## What changed
- Detect visible HTTP(S) URLs in the composer and attach the complete OSC 8 destination to every wrapped fragment, including when part of the URL is scrolled offscreen.
- Cache hyperlink metadata with the textarea wrap state while leaving masked input and destinations larger than 8 KiB unannotated.
- Make shared hyperlink mapping grapheme-aware, recognize Unicode whitespace boundaries, and scan URLs and trailing delimiters incrementally for large inputs.
## Testing
- Add coverage for wrapped and scrolled URLs, joined emoji, Unicode whitespace, preserved highlighting, masked input, cache invalidation, oversized destinations, and drafts containing many URLs.
GitOrigin-RevId: 40facdf2fe79438c91c82bff2d849c342f1ab28a
## What changed
- Read `x-codex-imagegen-request-id` from image generation and edit responses.
- Propagate the ID to `codex_image_generation_event` analytics.
- Keep the ID in process only, excluding it from extension item serialization, generated types, app-server wire data, and rollout history.
## Testing
- Cover response-header extraction and missing-header behavior in the images client.
- Verify end-to-end analytics emission and the unchanged image-generation item wire shape.
GitOrigin-RevId: 9b8e09b7d655c0c2faa84f0eee99aabae583668d
## Why
Users returning to a conversation need a short summary of its recent progress and next steps.
## What changed
- Generate a recap for eligible idle, unfocused conversations and add it to the transcript.
- Add `/recap` to request the same summary on demand, with visible progress and actionable errors.
- Keep recap requests bounded and isolated, reject stale results, and retry only automatic failures.
## Testing
- Cover automatic and manual generation, request eligibility, failure handling, loading-state cleanup, and temporary-thread configuration.
GitOrigin-RevId: 926a88d6996d67a42809ce2c4091b13fca882b52
## What changed
- Schedule recap eligibility checks when an unfocused thread changes, and cancel them when focus returns or recap state is replaced.
- Add bounded structured recap requests with stale-result rejection, normalized output, and one retry per turn revision.
- Harden temporary structured threads by reading the effective configuration and disabling all discovered MCP servers, tools, skills, and environment access.
## Testing
- Cover recap timers, focus changes, failed turns, output bounds, stale results, and retry behavior.
GitOrigin-RevId: eebf50059763928e9a2444b14d51648e0bdff4a8
## What changed
- Forward terminal focus changes through the TUI event stream and handle them across interactive screens.
- Track completed turns and recap eligibility across active, resumed, and switched threads.
- Add bounded recent-conversation prompt construction and a wrapping `Conversation recap` history cell.
- Cover focus timing, repeat eligibility, restored progress, UTF-8 prompt limits, and recap rendering with unit and snapshot tests.
GitOrigin-RevId: d7542c18b2bb1e72f5906f563898645bb526255f
## What changed
- Add the experimental `turn/start.cyberAccessProgram` option with `standard`,
`daybreakBlue`, and `daybreakRed` values.
- Forward the selection as `access_programs.cyber` on Responses, WebSocket,
and remote-compaction requests made with ChatGPT authentication, while
omitting it for API-key and custom-provider requests.
- Preserve the per-turn selection across recovery, compaction, and child-agent
turns without making it a persistent thread setting.
## Testing
- Cover app-server forwarding, authentication boundaries, WebSocket reuse,
turn recovery, compaction, and child-agent inheritance.
GitOrigin-RevId: d2eb468f365b2214c5099bc21741cf30f8bd2eb5
## What changed
- Add a feature-gated Amazon Bedrock option to eligible TUI sign-in flows.
- Discover existing AWS profiles and environment credentials, with manual setup for profiles, access keys, environment variables, and Bedrock API keys.
- Collect the AWS Region, mask secrets during entry, persist the selected Bedrock configuration through the app server, and restart the embedded server when the provider changes.
## Testing
- Cover wizard eligibility, sign-in option rendering, credential discovery ordering, region entry, and secret masking.
GitOrigin-RevId: 0a49afb6aca442b88e8448efa80336777848f4ac
## Why
Paginated thread history should be loaded incrementally through
`thread/turns/list` and `thread/items/list` instead of being fully reconstructed
in `thread.turns`.
## What changed
- Emit `deprecationNotice` when `thread/read`, `thread/resume`, or `thread/fork`
requests full history for a paginated thread.
