## What changed
- Add the under-development `features.context_management.experimental_mode` configuration and schema.
- For eligible ChatGPT Plus, Pro, and Pro Lite sessions using the Codex backend, enable token-budget context, history notes, and the `new_context` tool when experimental context management is configured.
- Keep the feature disabled for custom providers, provider credentials, non-Codex endpoints, and temporary structured threads.
## Testing
- Cover subscription eligibility, backend restrictions, configuration resolution, token-budget guidance, and temporary-thread overrides.
GitOrigin-RevId: 19402af19c4d69e09a7cdb3687ee7d233f6a562a
(cherry picked from commit cff76fa96f)
## What changed
- Replace `send_user_message_async` with `request_user_input_async`, accepting one or more questions with optional suggested answers while allowing the turn to continue.
- Attach structured question metadata to asynchronous agent messages while retaining readable fallback text, and preserve it through app-server events, thread history, and generated schemas.
- Continue enabling the new tool for model catalogs that advertise either the old or new tool name.
## Testing
- Cover tool registration, question validation, emitted items, continued turn execution, history preservation, and backwards-compatible deserialization.
GitOrigin-RevId: ffc49aebde2e854c3c50a122aa52805fec3fc6b3
## What changed
- Parse `experimental_network.header_injections` rules with host, method, path-prefix, and header mappings and carry them into `NetworkConstraints`.
- Export the rule type from `codex_config`.
- Summarize configured rule counts and hosts in the TUI debug configuration without exposing header values.
## Testing
- Cover managed configuration parsing and redaction of header values from debug output.
GitOrigin-RevId: 623b047e6c6111a9f2ccbe79c9ace054631a3c67
## What changed
- Add nullable `model` and `reasoningEffort` fields to the shared app-server `Thread` object and generated schemas.
- Report current settings for loaded threads and the latest persisted settings for unloaded threads across thread read, list, start, resume, rollback, metadata update, and notification paths.
- Keep unavailable legacy or filesystem-only settings nullable, and allow metadata reads without loading a thread or dispatching queued work.
## Testing
- Cover live-setting precedence, persisted settings after restart, null legacy values, and model metadata returned by thread lifecycle operations.
GitOrigin-RevId: 22ebe8a8d1910a820d90a97730d812a00d8c1372
## What changed
- Warn Plus and Team users when they have less than 50% of an approximately five-hour usage window remaining.
- Preserve the existing 75%, 90%, and 95% usage thresholds for other plans and window lengths.
- Continue deduplicating warnings across rolling rate-limit updates.
## Testing
- Cover eligible and ineligible plan and window combinations, retained plan metadata, and warning deduplication.
GitOrigin-RevId: b221def052b979c91490e7878829db2478c6e264
## What changed
- Add a bounded redo stack for complete composer drafts, including paste payloads and image attachments. `Ctrl+R` now reapplies the last undone edit in Vim normal mode, while new edits clear stale redo history.
- Add the configurable `vim_normal.redo` action to the keymap schema and picker. Preserve reverse prompt-history search in Vim insert mode and non-Vim mode, and honor explicitly configured bindings.
- Keep pending edit snapshots outside the shared undo/redo byte budget so canceled commands cannot evict committed history.
## Testing
- Cover grouped edits, Vim searches, direct draft changes, history limits, empty redo stacks, and custom or unbound shortcuts.
GitOrigin-RevId: 0cf5bb376ff865ddc0a77705dcb322ef6b57b3a3
## What changed
- Render descriptive Markdown labels alongside canonical local file targets instead of discarding them.
- Collapse labels that resolve to the same path, accounting for relative and absolute forms, `file://` URLs, percent encoding, case, separators, and location suffixes.
- Preserve `~/` destinations for display and keep absolute paths unless they can be shortened relative to the session working directory.
## Testing
- Add unit and snapshot coverage for descriptive and path-equivalent labels, invalid percent encoding, trailing separators, Unix and Windows paths, UNC paths, `file://` URLs, and table wrapping.
GitOrigin-RevId: 636bf4485b2899d96c6273be3f3b7f38728c9013
## What changed
- Show revealed running hooks in the bottom activity area instead of the conversation viewport or transcript overlay. Fold the hook message into the active status row when space permits and reflow it below the row without displacing background-process controls or status details.
