## What changed
- Accept optional `account/rateLimits/read` capabilities for Luna Reserve support
and lightweight background polling while preserving omitted and `null` params.
- Forward the Luna Reserve capability only for eligible ChatGPT sessions, and let
lightweight polls skip the separate reset-credit detail request.
- Return the backend's `ordinaryUsageAllowed` decision only when its account and
user identity match the active session.
## Testing
- Cover capability defaults, eligible and restricted authentication modes,
lightweight polling, identity filtering, and backend permission handling.
GitOrigin-RevId: f407a3ae1e70e411fdf245f072a16e453f59cd87
## What changed
Set `questions` to `None` when the buffered replay tests construct an
ordinary completed agent message.
GitOrigin-RevId: 8b5ff14ff8ef25f4f760441767cfaed8542f8b94
## Why
Buffered thread snapshots can contain both streaming deltas and the completed
assistant item. Replaying both reconstructs an already-finished stream instead
of restoring its finalized transcript entry.
## What changed
- Omit superseded assistant deltas from replay snapshots when a matching
completed item follows them.
- Preserve unfinished or unrelated deltas and treat other events as replay
barriers so text needed before tools or prompts is not dropped.
- Render completed replay items directly as formatted history cells while
preserving message order, separators, and composer drafts.
## Testing
Added replay tests covering completed, unfinished, unrelated, and
barrier-separated deltas, plus deterministic Markdown rendering and draft
preservation.
GitOrigin-RevId: 2870b09a04b32c0a4c0e9ab76970a8ebc3f5a7d4
## Why
Automatic startup work and `codex doctor` can run before a workspace is
trusted. A repository-controlled `PATH` must not be able to make those flows
execute workspace-provided helpers.
## What changed
- Resolve helpers used by automatic startup from trusted system installation
directories, and give plugin-sync Git subprocesses a sanitized environment.
- Make terminal detection environment-only and have doctor inspect executable
locations without running them. Fetch update metadata with the HTTP client
instead of `curl`.
- Fall back conservatively when trusted terminal helpers are unavailable,
including for tmux keyboard enhancement flags.
## Testing
Add black-box coverage with hostile workspace `PATH` entries for startup,
interactive tmux startup, support log collection, doctor, and curated plugin
sync. Add unit coverage for trusted executable resolution and bounded update
HTTP responses.
GitOrigin-RevId: 3b8995eb422b60ed53b0386951de59e8f9bfc542
## Why
Context compaction was only reported after it completed, so the TUI did not
show when compaction was actively making room to continue.
## What changed
- Show `Compacting context` as soon as manual or server-driven compaction
starts, with an elapsed timer independent of the current turn timer.
- Preserve the compaction status across follow-up input and transient activity,
while still allowing retry errors to take precedence.
- Restore in-progress compaction timing from thread snapshots and add the live
duration to the completion message.
- Clear stale compaction state when the turn starts, completes, or terminates.
## Testing
Added TUI tests covering manual and server-driven compaction, narrow rendering,
follow-up input, replay and task switching, retry status, timer preservation,
and turn termination.
GitOrigin-RevId: 804e1bc553315da24ff1f99462e8e282818cada3
## Why
Permission requests can originate in an environment whose path convention differs from the Codex host. Requiring the request working directory to be host-native prevents those requests from reaching interactive approval.
## What changed
- Carry the request `cwd` as a `LegacyAppPathString` through core events and the app-server protocol so the target environment's native representation is preserved.
- Convert the preserved value back to a `PathUri` when materializing permission grants.
- Regenerate the JSON and TypeScript protocol schemas for the updated `cwd` type.
## Testing
- Exercise the app-server permission request round trip with a target-native working directory across host path conventions.
- Verify remote permission requests retain their environment working directory and granted access still unblocks later execution.
GitOrigin-RevId: 97dc9707d9048883d20bab1b69c93871039f3188
## What changed
- Limit elevated interactive setup to provisioning sandbox identities and proxy settings; do not include caller workspace or ACL roots in its payload.
- Always run the non-elevated setup refresh during sandbox activation so the current permission profile supplies read, write, and deny paths, including when provisioning was completed previously.
- Add an `interactive-provision` setup mode that performs provisioning without the full ACL setup path.
