## Why
Windows sandbox setup and permission choices need to reflect the connected app server's requirements and the active thread's executors.
## What changed
- Refresh sandbox configuration and requirements for the current working directory when threads or directories change, before setup, and after setup completes.
- Use the thread's observed environments to determine whether sandbox setup is local, remote, mixed, or unknown.
- Defer initial prompt submission while requirements load and preserve the draft if loading fails or required setup is unavailable.
- Hide sandbox setup choices and elevation commands that requirements or executor selection disallow.
## Testing
Add coverage for observed thread hosts, app-server configuration reads, draft preservation and recovery after read failures, deferred initial prompts, and non-admin-only setup choices.
GitOrigin-RevId: d85ac66d18951b752e71d1a6bf25404eeedcad02
## Why
Daemon recovery reloads threads but leaves interrupted work unfinished. Resume eligible work automatically from the saved conversation, even without a connected client.
## What changed
- Attempt one new continuation turn immediately after restoration, including in Plan mode. Mark the old turn interrupted and supply recovery context without creating a user message or granting new authorization.
- Require an idle thread, matching permissions, and the same single local environment configured by the thread. Skip completed, aborted, or superseded work and snapshots without environment identity.
- Add `continue_turn_if_idle` with an atomic previous-turn check so newer tasks or standalone settings changes invalidate pending continuation.
- Preserve the output schema, service tier, and root turn ID, and emit a “Resuming interrupted work” warning when continuation starts.
## Testing
Add daemon restart coverage for continuation without a client, Plan mode, permission and environment mismatches, and legacy snapshots. Add core coverage for preserved continuation metadata, absence of user-message events, rejection of superseded continuations, and exclusion of remote execution from recovery snapshots.
GitOrigin-RevId: 2b290b75d9399fc58258bcda2e85c74e9b5b3b09
## What changed
- Add `WindowsSandboxConfig` helpers to read app-server configuration and managed requirements, preserve legacy feature flag fallbacks, and select an allowed setup mode with elevated mode preferred when the configured mode is disallowed.
- Store the sandbox host classification in thread session state using reported environments across start, resume, fork, and replay paths. Classify missing or empty environments as `Unknown`, and distinguish local, remote, and mixed selections.
## Testing
Add coverage for managed setup restrictions, legacy configuration precedence, unknown policy state, environment classification, and remote host state in inactive-thread replay.
GitOrigin-RevId: ae8920d9c2a1c80b641ac90617ae607b171bd55a
## Why
WSL interop can block while launching the Windows terminal probe, stalling TUI startup. Inconclusive detection can also enable keyboard enhancements that break dead-key composition in VS Code on WSL.
## What changed
- Give the Windows `TERM_PROGRAM` probe a one-second deadline, with launch and cleanup handled on a worker thread. Cache the result, including timeouts, and kill and reap probes that outlive the deadline once launch returns.
- Distinguish VS Code, other terminals, and unknown detection results. Disable keyboard enhancements on WSL for VS Code or unknown results, while preserving the `CODEX_TUI_DISABLE_KEYBOARD_ENHANCEMENT` override.
## Testing
Add regression tests for probe output and exit status, failed launches, timeouts during launch and execution, and child cleanup. Extend detection and override tests to cover unknown results.
GitOrigin-RevId: 39e980b0d7cf3d6716ee61597d6002b0fd59651e
## Why
Clients need widget presentation details to render MCP Apps without waiting for the full MCP catalog, including when replaying saved history.
## What changed
- Add `mcpToolCall.mcpAppUi` with the invoked descriptor's `resourceUri` and `preferredModelDisplayMode`, and carry it through tool-call events and saved history.
- Support `fullscreen` and default to `inline` when the display preference is missing or unsupported.
- Keep existing resource URI fields for compatibility. Leave `mcpAppUi` null for older history and tools that declare widgets only in result metadata, where clients still use catalog discovery.
- Update protocol schemas, TypeScript and Python types, and app-server documentation.
## Testing
Add parameterized integration coverage for fullscreen, missing and unsupported preferences, legacy URI metadata, and result-only widgets, verifying consistent tool events and preservation across session resume.
GitOrigin-RevId: 2a9bed804dcea8c2b4903b8406fa6710681f7f5e
## What changed
- Accept `fileId` alongside the existing `url` form for app-server image inputs, and forward file references to the Responses API as `file_id`. Update generated schemas and client types.
- Preserve file references, image detail hints, and mixed inline/file image ordering through user-message events, thread history, and rollout migration. Retain file images when truncating tool output.
- Pass file references through image preparation without resolving them, while keeping resize-notice numbering correct. Omit them from unsupported TUI display and Guardian image context.