- Keep fast hooks hidden, collapse concurrent hooks to a shared summary when needed, and support hook activity outside an active agent turn.
- Simplify durable hook output into user-facing messages and actionable failure, block, and stop states. Suppress model-facing context and quiet successful completions from all TUI history surfaces.
## Testing
- Add lifecycle, layout, narrow-width, multi-width Unicode, transcript, restart, and completion-output coverage for hook status and history rendering.
GitOrigin-RevId: 4c52b7a736e9e466e109107eb3c04a39d089597f
## What changed
- Render complete patch contents directly in TUI history cells.
- Render all input sent to background terminals inline.
- Remove the preview row and byte limits and their transcript hints so inline and transcript views contain the same content.
## Testing
Update snapshots to cover patches and terminal input longer than the former 12-row preview limit.
GitOrigin-RevId: 9960818a9b51fc0c7f84d9def77b9b1bd8acad6c
## Why
The agent command center only listed sessions currently loaded by the app server, so completed or otherwise unloaded tasks could not be revisited from the overview.
## What changed
- Seed the overview with up to 20 recent root sessions in addition to loaded sessions, retain discovered sessions for the lifetime of the TUI, and update rows from thread lifecycle notifications.
- Allow unloaded sessions to be resumed from the overview using the normal working-directory selection and configuration rebuild flow. Explicit runtime permission choices carry across a cold resume, while settings inherited from the previously selected task do not.
- Fall back from `recency_at` to `updated_at` when connected to an older server, and continue showing loaded sessions when recent-history listing is unavailable.
## Testing
Added coverage for recent-session discovery and retention, notification races, legacy and failed listing fallbacks, cold-resume working-directory and permission handling, reconnect behavior, and unloaded-session rendering and selection.
GitOrigin-RevId: 668068b1594eb24b2ea7faccd0327804b8cd22ef
## Why
Vite+ launches Codex through the same JavaScript shim as npm, so Codex could
misidentify Vite+-owned installations and recommend npm for updates.
## What changed
- Detect Vite+ global installs from their package ownership metadata and pass a
dedicated `CODEX_MANAGED_BY_VITE_PLUS` marker to the native binary.
- Represent Vite+ in install context and `codex doctor` output.
- Recommend `vp install -g @openai/codex` in update and repair flows for
Vite+-managed installs.
See https://github.com/openai/codex/pull/30880.
GitOrigin-RevId: 8add724eefd31170a078086392609dbbd7f20b26
## Why
Guardian review evidence must remain available after a compacted thread is resumed or forked, while rolled-back or parent-local evidence must not grant authorization in a different context.
## What changed
- Store the bounded, model-invisible Guardian transcript alongside compacted rollout history and restore it from the newest surviving checkpoint during replay.
- Trim Guardian history at rollback boundaries, clearing it when the boundary has already been evicted.
- Preserve the checkpoint for user-initiated forks, but remove it when spawning a subagent so parent review evidence is not inherited.
- Keep the new rollout field optional for compatibility with existing compacted records and legacy readers.
## Testing
- Cover Guardian history across compaction, restart, paginated and pathless stores, user forks, rollback, bounded replay, serialization, and subagent forks.
GitOrigin-RevId: 6ab076d5e0c3aac4d6a41ebd50ba2b200c90213e
## What changed
Emit the `codex.tui.start` counter once per TUI launch with an
`app_server_mode` label of `in_process`, `local_daemon`, or `remote`. Recording
the metric during startup keeps reconnects from counting as additional
launches.
GitOrigin-RevId: 7527f319b95ae53f5278fa16120120a433a29ae4
## Why
Composer drafts include attachments, mention targets, and deferred paste payloads in addition to visible text. Vim undo needs to restore that complete state as a single edit.
## What changed
- Add bounded, draft-level Vim undo history, with `u` as the configurable default binding in normal mode.
- Group complete Vim commands and insert sessions into undo steps, including direct composer changes such as pastes and attachments.
- Preserve undo, repeat, and search state when a reverse-history preview is canceled, and start fresh history when another prompt is accepted.