- Direct clients to omit `includeTurns` for reads or use `excludeTurns: true` for
resumes and forks, then page history through the list APIs.
- Document the deprecation in the protocol schemas and app-server README.
## Testing
- Cover notices for paginated reads, cold and loaded resumes, and forks.
- Verify metadata-only requests, legacy threads, and rejected forks do not emit
the notice.
GitOrigin-RevId: 0d387b46d73608f90b7960120a54af4ef332e510
## What changed
- Report `Session archived: <thread-id>` after successfully archiving the current session.
- Show the session ID when no resume hint is available, including for non-fatal exits.
- Keep deleted-thread exits distinct from successful archive exits.
## Testing
- Add coverage for archive lifecycle handling and exit-message formatting.
GitOrigin-RevId: 1812374e4c74fa1b3f11feb323de18a9dbff745b
## What changed
- Add an optional `turnTrigger` field to app-server `turn/start` requests and
expose it in the generated protocol schemas.
- Propagate non-empty trigger values to Responses request metadata as the
reserved `turn_trigger` field, while preserving the original value when a
request steers an active turn.
- Classify turns started by queue dispatch, goal continuation, retry recovery,
and realtime handoff.
## Testing
- Cover HTTP and WebSocket metadata forwarding, steering behavior, reserved
metadata handling, and the built-in trigger classifications.
GitOrigin-RevId: c12fe2c522286db21b76081ae6154fbf6bfb3639
## Why
Stream animation ticks generated on a background thread can accumulate while the
TUI is busy, causing stale ticks to run after the animation stops or the chat
widget is replaced.
## What changed
- Replace the animation thread and `CommitTick` app event with a Tokio interval
owned by the foreground event loop.
- Delay missed ticks instead of replaying a burst, and let pending app events run
before animation work.
- Drop the interval when animation stops or the chat widget is replaced, while
preserving `CommitTick` session-log entries.
## Testing
Add a paused-time test covering stable pacing, missed ticks, restart behavior,
and chat-widget replacement.
GitOrigin-RevId: d0561d3f8962b5e05a728463e76aa8ec83cd5a31
## Why
Exiting a TUI connected to a persistent app server can leave work running, so
the existing session-exit summary does not explain how to reconnect or stop the
active turn.
## What changed
- Distinguish disconnects, interrupted turns, and removed threads when building
exit summaries.
- For daemon and remote sessions, report whether work may still be running and
print commands to reconnect or stop the current turn.
- Sanitize remote WebSocket addresses in displayed commands and preserve the
configured remote authentication environment-variable option.
- Keep the existing token-usage and resume summary for embedded sessions.
## Testing
Add coverage for daemon, remote, interrupted, embedded, archived, and deleted
session exits, including credential sanitization.
GitOrigin-RevId: 9cbbf9c7dd36423a5ed99909a2b4cb32e3e87712
## Why
Closed agent channels can retain stale in-progress turns, which can incorrectly
block `/cd` or cause unnecessary background-terminal checks.
## What changed
- Mark agents closed whenever a `thread/closed` notification is routed, including
for inactive event channels.
- Exclude closed agents from running-turn detection and background-terminal checks
during working-directory changes.
## Testing
Cover directory-change recovery with both a routed close notification and a
replay-only closed thread that contains a stale in-progress turn.
GitOrigin-RevId: 1072456056f8c1a1b751a52635470b0be160d76c
## Why
The active goal's elapsed-time label could become stale while the TUI was idle because it was refreshed only as part of a redraw.
## What changed
- Refresh the goal status indicator when the terminal-title timer fires.
- Request a redraw only when the displayed elapsed-time label changes.
## Testing
- Add a regression test covering the minute transition and confirming that an unchanged label does not trigger another redraw.
GitOrigin-RevId: f10a1c2334cf7a5f1d2ee90d7138114479998c8d
## Why
Terminal title animations only need to update the title, but each animation tick
previously requested a full TUI frame.
## What changed
- Track the next terminal title refresh deadline on `ChatWidget`.
- Have the foreground event loop refresh the title when that deadline expires.
- Clear the deadline when title animations are disabled or the configured title is
empty.
## Testing
- Verify spinner and action-required animations set the expected refresh deadlines.
- Verify refreshing an animated title does not enqueue a TUI draw request.