## Testing
- Verify elevated provisioning payloads contain no caller ACL roots and use the new mode.
- Verify the setup helper accepts `interactive-provision` payloads.
GitOrigin-RevId: 081b1b43abd2388773c230fb35da82896e7be2ea
## Why
Compaction replaces the model history window, but host-verified user answers may
still be needed for the rest of the owning thread.
## What changed
- Add bounded, model-invisible retained context for verified
`request_user_input` answers.
- Persist retained context in rollout events and compaction checkpoints, and
restore it when a thread resumes.
- Remove answers when their source turns are rolled back, and prevent
parent-local answers from being inherited by child forks.
## Testing
Add lifecycle coverage for deduplication and size limits, compaction and resume,
rollback, rollout migration, and child forks.
GitOrigin-RevId: c32900d3e8120a9899b71f0576683acd67a4b898
## Why
An app-server thread can still be closing when the TUI reconnects. Its
`thread/resume` request then uses the same `-32600` error code as an unavailable
thread, even though the thread can be resumed once closing finishes.
## What changed
Treat the thread-specific "is closing" response as a transient reconnect error
so the existing reconnect loop retries instead of marking the conversation
unavailable.
## Testing
Extend the active reconnect and end-to-end reconnect tests to cover a closing
thread that resumes successfully on the next attempt.
GitOrigin-RevId: 30ce232b8894065fef346a86128b3ff9bf36ba1f
## Why
TUI preferences and persistence paths belong to the local client, while thread
configuration and account requirements may come from the active app server.
Keeping both in the same resolved `Config` can replace live local preferences
when a thread is resumed, forked, reconnected, or switched.
## What changed
- Add `LocalSettings` as the TUI-owned source for UI, history, notice, and local
persistence settings, and preserve it across session lifecycle transitions.
- Write preference changes to the selected user config file and reload local
settings from disk when changing roots.
- Use the app server's account response for authentication-dependent onboarding
and status UI instead of the local model-provider configuration.
- Retain platform family and OS metadata reported by remote app servers.
## Testing
- Cover local setting defaults, overrides, persistence destinations, reloads,
and preservation across widget replacement and root switching.
- Cover remote platform metadata and server-controlled authentication UI.
GitOrigin-RevId: dbc2965fb1d6cbecb3f973f6133f3dcd4467b753
## What changed
- Centralize app-level keymap actions in a shared dispatcher, including raw-output and external-editor chords.
- Move read-only transcript input handling into its own module while preserving prompt backtracking and older-history loading.
- Add regression coverage for transcript draft isolation, backtrack selection, global chords, and cached history when a thread is unavailable.
GitOrigin-RevId: a1465942d1ea6c57c2f54e5e313025aceb9f8510
## What changed
- Add Vim Replace mode, entered with `R`, which overwrites graphemes and appends at the end of a line.
- Restore overwritten text with Backspace and record replace edits for undo and dot-repeat.
- Preserve composer behavior for attachments, completions, paste bursts, history previews, and external editor imports while replacing text.
- Expose `vim_normal.enter_replace_mode` in the configurable TUI keymap.
## Testing
- Add coverage for grapheme replacement, Backspace recovery, dot-repeat, custom bindings, atomic attachments, completions, paste handling, and history interactions.
GitOrigin-RevId: cb04e3adcce013c1eb7b82c994b00e944310c481
## What changed
- Replace `send_user_message_async` with `request_user_input_async`, accepting one or more questions with optional suggested answers while allowing the turn to continue.
- Attach structured question metadata to asynchronous agent messages while retaining readable fallback text, and preserve it through app-server events, thread history, and generated schemas.
- Continue enabling the new tool for model catalogs that advertise either the old or new tool name.
## Testing
- Cover tool registration, question validation, emitted items, continued turn execution, history preservation, and backwards-compatible deserialization.
GitOrigin-RevId: ffc49aebde2e854c3c50a122aa52805fec3fc6b3
## What changed
- Parse `experimental_network.header_injections` rules with host, method, path-prefix, and header mappings and carry them into `NetworkConstraints`.
- Export the rule type from `codex_config`.
- Summarize configured rule counts and hosts in the TUI debug configuration without exposing header values.