## Testing
- Cover grouped edits, custom bindings, history and search interactions, attachments, and large paste payloads.
GitOrigin-RevId: 12ecdb3c34a2d66f5d856aa2f82dc15bd91b230b
## Why
Moving between prompts in backtrack mode rebuilt every transcript renderable and
discarded their cached heights, causing the entire transcript to be laid out
again for each selection change.
## What changed
Rerender only the previously highlighted cell and the newly highlighted cell.
Keep all other renderables, cached heights, and the live tail intact while
continuing to scroll the selected prompt into view.
## Testing
Add regression tests that verify selection changes preserve unrelated height
caches and produce the same viewport and scroll position as a full rebuild,
including with a live tail and terminal width changes.
GitOrigin-RevId: 685a8ce65ecadef20521ce2ded7b516fdf8499c9
## What changed
- Show the exact `codex resume <thread-id>` command on its own indented line.
- When a thread has a name, also explain that users can run `codex resume` and select the named thread from the picker.
- Apply command highlighting to both resume options when color is enabled.
## Testing
- Cover unnamed, empty-name, named, colored, and embedded-session exit summaries.
GitOrigin-RevId: d97c04db8a34376c6d9ea839b515b04a384b85d1
## Why
Large input sent to a background terminal can require excessive wrapping work and fill the inline history view.
## What changed
- Limit inline input previews to 12 rendered rows and bound preview processing to 64 KiB.
- Show a transcript hint when input is omitted, while preserving the complete input in transcript and raw views.
- Keep URLs intact when they fit and truncate only the final overflowing line when needed.
## Testing
Add regression coverage for long wrapped input, narrow viewports, zero-width Unicode payloads, URLs, and inputs that fit within the preview budget.
GitOrigin-RevId: c20edf156d5c8364083b1690e41cabd29786a279
## What changed
Dispatch `AppEvent::OpenAgentsOverview` in the daemon reconnect navigation test instead of simulating the Alt+A keyboard shortcut.
GitOrigin-RevId: 99729a39496ffb96747f6d0c4be0edf52d1ef3f6
## What changed
- Exercise Rust source discovery through a mocked `git ls-files` call, including files outside `codex-rs`, paths containing spaces, and stale entries that no longer exist.
- Assert that the formatter invokes `rustfmt` from `codex-rs` with the repository configuration in both format and check modes.
- Keep the multiline argument-comment lint fixture stable under formatting and update affected Rust test files to the expected style.
GitOrigin-RevId: 0cfffde1bb91bf620d2118bed1efc68466c0cca6
## What changed
- Start the composer in Vim Insert mode when Vim is enabled and return to
Insert mode after submissions and slash-command dispatch.
- Record the fresh Insert session as a Vim edit so `.` can repeat text entered
in a new draft.
- Keep `/` and `?` as Normal-mode composer searches, and let Backspace cancel
an empty search query and any pending operator without changing the draft.
## Testing
- Add coverage for startup, submitted and queued drafts, inline and goal slash
commands, repeatable edits, and canceled searches.
GitOrigin-RevId: 1a5ee30c44685d2b2a037e46c3ab4ab611024919
## What changed
- Keep the agent command center visible with its cached inventory and draft while reconnecting, then refresh it without losing the selected task.
- Allow cached, unavailable conversations to reattach when selected while preserving their drafts, recap progress, and runtime permissions.
- Report an unsubmitted rename when its target disappears during refresh, and continue to quarantine queued input instead of resending it automatically.
## Testing
- Add a Unix socket replacement test covering command-center recovery with and without an active conversation, failed reconnects, inventory changes, and subsequent live task input.
GitOrigin-RevId: 774aca2dfb8358e9abd6a2e2ef0d509646648f66
## What changed
- Open the agents overview with Left from an empty, focused composer in local-daemon sessions.
- Keep the shortcut inactive while editing text, using transient input surfaces, or when Left has been explicitly remapped.
- Show the contextual shortcut in the footer and shortcuts overlay.
- Leave the configurable `open_agents` action unbound by default instead of assigning `Alt+A`.
