## Why
Model requests need the selected workspace's routing constraints before sending content. A missing cached route cannot establish that a custom ChatGPT-auth destination is independent of the workspace.
## What changed
- Register the account processor as the workspace routing resolver for Responses HTTP, compaction, and WebSockets, enabling origin selection and routing headers while preserving API paths and rejecting routed HTTP redirects.
- Share concurrent discovery by auth generation, workspace, and backend configuration. Recover from discovery-time `401` responses while allowing token refreshes for the same auth owner.
- Require successful discovery before classifying custom destinations as independent, and require a new thread when a workspace-bound session's bootstrap origin changes.
- Refresh managed requirements using retained session configuration without fetching thread configuration again. Return typed routing errors without account or backend details.
## Testing
Extend coverage for discovery-time token refresh, retained provider definitions under managed requirements, and specific invalid-routing error categories.
GitOrigin-RevId: 090cda70daa91ee8acfbc973699d028111e54125
## What changed
- Accept `windows.sandbox = "mxc"` and preserve the selected backend through environment configuration, command execution, patch writes, and sandbox metadata.
- Treat MXC as enabled in the TUI and report Windows sandbox readiness as `ready`, avoiding legacy setup prompts.
- Keep `allowed_sandbox_implementations` scoped to the legacy elevated and unelevated backends without restricting MXC.
- Default `windows.sandbox_private_desktop` to `false` for MXC while retaining `true` for legacy sandboxes.
## Testing
Add coverage for MXC configuration precedence, legacy requirement handling, sandbox selection, and TUI state. Add a Wine integration test that verifies command and patch routing fails when native MXC is unavailable and reports `windows_mxc` in turn metadata.
GitOrigin-RevId: e2162447d0750f60753864c92a20e02a7f297bca
## What changed
- Render `\hat`, `\bar`, `\tilde`, `\vec`, `\dot`, and `\ddot` on single visible graphemes, preserving support for following subscripts and superscripts.
- Add symbols for physics, relations, sets, logic, arrows, and integrals, including `\hbar`.
- Support named delimiters, including with `\left` and `\right`, plus angle brackets written as `\left<` and `\right>`.
- Preserve raw math when accent arguments are empty, invisible, or span multiple graphemes or layout rows.
## Testing
Add snapshots for accents, symbols, named delimiters, and the Schrödinger equation, plus rejection tests for ambiguous accent arguments and unsupported delimiters.
GitOrigin-RevId: 9dd4883cdf187835a4b4e873886c4299de488705
## Why
An explicit `service_tier = "flex"` could be dropped when fast mode was disabled or the model catalog did not advertise Flex, even though Flex is an API request option.
## What changed
- Preserve configured `flex` through core session settings, TUI tier resolution, and request construction regardless of fast-mode or catalog support.
- Omit `service_tier` from Amazon Bedrock requests, including with custom catalogs, because Bedrock only supports the implicit default tier.
## Testing
Add regression coverage for Flex configured at startup or through thread settings, connected thread startup, and TUI turn submission. Update review coverage to expect Flex with fast mode disabled, and verify that both Bedrock providers omit `service_tier`.
GitOrigin-RevId: 98f2761bdd780603839ebfec75cb983a5d55e554
## Why
TUI startup metrics report the selected app-server mode before a connection succeeds, which can misrepresent embedded fallback or failed startup. Daemon startup and update actions also need distinct outcome observations.
## What changed
- Record `codex.tui.start` once after the first connection attempt, using the actual mode or `unconfirmed`, and include daemon selection and auto-start tags.
- Add `codex.daemon.start` for TUI auto-start and `codex.daemon.update` for foreground CLI updates and TUI update handoffs, using existing analytics consent and identity handling.
- Report TUI handoffs as `handoff_requested` and suppress duplicate child reporting. Remove the suppression flag when spawning long-lived daemon processes.
- Tag daemon settings by enabled state and explicit presence, without exporting setting values or contents; report invalid or unreadable settings as `unknown`.
## Testing
Add coverage for analytics defaults and explicit consent overrides, unconfirmed CLI updates, settings presence, and exactly-once launch observations. Extend the worktree TUI test to check startup tags and a single update handoff observation.
GitOrigin-RevId: 176d2ee594f930033fa1ece55d4c1c9603dbbc16
## Why
Private `/tmp` bind mounts can leave hidden entries in `/proc/self/mountinfo`, causing the Linux sandbox to reject layouts that safely isolate daemon sockets. The proc-mount preflight also needs the main sandbox's WSL masks when checking aliases.
## What changed
- Identify the opened socket directory's mount using `fdinfo`, with a `statx` fallback, and follow its mount ancestry to distinguish hidden paths from exposed aliases.
