nested containers, escaping, links, resize stability, and streaming boundaries.
GitOrigin-RevId: f0476334a6bf8ad0fb57626627bd258443540852
## Why
TUI test helpers used `TempDir::keep()`, leaving temporary Codex homes on disk after fixtures were dropped.
## What changed
Retain `TempDir` ownership in widget and app fixtures so their homes are removed on drop. Transfer ownership to app fixtures to keep the home alive across widget replacement, and retain directory guards in tests that use configs directly.
## Testing
Add regression tests for recursive cleanup, isolation between widget homes, and app home survival across widget replacement followed by cleanup on app drop.
GitOrigin-RevId: fe80f982cc467ede4c3e1edbac8012ec3066dfb3
## Why
Diagnostic uploads through the app server do not include the TUI client's diagnostic buffer. Attach those diagnostics when users consent to uploading logs.
## What changed
- Stage the most recent 1 MiB of client logs as `client-logs.txt` on the app-server host and append it to `extra_log_files`.
- Skip staging without log consent and list the optional attachment in the consent dialog.
- Continue uploading the report if staging fails, noting the omitted logs in the report reason. Attempt to remove the staging directory after both successful and failed uploads.
- Make app-server filesystem helpers usable by background requests.
## Testing
Extend submission tests to cover log truncation, preservation of existing attachments, consent gating, staging failures, cleanup after upload failure, and error display. Update consent dialog snapshots to include the client log attachment.
GitOrigin-RevId: 9790834d52772c08a147ee7c176cbbc2aa029d5f
## Why
Failed SQLite writes leave diagnostic logs incomplete. Notify users before they close Codex so they can submit logs or run `codex doctor`.
## What changed
- Add a best-effort warning on the first log write failure in standalone and in-process app servers, while continuing to retain failure diagnostics in memory.
- Handle failures that occurred before the in-process warning reporter was attached.
- Tailor the warning's guidance to whether submitting logs is enabled.
## Testing
Add coverage for warning deduplication, both guidance variants, retained diagnostics after the notification sender is dropped, and SQLite flush failures before and after reporter attachment. Extend log upload integration coverage and add a TUI warnings snapshot.
GitOrigin-RevId: 12a74126d13c3568430e539a180cca47fa931fa9
## Why
SQLite write failures can leave persisted logs incomplete, while log snapshots taken before collection miss errors raised during that collection.
## What changed
- Report SQLite flush failures directly to the in-memory log buffer without re-entering tracing, using an error category and batch size instead of raw error details.
- Track whether the log writer has lost a batch and make app-server diagnostic uploads use the memory buffer when SQLite logs are incomplete.
- Refresh log bytes after flushing and querying SQLite so the same submission includes collection failures, while preserving captured metadata and thread identity.
## Testing
Add regression tests for failure reporting without recursion, subsequent write recovery, metadata preservation, and healthy and failing SQLite collection. Add an upload integration test that captures attachments locally and checks failure diagnostics, memory-buffer fallback, and omission of raw SQLite error details.
GitOrigin-RevId: 51b0c4b69c977d9f4e74f2f245a9fd90fdb13761
## Why
Paste input classification and asynchronous flush deadlines need to share a clock, including when Tokio time is paused in tests.
## What changed
Use Tokio's clock for chat composer paste timing and startup draft newline tracking, converting to `std::time::Instant` where existing composer helpers require it.
## Testing
Run the existing startup draft multiline paste test with `start_paused = true`. It checks that non-bracketed pastes preserve newlines without submitting the draft.
GitOrigin-RevId: 73bac963204473d85e7395781e0df966ecc92801
## Why
`render_ref` already holds a read lock on `sign_in_state`. Acquiring another read lock in `render_continue_in_browser` can deadlock when a writer is waiting.
## What changed
Pass the borrowed `ContinueInBrowserState` from `render_ref` into the browser sign-in renderer instead of reading the lock again.
## Testing
Update the existing narrow-width browser sign-in test to exercise `render_ref`, retaining checks for the full OSC 8 authentication link, device-code guidance, and cancellation footer.
GitOrigin-RevId: ba83e212d510627be9dfd068c8d7318da32a1749
## Why
Native clipboard setup and writes can block, preventing the TUI from processing input or closing overlays while a copy is in progress.
## What changed
- Route clipboard copies through one session worker that retains native clipboard ownership. Keep terminal escape output on the UI thread.