GitOrigin-RevId: 269347cd48de4ad9ba9a0aef9ed105c25d1a7dae
## What changed
- Add `serviceTierForTurn` to `turn/start` so a newly started turn can override the service tier without changing the thread's saved tier.
- Treat `"default"` as standard speed and omitted or `null` values as inheriting the thread tier.
- Keep `serviceTier` authoritative for subsequent turns when both fields are supplied, and ignore the turn-scoped override when steering an active turn.
## Testing
- Extend the app-server turn-start test to verify both the one-turn `"default"` override and inheritance on the following turn.
GitOrigin-RevId: 4c2c4db21d8d31617a7a6e6df65bf54834e72383
## Why
Windows Terminal and xterm.js can render a theme that differs from the
underlying console color table. Querying that visible theme through OSC shares
the console input queue with keystrokes, including input for security-sensitive
startup prompts.
## What changed
- Defer the Windows OSC color probe until protected startup decisions and the
world-writable workspace scan have completed.
- Preserve and replay unrelated console input records around the probe, while
removing only valid OSC 10 and 11 replies and retaining the console palette
as a fallback.
- Require an explicit confirmation key after shortcuts select trust, sandbox,
or world-writable warning choices, so a fragmented terminal reply cannot
accept them.
- Accept one- through four-digit OSC RGB components so the visible terminal
palette is applied across supported response formats.
## Testing
Added coverage for delayed startup scans, protected prompt confirmation,
console-record replay, bracketed paste and malformed OSC preservation, RGB
response parsing, and light-theme composer rendering.
GitOrigin-RevId: b8ae456fe32c701ba3af31e9cc452fc4e8bffa22
## What changed
- Record collaboration tool analytics for `send_message`, `followup_task`,
`interrupt_agent`, and `list_agents`, including receiver attribution, duration,
failures, and interrupted calls.
- Include these calls in per-turn subagent tool counts while keeping the existing
`subAgentActivity` output unchanged and omitting additional public collaborator
tool items.
- Extend the collaboration tool schemas with the new tool variants and the
`interrupted` terminal status.
## Testing
- Add an app-server integration test covering successful and failed calls,
receiver attribution, duration, prompt omission, activity items, and turn
counts.
GitOrigin-RevId: e73eaa05c508261e5fc97e7d08d7881a31e04e22
## What changed
- Add Windows sandbox mode, private-desktop behavior, and legacy Landlock selection to each `EnvironmentConfig`.
- Centralize sandbox context construction on `TurnEnvironment`, preserving environment-owned permissions, paths, and backend settings while applying additional permission grants.
- Use the environment-derived context for project instructions, capability discovery, file uploads, and filesystem-oriented tools.
## Testing
- Verify capability discovery uses the selected environment's permission profile and sandbox backends when they differ from the thread defaults.
GitOrigin-RevId: 7ae2fed90c8ada950f2e8431e571e9b2c793c291
## What changed
- Add a `writeStdin` Guardian action carrying the approval, process, input, and working-directory details.
- Distinguish `command` and `writeStdin` execution approval requests while defaulting missing kinds to `command` for compatibility with older events.
- Render terminal-input review progress, denials, timeouts, and retry actions in the TUI, and record the action separately in analytics.
- Keep terminal-input reviews as child approvals so they do not change the parent command item's lifecycle or reconstructed history.
## Testing
- Cover Guardian serialization, app-server protocol conversion, command history reconstruction, analytics classification, and TUI review flows for terminal input.
GitOrigin-RevId: b083d5e2963bdd23b928644ec03c7eb68ebf2950
## What changed
- Bind `.` in Vim normal mode to repeat the last complete edit.
- Record semantic delete, change, replace, paste, and insert-mode actions so repeats preserve motions, text objects, inserted text, and editor actions across keymap changes.
- Expose `vim_normal.repeat_last_change` in the configurable keymap and keymap picker, including conflict handling for existing custom bindings.
## Testing
- Add coverage for repeating deletes, replacements, complete changes, pasted and literal text, insert-mode editor actions, custom bindings, unavailable motions, and cleared buffers.
GitOrigin-RevId: 3213df964811e7902377ff1d93641e59f4037914
## What changed
- Add an `Interrupt` hook event that runs for an active top-level turn before its
interrupted abort event is emitted.
