## Why
Windows Terminal and xterm.js can render a theme that differs from the
underlying console color table. Querying that visible theme through OSC shares
the console input queue with keystrokes, including input for security-sensitive
startup prompts.
## What changed
- Defer the Windows OSC color probe until protected startup decisions and the
world-writable workspace scan have completed.
- Preserve and replay unrelated console input records around the probe, while
removing only valid OSC 10 and 11 replies and retaining the console palette
as a fallback.
- Require an explicit confirmation key after shortcuts select trust, sandbox,
or world-writable warning choices, so a fragmented terminal reply cannot
accept them.
- Accept one- through four-digit OSC RGB components so the visible terminal
palette is applied across supported response formats.
## Testing
Added coverage for delayed startup scans, protected prompt confirmation,
console-record replay, bracketed paste and malformed OSC preservation, RGB
response parsing, and light-theme composer rendering.
GitOrigin-RevId: b8ae456fe32c701ba3af31e9cc452fc4e8bffa22
## What changed
- Generate a title suggestion from the latest substantive user and assistant messages when the TUI `/rename` prompt opens.
- Prefill the prompt with the result while keeping it editable and preserving any text the user enters before generation finishes.
- Bound and escape the conversation context, omit commentary and IDE context, and correlate responses with the active thread and prompt so stale suggestions are ignored.
## Testing
- Cover conversation selection and prompt construction, generated-title delivery through the embedded app server, loading and prefilled prompt states, stale responses, and preservation of manual edits.
GitOrigin-RevId: 1e7f1d5d4f6503ff9da0548388f610c446c130ca
## What changed
- Give unnamed TUI threads an immediate provisional title from the first user message, then replace it asynchronously with a normalized generated title.
- Preserve manual renames by applying a generated title only while the provisional title is still current, and keep automatic rename notifications out of the transcript.
- Run title generation in a bounded ephemeral structured request that preserves custom permission profiles, otherwise uses read-only access, and disables tools and MCP servers.
## Testing
- Cover prompt and response bounds, Unicode-safe truncation, title normalization, manual-rename races, silent automatic updates, permission preservation, and structured-response failures.
GitOrigin-RevId: 7ed73522f4f6c65a005f65f3a903974d8419e312
## What changed
- Include matching Codex tasks in the `@` mention popup when the active thread supports task tools, prioritizing tasks from the current working directory.
- Submit selected tasks as bounded live thread references so Codex can load their contents with `read_thread`.
- Preserve task mentions across composer history and thread start, resume, and fork flows.
## Testing
- Add coverage for task search and capability propagation, popup selection and rendering, submission encoding, history round-trips, and reference validation and limits.
GitOrigin-RevId: 17502be91bf6d4b01745668829eb69fb318cb5b9
## Why
The TUI rejected app-server dynamic tool calls as unsupported, so agents could
not inspect or manage other Codex tasks through a TUI session.
## What changed
- Add the `codex_tui` tool namespace for listing, reading, waiting on, creating,
forking, messaging, renaming, archiving, and restoring tasks.
- Handle tool calls through existing app-server thread operations, with bounded
inputs and responses and cleanup when calls complete or the TUI disconnects.
- Route delegation tools through an authenticated local MCP server with explicit
approval prompts, while respecting configured and managed MCP policies.
- Fall back to starting threads without dynamic tools when connected to an older
app server that does not support them.
## Testing
Add coverage for tool schemas and response bounds, task lifecycle operations,
approval-gated MCP transport, namespace dispatch, cancellation, and legacy
app-server fallback behavior.
GitOrigin-RevId: c782c11f0a3edceb3fa6909a4b92d6ce01a6eed3
## What changed
- Open a picker for `/copy` with the whole response plus each fenced code block and blockquote from the latest response.
- Label code blocks by language, show content previews, and preserve source whitespace and nested quote Markdown when copying an individual target.
- Keep the picker from disturbing terminal scrollback or queued input, retain clipboard leases, and avoid writing copied content to the session log.