- Accept safe private and stacked mounts while rejecting covered mounts, exposed aliases, and nested mounts. Retain conservative checks when no mount ID is available.
- Preserve WSL interop and WSLg masks in the proc-mount preflight.
- Heap-allocate large lifecycle futures in the TUI approval-gated MCP tool test to reduce Windows test-thread stack usage.
## Testing
Add mount-layout regression cases and a namespace integration test that verifies daemon sockets remain inaccessible under private `/tmp`, unrelated sockets remain reachable, and an exposed alias prevents startup. Add a preflight test for preserving WSL masks.
GitOrigin-RevId: 289b4446ba7776a7dd57ef5ff09e87bda19b069c
## What changed
- Add `features.daemon_auto_start`, disabled by default and available through `/experimental`, to start the shared local server for eligible new, resumed, and forked sessions. Changes take effect on the next launch, and disabling the feature persists an explicit `false`.
- Require successful daemon startup and connection when auto-start applies. On failure, show guidance to rerun the same command with `--no-daemon` instead of silently falling back to an embedded server.
- Preserve embedded mode for excluded launches, including Bedrock sign-in, and carry exclusion warnings through resume and fork pickers. Honor `--no-daemon` without an exclusion warning.
- Update `/import` guidance to recommend restarting with `codex --no-daemon`.
## Testing
Add CLI and TUI coverage for automatic daemon attachment, startup and connection failures, `--no-daemon`, picker warning persistence, and Bedrock onboarding with and without a running daemon. Add snapshots and configuration-write assertions for the experimental toggle.
GitOrigin-RevId: 2e8eb163bc7ddd268a86c7546c05a85356c1e9ee
## What changed
- Render web activity on one line with width-aware truncation and labels for searches, opened pages, and in-page searches. Preserve all batched queries in full details.
- Show viewed images by filename in chat while retaining their original paths in expanded transcripts and raw output. Use these activity renderers for persisted transcripts and exports.
- Display code-mode tool titles without the `Calling` or `Called` prefix and truncate headers to the available width while preserving full transcript titles and failure details.
- Keep `Returned image` markers inside the originating MCP call, alongside result text, and use the same wording in transcript exports.
## Testing
Add regression tests and snapshots for narrow displays, missing web action details, batched queries, image paths, MCP image results, matching live and replay rendering, and complete web and image details in persisted exports.
GitOrigin-RevId: 5d3f0a0031818c985378ad3ee4b24084d3868c98
## What changed
Show a brief starfield in the empty composer when a new task starts with Astra or the user selects Astra through `/model` before entering ordinary prompt content.
- Respect `tui.animations`, `tui.whimsy`, and true-color support; protect the placeholder and cursor and fade out by 15 seconds.
- Preserve eligibility through recognized slash commands, but permanently dismiss it after ordinary draft content, attachments, or work. Carry draft eligibility through startup and disconnected editing.
- Exclude resumed and forked tasks, and verify model-picker changes against the originating task and effective model when applied.
- Hide the effect during overlays or focus loss without restarting its deadline or scheduling hidden animation frames.
## Testing
Add regression tests and snapshots for task eligibility, model-picker transitions, draft and paste handling, history search, overlays, submissions, rendering protection, and animation expiry.
GitOrigin-RevId: 832705543e9cae1d561125ece853a16c4eefe627
## What changed
- Run with `--no-daemon` without starting or probing the shared server, even when it is already running. Preserve the flag through `resume` and `fork`, and honor it for session archive commands.
- Reject combinations with `--remote`, `codex agents`, and `codex queue`, which require a server connection. Point users to `codex --no-daemon` when the agents overview cannot start its shared server.
- Centralize daemon eligibility checks and exclude launches using `--profile` or `CODEX_EXEC_SERVER_URL` from implicit daemon reuse.
## Testing
Add coverage for flag propagation, incompatible command combinations, and daemon eligibility. Add a PTY test verifying that `--no-daemon` starts the TUI without creating daemon state or connecting to an existing control socket.
GitOrigin-RevId: acc6a7cb339df6433bb8273c796194cdceda37c1
## Why
Creating a session from Command Center waits for configuration and server requests before displaying the composer. Scanning loaded agents also adds unnecessary round trips for a new session with no descendants.
## What changed
- Show an editable startup composer while loading settings, starting the thread, and attaching the new session.
- Transfer the draft into the new session, including pending paste state, and retain edits for a retry if setup fails.
- Keep session creation running when cancellation keys are pressed in the provisional composer.
- Skip descendant backfill and paused-goal resume prompts for new sessions.
GitOrigin-RevId: 8371a6c3edc09de6366253021eae99f7b60d78ef
## Why
Multiple result blocks and wrapped text can exceed the compact preview's row budget. Truncation must also preserve trailing failure diagnostics.