- Flush the turn transcript before invoking the hook and provide the session,
turn, transcript, working directory, model, and permission mode in its input.
- Support command and MCP handlers, including asynchronous commands, with a
one-second default timeout and a three-second maximum.
- Expose the event through hook configuration, managed requirements, app-server
notifications, generated schemas, analytics, and the TUI hook views.
## Testing
- Cover handler discovery, timeout normalization, output parsing, protocol
compatibility, TUI rendering, and interrupt execution ordering.
GitOrigin-RevId: 163fa7c098d94ac2775f6d137f8e916f8ea9b6eb
## Why
Clients need a bounded view of realtime conversations that preserves the order of speech, agent work, and turn lifecycle events without loading the full thread history.
## What changed
- Persist realtime session boundaries, transcript segments, and promoted agent items in paginated thread rollouts.
- Add the experimental `thread/timeline/list` API to page ordinary items, realtime items, and turn boundaries in canonical rollout order. Include `activeRealtimeSessionAtPageStart` so each page can be rendered independently.
- Emit typed `thread/realtime/item/started`, `thread/realtime/item/transcript/delta`, and `thread/realtime/item/completed` notifications around durable realtime items.
- Keep the existing `thread/items/list` response and legacy thread history behavior unchanged.
## Testing
- Cover mixed timeline pagination, realtime-session state at page boundaries, rollout replay, subagent history prefixes, transcript streaming, steering, and promoted agent artifacts.
GitOrigin-RevId: faa2c420192d63e060e8fb32446e3c797422656e
## What changed
- Send `Free`, `Go`, `Plus`, `Pro`, and `ProLite` ChatGPT users to the individual Trusted Access page when a cybersecurity policy error ends a turn.
- Keep the enterprise Trusted Access application for other plans and sessions without a ChatGPT account or known plan.
## Testing
- Cover individual and enterprise link selection in chat widget tests and history-cell snapshots.
GitOrigin-RevId: a563560d15c401b47f1865a6f58ea4692d31d457
## What changed
- Render AGENTS.md paths under the home directory with `~` in `/status`.
- Preserve project-relative paths for instruction files inside or above the current working directory.
## Testing
- Add coverage for home-relative, parent, current-directory, and nested AGENTS.md paths.
GitOrigin-RevId: 6dd1ddf481d95dda9d16f7c03a7431d1297f87ec
## Why
Unified `@` search could show a plugin alongside the skills it owns, creating duplicate entry points for the same capability.
## What changed
- Add a nullable `pluginId` to `SkillMetadata` returned by `skills/list` so clients can associate skills with their owning plugin without inspecting names or paths.
- Hide a plugin's owned skills from unified `@` results when that plugin is present, while retaining standalone skills and skills with unknown ownership.
- Keep `$` focused on individual skills and apps, and use it consistently as the skills-list shortcut. Preserve the legacy mention behavior when `mentions_v2` is disabled.
## Testing
- Cover plugin ownership in `skills/list` and the updated `@` and `$` composer results.
GitOrigin-RevId: e168cdff8d0c58f74ce4c228a683880a3167775b
## What changed
- Generate a title suggestion from the latest substantive user and assistant messages when the TUI `/rename` prompt opens.
- Prefill the prompt with the result while keeping it editable and preserving any text the user enters before generation finishes.
- Bound and escape the conversation context, omit commentary and IDE context, and correlate responses with the active thread and prompt so stale suggestions are ignored.
## Testing
- Cover conversation selection and prompt construction, generated-title delivery through the embedded app server, loading and prefilled prompt states, stale responses, and preservation of manual edits.
GitOrigin-RevId: 1e7f1d5d4f6503ff9da0548388f610c446c130ca
## What changed
- Ignore `thread/started` notifications for ephemeral threads whose feature source is `system`, preventing hidden helper threads from entering TUI thread routing or refreshing the agents overview.
- Continue routing persisted system threads normally.
## Testing
- Add coverage for hidden and persisted system-thread notifications in the agents overview.
- Add generated-title normalization cases for wrapping quotes, trailing punctuation, and meaningful leading punctuation.
GitOrigin-RevId: e1ea48502b4f9aa7d5a187c7407df69c55abe2a9
## What changed
- Give unnamed TUI threads an immediate provisional title from the first user message, then replace it asynchronously with a normalized generated title.