- Reject image-edit requests whose recent-image window includes a file reference, preventing selection of an older inline image instead.
## Testing
Add coverage for serialization, request and rollout preservation, mixed-image history ordering, incomplete ordering metadata, tool-output truncation, and rejection of unsupported image-edit selections.
GitOrigin-RevId: 6ca20a8577155cc934b720803c3b7b3bffdf972a
Replace `◦` with `•` in the rendered popup before comparing the
`image_preparation_disconnected` snapshot.
GitOrigin-RevId: f951c5e1f230bf8ee6d7f32a41f41316feabcb0f
## What changed
- Expose `analytics_plan_history` in the experimental features menu for previewing consumer five-hour and weekly allowance history in `/analytics`. Keep it disabled by default.
- Add `h` and `l` as left/right navigation aliases in analytics, preserving explicit bindings and honoring remapped or unbound arrows.
- Use terminal-aware footer key colors to keep analytics shortcuts readable on light backgrounds.
## Testing
Add navigation tests for arrow equivalence, custom bindings, modifiers, and key repeat. Extend light-background contrast assertions and update style snapshots. Add a snapshot for the plan history experimental feature entry.
GitOrigin-RevId: 310e64a43a7dd08c8a3fd1efed6985805f7dd580
## Why
Reading daily totals required selecting each bar, and changing grouping required opening a picker. Section navigation could shift vertically, while scroll hints appeared even when content fit.
## What changed
- Make `g` cycle through available groupings and summary views directly.
- Show daily totals on charts spanning up to seven days when space permits, prioritizing the selected value and keeping neighboring labels separate.
- Keep section navigation at a stable height, show more legend rows in taller maximized reports, and move their update timestamp into the footer.
- Hide scroll hints when content fits, including an exact fit, and show only the active summary view label.
## Testing
Add regression tests and snapshots for seven-day totals, narrow label spacing, grouping wraparound and server capabilities, configured `g` navigation in ungrouped sections, stable tab placement, adaptive legends, footer timestamps, and overflow-dependent scroll hints.
GitOrigin-RevId: 9d14f314b4a22ca2d926f0e69c6b89e4f9c8550d
## What changed
- Make Summary the initial Analytics tab, showing profile identity, token totals, streaks, activity insights, and most-used plugins and skills.
- Move daily, weekly, and cumulative token activity charts into Summary. Replace the usage menu's separate views with “View analytics”; `/usage weekly` and the other explicit modes open Summary with the requested view, while reopening from the menu retains navigation.
- Load account profiles independently of other reports, preserve missing values separately from zero, and reject responses when the active account changes. Refresh retries profile failures.
- Adapt Summary to narrow terminals and compact large chart totals and axis labels. Show the account email without its ID in the Analytics header.
- Flush queued transcript history before opening an overlay so startup output stays in the transcript.
## Testing
Add profile decoding and account identity tests, Summary layout and navigation snapshots, refresh and cancellation coverage, and regression tests for retained navigation and transcript history when opening Analytics.
GitOrigin-RevId: 6dbe6c4c98209000d8b4bc18a4e01b98fab5991a
## Why
Consumer analytics lacked a per-chat view of allowance usage and balance credit debits.
## What changed
- Add a Top chats panel for up to 100 local chats active in the past 30 days, including discovered descendants and excluding archived roots.
- Show weekly and five-hour usage as percentages of current full limits, plus balance credits including adjustments. Preserve exact credit decimals and distinguish missing values from zero.
- Support cycling sort metrics with `s`, a top-five dashboard summary, and expandable model, reasoning effort, and speed breakdowns.
- Query task usage through `query_v2` with bounded, disjoint descendant groups. Retain partial and unavailable rows, hide titles when usage is unavailable, and report ranking coverage and freshness.
## Testing
Add backend and TUI tests covering decimal precision, request and response validation, paginated archived descendants, unavailable responses, metric selection, title hiding, and top-five rendering.
GitOrigin-RevId: b8f233166576389c8212bb97eceb7c6be7f5f51d
## What changed
- Add consumer plan usage history behind `analytics_plan_history`, disabled by default, fetching seven days of five-hour and weekly allowance periods.
- Show period usage percentages with expandable breakdowns by feature, model, surface, or turn start, plus snapshot freshness and incomplete coverage indicators.
- Preserve unknown usage separately from zero and handle an unavailable history endpoint without blocking other analytics reports.
## Testing
Add backend and TUI tests for unavailable endpoints, response validation, feature and account gating, account changes during requests, period navigation, snapshot resets, and narrow and wide layouts.