## What changed
Apply a shared rendered-row limit to code-mode output previews after wrapping, including overlong URLs. Keep the first and last rows around an `… more · ctrl+t` indicator, while retaining the full text in the expanded transcript.
## Testing
Add coverage for multiple result blocks, trailing failure diagnostics, Unicode wrapping, long URLs, and error results at several terminal widths, including transcript preservation.
GitOrigin-RevId: ad9cf0fafb909e4df9a132f83722d6cd4e669687
## What changed
- Bind `F8` to start or stop a voice conversation through the existing voice toggle handler, preserving its start guards and the composer draft.
- Expose `tui.keymap.chat.toggle_voice` in the configuration schema and keymap picker, with support for remapping, unbinding, and key chords.
- Let the default yield to existing `F8` bindings and overlapping chord prefixes, and validate explicit bindings against shortcut conflicts and reserved text input.
- Handle the shortcut only on key presses when no modal or popup is active.
## Testing
Add tests for default and custom bindings, conflicts, chord dispatch, live remapping and unbinding, draft preservation, start guards, and popup and key-event handling. Add a snapshot for the voice shortcut editor.
GitOrigin-RevId: e5e373e8eefa89bec4d5cbdca801616e312134b5
## Why
Inline code and local file paths in the TUI used a fixed cyan foreground regardless of the active syntax theme.
## What changed
Use the active theme's Markdown raw-text foreground for inline code and local file paths, with cyan as the fallback when no matching color is available. Isolate the active theme and its revision per test thread to prevent parallel tests from affecting each other's rendering.
## Testing
Add rendering snapshots for dark, light, ANSI, and fallback themes, plus a regression test for theme and revision isolation between test threads.
GitOrigin-RevId: 40d84131d0abc9f177019d9b0b3e19536d5cd553
## What changed
Render completion footers as `2:32 PM` or `Worked for 2m 5s · 2:32 PM`, with the existing date formatting for older completions.
Update test helpers to identify completion footer cells by type when normalizing or excluding timestamps, preserving message text that resembles a completion footer.
## Testing
Update completion label and transcript snapshots, and add assertions that timestamp normalization preserves ordinary message text while normalizing completion footer cells.
GitOrigin-RevId: 35f1658db02f8527212c006fd7492b574a105304
## What changed
- Render completed `mermaid` fences with `codex-mermaid`, using syntax-theme colors for nodes and edges.
- Keep source visible for unclosed, invalid, unsupported, or oversized diagrams, and preserve the original Mermaid for copying and raw mode.
- Keep streamed diagrams mutable until the next top-level block so closing fences and terminal resizing can update their display. Preserve scrollback progress across width and render-mode changes.
## Testing
Add renderer and streaming tests covering supported diagram families, nested fences, Unicode, theme colors, source fallbacks, resizing, raw-mode transitions, and original-source preservation. Verify that node connection ports retain node styling in all four flowchart directions.
GitOrigin-RevId: 9a759248110e6730d629d653061ff7e2ec5dc2c0
## Why
Per-socket metrics label resends after reconnect as initial requests, obscuring why full input was sent. Client telemetry can preserve that reason across reconnect failures and turn boundaries.
## What changed
- Add `codex.websocket.continuation` to count `response.create` send attempts, including failed sends, with `mode`, `reason`, and `phase` tags.
- Distinguish incremental continuations, fresh requests, restored history, closed connections, and other full-input sends. Track warmup and generation separately.
- Preserve the first continuation reset reason until the next send and identify resumed or forked history.
- Allow session telemetry to use a `MetricsClient` supplied through thread extensions and document the counter's semantics.
## Testing
Add metric assertions for incremental reuse, warmup, changed requests, account switches, reconnects, and resumed or forked history. Add a unit test for preserving reset reasons across repeated resets and turn boundaries.
GitOrigin-RevId: 29324f5e9d5677e0c6068f89b2256a92a5a0d157
## Why
Compression metrics do not distinguish startup runs from runs requested through
`rollout/compress`, making their outcomes indistinguishable by entry point.
## What changed
Pass `RolloutCompressionTrigger` from startup and RPC callers through the
compression worker. Add a `trigger` tag with `startup` or `rpc` to run, file,
scan-error, and temporary-file cleanup metrics, including durations, byte counts,
and compression ratios.
GitOrigin-RevId: f23d9da791b666a7311f2323f6bead6570067798
## Why
Read-only MCP discovery and invocation need a consistent policy across requests, connection reuse, and tool catalogs. Reusing an unrestricted connection or cached catalog can bypass filtered discovery.