- Show pending and busy status messages, reject additional copies without queuing them, and ask users to retry image paste after an active copy finishes.
- Abandon setup after five seconds and prevent late delivery. Keep the worker busy until the blocked call returns, and bound shutdown waiting for clipboard handoff.
- Match completions to their originating requests so stale results cannot clear newer selections or unexpectedly resume transcript following. Retain selections on automatic copies, failures, and unconfirmed delivery.
## Testing
Add regression tests for blocked backends, overlay exit, copy and paste ordering, setup expiry, bounded shutdown, completion status messages, and preservation of replaced or moved selections.
GitOrigin-RevId: 4ba1f8da258b9d0700b0edec9ac0ba699f536785
## Why
RPC sending and waiting do not depend on request or response types, and Markdown layout does not depend on the parser iterator. Share these implementations across typed calls and parser variants.
## What changed
- Extract `RpcClient::send_request_and_wait` into a non-generic async method, preserving registration before serialization and disconnected-client error precedence.
- Remove the iterator type parameter from `Writer` and pass iterators to event traversal methods, retaining static dispatch and dropping the parser before rendering state, including on unwind.
- Update streaming rendering and existing rendering tests to use the separate parser.
GitOrigin-RevId: 4cc07223111b7c08211028948d13fe04598f8fc7
## Why
Confirming an Astra model selection recursively polled the large event dispatcher on the TUI thread's stack.
## What changed
Unwrap `AstraSelectedFromModelPicker` before dispatching its model update, then trigger the sparkle afterward when eligible. Keep the eligibility check and model update in the same event so queued backend updates cannot turn a no-op confirmation into a sparkle.
## Testing
Add a regression test that confirms `gpt-6-astra` with `XHigh` reasoning on a thread with a 4 MiB stack and checks the resulting model and reasoning effort.
GitOrigin-RevId: 89df8b417a9fd0107ebb918edeb2d240b53d42bd
## Why
Flowcharts with labels such as `A["Review & confirm"]` fell back to source display instead of rendering a diagram.
## What changed
Accept double-quoted node and edge labels, strip the surrounding quotes, and allow literal ampersands in flowchart labels. Keep other diagram families' label restrictions and continue rejecting HTML, entity escapes, and malformed quotes.
## Testing
Add parser and renderer regression tests for quoted labels, literal ampersands, statement separators, and unsupported text, plus TUI coverage for rendered labels and entity source fallback.
GitOrigin-RevId: 9e61a04665f0266d369fa3595411c9a72f10cb9d
## What changed
Use a dedicated default catalog for Bedrock Mantle endpoints whose host starts with `bedrock-mantle.us-gov-` and ends with `.api.aws`. Include only GPT-5.6 Terra, GPT-5.6 Luna, and GPT-5.4, with GPT-5.6 Terra as the default.
## Testing
Add model picker snapshot coverage for `us-gov-west-1` and `us-gov-east-1`. Update the configured-catalog test to use a GovCloud endpoint, verifying that a custom catalog is preserved while service tiers remain normalized.
GitOrigin-RevId: 5f22ba6983bd60be52d8845c9709112a4766839d
## What changed
- Add `tui.copy_on_select` with `auto` (default), `always`, and `never` modes, and apply it to the fullscreen transcript, transcript overlay, and resume/fork previews.
- Enable `auto` in tmux and Zellij, and in direct macOS terminals except Ghostty and Kitty. On other platforms, enable it in direct terminals identified as iTerm2 or Terminal.app.
- Copy nonempty mouse selections on release, including word and line selections, while retaining their highlight. Preserve link activation and ignore empty selections.
- Clear composer selections after confirmed keyboard copies, matching right-click copies, while preserving the draft and cursor. Keep selections when copying fails or delivery is unconfirmed.
## Testing
Add coverage for terminal defaults and configuration overrides, copying on release, retained highlights, repeated clicks, link activation, and empty drags. Extend composer coverage to verify selection clearing for `Cmd-C`, `Ctrl-C`, and right-click across clipboard outcomes.
GitOrigin-RevId: 24e6f9e267ef3ab249c5356db736e094127f68b8
## Why
Queued-message edit hints could vary by terminal instead of showing the first configured shortcut. Use the keymap consistently for queued messages and async question navigation.