GitOrigin-RevId: 7bea87a3407730b18040d7dda7e7dd0afe67fb2e
## What changed
- Show local chats active in the past 30 days, ranked by estimated lifetime credits, for supported Business and Enterprise plans. Exclude archived chats and subagents.
- Add expandable model, reasoning effort, and speed breakdowns, optional zero-credit groups, and dollar estimates when supplied by the backend.
- Load estimates in bounded batches of up to 100 distinct threads, retaining available results when some estimates are unavailable. Hide chat titles without a returned estimate and distinguish missing usage from zero.
## Testing
Add coverage for batch validation, partial failures, request limits, pagination and ranking, plan eligibility, title visibility, and responsive table navigation and details.
GitOrigin-RevId: 783b960a780f4e0fd39f57e2fa78fb31b3090c44
## What changed
- Add “Explore analytics” to the `/usage` menu for ChatGPT accounts, opening a full-screen dashboard.
- Show usage and messages for consumer accounts, credits and token usage for Business and Enterprise accounts, and plugin and skill activity for both.
- Support overview and maximized views, 7- and 30-day ranges, report grouping, daily details, model filtering for token usage, and refresh.
- Keep report loading and errors independent, cancel pending loads on close, and retain navigation state across reopening while preserving the composer draft.
## Testing
Add regression and snapshot coverage for account-specific reports, range and grouping changes, model filtering, loading and cancellation, small terminals, terminal colors, and draft preservation.
GitOrigin-RevId: 46da94a14d6e227551e740b85f9d2d552aaf75b0
## What changed
Add daily stacked bar rendering in the TUI analytics module, staged for dashboard integration.
- Plot three categories plus an Other remainder without renormalizing values, with separate positive and negative bands for signed credits.
- Add readable numeric axes, calendar ticks, a selection cursor, and a callout showing the authoritative daily total. Distinguish missing days from zero usage.
- Keep the selection visible in narrow viewports and omit labels that cannot fit without truncation.
- Use terminal palette colors for series and adapt secondary text to terminal color support and background.
## Testing
Add unit and snapshot coverage for axis scaling, signed bars on light and dark terminals, missing and zero values, narrow layouts, tiny segments, authoritative totals, and duplicate-date remainders.
GitOrigin-RevId: 2ed58def17abd14e77929016a54fd20e91d45670
## Why
Token plan claims can be stale, and the active account or user can change while a request is in flight. Analytics report selection and account-bound response data need to reflect the verified identity and current server plan.
## What changed
- Fetch the active account's plan once per analytics session and use it to select report endpoints and supported credit breakdowns.
- Add report loading with a fixed end date, account-scoped response caching, and token model filtering. Reuse payloads across grouping changes and evict invalid cached responses so requests can retry.
- Prefer complete attribution for usage breakdowns within the requested range; retain legacy surface/model data when attribution is incomplete and include all features in turn-start breakdowns.
- Add cancellable report-loading state with timeout and interruption errors, and preserve actionable sign-in and retry messages.
- Recheck the active identity after rate-limit reads before exposing account-bound fields.
## Testing
Add regression tests for server plan discovery, report routing and caching, model filtering, attribution fallback, failed-request retries, load cancellation, authentication recovery, and account or user changes during requests.
GitOrigin-RevId: 45c4c09f108c9703893f3ed15613437ebd7c74a8
## What changed
- Add `AnalyticsSession` to load local ChatGPT credentials, bind requests to the initial account and user, and reject identity changes before requests or when accepting results.
- Reload credentials and provide bounded recovery for unauthorized requests, using a backend client that disables redirects.
- Add lazy TUI analytics session initialization, account display metadata, and plan-specific credit groupings for future dashboard integration.
## Testing
Add regression tests for account and user changes, missing or API-key-only authentication, credential reloads, recovery after a `401` response, and session initialization after signing in.
GitOrigin-RevId: 2ba0d96fb44936d12d13aedffc3f2e61aedea560
## What changed
- Add daily text token history grouped by model or token type, with date-range and model filtering, freshness metadata, and validation of token counts. Support both grouped and per-model report data, including reported model totals when components are unavailable.
- Add credit formatting helpers that preserve tiny signed adjustments and format integer millionths without floating-point rounding, plus a short date formatter.
## Testing
Add unit tests for token groupings, model filtering, freshness, missing components, explicit zero totals, and credit formatting across tiny refunds and integer limits.
GitOrigin-RevId: 706dcae7995e46707c2f1df9cdf3e06966459dd6
## What changed
Add display models and adapters from typed backend responses for usage, credits, messages, plugins, and skills. Normalize reports into daily histories with grouping labels, units, and freshness timestamps.