## What changed
- Thread `requires_read_only_mcp_tools` through MCP configuration and client setup, leaving it disabled by default.
- When enabled, set `openai/readOnly` to `true` in `tools/list` and `tools/call` request metadata, overriding a caller-supplied `false` while preserving other metadata, pagination, and arguments.
- Include the policy in connection identity and bypass shared Apps and persistent tool catalog caches for read-only connections.
## Testing
Add coverage for metadata propagation in legacy and modern protocol modes, preservation through session recovery, and isolation from unrestricted connections and shared Apps catalogs.
GitOrigin-RevId: f4a3a4021a54e302bffd53f08092b080c056246b
## What changed
- Probe for screen readers at startup on macOS, Windows, and Linux, with a 450 ms timeout. Include Windows Narrator detection in the current login session.
- Save `tui.animations = false` when a screen reader is detected and no user animation preference is configured. Preserve explicit preferences and config comments, and retain a session default if saving fails.
- Record the attempt in `tui.screen_reader_detection_done`; either boolean value skips future detection. Allow explicit animation preferences to override the screen-reader default on reload.
## Testing
Add tests for one-time detection, timeouts, preference preservation, temporary CLI overrides, persistence failures, and preference reloads. Verify rendering without animation frame requests and interactive startup that records detection without replacing an explicit preference.
GitOrigin-RevId: f61c19dfd053f97e8cfed68dce7389fa7601120d
## Why
Failures to save `approvals_reviewer` in the TUI hide the underlying configuration error, leaving users without the details needed to fix it.
## What changed
Use `format_config_error` when displaying save failures so the message includes the error chain, including configuration file locations and parse errors.
## Testing
Add a regression test that introduces an unclosed array in `config.toml` after startup, attempts to save the approvals reviewer through the app server, and verifies the rendered error retains the parse failure and its location.
GitOrigin-RevId: bb29b5f8e61569e6c1c23a0c968e64091a95f72d
## Why
Permission shortcuts updated local permission state as soon as the server accepted the settings request, before receiving the server's settings notification.
## What changed
Use `select_permission_profile` for session-only permission shortcuts so local permissions follow the server's `ThreadSettingsUpdated` notification. Report the selection as requested while it is pending, and use the shared rejection messages. Include the full error chain when permission selection fails.
## Testing
Update shortcut tests to verify that local permissions remain unchanged until the settings notification arrives, pending state clears afterward, and `config.toml` remains unchanged. Update rejection snapshots for unsupported servers and server errors.
GitOrigin-RevId: 0ecd3d8b0698a039bf354d83b25b64b4c38fb45f
## Why
Built-in permission selections in connected TUI threads previously applied local settings directly. Use server-confirmed settings so the TUI adopts the authoritative permissions and refreshes cached network configuration.
## What changed
- Send built-in permission selections through the existing app-server settings API, including selections after Windows sandbox setup. Allow built-in selections during a running turn.
- Block task creation and switching while permission updates are pending, restoring submitted text to the composer when necessary.
- Refresh local permissions, approval settings, runtime overrides, and network configuration when the server confirms a built-in selection.
- Submit a pending initial prompt when the selected permissions already match the current settings.
## Testing
Add regression tests for server-confirmed built-in selection during a running turn, blocked task switches, stale proxy removal, and pending prompt submission when permissions already match. Update background-task tests to wait for settings confirmation.
GitOrigin-RevId: 76e71a8c278c37c0a7ce7c0246da7d185e12ee7a
## Why
An omitted controller socket policy was treated as an explicit denial, preventing execution environments from supplying their own Unix socket grants.
## What changed
- Preserve omission of `dangerously_allow_all_unix_sockets` separately from `false`, and retain explicitly empty `unix_sockets` maps.
- Defer to attachment socket permissions when the controller supplies neither setting. Continue enforcing explicit restrictions, socket denials, and managed requirements.
- Resolve omitted values to `false` for ordinary execution and remote configuration, preserving the default for commands without attachment grants.
- Add debug logging for effective environment and remote execution network policies.
## Testing
Add regression coverage for omitted, explicit, finite, empty, and managed socket policies through remote launch configuration, including live policy replacement and serialization round trips. Adjust remote environment tests to tolerate child-completion ordering and box large cold-resume test futures to reduce Windows stack usage.
GitOrigin-RevId: 98a88d01cbb91aea1faaa03b3c414ef3be7af398
## Why
Task attachment awaits server requests while the event handler cannot process scheduled frames. Prompts and chat widget replacement can also clear the terminal during loading.
## What changed
Draw a bold `Loading task…` message immediately when attaching a task, and redraw it after folder selection, trust prompts, and chat widget replacement. Schedule a frame to restore the normal view afterward.