## What changed
- Make `Shift+Left` the primary shortcut for advancing through questions and editing the last queued message, and `Shift+Right` for navigating back toward the composer. Keep `Alt+Up` and `Alt+Down` as alternatives.
- Remove terminal-specific hint selection and derive hints from the configured keymap, including custom chords and unbound actions.
- Update question footers, queued-input previews, and keymap picker snapshots to reflect the preferred shortcuts.
## Testing
Extend tests to cover both default shortcut pairs, configured shortcut ordering, custom chord hints, and hiding the queued-message edit hint when the action is unbound.
GitOrigin-RevId: e0f60860ef1e81c71ca0fc32369b8cbd12582b47
## Why
An unfinished Markdown link can display its destination across multiple preview rows, then collapse when the closing parenthesis arrives.
## What changed
Keep the link label visible while withholding the opening parenthesis and destination until the link closes. Scan incoming text incrementally, accounting for nested parentheses, escapes, angle-bracket destinations, titles, and inline code. Apply this holdback only to rich prose previews; newline commitment and finalization still render the original source.
## Testing
Add regression tests for character-by-character input, long Unicode destinations, resizing, raw-mode switching, and flushing unfinished links on newline or completion, plus a snapshot of the label-only preview.
GitOrigin-RevId: 9cea680a93dfcd0aea21f0fc12006b27400d4dab
## Why
Mermaid diagrams that cannot be rendered currently fall back to source without
explaining why the preview is unavailable.
## What changed
Show a dimmed notice above the preserved source when a completed Mermaid block
uses unsupported syntax, exceeds renderer size limits, or does not fit the
terminal width. Wrap the notice to the available width and preserve indentation
inside lists and blockquotes. Leave unfinished fences and disabled Mermaid
rendering without notices.
## Testing
Add coverage for fallback reasons, dimmed styling, source preservation, nested
indentation, and suppression of notices for unfinished fences and disabled
rendering. Update the streaming resize snapshot to include the width notice.
GitOrigin-RevId: 6ac7914b398c855e7aed3775ee0de70fb4484b78
## Why
Command execution analytics lack the observed sandbox backend. Older execution servers may omit this information, so an unknown backend must remain distinguishable from an explicitly unsandboxed process.
## What changed
- Carry optional `sandbox_type` metadata through command execution items and emit its metric tag as `sandbox_backend` in analytics.
- Propagate the observed backend through unified execution completion and failure events, including asynchronous exits.
- Preserve missing backend information as `None` and mark executed user shell commands as `Some(SandboxType::None)`.
- Exclude the metadata from serialized command items and generated schemas and TypeScript types.
## Testing
Extend tests for missing and explicit executor backends, backend propagation on failed execution, and analytics payloads, including platform-specific backend tags in app-server integration coverage.
GitOrigin-RevId: 178fe46824a6194910802ec02168ed40ee0b2019
Apply `secondary_text_style()` to the shortcut hint separator and label
so they use a readable foreground color instead of terminal-dependent dimming.
GitOrigin-RevId: 6cd9ced75deca9353c1224d3e5fefc6c4ad6ae8f
## Why
An async question notification can outlive its unanswered question and suppress the lower-priority turn completion notification.
## What changed
Clear pending `AsyncQuestion` notifications when collecting question drafts on completion, interruption, or failure, including the error-handling path. Completed turns can then queue their completion notification.
## Testing
Add regression coverage for all three turn outcomes and assertions for error handling and completion after dropped message deltas.
GitOrigin-RevId: 647b2b37acced431fc98fd4f5334c8973a0be241
## Why
Recovering question answers or interrupted input can cancel an active `Ctrl+R` search or overwrite its preview. Recovery should preserve the search while keeping the recovered input available on cancellation.
## What changed
- Apply background updates to the saved draft without changing the search query or visible preview, including when a query has no match.
- Restore the updated draft on `Esc` or `Ctrl+C`; discard it when accepting a history match. Keep search open when `Enter` has no match to accept.
- Capture the saved draft rather than the preview in draft snapshots, preserving attachments, mention bindings, and pending pastes.
- End search on an explicit fresh draft replacement so cancellation cannot resurrect discarded input.
## Testing
Add regression coverage for recovery on turn completion, failure, and interruption; accepting and canceling search after recovery; Vim undo/redo; pending paste preservation; and clearing drafts after a misalignment policy failure.