Preserve missing values, signed credit adjustments, and full daily totals when grouping usage by task start. Account for unassigned message counts as `Other`, merge duplicate dates, and fill unreported days only for credit reports. Group models contributing less than 1% of relative usage into `Other`.
This adds the data preparation layer for dashboard integration; it is not yet connected to `/usage`.
## Testing
Add unit tests covering missing versus explicit zero values, signed credits, enterprise labels and freshness, usage grouping, duplicate-date message remainders, and unsupported message groupings.
GitOrigin-RevId: 931f46a9a6521b4cda2fc26051e7a305cbf6fa6c
## Why
The TUI renders supported inline math as Unicode but leaves display equations to ordinary Markdown rendering. Display fractions need spatial layout, and streamed equations must remain mutable while their closing delimiter is pending.
## What changed
- Render supported standalone `$$...$$` and `\[...\]` equations as Unicode, with stacked fractions and aligned baselines.
- Fall back to source for unsupported expressions, nested fractions, and spatial layouts that exceed the available width or occur inside lists or block quotes.
- Preview unfinished display math as wrapped source and hold it out of scrollback within the conversion budget, then render it when closed.
- Preserve display delimiter boundaries across incremental rendering and bound lookahead for rejected openers so shell `echo $$` does not retain the entire response.
## Testing
Add snapshots and regression tests for display layouts, narrow widths, literal fallback, streaming closure, resize reflow, raw source preservation, shell dollars, and bounded incremental rendering.
GitOrigin-RevId: ab54675f2e27a243f5d7165c76d9d7355f9fabd1
## Why
Interrupted or failed turns can discard buffered answer or plan source, leaving incomplete math content missing from the transcript or unable to reflow correctly.
## What changed
Flush and consolidate both answer and plan streams before `finalize_turn` clears streaming state. Reuse the same helper for normal completion, preserving received source for terminal resizing and raw output mode changes.
## Testing
Add regression coverage for interrupted answers and plans, failed plans, and policy errors with unfinished math blocks, with and without a trailing newline. Verify source preservation and stable content across width and raw output mode changes, with narrow transcript snapshots. Update the usage activity test to verify that history insertion waits for stream consolidation.
GitOrigin-RevId: 1ae0c192e2fee00dc0b5ee2ac07f3d5f2313ad1b
## What changed
- Add experimental `account/read.workspaceRouting` metadata containing the selected ChatGPT workspace ID, resolved HTTPS backend origin, and routing override (`us`, `us_cr`, or `NO_CONSTRAINT`).
- Discover and cache routing through `accounts/check` for saved logins, new logins, and workspace switches. Return `null` for signed-out accounts, API-only accounts, and saved credentials without a selected workspace.
- Validate discovered origins against required `chatgpt_base_url` origins. Return errors for failed or malformed discovery and retry on later reads.
- Wait for requirements and routing before publishing account updates, including to newly initialized connections. Clear routing on logout, discard stale discovery results, and guard queued notifications against account changes.
## Testing
Add unit and integration coverage for origin resolution and validation, discovery failures and retries, startup discovery, workspace switching, logout, configuration changes during discovery, and authentication changes while notifications wait for queue capacity.
GitOrigin-RevId: 2c5367bb01dd7543b08d374f44444323e40f1981
## Why
Resuming a thread initialized its collaboration mode to Default, losing the saved Plan mode and its developer instructions. Reconnecting clients also lacked a server-reported mode to reconcile changes made by another client.
## What changed
- Restore the saved collaboration mode from the latest matching `ThreadSettingsApplied` event, falling back to the last legacy `TurnContext`. Apply the effective model and reasoning effort while retaining the saved mode and developer instructions.
- Include `collaborationMode` in `thread/resume` responses and update the generated schemas and bindings.
- Use the restored mode in the TUI, including the first prompt after resume. Prefer the server's mode when restoring disconnected input, while preserving the local selection for older servers that omit it.
## Testing
Add regression coverage for persisted and legacy collaboration modes, model and reasoning-effort overrides, the resumed Plan mode display and first prompt, and reconnect behavior with and without a server-reported mode.
GitOrigin-RevId: ed064516e7fae1c1668152ab448f510cbcacfe06
## What changed
Convert supported expressions inside `$...$` and `\(...\)` to readable Unicode in regular and streaming Markdown. For example, `$\alpha^2 + \beta_{10}$` renders as `α² + β₁₀`. Support a bounded TeX subset including symbols, superscripts, subscripts, square roots, and parenthesized fractions, with verbatim fallback for unsupported expressions.