## Testing
Extend the cold-resume test to verify that a loading message appears before server requests complete, survives widget replacement, and is replaced on the next draw.
GitOrigin-RevId: cb2e73efe38758025964aa53f52127a2b2609fca
## Why
History paging failures can prevent the TUI from opening a conversation that is already open elsewhere, even when its prompts and final replies are available through turn summaries.
## What changed
- When paginated read-only history loading fails, request the latest 100 turns from `thread/turns/list` with `itemsView: summary` and display them in chronological order.
- Clear history pagination state and show a notice that intermediate messages and tool activity are unavailable. Surface the notice during startup, session selection, and command center selection.
- Show a concise retry message when the command center cannot load the conversation, preserving the current conversation.
## Testing
Extend read-only history tests to cover summary recovery, the 100-turn limit and ordering, the user notice, and preservation of the current conversation when both history loading methods fail.
GitOrigin-RevId: c9f06ad58ed5573ce0b4578f429558bfd475830f
## Why
Hiding the selected task can reset selection to the current task or first row, interrupting navigation through the list.
## What changed
Select the next visible task before hiding the selected task, falling back to the previous task at the end of the list. Follow the active grouping and search filter. Preserve the existing rename cancellation behavior when hiding a rename target so its draft cannot transfer to a neighboring task.
## Testing
Add regression tests and a selection snapshot covering project, status, and model grouping, filtered and unfiltered lists, custom hide bindings, hiding all visible tasks, and hiding a task with an unsubmitted rename draft.
GitOrigin-RevId: e5ca6b2a9955622bcf60e68621322b3abd801a7f
## Why
Executor profile roots can use path conventions that are not native to the current host. Converting them to host paths during configuration or turn reconstruction can reject or drop those roots, while case-insensitive comparison can hide Windows path spelling changes.
## What changed
- Store profile roots as URI-backed `ProfileWorkspaceRoot` values throughout permission snapshots and thread settings, preserving spelling in equality and deduplication.
- Keep effective workspace roots as `PathUri` values for permission materialization and status summaries. Convert Windows sandbox root hints to native paths only at native Windows sandbox boundaries, rejecting incompatible roots.
- Omit the legacy rollout `workspace_roots` field when profile roots cannot be represented as host paths, retaining the compiled permission profile.
## Testing
Add regression coverage for Windows and UNC root spelling changes, settings restoration and turn recording with foreign roots, executor-root status display, and backend-specific Windows root conversion.
GitOrigin-RevId: 903c068fd74959bdd10e7cb1141aa42b953a59a4
## Why
Local daemon version warnings direct users to a shell command. Provide an update flow from the TUI with an explicit choice of package source and confirmation before exiting.
## What changed
- Add `/daemon` with options to install the latest public stable release or use the current CLI package. Point local server version notices to the menu.
- Default confirmation to Cancel and explain restart, interruption, and relaunch behavior. After confirmation, exit the TUI and run the update through the launching CLI executable, propagating failures.
- Keep maintenance available when disconnected or using the embedded server. Disable updates for remote connections or a missing CLI executable, and disable copying the CLI build when no local package is available.
## Testing
Add menu snapshots and interaction tests covering both update sources, cancellation, and unavailable actions. Add a Unix CLI handoff test verifying the selected executable, command arguments, and failure propagation.
GitOrigin-RevId: 06b485feb5650673ec7dd00adda01fedb8909393
## Why
Permission summaries must preserve executor paths without interpreting them in the host's filesystem namespace.
## What changed
Accept `PathUri` values and summarize permission profiles directly instead of converting them to a legacy sandbox policy. Render additional workspace roots using their inferred native path convention, and update the exec and TUI callers.
Keep workspace subpath writes and writes outside the working directory classified as `custom permissions` when the working directory itself is not writable.
## Testing
Add coverage for POSIX, Windows drive, and UNC workspace paths, including encoded spaces and case-distinct roots, plus opaque workspace subpath writes.
GitOrigin-RevId: ff2c456e2a720e7216f13e0241b3a935cc925d00
## What changed
Use `thread/revert` to remove the selected turn and subsequent history, then restore the selected prompt in the composer. Keep the thread identity, settings, goal, and unrelated thread channels intact. Show a notice that conversation history was reverted and file changes are unchanged.
Resolve selections against persisted history, accounting for partially loaded transcripts and hidden review prompts. Reject stale selections and mid-turn steers. Refresh replay state and pagination after a revert, clear queued input and obsolete actions, and require a session reload when the revert cannot be confirmed.
## Testing
Add regression coverage for reverting earlier and first visible prompts in place, preserving unloaded history and thread state, rejecting steers in clipped history, and clearing streaming output, queued input, and stale approval actions.