GitOrigin-RevId: d3de19bbbcdab2e461c19d47b2b7dca0b28f6ff3
## What changed
Clear pending asynchronous questions when a live turn completes, is interrupted, or fails, and append nonblank typed answers to the main composer in question order without submitting them. Preserve existing composer content and input restored after interruption, and retain large answers as paste placeholders.
Cancel history previews and pending Vim commands during recovery while preserving undo grouping and dot-repeat behavior. Skip recovery during replay and keep input cleared after a misalignment policy violation.
## Testing
Add regression tests and snapshots for open and collapsed drafts, buffered typing, answer ordering, repeated completion notifications, large pastes, interrupted queued input, and Vim undo/redo behavior. Update coverage for terminal errors and realtime question expiration.
GitOrigin-RevId: fec109fe8aecb0735a3a5410fbb063b5c5c6e9a1
## What changed
- Detect Terminal.app from primary and secondary device attributes during startup on Unix SSH sessions without a detected multiplexer. Ignore signatures inside bracketed paste and leave incomplete replies unknown.
- Use inline mode when Terminal.app is detected and `tui.alternate_screen` is `auto`. Apply the decision before the first startup frame and retain it for later configuration loads. Preserve explicit `always`, `never`, and `--no-alt-screen` overrides.
- Update the `crossterm` dependency revision and lockfiles.
## Testing
Add coverage for terminal signatures, fragmented and pasted replies, probe completion and timeout behavior, screen-mode overrides, and an inline startup snapshot.
GitOrigin-RevId: 9b937824b080f9bd6de29df1d9e84f42a698af46
## What changed
Extend an existing transcript selection with Shift-click while preserving its original anchor and selection unit. Allow continued dragging and repeated extension in either direction, including whole-word selections made by double-clicking. An ordinary click still starts a fresh selection.
## Testing
Add tests for extension in both directions, preservation of selection units, continued dragging, and ordinary-click reset, plus a snapshot of word-selection highlighting.
GitOrigin-RevId: e6208c1bc6260ac26e7cd1f81c752b2c0b375f36
## Why
Application network restrictions need to cover clients created by the TUI and `codex exec` before embedded app-server startup, and remain effective when configuration is rebuilt.
## What changed
- Introduce `EmbeddedNetworkPolicy` to share live policy between caller-owned transports and the embedded app-server.
- Apply loaded requirements before creating telemetry, background HTTP clients, and executor connections. Limit authentication and cloud configuration bootstrap requests to exact endpoints under local policy.
- Preserve the shared policy across TUI session changes, permission-profile rebuilds, and worktree cloud loaders so existing clients observe policy reloads and failures.
- Document application network policy behavior and transport coverage.
## Testing
Add regression coverage for policy activation, reload failure and recovery, retained policy across TUI rebuilds, rejected OAuth and cloud-policy redirects, and workspace network restrictions with `CODEX_API_KEY`. Also cover retaining the caller-selected project during embedded startup.
GitOrigin-RevId: 629009f087b8cb21fc34a1ee7ea6fe95d9e0f2b5
## What changed
- Load `application.network` requirements at startup and explicit config/account reloads, applying local policy before authentication and cloud configuration bootstrap.
- Block traffic when policy loading fails, cancel requests that a new policy no longer permits, and reject configuration loads based on superseded policy snapshots. Local requirements edits take effect on the next explicit reload or restart.
- Bind authenticated clients to the current account and revoke them when account ownership changes. Carry policy enforcement through backend requests, realtime connections, workload identity exchanges, and code-mode gRPC streams while preserving gRPC trailers.
- Treat denied credential refreshes as policy errors without retrying them or invalidating stored credentials.
## Testing
Add regression coverage for startup restrictions, reload ordering, cancellation after restrictive or malformed requirements edits, account revocation, gRPC destination denial, workload identity cancellation, and credential preservation after denied OAuth refresh.
GitOrigin-RevId: 0cb4c720a906397e9df06675f01ecf60d741101f
## Why
Codex could enable mouse capture even when the containing tmux session had mouse support turned off.
## What changed
- Probe tmux's `mouse` and `extended-keys-format` settings together, targeting `TMUX_PANE` when available.
- Suppress mouse capture when tmux explicitly reports `0` or `off`, and apply that policy across fullscreen and overlay input changes. Refresh the policy when entering or restoring the alternate screen.