Exclude code, links, HTML, and display equations from conversion, and avoid interpreting common currency and shell syntax as math. Preserve file citation paths and keep streaming cache boundaries outside display equations.
## Testing
Add snapshots for inline rendering and narrow wrapping, plus regression tests for unsupported input, parser limits, Markdown contexts, file citations, and streaming display boundaries across chunks and widths.
GitOrigin-RevId: 828bf7b48345b05bc6c2fb5cb2798412c3b71dbe
## Why
Remote app servers cannot read image paths on the TUI host. Image attachments need to carry their contents when submitting to a remote workspace.
## What changed
- Prepare local images as data URLs off the event loop for new turns and steers, preserving source pixels for model-specific resizing and enforcing a 32 MiB image transport budget.
- Show preparation progress, preserve queued message order, and recover drafts on preparation failures, cancellation, disconnects, or thread switches. Ignore stale preparation completions.
- Avoid duplicate user messages from server receipts and duplicate image labels in history.
## Testing
Add regression tests for portable image contents, receipt deduplication, draft restoration, responsive input during preparation, and cancellation across thread and connection changes.
GitOrigin-RevId: 6404615eae0b06c141af96b4229501c61f7fcfee
## Why
Matches starting inside a lowercase expansion such as `İ` → `i̇` could receive an incorrect prefix bonus or gap penalty, causing strings that lowercase identically to rank differently.
## What changed
Track the first matched position in the lowercased text directly when calculating scores. Preserve original character indices for highlighting.
## Testing
Add a skill popup regression test and snapshot covering ranking and highlighting for matches beginning at the combining dot in expanded and already-lowercase names.
GitOrigin-RevId: 78a8b79f1defca9f76fde5df945b0b1ff4af25da
## Why
A persistent tmux session can gain remote clients after Codex starts, so successful native copying must not skip terminal forwarding. Terminal sends also lack delivery acknowledgement and cannot replace native copying reliably.
## What changed
- Attempt native copying first, then independently forward through tmux or OSC 52 in tmux and SSH sessions. Preserve existing native clipboard leases when a later copy returns no new lease.
- Target the most recently active client in the current pane's tmux session, checking that client's clipboard capability before sending. Retain OSC 52 fallback when tmux forwarding fails.
- Reject empty selections without touching clipboards and apply the 100,000-byte terminal payload limit to tmux copies.
- Resolve tmux and PowerShell through trusted system locations, adding Nix system profiles and the WSL PowerShell directory to helper discovery.
## Testing
Add regression coverage for native-before-terminal ordering, fallback routing, clipboard lease retention, empty and oversized payloads, tmux client selection, capability checks, and combined backend errors.
GitOrigin-RevId: df4b66fa4368a3cf19b4d07fde6c76ea96a8fef5
## Why
When terminals deliver pasted text as individual key events, tabs can trigger completion, submission, or queuing instead of preserving indentation in the draft.
## What changed
Capture unmodified `Tab` events during paste bursts before shortcut dispatch, including after short Unicode prefixes. Refresh the burst idle timeout when appending tabs or newlines, and flush expired bursts before handling manual `Tab` shortcuts.
## Testing
Add regression tests for multiline tab preservation, ASCII and Unicode prefixes, idle timeout refresh, completion suppression, and normal submission and queue shortcuts. Add a snapshot for pasted indentation.
GitOrigin-RevId: ba404cfe66c23f37da5a0db7cccfdd3d4c4af331
## Why
Command execution and plugin measurement events lack model and reasoning-effort labels. Attribution needs to reflect the step that invoked the command, even when model settings change before a background process finishes.
## What changed
- Add `model_slug` and `reasoning_effort` to command execution and plugin measurement analytics.
- Capture model context from resolved step settings and carry it through execution, approval, Guardian review, and plugin metrics collection.
- Preserve the first command-start model context when subsequent start notifications arrive.
- Keep the carried context out of serialized protocol items and generated schemas.
## Testing
Extend analytics tests to cover model switches before invocation and during background execution, default reasoning effort, Guardian-denied commands, and repeated start notifications retaining the original model context.
GitOrigin-RevId: af90e1c0d39bab625f2e89786085b61a9b96c0ce
## What changed
- Add a configurable `new_worktree` action, bound to `w`, for local sessions with worktree support enabled.
- Create the worktree from the cached project default branch, preferring remote `HEAD` and falling back to conventional `main` or `master` refs without fetching. Preserve the selected subdirectory and source checkout edits.
- Start and bind a blank session in the new worktree, preserving the selected approval reviewer without sending an initial turn.
- Show creation progress, pause conflicting actions, clean up unclaimed clean worktrees, and report retained checkout paths when session startup fails. Clear pending creation state on reconnect.