## Testing
- Add coverage for target extraction, picker navigation and cancellation, exact copied content, plan responses, queued input, scrollback preservation, clipboard failures, and session logging.
GitOrigin-RevId: 77a35bc99f4f45932d39914f9a709b30fe8cd7c2
## What changed
- Add unbound `previous_permission_mode` and `next_permission_mode` actions to
`tui.keymap.chat` so users can configure shortcuts that cycle through the
available built-in permission modes.
- Apply shortcut selections only to the active session, without writing them
to `config.toml`, and report update failures in the transcript.
- Exclude modes disallowed by managed requirements or platform safety checks,
reject printable-key bindings, and ignore these bindings in project config.
## Testing
- Cover mode cycling, unavailable modes, session-only updates, server errors,
stale threads, keymap validation, and project-config sanitization.
GitOrigin-RevId: c3cfdf1e732b7b7bfe8f53fcac19a37e593bbfab
## Why
When the app server reports a misalignment policy violation, the TUI must stop the affected chat rather than allow more work to continue in it.
## What changed
- Finalize the active turn, clear queued and draft input, disable the composer, and reject further operations and interactive requests for the stopped chat.
- Interrupt an active side conversation when its parent reports the violation, and prevent queued turns, forks, approvals, or goal resumption from restarting work.
- Show a non-dismissible precaution view that directs users to start a new chat or resume another one, with agent command center navigation for remote sessions.
## Testing
Added coverage for stopped-chat behavior, parent/side-thread handling, blocked goal resumption, navigation actions, and narrow and remote-session rendering.
GitOrigin-RevId: 0268c46a19294a17765ea4099f389f15ffaaf030
## Why
Some managed filesystem permission profiles cannot be represented by the
legacy app-server sandbox policy without changing which paths are accessible.
## What changed
- Require legacy sandbox conversion to preserve the filesystem policy's
semantics, and reject unsupported profiles with an actionable error.
- Keep queued follow-up messages and safety-buffered retries intact when
permissions are rejected, resuming queued input only after a compatible
profile is selected.
- Cover compatible profiles, lossy restrictions and write roots, turn-start
handling, and safety-buffered retries with regression tests.
GitOrigin-RevId: 345cc2a839206b2b1997e8981feb59f91b6975cc
## What changed
- Add `codex agents` to open the shared agents overview without creating a new session.
- Start the local background app server automatically on Unix, or connect to a server supplied with `--remote`.
- Reject invocation-specific session overrides that cannot apply to shared sessions.
- When the overview is opened from an embedded session, offer to start the background server without moving or interrupting the current session.
## Testing
- Cover command-line parsing and rejection of incompatible overrides.
- Snapshot the embedded-session background-server prompt.
GitOrigin-RevId: 60845dfebc48d820dc4ff090626d30452127f062
## What changed
- Let users start tasks, open root sessions, rename tasks, and stop active work directly from the agents overview.
- Show details for the selected task on wide terminals and limit the overview to root sessions while still reflecting background activity.
- Preserve draft input and pending server requests when switching sessions so running roots and their subagents can continue in the background.
- Apply the selected project's working directory when dispatching from project grouping, including remote workspaces.
## Testing
- Expand overview rendering and interaction coverage for root filtering, dispatch, search, selection, renaming, and responsive input.
- Cover switching away from roots with running subagents and retaining background server requests.
GitOrigin-RevId: b7b0d33b7ecc077498efb756a0ad2fd425158b17
## What changed
- Add `/agents` to open a full-screen dashboard of loaded root sessions from the shared app server, with subagent status reflected in each root session.
- Support search, navigation, and grouping sessions by project or status.
- Refresh the dashboard when relevant thread notifications arrive, while preserving its selection and view preferences.
- Show a clear message when the dashboard is unavailable with the embedded app server.
## Testing
- Add coverage for dashboard rendering, status grouping, persisted view state, and restoring the conversation viewport after closing the dashboard.
- Cover `/agents` command discovery and dispatch from parent-owned threads.