## Testing
- Cover managed configuration parsing and redaction of header values from debug output.
GitOrigin-RevId: 623b047e6c6111a9f2ccbe79c9ace054631a3c67
## What changed
- Add nullable `model` and `reasoningEffort` fields to the shared app-server `Thread` object and generated schemas.
- Report current settings for loaded threads and the latest persisted settings for unloaded threads across thread read, list, start, resume, rollback, metadata update, and notification paths.
- Keep unavailable legacy or filesystem-only settings nullable, and allow metadata reads without loading a thread or dispatching queued work.
## Testing
- Cover live-setting precedence, persisted settings after restart, null legacy values, and model metadata returned by thread lifecycle operations.
GitOrigin-RevId: 22ebe8a8d1910a820d90a97730d812a00d8c1372
## What changed
- Warn Plus and Team users when they have less than 50% of an approximately five-hour usage window remaining.
- Preserve the existing 75%, 90%, and 95% usage thresholds for other plans and window lengths.
- Continue deduplicating warnings across rolling rate-limit updates.
## Testing
- Cover eligible and ineligible plan and window combinations, retained plan metadata, and warning deduplication.
GitOrigin-RevId: b221def052b979c91490e7878829db2478c6e264
## What changed
- Add a bounded redo stack for complete composer drafts, including paste payloads and image attachments. `Ctrl+R` now reapplies the last undone edit in Vim normal mode, while new edits clear stale redo history.
- Add the configurable `vim_normal.redo` action to the keymap schema and picker. Preserve reverse prompt-history search in Vim insert mode and non-Vim mode, and honor explicitly configured bindings.
- Keep pending edit snapshots outside the shared undo/redo byte budget so canceled commands cannot evict committed history.
## Testing
- Cover grouped edits, Vim searches, direct draft changes, history limits, empty redo stacks, and custom or unbound shortcuts.
GitOrigin-RevId: 0cf5bb376ff865ddc0a77705dcb322ef6b57b3a3
## What changed
- Render descriptive Markdown labels alongside canonical local file targets instead of discarding them.
- Collapse labels that resolve to the same path, accounting for relative and absolute forms, `file://` URLs, percent encoding, case, separators, and location suffixes.
- Preserve `~/` destinations for display and keep absolute paths unless they can be shortened relative to the session working directory.
## Testing
- Add unit and snapshot coverage for descriptive and path-equivalent labels, invalid percent encoding, trailing separators, Unix and Windows paths, UNC paths, `file://` URLs, and table wrapping.
GitOrigin-RevId: 636bf4485b2899d96c6273be3f3b7f38728c9013
## What changed
- Show revealed running hooks in the bottom activity area instead of the conversation viewport or transcript overlay. Fold the hook message into the active status row when space permits and reflow it below the row without displacing background-process controls or status details.
- Keep fast hooks hidden, collapse concurrent hooks to a shared summary when needed, and support hook activity outside an active agent turn.
- Simplify durable hook output into user-facing messages and actionable failure, block, and stop states. Suppress model-facing context and quiet successful completions from all TUI history surfaces.
## Testing
- Add lifecycle, layout, narrow-width, multi-width Unicode, transcript, restart, and completion-output coverage for hook status and history rendering.
GitOrigin-RevId: 4c52b7a736e9e466e109107eb3c04a39d089597f
## What changed
- Render complete patch contents directly in TUI history cells.
- Render all input sent to background terminals inline.
- Remove the preview row and byte limits and their transcript hints so inline and transcript views contain the same content.
## Testing
Update snapshots to cover patches and terminal input longer than the former 12-row preview limit.
GitOrigin-RevId: 9960818a9b51fc0c7f84d9def77b9b1bd8acad6c
## Why
The agent command center only listed sessions currently loaded by the app server, so completed or otherwise unloaded tasks could not be revisited from the overview.
## What changed
- Seed the overview with up to 20 recent root sessions in addition to loaded sessions, retain discovered sessions for the lifetime of the TUI, and update rows from thread lifecycle notifications.
- Allow unloaded sessions to be resumed from the overview using the normal working-directory selection and configuration rebuild flow. Explicit runtime permission choices carry across a cold resume, while settings inherited from the previously selected task do not.