## Testing
Add coverage for default-branch selection, source checkout preservation, session ownership and approval settings, cleanup, startup failures, reconnect state, and busy-state rendering. Extend Git environment isolation coverage and test unrelated non-UTF-8 refs.
GitOrigin-RevId: 771ddc12d04dbf0d12e77e9c96c8386cf31e67c5
## Why
Scrolling with `CSI S` can discard history rows in QTermWidget and xterm.js when the viewport grows.
## What changed
Use newlines at the bottom of the history scroll region for `ScrollbackStrategy::Standard`, preserving the composer and restoring the cursor and full-screen scroll region afterward. Fall back to full-screen scrolling when only one history row exists, since `DECSTBM` requires two distinct rows. Skip scrolling when there are no history rows or no rows to scroll.
## Testing
Add regression tests for composer and cursor preservation, scroll-region restoration, emitted newline sequences, single-row scrollback preservation, and no-op growth. Snapshot visible geometry for growth by one, three, and four rows.
GitOrigin-RevId: 1dbfc30bb6997dcc2738ec6b2f42d35c786124de
## Why
Pasting during `Ctrl+R` history search previously went through normal composer paste handling instead of updating the search query.
## What changed
- Append sanitized pasted text to the active query and restart matching from the newest history entry, including for large pastes and image paths.
- Ignore empty pastes so they preserve the selected match.
- Display newlines and tabs as `↵` and `⇥` in the footer while matching the original query, and clamp the cursor safely for very large queries.
## Testing
Add regression tests and snapshots covering pasted query acceptance, empty pastes, draft restoration on misses and cancellation, sanitization, large pastes, image paths, separator rendering, and cursor placement.
GitOrigin-RevId: 2ec13fdddcb7503a72a21fc03b2a27ed36313a8a
## What changed
- Replace the inline task composer with a session list: `n` opens a blank session in the selected checkout without sending an initial turn or interrupting running agents.
- Use single-letter action shortcuts and `Enter` to open a session. `Esc` cancels search or rename without closing the list; `Ctrl+C` quits from the list.
- Load destination settings for new sessions while carrying over explicit permission choices. Retain blank sessions and their drafts across navigation until the first turn.
## Testing
Update tests and snapshots for command center navigation, shortcuts, blank draft restoration, destination defaults, permission carryover, and directory trust.
GitOrigin-RevId: bddd04fdbe6ac2f5b7bd70293fd04f673b97ba02
## What changed
Remove the animated stars shown when selecting Astra, along with their input, terminal-focus, and model-selection hooks.
## Testing
Retain draft text and live voice control snapshots in a standalone composer snapshot test, and remove sparkle-specific tests and snapshots.
GitOrigin-RevId: cbe4396e8700cabfb1e0db9fbe8f997b94316c0f
## Why
Unterminated prose stayed hidden until a newline arrived or the stream completed, leaving long single-line responses invisible while they streamed.
## What changed
- Show live prose previews for agent messages and proposed plans, requesting redraws when the preview changes.
- Keep previews out of the scrollback queue and render the full source on newline or completion without duplicating text.
- Bound previews to the most recent 8 KiB at a Unicode character boundary, with an ellipsis for omitted text, and reflow them when the width changes.
- Preserve holdback for incomplete table and code structures, retaining the last safe prose preview when a pipe arrives.
## Testing
Add controller tests and TUI snapshots covering visibility before completion, resize reflow, finalization without duplication, long Unicode previews, table and code holdback, and inline visualization context.
GitOrigin-RevId: 26c83c218b986625820b20779a46d1b800a7e0ff
## Why
Unbracketed multiline pastes could submit the report form at the first newline, before the full note was entered.
## What changed
Use `PasteBurst` in the report note editor to insert newlines during rapid paste input and allow `Enter` to submit after the burst ends. Extend the burst window across newlines and tabs, and clear burst state after explicit pastes or other editing input.
## Testing
Add regression tests for multiline paste bursts with short first lines, blank lines, and tabs, verifying the complete submitted note with and without logs. Add a multiline rendering snapshot and a test that bracketed paste stays in the report form, leaves the chat composer empty, and allows immediate submission.
GitOrigin-RevId: a76e680a01767c619a4fcc150d1dcad537e67194
## Why
Saving a manual thread name leaves pending title generation running and its progress indicator visible until the request finishes.
## What changed
- Cancel pending title requests after a successful manual rename, including renames from the agents overview, and clear the progress indicator immediately.
- Interrupt canceled title-generation turns and unsubscribe their temporary threads. Ignore late start and completion events so canceled requests cannot affect newer requests.