GitOrigin-RevId: d3f0342539392bdbfec925d0c3d6f67369937f1b
## Why
Users need to change the active session's model and reasoning effort without replacing saved defaults for future threads.
## What changed
- Add an `s` shortcut to final model and reasoning choices, with footer hints and a session-only confirmation.
- Apply the selection to the active thread while preserving saved configuration, including separate Plan mode defaults.
- Restore Plan mode reasoning effort with thread input state and suppress the shortcut when it conflicts with configured list bindings.
## Testing
Add coverage for picker shortcuts, active-thread updates, unchanged configuration and fresh-thread defaults, Plan mode restoration, and shortcut conflicts. Update picker snapshots to show the new hints.
GitOrigin-RevId: 07fd129021cc076e3a9bdee04b71979212788eb4
## Why
The TUI's Windows sandbox turn-context override was ignored by `thread/settings/update`, and onboarding derived sandbox state from local configuration instead of the app server's effective configuration.
## What changed
- Read Windows sandbox configuration from the app server before showing the onboarding sandbox creation hint. Show the hint only when the read succeeds and the sandbox is disabled.
- Remove `windows_sandbox_level` from `AppCommand::OverrideTurnContext` and stop sending sandbox-only overrides after setup or feature changes.
- Rely on the effective configuration refresh after setup instead of updating local sandbox flags manually.
## Testing
Update the trust-directory rendering test and snapshot to cover the sandbox creation hint.
GitOrigin-RevId: 2ee6b0634812e7b39fd73dab3ae344729910ba70
## Why
Windows sandbox setup and permission choices need to reflect the connected app server's requirements and the active thread's executors.
## What changed
- Refresh sandbox configuration and requirements for the current working directory when threads or directories change, before setup, and after setup completes.
- Use the thread's observed environments to determine whether sandbox setup is local, remote, mixed, or unknown.
- Defer initial prompt submission while requirements load and preserve the draft if loading fails or required setup is unavailable.
- Hide sandbox setup choices and elevation commands that requirements or executor selection disallow.
## Testing
Add coverage for observed thread hosts, app-server configuration reads, draft preservation and recovery after read failures, deferred initial prompts, and non-admin-only setup choices.
GitOrigin-RevId: d85ac66d18951b752e71d1a6bf25404eeedcad02
## Why
Daemon recovery reloads threads but leaves interrupted work unfinished. Resume eligible work automatically from the saved conversation, even without a connected client.
## What changed
- Attempt one new continuation turn immediately after restoration, including in Plan mode. Mark the old turn interrupted and supply recovery context without creating a user message or granting new authorization.
- Require an idle thread, matching permissions, and the same single local environment configured by the thread. Skip completed, aborted, or superseded work and snapshots without environment identity.
- Add `continue_turn_if_idle` with an atomic previous-turn check so newer tasks or standalone settings changes invalidate pending continuation.
- Preserve the output schema, service tier, and root turn ID, and emit a “Resuming interrupted work” warning when continuation starts.
## Testing
Add daemon restart coverage for continuation without a client, Plan mode, permission and environment mismatches, and legacy snapshots. Add core coverage for preserved continuation metadata, absence of user-message events, rejection of superseded continuations, and exclusion of remote execution from recovery snapshots.
GitOrigin-RevId: 2b290b75d9399fc58258bcda2e85c74e9b5b3b09
## What changed
- Add `WindowsSandboxConfig` helpers to read app-server configuration and managed requirements, preserve legacy feature flag fallbacks, and select an allowed setup mode with elevated mode preferred when the configured mode is disallowed.
- Store the sandbox host classification in thread session state using reported environments across start, resume, fork, and replay paths. Classify missing or empty environments as `Unknown`, and distinguish local, remote, and mixed selections.
## Testing
Add coverage for managed setup restrictions, legacy configuration precedence, unknown policy state, environment classification, and remote host state in inactive-thread replay.
GitOrigin-RevId: ae8920d9c2a1c80b641ac90617ae607b171bd55a
## Why
WSL interop can block while launching the Windows terminal probe, stalling TUI startup. Inconclusive detection can also enable keyboard enhancements that break dead-key composition in VS Code on WSL.
## What changed
- Give the Windows `TERM_PROGRAM` probe a one-second deadline, with launch and cleanup handled on a worker thread. Cache the result, including timeouts, and kill and reap probes that outlive the deadline once launch returns.
- Distinguish VS Code, other terminals, and unknown detection results. Disable keyboard enhancements on WSL for VS Code or unknown results, while preserving the `CODEX_TUI_DISABLE_KEYBOARD_ENHANCEMENT` override.
## Testing
Add regression tests for probe output and exit status, failed launches, timeouts during launch and execution, and child cleanup. Extend detection and override tests to cover unknown results.