## Testing
- Add coverage for session eligibility, input-state guards, editor and Vim remaps, event dispatch, and footer rendering.
GitOrigin-RevId: ef17db3d9d09c3a08c3f7353c5b8a02f2b61c696
## What changed
- Reconnect out-of-process TUI sessions after the app-server transport drops, bootstrap a fresh client, and resume the active thread.
- Preserve cached transcripts, drafts, runtime settings, task-tool capabilities, and live notification routing across the new connection.
- Keep recovered or possibly submitted input paused for manual review instead of resending it, and leave conversations that cannot be resumed available as read-only cached views.
- Show reconnect progress and actionable failure states while still allowing drafts to be edited or copied.
## Testing
- Add app-level coverage for successful recovery, failed and unavailable resumes, input quarantine, and preserved session state.
- Extend the terminal integration test to verify that a draft survives reconnection, the thread is resumed without starting a turn, and notifications arrive through the replacement connection.
GitOrigin-RevId: 5dcb867c89e226a0c545d6313a77424c233cd47a
## Why
Streaming can temporarily hide the status row, but its elapsed time is still
needed when the row returns and when the final `Worked for` duration falls back
to the local clock. Approval prompts must also keep that clock paused.
## What changed
- Own the pause-aware status timer in the bottom pane independently of the
optional status row.
- Preserve elapsed time and modal pause state while hiding or restoring the row,
and reset the clock for new turns and Windows sandbox setup.
- Use the independent timer as the fallback for the final turn duration.
## Testing
Add timer unit coverage and TUI tests for hidden rows, outstanding approvals,
fallback turn durations, and fresh Windows sandbox setup clocks.
GitOrigin-RevId: a77931e465d5aedd4a8cd606a3a3117d1bb37ce7
## Why
Resumed threads need to continue per-turn and per-thread token totals without scanning arbitrarily far beyond the latest compaction checkpoint.
## What changed
- Add durable `TokenUsageRecord` rollout items with response, turn, thread, session, and root-turn attribution.
- Restore accumulated usage on resume and snapshot the latest record plus the compaction response ID in compaction checkpoints.
- Preserve root-turn lineage in persisted turn context, while ensuring forked child threads start with their own usage totals.
## Testing
- Cover usage accumulation across multiple responses and resumed turns.
- Cover local and remote compaction checkpoints, invalid remote compaction output, rollout reconstruction, and fork isolation.
GitOrigin-RevId: ef9e0c4a9102a08a2c382be4cdac68c84353c90a
## Why
Losing an external app-server connection can leave a submission's outcome uncertain. The TUI must preserve local work without retrying it or allowing stale server events to trigger more actions.
## What changed
- Enter an offline state when an external app-server transport disconnects during startup, event streaming, or submission.
- Keep conversation drafts, queued input, expanded pastes, attachments, and agent-overview input editable while blocking submissions, remote actions, and automatic queue replay.
- Show a connection-lost notice that directs users to copy their work and relaunch, while retaining `Ctrl-C` and an empty-composer `Ctrl-D` as quit shortcuts.
- Cancel pending views and asynchronous work, and ignore stale completions after the disconnect. Embedded app-server behavior is unchanged.
## Testing
Added unit, snapshot, and pseudo-terminal coverage for lost startup and mutation replies, offline draft editing, queued-input recovery, stale-event quarantine, agent-overview behavior, and end-to-end preservation without reconnection or resubmission.
GitOrigin-RevId: 7219a95fad676dda447d625db9e465345b469d58
## What changed
- Emit a separate history cell for each completed command instead of grouping
consecutive successes into a `Ran N commands` summary.
- Preserve `Explored` grouping for related file reads, searches, and listings.
- Replay completed commands as individual entries so their output and failure
status remain visible.
## Testing
- Update TUI tests and snapshots for live exploration and replayed commands.
GitOrigin-RevId: 7dafe0b7846fc89784093791a6be137a1b1ab8ff
## What changed
- Carry optional backend-owned banner and account identity data through
`account/rateLimits/read`, filtering banners that do not match the authenticated
account and user.
- Render supported rate-limit notices above the composer with actions for usage,
credits, resets, owner notifications, and plan management while preserving the
existing fallback UI for absent or unsupported banners.