- Fall back from `recency_at` to `updated_at` when connected to an older server, and continue showing loaded sessions when recent-history listing is unavailable.
## Testing
Added coverage for recent-session discovery and retention, notification races, legacy and failed listing fallbacks, cold-resume working-directory and permission handling, reconnect behavior, and unloaded-session rendering and selection.
GitOrigin-RevId: 668068b1594eb24b2ea7faccd0327804b8cd22ef
## Why
Vite+ launches Codex through the same JavaScript shim as npm, so Codex could
misidentify Vite+-owned installations and recommend npm for updates.
## What changed
- Detect Vite+ global installs from their package ownership metadata and pass a
dedicated `CODEX_MANAGED_BY_VITE_PLUS` marker to the native binary.
- Represent Vite+ in install context and `codex doctor` output.
- Recommend `vp install -g @openai/codex` in update and repair flows for
Vite+-managed installs.
See https://github.com/openai/codex/pull/30880.
GitOrigin-RevId: 8add724eefd31170a078086392609dbbd7f20b26
## Why
Guardian review evidence must remain available after a compacted thread is resumed or forked, while rolled-back or parent-local evidence must not grant authorization in a different context.
## What changed
- Store the bounded, model-invisible Guardian transcript alongside compacted rollout history and restore it from the newest surviving checkpoint during replay.
- Trim Guardian history at rollback boundaries, clearing it when the boundary has already been evicted.
- Preserve the checkpoint for user-initiated forks, but remove it when spawning a subagent so parent review evidence is not inherited.
- Keep the new rollout field optional for compatibility with existing compacted records and legacy readers.
## Testing
- Cover Guardian history across compaction, restart, paginated and pathless stores, user forks, rollback, bounded replay, serialization, and subagent forks.
GitOrigin-RevId: 6ab076d5e0c3aac4d6a41ebd50ba2b200c90213e
## What changed
Emit the `codex.tui.start` counter once per TUI launch with an
`app_server_mode` label of `in_process`, `local_daemon`, or `remote`. Recording
the metric during startup keeps reconnects from counting as additional
launches.
GitOrigin-RevId: 7527f319b95ae53f5278fa16120120a433a29ae4
## Why
Composer drafts include attachments, mention targets, and deferred paste payloads in addition to visible text. Vim undo needs to restore that complete state as a single edit.
## What changed
- Add bounded, draft-level Vim undo history, with `u` as the configurable default binding in normal mode.
- Group complete Vim commands and insert sessions into undo steps, including direct composer changes such as pastes and attachments.
- Preserve undo, repeat, and search state when a reverse-history preview is canceled, and start fresh history when another prompt is accepted.
## Testing
- Cover grouped edits, custom bindings, history and search interactions, attachments, and large paste payloads.
GitOrigin-RevId: 12ecdb3c34a2d66f5d856aa2f82dc15bd91b230b
## Why
Moving between prompts in backtrack mode rebuilt every transcript renderable and
discarded their cached heights, causing the entire transcript to be laid out
again for each selection change.
## What changed
Rerender only the previously highlighted cell and the newly highlighted cell.
Keep all other renderables, cached heights, and the live tail intact while
continuing to scroll the selected prompt into view.
## Testing
Add regression tests that verify selection changes preserve unrelated height
caches and produce the same viewport and scroll position as a full rebuild,
including with a live tail and terminal width changes.
GitOrigin-RevId: 685a8ce65ecadef20521ce2ded7b516fdf8499c9
## What changed
- Show the exact `codex resume <thread-id>` command on its own indented line.
- When a thread has a name, also explain that users can run `codex resume` and select the named thread from the picker.
- Apply command highlighting to both resume options when color is enabled.
## Testing
- Cover unnamed, empty-name, named, colored, and embedded-session exit summaries.
GitOrigin-RevId: d97c04db8a34376c6d9ea839b515b04a384b85d1
## Why
Large input sent to a background terminal can require excessive wrapping work and fill the inline history view.
## What changed
- Limit inline input previews to 12 rendered rows and bound preview processing to 64 KiB.
- Show a transcript hint when input is omitted, while preserving the complete input in transcript and raw views.
- Keep URLs intact when they fit and truncate only the final overflowing line when needed.