- Cancel pending title requests when resetting connection state.
- Show only a spinner when generating a title without an existing name, removing the `renaming...` placeholder.
## Testing
Add regression tests for manual and overview renames that verify turn interruption, cleanup, and preservation of the saved name. Cover late events after cancellation and update footer and terminal-title snapshots for the spinner-only display.
GitOrigin-RevId: f9490ea7be9968ea6c35d80bfbac06fee57d0135
## Why
The 900-byte recap prompt limit leaves little room for completed progress, unresolved caveats, and recent corrections. Recaps need this context to distinguish completed work from pending requests.
## What changed
- Introduce a shared `RecapPrompt` with a 32 KiB ceiling for instructions and history, using an 8,192-token estimate. Instruct summaries to retain the broader goal, completed outcomes, and unresolved availability or validation caveats.
- Select up to eight answered exchanges plus a pending request, preserving adjacent steering and progress messages. Drop older whole exchanges before excerpting both ends of oversized messages, while retaining the newest answer and pending correction.
- Require a `summary` and nullable `next_action`, bounded to 700 and 200 characters respectively. Reject malformed or oversized responses and display an optional, separately styled `Next:` line.
## Testing
Add coverage for UTF-8 prompt bounds, exchange selection, pending corrections, excerpt boundaries, strict response parsing, and next-action rendering. Extend the recap generation integration test to verify bounded history and the structured response schema.
GitOrigin-RevId: 6c6a84bc602a168418c1952feb1d286ec0cb9e28
## What changed
- Increase the automatic recap delay from 3 to 30 minutes.
- Replace the recap heading and divider with an italic `↳ Recap:` layout, hanging indentation, and right padding. Preserve explicit line breaks and Unicode, splitting URLs only when they exceed the available text column.
- Use Tokio's clock for automatic recap eligibility and create the timer before spawning its task.
- Remove the `token_budget.use_history_notes_extension` override from temporary structured requests.
## Testing
Add coverage for the 30-minute deadline, recap styling, narrow terminals, Unicode, and URL wrapping. Update recap generation and reconnect tests to advance Tokio's clock instead of relying on host uptime.
GitOrigin-RevId: 79a9bca779020b59a409207163b02944b30c1a20
## What changed
- Display input/output token counts and estimated credits and USD cost in task details. Prefer live token totals, falling back to complete totals from usage breakdowns.
- Fetch estimates for the selected task on a one-minute cadence for supported Business and Enterprise plans. Cache results, preserve prior nonzero estimates when a response reports zero, and stop fetching when the capability is unavailable.
- Clear cached usage and discard pending results on account changes, reconnects, or missed server events. Prioritize activity and usage over the original prompt when space is limited.
## Testing
Add a rendering snapshot and tests covering caching, stale results, unavailable usage, token resets, and incomplete usage breakdowns.
GitOrigin-RevId: b72c96053557389fdc723a70fab0dab841a52e49
## Why
The command center previously refused to open tasks managed by another app server, preventing users from viewing their saved history.
## What changed
- Fall back to a frozen, read-only history snapshot when attaching fails because another server owns the task. Preserve drafts and skip buffered request replay and paused-goal prompts while viewing.
- Keep the snapshot when reopening the displayed task, and allow explicit retry to attach once the other server releases it.
- Allow pasting into the command center while a read-only conversation is displayed, while keeping the conversation composer protected.
- Box the TUI startup future to keep it out of the CLI caller's frame.
## Testing
Add coverage for read-only history, draft and selection preservation, retry before and after ownership release, and history-read failure without leaving the current conversation. Assert that opening a read-only task does not start a turn and that the TUI startup future remains below 64 KiB.
GitOrigin-RevId: f1bdb5b2d9182079de4e53346a56742a4a02a1c7
## What changed
- Cycle task grouping through project, status, and model with `Ctrl+S`, and show the active grouping in the footer.
- Group tasks by model with the most recently updated tasks first within each group. Use `Unknown` for missing or empty model names.
- Display the model in task details and refresh it when thread settings change.
- In model grouping, dispatch new tasks without inheriting the selected task's working directory, matching status grouping.
## Testing
Add coverage for model grouping, selection preservation, navigation, and new-task dispatch across grouping modes. Update snapshots for model details and grouping hints.
GitOrigin-RevId: 429cf61c1e7438ba3b2f989d3ed14e12545856f7
## Why
Completed voice captions could disappear before their queued history insertion ran. Interleaved user and assistant updates could also hide the other speaker's caption and restart its animation.
## What changed
- Preserve separate live caption cells for both speakers, rendering the user above the assistant without restarting settled text.