GitOrigin-RevId: 39e980b0d7cf3d6716ee61597d6002b0fd59651e
## Why
Clients need widget presentation details to render MCP Apps without waiting for the full MCP catalog, including when replaying saved history.
## What changed
- Add `mcpToolCall.mcpAppUi` with the invoked descriptor's `resourceUri` and `preferredModelDisplayMode`, and carry it through tool-call events and saved history.
- Support `fullscreen` and default to `inline` when the display preference is missing or unsupported.
- Keep existing resource URI fields for compatibility. Leave `mcpAppUi` null for older history and tools that declare widgets only in result metadata, where clients still use catalog discovery.
- Update protocol schemas, TypeScript and Python types, and app-server documentation.
## Testing
Add parameterized integration coverage for fullscreen, missing and unsupported preferences, legacy URI metadata, and result-only widgets, verifying consistent tool events and preservation across session resume.
GitOrigin-RevId: 2a9bed804dcea8c2b4903b8406fa6710681f7f5e
## What changed
- Accept `fileId` alongside the existing `url` form for app-server image inputs, and forward file references to the Responses API as `file_id`. Update generated schemas and client types.
- Preserve file references, image detail hints, and mixed inline/file image ordering through user-message events, thread history, and rollout migration. Retain file images when truncating tool output.
- Pass file references through image preparation without resolving them, while keeping resize-notice numbering correct. Omit them from unsupported TUI display and Guardian image context.
- Reject image-edit requests whose recent-image window includes a file reference, preventing selection of an older inline image instead.
## Testing
Add coverage for serialization, request and rollout preservation, mixed-image history ordering, incomplete ordering metadata, tool-output truncation, and rejection of unsupported image-edit selections.
GitOrigin-RevId: 6ca20a8577155cc934b720803c3b7b3bffdf972a
Replace `◦` with `•` in the rendered popup before comparing the
`image_preparation_disconnected` snapshot.
GitOrigin-RevId: f951c5e1f230bf8ee6d7f32a41f41316feabcb0f
## What changed
- Expose `analytics_plan_history` in the experimental features menu for previewing consumer five-hour and weekly allowance history in `/analytics`. Keep it disabled by default.
- Add `h` and `l` as left/right navigation aliases in analytics, preserving explicit bindings and honoring remapped or unbound arrows.
- Use terminal-aware footer key colors to keep analytics shortcuts readable on light backgrounds.
## Testing
Add navigation tests for arrow equivalence, custom bindings, modifiers, and key repeat. Extend light-background contrast assertions and update style snapshots. Add a snapshot for the plan history experimental feature entry.
GitOrigin-RevId: 310e64a43a7dd08c8a3fd1efed6985805f7dd580
## Why
Reading daily totals required selecting each bar, and changing grouping required opening a picker. Section navigation could shift vertically, while scroll hints appeared even when content fit.
## What changed
- Make `g` cycle through available groupings and summary views directly.
- Show daily totals on charts spanning up to seven days when space permits, prioritizing the selected value and keeping neighboring labels separate.
- Keep section navigation at a stable height, show more legend rows in taller maximized reports, and move their update timestamp into the footer.
- Hide scroll hints when content fits, including an exact fit, and show only the active summary view label.
## Testing
Add regression tests and snapshots for seven-day totals, narrow label spacing, grouping wraparound and server capabilities, configured `g` navigation in ungrouped sections, stable tab placement, adaptive legends, footer timestamps, and overflow-dependent scroll hints.
GitOrigin-RevId: 9d14f314b4a22ca2d926f0e69c6b89e4f9c8550d
## What changed
- Make Summary the initial Analytics tab, showing profile identity, token totals, streaks, activity insights, and most-used plugins and skills.
- Move daily, weekly, and cumulative token activity charts into Summary. Replace the usage menu's separate views with “View analytics”; `/usage weekly` and the other explicit modes open Summary with the requested view, while reopening from the menu retains navigation.
- Load account profiles independently of other reports, preserve missing values separately from zero, and reject responses when the active account changes. Refresh retries profile failures.
- Adapt Summary to narrow terminals and compact large chart totals and axis labels. Show the account email without its ID in the Analytics header.
- Flush queued transcript history before opening an overlay so startup output stays in the transcript.
## Testing
Add profile decoding and account identity tests, Summary layout and navigation snapshots, refresh and cancellation coverage, and regression tests for retained navigation and transcript history when opening Analytics.
GitOrigin-RevId: 6dbe6c4c98209000d8b4bc18a4e01b98fab5991a
## Why
Consumer analytics lacked a per-chat view of allowance usage and balance credit debits.