- Refresh usage after limit errors, reject stale responses, and keep queued input
paused until recovery completes. When instructed by the banner, switch to the
first available fallback model without changing unrelated thread settings.
## Testing
- Add protocol, banner parsing and rendering, CTA, identity filtering, refresh
ordering, fallback-model, account-change, and queued-input recovery coverage.
GitOrigin-RevId: e03d75a82e425deb87f4b120a71cf2286c0ef6cc
## Why
Older JediTerm versions can print the space intermediate in `DECSCUSR`,
overwriting the glyph beneath a cursor-style command.
## What changed
- Apply cursor-style commands at a repairable, terminal-owned glyph and redraw
that glyph with its original style and hyperlink before restoring the requested
cursor position.
- Omit the style command when the viewport has no safe repair anchor.
- Handle skipped cells, wide glyphs, and single-column viewports without
corrupting content or causing scrolling.
## Testing
Add cursor rendering tests for styled and cursor-only frames, skipped and wide
hyperlinked glyphs, single-column viewports, and viewports without owned cells.
GitOrigin-RevId: c8bbb74c53737b5980c533859af39da26f0e06cc
## What changed
- Relocate Vim history-navigation tests alongside the history search implementation.
- Share the human-like typing test helper with the nested test module.
GitOrigin-RevId: e2d03a173d2f3b73cf9f0c30411284a47f623838
## What changed
- Add draft-local forward and backward literal search with `/` and `?`, plus
wrapped repeat navigation with `n` and `N`.
- Support search motions after delete, change, and yank operators, while keeping
queries separate from the draft and skipping atomic elements and partial
grapheme matches.
- Render and edit the query in the composer footer, highlight matches, and add
configurable `tui.keymap.vim_search` bindings to the keymap picker and schema.
## Testing
- Cover navigation, wrapping, operator composition, repeat behavior, Unicode
graphemes, atomic elements, query editing, paste handling, and rendering.
GitOrigin-RevId: 087b080ff8fd74e48456c6b899c07ea5eed38e0c
## Why
The `core` and `tui` Bazel targets treated nearly their entire crate trees as
compile-time data, mixing embedded runtime resources with source files and test
fixtures.
## What changed
- Move embedded resources for `core` and `tui` into dedicated `assets/`
directories and update their `include_str!` paths.
- Restrict Bazel compile data to explicit asset and frame directories.
- Move test-only prompts into `tests/fixtures`, resolve the core prompt through
`find_resource!`, and reuse the integration-test file glob when assembling
Bazel test data.
GitOrigin-RevId: eee9b0e41df77ea2604215a7f7333a6fe8317bfa
## Why
The model picker can open from a cached startup catalog that no longer reflects the models available to the current account.
## What changed
- Fetch the current model list asynchronously whenever the picker opens, while showing cached choices immediately.
- Refresh an open model picker in place, preserving its highlighted model, dismissal behavior, and reasoning submenu.
- Apply accepted catalog updates to model-dependent UI, service-tier controls, and new-thread defaults. Ignore stale, failed, empty, unchanged, or account-invalidated responses.
## Testing
- Added coverage for catalog refreshes, stale and unusable responses, popup state preservation, empty choices, service tiers, and new-thread defaults.
GitOrigin-RevId: 45abe1d309ff7f90701fffe29c6544ca4157f836
## What changed
- Advertise `openai/elicitation` form support when the client declares an
object-valued `form` capability, without deriving it from the legacy
`openai/form` capability.
- Handle `openai/elicitation/create` requests in `form` mode and forward their
metadata and opaque schema through app-server as `openaiForm`, preserving
`x-openai-*` annotations.
- Keep legacy form handling independent and have the TUI automatically decline
the new form requests it cannot render.
## Testing
- Add an app-server round-trip test for capability negotiation, request
forwarding, and accepted responses.
- Extend MCP capability filtering coverage for `openai/elicitation.form`.
GitOrigin-RevId: 88f39257bffafe4ee98a9c910e38507843cd7eeb
## What changed
- Lazily index items in larger thread-history turns so late updates can reuse
their positions after turn completion and rollback.