## Testing
Add regression coverage for long wrapped input, narrow viewports, zero-width Unicode payloads, URLs, and inputs that fit within the preview budget.
GitOrigin-RevId: c20edf156d5c8364083b1690e41cabd29786a279
## What changed
Dispatch `AppEvent::OpenAgentsOverview` in the daemon reconnect navigation test instead of simulating the Alt+A keyboard shortcut.
GitOrigin-RevId: 99729a39496ffb96747f6d0c4be0edf52d1ef3f6
## What changed
- Exercise Rust source discovery through a mocked `git ls-files` call, including files outside `codex-rs`, paths containing spaces, and stale entries that no longer exist.
- Assert that the formatter invokes `rustfmt` from `codex-rs` with the repository configuration in both format and check modes.
- Keep the multiline argument-comment lint fixture stable under formatting and update affected Rust test files to the expected style.
GitOrigin-RevId: 0cfffde1bb91bf620d2118bed1efc68466c0cca6
## What changed
- Start the composer in Vim Insert mode when Vim is enabled and return to
Insert mode after submissions and slash-command dispatch.
- Record the fresh Insert session as a Vim edit so `.` can repeat text entered
in a new draft.
- Keep `/` and `?` as Normal-mode composer searches, and let Backspace cancel
an empty search query and any pending operator without changing the draft.
## Testing
- Add coverage for startup, submitted and queued drafts, inline and goal slash
commands, repeatable edits, and canceled searches.
GitOrigin-RevId: 1a5ee30c44685d2b2a037e46c3ab4ab611024919
## What changed
- Keep the agent command center visible with its cached inventory and draft while reconnecting, then refresh it without losing the selected task.
- Allow cached, unavailable conversations to reattach when selected while preserving their drafts, recap progress, and runtime permissions.
- Report an unsubmitted rename when its target disappears during refresh, and continue to quarantine queued input instead of resending it automatically.
## Testing
- Add a Unix socket replacement test covering command-center recovery with and without an active conversation, failed reconnects, inventory changes, and subsequent live task input.
GitOrigin-RevId: 774aca2dfb8358e9abd6a2e2ef0d509646648f66
## What changed
- Open the agents overview with Left from an empty, focused composer in local-daemon sessions.
- Keep the shortcut inactive while editing text, using transient input surfaces, or when Left has been explicitly remapped.
- Show the contextual shortcut in the footer and shortcuts overlay.
- Leave the configurable `open_agents` action unbound by default instead of assigning `Alt+A`.
## Testing
- Add coverage for session eligibility, input-state guards, editor and Vim remaps, event dispatch, and footer rendering.
GitOrigin-RevId: ef17db3d9d09c3a08c3f7353c5b8a02f2b61c696
## What changed
- Reconnect out-of-process TUI sessions after the app-server transport drops, bootstrap a fresh client, and resume the active thread.
- Preserve cached transcripts, drafts, runtime settings, task-tool capabilities, and live notification routing across the new connection.
- Keep recovered or possibly submitted input paused for manual review instead of resending it, and leave conversations that cannot be resumed available as read-only cached views.
- Show reconnect progress and actionable failure states while still allowing drafts to be edited or copied.
## Testing
- Add app-level coverage for successful recovery, failed and unavailable resumes, input quarantine, and preserved session state.
- Extend the terminal integration test to verify that a draft survives reconnection, the thread is resumed without starting a turn, and notifications arrive through the replacement connection.
GitOrigin-RevId: 5dcb867c89e226a0c545d6313a77424c233cd47a
## Why
Streaming can temporarily hide the status row, but its elapsed time is still
needed when the row returns and when the final `Worked for` duration falls back
to the local clock. Approval prompts must also keep that clock paused.
## What changed
- Own the pause-aware status timer in the bottom pane independently of the
optional status row.
- Preserve elapsed time and modal pause state while hiding or restoring the row,
and reset the clock for new turns and Windows sandbox setup.
- Use the independent timer as the fallback for the final turn duration.
## Testing
Add timer unit coverage and TUI tests for hidden rows, outstanding approvals,
fallback turn durations, and fresh Windows sandbox setup clocks.
GitOrigin-RevId: a77931e465d5aedd4a8cd606a3a3117d1bb37ce7
## Why
Resumed threads need to continue per-turn and per-thread token totals without scanning arbitrarily far beyond the latest compaction checkpoint.