## What changed
- Add a Top chats panel for up to 100 local chats active in the past 30 days, including discovered descendants and excluding archived roots.
- Show weekly and five-hour usage as percentages of current full limits, plus balance credits including adjustments. Preserve exact credit decimals and distinguish missing values from zero.
- Support cycling sort metrics with `s`, a top-five dashboard summary, and expandable model, reasoning effort, and speed breakdowns.
- Query task usage through `query_v2` with bounded, disjoint descendant groups. Retain partial and unavailable rows, hide titles when usage is unavailable, and report ranking coverage and freshness.
## Testing
Add backend and TUI tests covering decimal precision, request and response validation, paginated archived descendants, unavailable responses, metric selection, title hiding, and top-five rendering.
GitOrigin-RevId: b8f233166576389c8212bb97eceb7c6be7f5f51d
## What changed
- Add consumer plan usage history behind `analytics_plan_history`, disabled by default, fetching seven days of five-hour and weekly allowance periods.
- Show period usage percentages with expandable breakdowns by feature, model, surface, or turn start, plus snapshot freshness and incomplete coverage indicators.
- Preserve unknown usage separately from zero and handle an unavailable history endpoint without blocking other analytics reports.
## Testing
Add backend and TUI tests for unavailable endpoints, response validation, feature and account gating, account changes during requests, period navigation, snapshot resets, and narrow and wide layouts.
GitOrigin-RevId: 7bea87a3407730b18040d7dda7e7dd0afe67fb2e
## What changed
- Show local chats active in the past 30 days, ranked by estimated lifetime credits, for supported Business and Enterprise plans. Exclude archived chats and subagents.
- Add expandable model, reasoning effort, and speed breakdowns, optional zero-credit groups, and dollar estimates when supplied by the backend.
- Load estimates in bounded batches of up to 100 distinct threads, retaining available results when some estimates are unavailable. Hide chat titles without a returned estimate and distinguish missing usage from zero.
## Testing
Add coverage for batch validation, partial failures, request limits, pagination and ranking, plan eligibility, title visibility, and responsive table navigation and details.
GitOrigin-RevId: 783b960a780f4e0fd39f57e2fa78fb31b3090c44
## What changed
- Add “Explore analytics” to the `/usage` menu for ChatGPT accounts, opening a full-screen dashboard.
- Show usage and messages for consumer accounts, credits and token usage for Business and Enterprise accounts, and plugin and skill activity for both.
- Support overview and maximized views, 7- and 30-day ranges, report grouping, daily details, model filtering for token usage, and refresh.
- Keep report loading and errors independent, cancel pending loads on close, and retain navigation state across reopening while preserving the composer draft.
## Testing
Add regression and snapshot coverage for account-specific reports, range and grouping changes, model filtering, loading and cancellation, small terminals, terminal colors, and draft preservation.
GitOrigin-RevId: 46da94a14d6e227551e740b85f9d2d552aaf75b0
## What changed
Add daily stacked bar rendering in the TUI analytics module, staged for dashboard integration.
- Plot three categories plus an Other remainder without renormalizing values, with separate positive and negative bands for signed credits.
- Add readable numeric axes, calendar ticks, a selection cursor, and a callout showing the authoritative daily total. Distinguish missing days from zero usage.
- Keep the selection visible in narrow viewports and omit labels that cannot fit without truncation.
- Use terminal palette colors for series and adapt secondary text to terminal color support and background.
## Testing
Add unit and snapshot coverage for axis scaling, signed bars on light and dark terminals, missing and zero values, narrow layouts, tiny segments, authoritative totals, and duplicate-date remainders.
GitOrigin-RevId: 2ed58def17abd14e77929016a54fd20e91d45670
## Why
Token plan claims can be stale, and the active account or user can change while a request is in flight. Analytics report selection and account-bound response data need to reflect the verified identity and current server plan.
## What changed
- Fetch the active account's plan once per analytics session and use it to select report endpoints and supported credit breakdowns.
- Add report loading with a fixed end date, account-scoped response caching, and token model filtering. Reuse payloads across grouping changes and evict invalid cached responses so requests can retry.
- Prefer complete attribution for usage breakdowns within the requested range; retain legacy surface/model data when attribution is incomplete and include all features in turn-start breakdowns.
- Add cancellable report-loading state with timeout and interruption errors, and preserve actionable sign-in and retry messages.
- Recheck the active identity after rate-limit reads before exposing account-bound fields.
## Testing
Add regression tests for server plan discovery, report routing and caching, model filtering, attribution fallback, failed-request retries, load cancellation, authentication recovery, and account or user changes during requests.
GitOrigin-RevId: 45c4c09f108c9703893f3ed15613437ebd7c74a8