- Preserve manual renames by applying a generated title only while the provisional title is still current, and keep automatic rename notifications out of the transcript.
- Run title generation in a bounded ephemeral structured request that preserves custom permission profiles, otherwise uses read-only access, and disables tools and MCP servers.
## Testing
- Cover prompt and response bounds, Unicode-safe truncation, title normalization, manual-rename races, silent automatic updates, permission preservation, and structured-response failures.
GitOrigin-RevId: 7ed73522f4f6c65a005f65f3a903974d8419e312
## What changed
- Add the experimental `amazonBedrockAccessKeys` app-server login flow, persist its credentials in the configured auth store, and use them for SigV4-signed Bedrock requests.
- Report `bedrockAccessKeys` as a distinct auth mode and document access-key login alongside AWS profile and environment credential setup.
- Clear the selected Bedrock provider, AWS settings, and Bedrock-specific model on logout while leaving external AWS credentials and `.env` untouched.
- Reject managed access-key login when higher-precedence configuration would prevent its region or profile settings from taking effect.
## Testing
- Cover access-key login, storage, request signing, configuration conflicts, status reporting, and logout cleanup.
GitOrigin-RevId: bbf297887c6503d3651ceb2aad85c4d626e32723
## Why
Multi-Agent V2 children are owned by their parent at runtime. Resuming an
unloaded child directly could rebuild it from caller-provided settings instead
of the parent's current authority.
## What changed
- Route child reloads through their loaded immediate parent and reject direct
cold resume when that parent is unavailable.
- Preserve the child's recorded model, provider, reasoning effort, and role
while inheriting the parent's execution policy and MCP extensions.
- Validate cached environments against the parent, intersect local permission
profiles, and reject stale remote or workspace-root configurations.
- Keep paginated cold-resume token usage attribution when attaching to the
reloaded child.
## Testing
Add coverage for owner validation, nested-parent reloads, permission and
environment changes, role instruction restoration, paginated usage replay,
and app-server child resume behavior.
GitOrigin-RevId: 84014762bcdb57f94fc23974c9c1af55dc1babf1
## What changed
- Render web-link labels in cyan with an underline and hide the repeated destination in recognized terminals with hyperlink support.
- Keep destinations visible for unknown terminals, multiplexers, non-terminal output, and empty labels so the URL remains usable.
- Preserve OSC 8 link targets through prose and table wrapping, streaming updates, transcript clipping, and pager scrolling.
## Testing
- Add coverage for terminal detection, label formatting and fallbacks, wrapped tables and prose, streaming parity, history output, and scrolled transcript rendering.
GitOrigin-RevId: 4a09e41e349ba299022a9c00f0c25892d9aaefe3
## Why
A Multi-Agent V2 child can finish after the parent turn that spawned it, so its
successful completion needs to remain associated with that parent turn in
notifications and history.
## What changed
- Add `completed` to `SubAgentActivityKind` and emit the corresponding started
and completed item events on the spawning parent turn when a child succeeds.
- Persist completed activity as a canonical turn item in both legacy and
paginated history, and expose it through app-server history and schemas.
- Render completed activity as terminal in the TUI without counting it as a
separate tool call or tool-runtime event.
## Testing
- Cover successful completion in legacy and paginated history, late updates to
completed parent turns, TUI rendering, analytics, and rollout tracing.
- Verify that terminal child errors do not emit completed activity.
GitOrigin-RevId: 6c71eb8b10e7327611c6af84f70e294e27d94d02
## What changed
- Include matching Codex tasks in the `@` mention popup when the active thread supports task tools, prioritizing tasks from the current working directory.
- Submit selected tasks as bounded live thread references so Codex can load their contents with `read_thread`.
- Preserve task mentions across composer history and thread start, resume, and fork flows.
## Testing
- Add coverage for task search and capability propagation, popup selection and rendering, submission encoding, history round-trips, and reference validation and limits.
GitOrigin-RevId: 17502be91bf6d4b01745668829eb69fb318cb5b9
## Why
The TUI rejected app-server dynamic tool calls as unsupported, so agents could
not inspect or manage other Codex tasks through a TUI session.
## What changed
- Add the `codex_tui` tool namespace for listing, reading, waiting on, creating,
forking, messaging, renaming, archiving, and restoring tasks.