- Preserve normal mouse behavior when the probe fails or the setting is unknown, and retain the keyboard-format fallback for older tmux versions.
## Testing
Add tests for pane targeting, explicit and unknown mouse settings, probe failures, keyboard fallback, and mouse-policy changes across fullscreen and overlays.
GitOrigin-RevId: 7bdd2759207b30a3877e983b489462de7c96e692
## Why
Destination restrictions and policy revocation must remain effective during redirects, response body reads, and established WebSocket traffic. Policy denials must also survive error handling so callers do not retry them or report a revoked operation as successful.
## What changed
- Route managed HTTP clients through a shared `RequestBuilder` and policy-aware execution, checking each redirect destination before route resolution and retaining a network permit while consuming response bodies.
- Guard WebSocket connection setup, reads, and writes with revocable permits, including independent wakeups for split readers and writers.
- Preserve `TransportError::Policy` through HTTP, SSE, and realtime error handling, and treat policy denials as non-retryable.
- Keep the supplied network policy in plugin startup HTTP requests and propagate response body failures from backend and plugin requests.
## Testing
Add regression coverage for rejection before connecting, revocation during redirect routing and streamed body reads, split WebSocket revocation, realtime writer error propagation, and revoked plugin upload responses.
GitOrigin-RevId: fba36700444c98a8364c09b4dc5452c4d78a90fb
## Why
Selecting text can pause following while the final transcript row remains visible. Clearing that selection could leave an unnecessary `esc latest` hint in place of the composer hints.
## What changed
Only show the return-to-latest footer for paused navigation when the transcript tail is out of view. At the bottom, show selection shortcuts without the earlier-history status, then restore composer hints when the selection is cleared, even if following remains paused. Preserve loading and retry hints.
## Testing
Add regression coverage for selection, clicking away, and scrolling at the bottom with partial and complete history, plus selection above the bottom. Verify retry hints with selected text and update activity expectations and the composer-gap snapshot.
GitOrigin-RevId: aeb2109244d6c3214c945abb51cf469087d03074
## What changed
Display a `voice` badge on the task whose session owns the running voice conversation, including when a child thread owns it. Refresh the overview after voice controls and realtime conversation resets so the badge clears when background voice closes asynchronously.
## Testing
Add snapshot coverage for a child thread owning voice and a regression test for clearing the badge after an asynchronous background voice close.
GitOrigin-RevId: 815dfad4ce1a31945d2dd0d3f9cecc5abfa419d6
## Why
Switching threads stopped the active voice conversation. Users should be able to view another task while continuing the call on its original thread.
## What changed
- Retain the voice owner's live widget and subscription in the background, routing voice controls, speech, and connection callbacks to that owner.
- Restore the live call and transcript when returning to its thread, without duplicating captions or letting background UI events affect the visible task.
- Preserve undelivered speech and defer background errors until the owning thread is shown.
- Stop background voice on shutdown, disconnect, or removal of the owning session.
## Testing
Extend regression and end-to-end coverage for thread switching during delegated speech, voice control routing, transcript restoration, caption deduplication, and cleanup on disconnect or archive/delete.
GitOrigin-RevId: ce010dce6fa8cd6fa44949a131f3f16e8cb80c4d
## What changed
- Handle voice toggle and mute shortcuts in `App`, and route `/voice`, `/voice stop`, and `/voice mute` through thread-scoped events that ignore requests for a different current thread.
- Allow function-key voice toggle bindings and chords beyond chat, including transcript browsing and search, while preserving existing surface bindings and raw key capture.
- Exit transcript browsing when toggling voice, avoid matching completed chords again, and preserve startup submission handling before dispatch.
## Testing
Add regression coverage for voice chords outside chat, binding conflicts, key capture, transcript browsing, mute dispatch, and startup submission cancellation with draft preservation.
GitOrigin-RevId: c4d110ca8a2e1840247a7fe84cd69c6b7cdb36d7
## What changed
Add `backend_reasoning_status`, disabled by default, to relay public reasoning summaries during active, server-managed realtime V3 delegations.
Use the last non-empty summary from each completed reasoning item, truncate it to 256 bytes at a character boundary, and append it as `[STATUS]` context on the `commentary` channel. Discard queued updates if their delegation is no longer active.