## What changed
- Add durable `TokenUsageRecord` rollout items with response, turn, thread, session, and root-turn attribution.
- Restore accumulated usage on resume and snapshot the latest record plus the compaction response ID in compaction checkpoints.
- Preserve root-turn lineage in persisted turn context, while ensuring forked child threads start with their own usage totals.
## Testing
- Cover usage accumulation across multiple responses and resumed turns.
- Cover local and remote compaction checkpoints, invalid remote compaction output, rollout reconstruction, and fork isolation.
GitOrigin-RevId: ef9e0c4a9102a08a2c382be4cdac68c84353c90a
## Why
Losing an external app-server connection can leave a submission's outcome uncertain. The TUI must preserve local work without retrying it or allowing stale server events to trigger more actions.
## What changed
- Enter an offline state when an external app-server transport disconnects during startup, event streaming, or submission.
- Keep conversation drafts, queued input, expanded pastes, attachments, and agent-overview input editable while blocking submissions, remote actions, and automatic queue replay.
- Show a connection-lost notice that directs users to copy their work and relaunch, while retaining `Ctrl-C` and an empty-composer `Ctrl-D` as quit shortcuts.
- Cancel pending views and asynchronous work, and ignore stale completions after the disconnect. Embedded app-server behavior is unchanged.
## Testing
Added unit, snapshot, and pseudo-terminal coverage for lost startup and mutation replies, offline draft editing, queued-input recovery, stale-event quarantine, agent-overview behavior, and end-to-end preservation without reconnection or resubmission.
GitOrigin-RevId: 7219a95fad676dda447d625db9e465345b469d58
## What changed
- Emit a separate history cell for each completed command instead of grouping
consecutive successes into a `Ran N commands` summary.
- Preserve `Explored` grouping for related file reads, searches, and listings.
- Replay completed commands as individual entries so their output and failure
status remain visible.
## Testing
- Update TUI tests and snapshots for live exploration and replayed commands.
GitOrigin-RevId: 7dafe0b7846fc89784093791a6be137a1b1ab8ff
## What changed
- Carry optional backend-owned banner and account identity data through
`account/rateLimits/read`, filtering banners that do not match the authenticated
account and user.
- Render supported rate-limit notices above the composer with actions for usage,
credits, resets, owner notifications, and plan management while preserving the
existing fallback UI for absent or unsupported banners.
- Refresh usage after limit errors, reject stale responses, and keep queued input
paused until recovery completes. When instructed by the banner, switch to the
first available fallback model without changing unrelated thread settings.
## Testing
- Add protocol, banner parsing and rendering, CTA, identity filtering, refresh
ordering, fallback-model, account-change, and queued-input recovery coverage.
GitOrigin-RevId: e03d75a82e425deb87f4b120a71cf2286c0ef6cc
## Why
Older JediTerm versions can print the space intermediate in `DECSCUSR`,
overwriting the glyph beneath a cursor-style command.
## What changed
- Apply cursor-style commands at a repairable, terminal-owned glyph and redraw
that glyph with its original style and hyperlink before restoring the requested
cursor position.
- Omit the style command when the viewport has no safe repair anchor.
- Handle skipped cells, wide glyphs, and single-column viewports without
corrupting content or causing scrolling.
## Testing
Add cursor rendering tests for styled and cursor-only frames, skipped and wide
hyperlinked glyphs, single-column viewports, and viewports without owned cells.
GitOrigin-RevId: c8bbb74c53737b5980c533859af39da26f0e06cc
## What changed
- Relocate Vim history-navigation tests alongside the history search implementation.
- Share the human-like typing test helper with the nested test module.
GitOrigin-RevId: e2d03a173d2f3b73cf9f0c30411284a47f623838
## What changed
- Add draft-local forward and backward literal search with `/` and `?`, plus
wrapped repeat navigation with `n` and `N`.
- Support search motions after delete, change, and yank operators, while keeping
queries separate from the draft and skipping atomic elements and partial
grapheme matches.
- Render and edit the query in the composer footer, highlight matches, and add
configurable `tui.keymap.vim_search` bindings to the keymap picker and schema.