GitOrigin-RevId: 6651f4c47358116e1809da3ac8844a5842026a95
## Why
The app directory is a discovery catalog and can include apps that are not
callable in the active thread. Using it for `$` suggestions can therefore
offer mentions that cannot be used.
## What changed
- Load mention candidates from `app/installed`, enrich callable apps through
bounded `app/read` batches, and retain compatibility with app servers that
do not support `app/installed`.
- Keep the mention catalog separate from the `/apps` directory cache and scope
results to the current thread, workspace, and account.
- Refresh mentions after app notifications, enablement changes, configuration
updates, and apps MCP readiness, while immediately removing disabled apps.
## Testing
Add coverage for batching and fallback behavior, stale scoped results,
notification refreshes, enablement changes, MCP startup races, and filtering
non-callable apps from mentions.
GitOrigin-RevId: 4d9e20794aed30cc97120170792fb555b86fe1e7
## What changed
- Add `/cd [path]` for changing an idle local session's working directory while preserving conversation history. Relative paths resolve from the current directory, and omitting the path selects `~`.
- Reload project configuration, instructions, permissions, keybindings, file search, and hooks for the destination before replacing the active session.
- Reject unsafe transitions, including active or queued work, background terminals, remote environments, untrusted destinations, and incompatible permission profiles.
- Add `/pwd` and its `/cwd` alias to display the current working directory, and discard asynchronous results left over from the previous directory.
## Testing
- Cover command parsing, aliases, default paths, session eligibility, transition failures, history preservation, destination policy loading, hooks, and stale events.
GitOrigin-RevId: 1a987c029f157a087ba02c0f26e022260409132b
## Why
App directory data and in-flight requests can outlive the account, workspace, or thread that produced them, allowing stale apps to appear in the current TUI context.
## What changed
- Invalidate cached app data, dismiss the app picker, and start a fresh fetch when the account, workspace, or thread changes.
- Tag app directory fetches with their originating thread, workspace, and scope generation, and ignore queued requests or results that no longer match.
- Treat `AppListUpdated` notifications as revalidation signals instead of directly adopting their unscoped contents, with deduplication and a bounded error retry.
## Testing
Added coverage for stale request and result rejection, context invalidation, picker dismissal, and notification revalidation.
GitOrigin-RevId: f20930a0598a6abbdfb3c7826ec955346fe2da7a
## Why
Terminal probes and other bootstrap work can leave keys or partial control
sequences buffered before an interactive startup screen is visible. Those
inputs must not accidentally select or confirm an action, while typeahead
intended for the composer should survive terminal initialization.
## What changed
- Replay user input consumed by Unix startup probes through Crossterm while
filtering completed terminal color replies, and avoid consuming the Windows
console input queue when detecting default colors.
- Drain decoded and unread input after rendering actionable startup screens,
including onboarding trust, migration, update, provider, resume, and hooks
prompts. Keep incomplete control sequences quarantined and fail closed when
an input boundary cannot be resolved.
- Restore terminal modes if initialization exits early and bound terminal probe
reads by time and byte limits.
## Testing
Add parser, boundary, onboarding, and PTY coverage for preserved typeahead,
split escape sequences, bracketed paste, delayed input, and fresh input after
an interactive screen becomes ready.
GitOrigin-RevId: 321198996cdd88fe9b43c4a762e750bff450482c
## What changed
When `Ctrl-C` is pressed with an empty composer while a task is running in a local daemon session, show a menu that lets the user:
- cancel the task and stay in Codex;
- exit Codex while leaving the task running; or
- stop the task and exit Codex.
Do not offer background execution for side-thread tasks or when follow-up messages are queued. Preserve existing `Ctrl-C` behavior for non-daemon sessions, drafts, paste bursts, MCP startup, and returning from an active side thread.
## Testing
Add TUI tests for each exit action, menu dismissal, side threads, queued follow-ups, composer input, MCP startup, and non-daemon sessions.