## Testing
Add an integration test covering enabled and disabled behavior, selection of the latest non-empty summary, exclusion of raw reasoning and partial summaries, and delivery without triggering `response.create` or changing the model's reasoning-summary setting.
GitOrigin-RevId: 75ce87dbbbab15a6d9d0ad0b23737738837192fd
## Why
User prompt URLs only received explicit hyperlink destinations when they required forced wrapping, leaving other URLs without those annotations.
## What changed
Annotate web URLs before wrapping user messages so their full destinations survive both adaptive wrapping and forced splitting of oversized URLs.
## Testing
Add a regression test and snapshot at widths of 120, 60, and 24 columns, checking URL destinations, line width limits, and matching display and transcript output, including a prompt with an image placeholder and a parenthesized URL.
GitOrigin-RevId: fccae7b76a3613776d7a663c41e699ebad7eebc1
## What changed
Reserve a blank row below a trailing recap when the transcript viewport has room. Keep this spacing in layout rather than selectable content, and omit it when a completed or live message follows the recap.
## Testing
Add snapshots covering recap tail spacing across terminal sizes, with and without a next action, and with completed or streaming follow-up messages. Verify that reflowed history retains a single separator between a recap and the following message.
GitOrigin-RevId: f9552931fac4eabd7d72c2b312ffba717257e9e1
## What changed
Add `openai.gpt-6-sol` and `openai.gpt-6-luna` to the Bedrock catalog, including `global.` and `us.` variants for Bedrock Runtime. Make GPT-6 Sol the default and provider fallback model, preferring its global variant for Runtime. Retain the existing models and update model picker ordering.
## Testing
Extend catalog and provider tests to cover the new models, metadata, ordering, and default selection. Update thread-start tests for supported model preservation and fallback behavior, and refresh Mantle and Runtime model picker snapshots.
GitOrigin-RevId: 5ce646e384353ae26cdfc4ea4e7c049ac61e698c
## What changed
- Add “Inspect activity” to the shortcut help’s Session section, using the runtime `focus_activity` binding (`F4` by default) and hiding it when unbound.
- Remove the passive activity footer hint so composer hints remain available. Keep previous, next, details, and back controls while activity is focused, shortening them to fit the available width.
## Testing
Add snapshot coverage for default, remapped, and disabled activity shortcuts. Update footer coverage to verify the absence of passive hints and interactive controls at 20, 32, and 80 columns.
GitOrigin-RevId: 52ca6f4992778cd3cf3eebe163d533e69a8dabeb
## What changed
- Add `gpt-6-sol` and `gpt-6-luna` catalog entries and refresh model descriptions.
- Offer migrations from `gpt-5.5`, `gpt-5.6-sol`, and `gpt-5.6-terra` to `gpt-6-sol`, and from `gpt-5.6-luna` to `gpt-6-luna`.
- Retarget retired `gpt-5.4` and `gpt-5.4-mini` selections to GPT-6 Sol and Luna, respectively.
- Recommend `gpt-6-luna` in the rate-limit switch prompt.
## Testing
Extend migration tests to cover the new targets, their default reasoning effort, and prompting again after a previously acknowledged migration to an older target. Update model-picker and rate-limit prompt snapshots.
GitOrigin-RevId: d3a093d18ce44a903383504ab8f5cbbc911d602d
## Why
An empty composer hint row already separates activity from the input. Adding another separator wastes transcript space, especially in short terminals.
## What changed
Reserve the extra separator only when copy status text, a follow control, or a fitting hint occupies the shared row and the viewport has room. Recalculate the transcript layout in the same frame when adding that separator, and use a shared timestamp for copy status visibility and expiry.
## Testing
Extend snapshots for running turns with no hint, follow controls in short terminals, and copy status text at narrow widths and limited heights. Update resize assertions to check that the draft and caret remain stable relative to the terminal bottom.
GitOrigin-RevId: a73894063b759ec6b9a25f720e0e8007516109c8
## What changed
Remove trailing periods from concise built-in option descriptions and disabled-option explanations, and simplify wording across TUI menus. Share the built-in permission preset descriptions between permission pickers.
Document the convention in `codex-rs/tui/styles.md`, including normal punctuation for descriptions with multiple sentences and preservation of externally supplied descriptions.
## Testing
Update menu assertions and rendering snapshots for the revised copy and line wrapping.
GitOrigin-RevId: 3231d25484178452ab001af5ddc982460d14f94a
Eric Traut