## Testing
- Cover navigation, wrapping, operator composition, repeat behavior, Unicode
graphemes, atomic elements, query editing, paste handling, and rendering.
GitOrigin-RevId: 087b080ff8fd74e48456c6b899c07ea5eed38e0c
## Why
The `core` and `tui` Bazel targets treated nearly their entire crate trees as
compile-time data, mixing embedded runtime resources with source files and test
fixtures.
## What changed
- Move embedded resources for `core` and `tui` into dedicated `assets/`
directories and update their `include_str!` paths.
- Restrict Bazel compile data to explicit asset and frame directories.
- Move test-only prompts into `tests/fixtures`, resolve the core prompt through
`find_resource!`, and reuse the integration-test file glob when assembling
Bazel test data.
GitOrigin-RevId: eee9b0e41df77ea2604215a7f7333a6fe8317bfa
## Why
The model picker can open from a cached startup catalog that no longer reflects the models available to the current account.
## What changed
- Fetch the current model list asynchronously whenever the picker opens, while showing cached choices immediately.
- Refresh an open model picker in place, preserving its highlighted model, dismissal behavior, and reasoning submenu.
- Apply accepted catalog updates to model-dependent UI, service-tier controls, and new-thread defaults. Ignore stale, failed, empty, unchanged, or account-invalidated responses.
## Testing
- Added coverage for catalog refreshes, stale and unusable responses, popup state preservation, empty choices, service tiers, and new-thread defaults.
GitOrigin-RevId: 45abe1d309ff7f90701fffe29c6544ca4157f836
## What changed
- Advertise `openai/elicitation` form support when the client declares an
object-valued `form` capability, without deriving it from the legacy
`openai/form` capability.
- Handle `openai/elicitation/create` requests in `form` mode and forward their
metadata and opaque schema through app-server as `openaiForm`, preserving
`x-openai-*` annotations.
- Keep legacy form handling independent and have the TUI automatically decline
the new form requests it cannot render.
## Testing
- Add an app-server round-trip test for capability negotiation, request
forwarding, and accepted responses.
- Extend MCP capability filtering coverage for `openai/elicitation.form`.
GitOrigin-RevId: 88f39257bffafe4ee98a9c910e38507843cd7eeb
## What changed
- Lazily index items in larger thread-history turns so late updates can reuse
their positions after turn completion and rollback.
- Map reverse-history search matches back to Unicode byte ranges with a linear
scan.
- Preserve first-occurrence semantics for duplicate item IDs and Unicode match
boundaries.
## Testing
- Cover indexed duplicate updates before and after the indexing threshold.
- Cover retained-turn updates after rollback and Unicode history-search ranges.
GitOrigin-RevId: 3a9c819966d90d833c4183cf6523b6ea4f7be7e7
## What changed
- Add an optional `timeoutMs` parameter to `thread/shellCommand` and propagate it to user shell execution.
- Preserve the one-hour default when the parameter is omitted or `null`, allow longer deadlines, and treat `0` as an immediate timeout.
- Reject negative or otherwise invalid values before execution. Timing out an auxiliary shell command leaves its active turn running.
## Testing
- Cover default, extended, immediate, invalid, standalone, active-turn, and interruption behavior.
GitOrigin-RevId: d72f67793d9766b7383f28d30140270a4a76a495
## What changed
- Build per-context conflict checks from the shared runtime action registry instead of maintaining separate action lists.
- Preserve the existing context validation order and error messages.
- Add regression coverage for the first reported conflict across editor, Vim, pager, list, agents, and approval contexts.
GitOrigin-RevId: 665839bb9094ac573ab1494248c69c4000998483
## What changed
- Emit turn-scoped authentication recovery started and completed events when a model provider refreshes expired credentials.
- Add stable `modelProvider/authRecoveryStarted` and `modelProvider/authRecoveryCompleted` app-server notifications with the thread, turn, provider, and user-facing message.
- Show recovery progress in the TUI and `codex exec`, including Amazon Bedrock session reauthentication.
## Testing
- Cover provider recovery success and failure events, app-server routing, client rendering, and Amazon Bedrock credential refresh.
GitOrigin-RevId: 3010c38d0676f18bced27761cf86dd38344d09f9
dhruvgupta-oai