- Handle tool calls through existing app-server thread operations, with bounded
inputs and responses and cleanup when calls complete or the TUI disconnects.
- Route delegation tools through an authenticated local MCP server with explicit
approval prompts, while respecting configured and managed MCP policies.
- Fall back to starting threads without dynamic tools when connected to an older
app server that does not support them.
## Testing
Add coverage for tool schemas and response bounds, task lifecycle operations,
approval-gated MCP transport, namespace dispatch, cancellation, and legacy
app-server fallback behavior.
GitOrigin-RevId: c782c11f0a3edceb3fa6909a4b92d6ce01a6eed3
## What changed
- Show `SelfServeBusinessProLite` as `Business Premium` in TUI account displays instead of grouping it under `Business`.
- Update the display-name and app-server session tests for the new label.
GitOrigin-RevId: aac5c7abe9543f5d49f4e9dc9cbe20e7e3b41e5b
## What changed
- Recognize `cua_repl` alongside `node_repl` when collecting Guardian review evidence, applying computer-use policy, and capturing transcript images.
- Render `cua_repl.js` results with the compact REPL history and transcript views.
- Preserve failed MCP call status and result content when replaying app-server history.
## Testing
- Cover both REPL server names across Guardian policy, evidence, image capture, history rendering, and failed-call replay tests.
GitOrigin-RevId: 8c13a721f718add403b07e727c1634b59203c51a
## What changed
- Keep the normal composer footer visible when a draft contains the word `plan`.
- Remove the contextual “Create a plan?” prompt, its Escape dismissal behavior, and its per-thread dismissal state.
## Testing
- Update wide and narrow composer snapshots to cover the standard footer for plan-related drafts.
GitOrigin-RevId: 1a3c8cfce9d4effa2149790975133f652aa7c914
## What changed
- Cover live and replayed patch approvals recovering their file changes for the full-screen pager.
- Verify scrolling, resizing, dismissing and reopening the pager, and accepting or canceling a request exactly once.
- Document why approval requests recover diff contents from the matching stored item.
GitOrigin-RevId: 0b1ef25998aa466409ea79731e2c913a6d42388a
## Why
Showing the cursor before moving it can briefly expose it at its previous
position during a draw.
## What changed
Reorder terminal cursor updates so the cursor is positioned before it is made
visible.
## Testing
Add a regression test that verifies the cursor move escape sequence is emitted
before the show-cursor sequence.
GitOrigin-RevId: 2df277ba315bef4a7a56c11ecb78fcd52c354ac5
## Why
MCP inventory can be cached or collected separately from a thread's live
connections, so tool availability alone does not describe the current runtime
state.
## What changed
- Add a nullable `runtimeStatus` to `mcpServerStatus/list` for thread-scoped
requests, covering not-started, starting, connected, authentication-required,
failed, cancelled, and disabled connections.
- Observe published connection state without starting or reconnecting servers,
and return an unknown status when no thread is supplied or the active
configuration no longer matches the published registration.
- Show connection state and tool counts in the compact `/mcp` view while
retaining the detailed inventory in `/mcp verbose` and compatibility with
servers that omit `runtimeStatus`.
## Testing
- Cover runtime status transitions, deferred and disabled servers, closed
transports, configuration changes, protocol compatibility, and TUI rendering.
GitOrigin-RevId: e3bb6efe652f0fa8b3c97d5c53e4729b3a87cd91
## Why
The `fast-mode` status item showed `Fast off` even when the selected model did not support Fast mode.
## What changed
- Hide the Fast mode status value when the current model is known not to support Fast mode.
- Continue showing the value for supported and uncatalogued models.
## Testing
- Cover visibility updates when switching among supported, unsupported, and uncatalogued models.
- Update the footer snapshot to verify that an unsupported model omits the Fast mode value.
GitOrigin-RevId: c297655189efc719b2097c2aa415029b01d6873e
## What changed
- Open a picker for `/copy` with the whole response plus each fenced code block and blockquote from the latest response.
- Label code blocks by language, show content previews, and preserve source whitespace and nested quote Markdown when copying an individual target.
- Keep the picker from disturbing terminal scrollback or queued input, retain clipboard leases, and avoid writing copied content to the session log.