- Map reverse-history search matches back to Unicode byte ranges with a linear
scan.
- Preserve first-occurrence semantics for duplicate item IDs and Unicode match
boundaries.
## Testing
- Cover indexed duplicate updates before and after the indexing threshold.
- Cover retained-turn updates after rollback and Unicode history-search ranges.
GitOrigin-RevId: 3a9c819966d90d833c4183cf6523b6ea4f7be7e7
## What changed
- Add an optional `timeoutMs` parameter to `thread/shellCommand` and propagate it to user shell execution.
- Preserve the one-hour default when the parameter is omitted or `null`, allow longer deadlines, and treat `0` as an immediate timeout.
- Reject negative or otherwise invalid values before execution. Timing out an auxiliary shell command leaves its active turn running.
## Testing
- Cover default, extended, immediate, invalid, standalone, active-turn, and interruption behavior.
GitOrigin-RevId: d72f67793d9766b7383f28d30140270a4a76a495
## What changed
- Build per-context conflict checks from the shared runtime action registry instead of maintaining separate action lists.
- Preserve the existing context validation order and error messages.
- Add regression coverage for the first reported conflict across editor, Vim, pager, list, agents, and approval contexts.
GitOrigin-RevId: 665839bb9094ac573ab1494248c69c4000998483
## What changed
- Emit turn-scoped authentication recovery started and completed events when a model provider refreshes expired credentials.
- Add stable `modelProvider/authRecoveryStarted` and `modelProvider/authRecoveryCompleted` app-server notifications with the thread, turn, provider, and user-facing message.
- Show recovery progress in the TUI and `codex exec`, including Amazon Bedrock session reauthentication.
## Testing
- Cover provider recovery success and failure events, app-server routing, client rendering, and Amazon Bedrock credential refresh.
GitOrigin-RevId: 3010c38d0676f18bced27761cf86dd38344d09f9
## What changed
- Reuse the mention codec's linked-tool parser and mention-name helpers when extracting skill mentions.
- Remove the duplicate parser and environment-variable filter from the skill mention code.
## Testing
- Cover Unicode byte offsets, whitespace-trimmed paths, both supported sigils, and malformed linked mentions.
GitOrigin-RevId: 4ed3627f0caf90d49bcbc0681ff9d9b43b3736e3
## Why
Restored app-server threads can carry permission profiles that cannot be
represented without loss as legacy sandbox-mode overrides. Sending those
profiles as per-turn overrides can discard their original permission details.
## What changed
- Distinguish restored permission profiles from legacy per-turn sandbox
overrides.
- Preserve restored profiles while routing turns and changing to compatible
working directories.
- Reject `/cd` when a restored profile cannot be represented safely by a
legacy sandbox mode.
## Testing
- Cover retaining a restored read-only profile across `/cd` without a turn
override.
- Verify that lossy sandbox-mode projections are detected.
GitOrigin-RevId: 6143dca4b83ab4f59bab05f6a59b4fe841c56192
## Why
Large or minified diffs can require substantial work to allocate wrapped rows and syntax-highlighted spans in the inline patch view.
## What changed
- Limit inline patch previews to 12 rendered rows across all changed files, while retaining file summaries and directing users to the transcript when content is omitted.
- Preserve complete diff content in transcript and raw views.
- Bound preview source scanning to 64 KiB so zero-width content cannot bypass the row budget.
## Testing
Add coverage for added, deleted, updated, renamed, minified, narrow-width, wide-character, combining-character, and multi-file diffs, including preservation of complete transcript and raw output.
GitOrigin-RevId: 1899129ab548771c29d226ff624549573fb2f688
## Why
Delegated prompts should retain the authority of the TUI tool that sent them instead of being recorded as user input.
## What changed
- Start delegated `create_thread` and `send_message_to_thread` turns with a namespaced tool output and an empty user input list.
- Recognize delegated outputs from trusted Codex namespaces when building activity summaries.
- Render replayed delegation outputs in history and transcripts with their source task attribution, without adding them to composer history.
## Testing
- Cover turn request encoding, namespace filtering, activity summaries, and replayed history/transcript rendering.