GitOrigin-RevId: 539c33d3a4ff288a015bddbe9465d2bbdbe018d0
## What changed
- Extend `account/usage/read` with an optional `threadId` request and a
backward-compatible `threadUsage` response containing estimated credits,
optional USD cost, and model, reasoning, speed, and token breakdowns.
- Fetch thread usage for eligible Business and Enterprise plans when `/status`
is opened, then update the rendered status card asynchronously.
- Preserve terminal scrollback when replacing a visible status-card tail, and
append a refreshed card when the original tail can no longer be updated.
## Testing
- Add app-server coverage for authentication, canonical thread IDs,
unavailable billing routes, and malformed IDs.
- Add TUI coverage for usage formatting, stale responses, retries, history
updates, terminal reflow, and scrollback preservation.
GitOrigin-RevId: 49300914b3fba917c0f08e8595363e04e5ba6d37
## Why
Prompt editing looks up the selected user message in the thread's turns, but
new live turns may still exist only in the replay buffer.
## What changed
Reconstruct buffered turns from turn and item notifications before locating
the prompt to edit. Preserve completion metadata and avoid duplicating turns
or items already present in the snapshot.
## Testing
Extend the prompt-edit fork test to cover a selected turn supplied through the
replay buffer and verify that the source thread remains unchanged.
GitOrigin-RevId: e357098085a4def871f3df65b6721a31e07b737f
## What changed
- Add a `Ctrl+A` action and footer hint for archiving the selected session in the resume picker.
- Send archive requests through the app server, remove successfully archived sessions from the picker, and surface failures inline.
- Prevent duplicate actions while an archive is pending, preserve configured keybindings, and direct users to `/archive` when they select the current session.
- Ignore archive notifications for untracked side threads so they do not appear in agent navigation.
## Testing
- Cover successful, repeated, rejected, and failed archive requests, shortcut conflicts, footer rendering, and untracked-thread notifications.
GitOrigin-RevId: 20ea21c804a9685e46484d67df967859f9be4651
## What changed
- Add `/export` with clipboard and file destinations, including a default filename prompt and support for an explicit path argument.
- Export the complete conversation history as structured Markdown, preserving user and assistant messages, plans, reasoning, activity, image labels, file changes, and MCP tool details while honoring reasoning visibility.
- Fall back to legacy history loading when pagination is unavailable, and use the visible transcript for ephemeral sessions.
- Resolve relative and home-relative paths without overwriting an existing file, and report export or copy results in the conversation.
## Testing
- Cover Markdown rendering, hidden review prompts, activity details, complete paginated and legacy history loading, destination prompts, status messages, path resolution, and overwrite protection.
GitOrigin-RevId: c2815fc2430d7a555da75d7038cc1ac08157b82e
## What changed
- Share exact-name candidate lookup between resume and archive commands.
- Prefer valid SQLite names for local sessions, then recover legacy index names without overriding newer metadata.
- Validate rollout identity, collection, source, and model provider before selecting a local session, and choose the most recently modified eligible legacy duplicate.
- Preserve server-side lookup behavior for remote workspaces.
## Testing
- Cover stale and duplicate SQLite entries, legacy-name recovery, source and provider filtering, paginated histories, and duplicate legacy names.
GitOrigin-RevId: c69f86d64ff556bc7b463d13522a9241591eb070
## What changed
- Propagate the optional `modelSpecialty` field through the model catalog and
app-server `model/list` response.
- When a newly selected model has the `cyber` specialty, default an active TUI
thread to workspace-write permissions with on-request approval. Use auto
review when available, otherwise keep the user as reviewer, while respecting
configured permission requirements.
- Show a notice when auto review is applied and strengthen the full-access
warning for cyber models.
- Preserve explicitly selected permissions when only reasoning settings change.
## Testing
- Cover auto-review defaults, requirement-aware fallback behavior, permission
preservation across reasoning changes, and the new warning notice.
GitOrigin-RevId: 8f25b0082d3051d9ff91f7355921236d0f82f758
## What changed
- Keep paginated resume, transcript, and fork workflows on bounded turn and item page requests, while preserving the legacy full-history fallback.