## Testing
- Add coverage for target extraction, picker navigation and cancellation, exact copied content, plan responses, queued input, scrollback preservation, clipboard failures, and session logging.
GitOrigin-RevId: 77a35bc99f4f45932d39914f9a709b30fe8cd7c2
## What changed
- Add a top-level `allow_browser_and_computer_use` requirement.
- Support browser requirements for history access, automatic review, persistent approvals, and default or per-origin access policies.
- Support computer-use requirements for persistent approvals, default app access, macOS bundle IDs, Windows AUMIDs, and Windows executables.
- Preserve these settings and their sources when composing layered requirements.
## Testing
- Cover deserialization, empty-value detection, source propagation, and layered TOML merging for the new requirements.
GitOrigin-RevId: d14a10b64465f1c54e9bcc3795dc93031e6b029b
## What changed
- Use one binding-aware description for each keymap action instead of swapping
in separate text for the selected item.
- Keep the action menu content unchanged as the selection moves between items.
- Update key and key-chord replacement descriptions to name the affected
binding directly.
## Testing
- Extend the keymap action menu test to move through every item and verify that
the rendered picker remains unchanged.
GitOrigin-RevId: bbd2bd08ca444c76c28c5213ae077ad85bc50f27
## Why
Draining every queued active-thread event in one foreground pass can overrun the
frame budget. Buffered thread events can also race ahead of queued replay and
startup app events, causing the TUI to switch views before the corresponding
history and operations have been applied.
## What changed
- Bound active-thread draining to one target frame interval and leave remaining
notifications queued for a later frame.
- Prioritize queued app events over active-thread events so replay state is
applied before buffered closures or other thread notifications.
- Block startup input only for pending requests, rather than ordinary queued
notifications whose draining yielded at the frame deadline.
- Leave selected side-thread closure handling to the foreground event loop.
## Testing
Added tests covering deadline-limited notification draining and foreground
handling of a selected side thread closing.
GitOrigin-RevId: 41080d3df13ca308eec1ea0fbb0ba067a4640c4c
## What changed
- Add unbound `previous_permission_mode` and `next_permission_mode` actions to
`tui.keymap.chat` so users can configure shortcuts that cycle through the
available built-in permission modes.
- Apply shortcut selections only to the active session, without writing them
to `config.toml`, and report update failures in the transcript.
- Exclude modes disallowed by managed requirements or platform safety checks,
reject printable-key bindings, and ignore these bindings in project config.
## Testing
- Cover mode cycling, unavailable modes, session-only updates, server errors,
stale threads, keymap validation, and project-config sanitization.
GitOrigin-RevId: c3cfdf1e732b7b7bfe8f53fcac19a37e593bbfab
## Why
`codex agents` rejected invocation-specific configuration, preventing the
dashboard from applying settings when starting a shared thread.
## What changed
- Accept interactive options such as model, approval, sandbox, search, working
directory, and configuration overrides when opening the agents dashboard.
- Forward supported session-flag configuration into threads started through an
embedded or remote app server, while excluding unrelated values.
- Continue to reject initial prompts and images, along with local provider and
additional-directory settings that cannot be applied to a remote server.
## Testing
- Cover accepted dashboard options and rejected incompatible inputs.
- Verify that explicit feature and sandbox overrides reach shared threads in
both embedded and remote modes.
GitOrigin-RevId: f10aa1e16ff62b49d55679e987d9e458438ba3f8
## Why
Pending input previews display at most three wrapped rows, but previously wrapped every logical line before truncating the result. This made rendering do unnecessary work for very large multiline inputs.
## What changed
Limit pending steers, rejected steers, and queued follow-up inputs to four source lines before wrapping: three for the preview and one to detect overflow and render the ellipsis.
## Testing
Keep multiline preview coverage for queued messages and pending steers, including blank lines near the truncation boundary.
GitOrigin-RevId: 4c300b13532983ff9c3bdfbd62d6ca722ea3a5aa
## What changed
- Add `hostname` as a selectable status-line item and show it in setup previews.
- Read the normalized operating-system hostname without triggering DNS resolution, and omit the item when no hostname is available.
## Testing
- Cover hostname normalization, status-line rendering, and setup and surface previews.
GitOrigin-RevId: c5e4e0ee1dba6e4bfdf942562a6b037835ff9e69
Charlie Marsh