GitOrigin-RevId: aeb2f5c8ad2f2a898c80e8fc791ed879a0ab655d
## What changed
- Add an optional `toolOutput` to `turn/start` for starting or steering a turn with a named function-call output instead of user input.
- Emit standalone outputs as `functionCallOutput` thread items, persist them in durable history, and include them in resumed threads.
- Validate that tool outputs have a name, are not combined with nonempty `input`, satisfy the text-size limit, and use supported image URLs.
## Testing
- Cover standalone tool-output notifications, model input, and resumed history in both legacy and paginated history modes.
- Cover the text-size limit for structured tool output.
GitOrigin-RevId: a1eeec7b9b7de67b1a1c5e829a54552b85ec118b
## What changed
- Return the number of directories flagged by successful Windows sandbox world-writable scans.
- Record that count in the `codex.windows_sandbox.world_writable_scan_flagged_directories` histogram for startup and warning-triggered scans.
- Tag each measurement with a `success` or `error` result, using a count of zero when the scan fails.
GitOrigin-RevId: 076160f36b1d62fa737f4b2d0318774e6c44a4b1
## What changed
- Add the `write_stdin_approval` feature flag, disabled by default, to require a fresh approval before sending non-empty input to an escalated unified-exec terminal.
- Route these reviews through hooks, Guardian, app-server, and the TUI as `writeStdin` approvals while keeping the parent command item unchanged.
- Preserve the terminal environment, launch directory, and escalation state across turns, and revalidate the process identity after approval before writing input.
## Testing
- Cover approval routing, policy decisions, process reuse, terminal identity preservation, app-server events, analytics, and TUI rendering.
GitOrigin-RevId: 4ba29eaae6208e934737ba078c96e589c7c2164d
## What changed
- Add `gg` and `G` motions to jump to the first and last buffer lines.
- Support the motions with delete, change, and yank operators, including dot-repeat for edits.
- Expose normal-mode and operator-motion bindings in the configurable keymap while preserving conflicting user bindings.
## Testing
- Cover buffer jumps, operator combinations, repeat behavior, chord routing, and custom remapping.
GitOrigin-RevId: 24a9178cf7964053aaf9a8cd268c5434dda0778e
## Why
App-server clients need the explanation and steering instruction returned with a
misalignment policy violation to offer a user-confirmed continuation. Missing or
incomplete details must continue to behave as a terminal block.
## What changed
- Parse optional misalignment classification, explanation, and steering details
from streamed and HTTP Responses errors and propagate them through core errors.
- Include the details in live app-server `error` and `turn/completed` payloads and
export the corresponding protocol schemas and TypeScript types.
- Keep explanations and steering messages out of serialized rollout events and
redact them from debug output.
- Document how clients can resume with `turn/start` after user confirmation.
## Testing
- Cover streamed, HTTP, and WebSocket-wrapped errors, including malformed and
classification-only details.
- Verify live app-server notifications expose resumable details without writing
the explanation or steering message to the rollout.
GitOrigin-RevId: 329258a444c2cd91d0c57ab1720830b33ddcfac5
## What changed
- Classify `response.failed` events with the `rate_limit_exceeded` code as a distinct retryable error while preserving any parsed retry delay.
- Expose the error as `rateLimitExceeded` through the core protocol and app-server schemas after stream retries are exhausted.
- Preserve the upstream message for TUI display while keeping it out of telemetry summaries.
## Testing
- Cover SSE classification, retry metadata, protocol conversion and serialization, exhausted stream retries, telemetry redaction, and TUI rendering.
GitOrigin-RevId: 02dab4d3477dcd7653a58c49c4bd38687a616579
## What changed
- Add `persistent` to the reasoning-effort protocol and TypeScript SDK types.
- Show model-advertised persistent reasoning in the TUI as “Persistent”.
- Preserve `persistent` in local configuration while sending the Responses API's `disabled` wire value.
## Testing
- Cover parsing and serialization, request translation, remote model requests, the TUI reasoning selector, and TypeScript CLI argument forwarding.
GitOrigin-RevId: 22fc2fba1975db345c12d555ec12803d8dc0abca
pmccrary-oai