- Render completed captions while history insertion is pending, then move them into history in one app event. Keep them visible when agent streaming delays insertion.
- Invalidate the transcript overlay when an interleaved caption is cleared.
## Testing
Add regression tests for caption visibility through deferred history insertion, settled animations with either speaker arriving first, and empty caption completion during active and stopping sessions. Update replay coverage to exercise the app's history handoff.
GitOrigin-RevId: 31de6fc74b6dc7ff148c554e3176bf3ee92dced9
## What changed
- Use literal model instruction templates and the standard fallback prompt, ignoring legacy personality variables. Retain catalog decoding compatibility and report `supports_personality` as `false` for generated model presets.
- Stop emitting `<personality_spec>` developer messages and assigning an implicit Pragmatic configuration default.
- Filter Friendly/Pragmatic overrides from TUI requests while preserving explicit `personality = "none"`. With `features.personality` enabled, this opt-out still strips the model's personality section.
- Refresh inherited model instructions for agent roles only when the personality opt-out changes, preserving custom instructions.
## Testing
Update coverage for literal legacy templates, deprecated overrides on turn start and resume, role instruction refresh, and forwarding the explicit opt-out through thread start, resume, and fork requests.
GitOrigin-RevId: 1391db4e565e010569f0885f80013d1f86b45825
## What changed
Use `windowsSandbox/setupStart` for elevated and unelevated setup, and handle completion notifications while retaining the pending approval preset and permission profile selection. Verify the effective sandbox mode before enabling Agent mode.
Keep input locked and setup pending when the start request times out or its response is lost. Block thread replacement during setup, ignore completion notifications for a different mode, and clear interrupted setup state with a restart message after reconnection. Preserve the fallback prompt when elevated setup fails and report unelevated setup failures.
Remove the TUI's direct sandbox setup helpers and sandbox-mode configuration writes.
## Testing
Add regression coverage for uncertain setup responses, matching completion modes, blocked thread replacement with retained input, and interrupted setup during reconnection.
GitOrigin-RevId: 5ec1101a1a69b3f96f01fc2ba6a03112705f4918
## Why
The Windows TUI cannot configure a remote executor's sandbox. Required elevated sandbox setup also needs to reflect the local app server's readiness rather than the TUI's local setup files.
## What changed
- Restrict setup prompts and actions to local connections with local executors, including local daemon connections. Let remote servers own Agent permission selection, and warn when local and remote executors are configured together.
- Query `WindowsSandboxReadiness` at startup when elevated sandboxing is required locally, and track successful setup across chat widget replacement and reconnects.
- Restore pending initial input to the composer when mixed executors prevent required setup or a local connection goes offline.
## Testing
Add regression coverage for local, remote, and mixed host selection, remote Agent permission selection, pending input restoration with mixed executors, and setup state preservation during daemon reconnects.
GitOrigin-RevId: bd45b308ac3ae4c2489b0bd2ac5d7e12a7fc35d6
## What changed
Remove the `/personality` command, selection popup, tooltip, and associated settings update and persistence handlers. Stop sending a personality override with TUI user turns.
GitOrigin-RevId: 0549a1f9dcfd8118340fad4b60fd24d4eee7f93a
## What changed
Remove TUI-triggered world-writable scans at startup and during permission changes, along with their warning dialogs, acknowledgement handling, and scan telemetry. Permission selection and shortcuts no longer check for these warnings, and terminal color probing no longer waits for a startup scan.
GitOrigin-RevId: a8d2fb5de7f891dcae5261286743fe3a125b82aa
## What changed
Replace the selectable personality templates in the bundled `gpt-5.4` and `gpt-5.5` definitions with fixed friendly instructions. Personality selection becomes unavailable for these models in the TUI, and submitted turns omit the personality override. Remove personality overrides from Python SDK examples and the walkthrough notebook.
## Testing
Update core and TUI tests to cover fixed friendly instructions, ignored pragmatic updates, unavailable personality selection, and omitted turn overrides. Preserve coverage for selectable personalities in legacy catalogs, and add coverage for resumed legacy sessions and explicit empty instruction overrides.
GitOrigin-RevId: 869a71445584272405fcbd1325efc31c224808c8
## Why
A quiet sample cleared all earlier activity from that channel's voice meter, making recent speech disappear immediately.
## What changed
Let quiet samples scroll into the microphone and speaker meter history so earlier activity remains visible until it ages out.
## Testing
Update history assertions and the meter snapshot to cover quiet samples on each channel and the eventual return to silence after a full history window.
GitOrigin-RevId: 834157df28c9d2cfbe9fa17bbfaf32b81313a295
Eric Traut