- Refill underfilled terminal scrollback from older pages and show a transcript shortcut when earlier history is unloaded or truncated by the row cap.
- Preserve a successfully created fork if its initial history hydration fails, keep side forks bounded, and retain the correct history boundary for nested forks and subagents.
## Testing
- Add coverage for scrollback refill and truncation notices, bounded paginated requests, fork hydration failures, nested forks, and inherited subagent history filtering.
GitOrigin-RevId: 10ba952ffb2f69717fbc71aa03cac7685f7dcf78
## What changed
- Load older transcript items in bounded pages as users scroll upward, and let `Home` continue fetching until the start of the thread.
- Show loading, partial-history, retry, and complete states in the transcript overlay while preserving the visible scroll position as pages are prepended.
- Use paginated history for resume, fork, retry, and prompt-edit flows, while falling back to legacy history requests when the app server does not support pagination.
## Testing
- Cover multi-page transcript loading, page-boundary prompt reconciliation, legacy-server fallback, bounded retry history, and transcript history-state rendering.
GitOrigin-RevId: cc6b764bc4185d079b2f68bedf235c1d08278dfb
## Why
Paginated threads should not require the TUI to load and render their entire
history when a session is resumed.
## What changed
- Hydrate a bounded initial history page for paginated resumes and forks,
respecting the configured terminal reflow row budget.
- Load older transcript items in the background as users navigate upward, while
preserving the viewport, live output, and backtrack selection.
- Reconcile review-mode prompts across page boundaries and keep restored token
usage hidden until it can be attributed to a persisted turn.
## Testing
- Added coverage for paginated resume and fork hydration, older-page merging,
transcript prepending, backtrack behavior, review prompt filtering, and token
usage restoration.
GitOrigin-RevId: 42160b943a9f6a1ba0cfe4b195c24ddf410b747d
## What changed
- Accept two-stroke bindings such as `ctrl-x ctrl-s` in TUI keymap configuration while preserving arrays as alternative bindings.
- Route chords through the active TUI context, show pending and configured chord hints, and cancel pending chords on `esc`, context changes, or a one-second timeout.
- Extend `/keymap` to capture, add, replace, and display key chords.
- Reject chords that conflict with active single-key bindings, overlapping-context chords, or reserved terminal shortcuts.
## Testing
- Add coverage for chord parsing, validation, matching, timeout and cancellation behavior, context dispatch, key capture, and rendered shortcut hints.
GitOrigin-RevId: dfdede03f518d4936ad8621ebf5537026f2b282e
## What changed
- Carry dimensions on resize events and reuse the cached screen size for ordinary draws.
- Refresh terminal geometry after resize settling, process resume, and external program execution.
- Pass the resolved size through transcript reflow, viewport updates, and standalone TUI screens so each frame uses consistent dimensions.
## Testing
- Cover cached draws, resize-driven rendering, settled-size rechecks, resume refreshes, and alternate-screen size updates.
GitOrigin-RevId: 9d83dbab50d7a038bd59b4c66c13abcac69ddc79
## What changed
- Accept an optional thread name with `/fork`, trimming surrounding whitespace.
- Apply the name to the newly forked thread and update the active session metadata.
- Keep the successful fork active and show an error when naming it fails.
## Testing
- Cover unnamed and named `/fork` dispatch, persisted names, and naming failures.
GitOrigin-RevId: 1799576f82ef0856f992a0378f041e4bab89621b
## What changed
- Move the migration flow, model, and source picker under the
`external_agent_config_migration` module.
- Keep their tests and snapshots alongside the corresponding module files and
update imports and snapshot source paths.
GitOrigin-RevId: 4b2f83ca689534e4d9cd1dc7aaa8424e76166bba
## Why
Pending MCP server startup can outlive an agent turn. Treating its shared
running indicator as an active user turn prevents queued follow-ups and slash
commands from advancing after the turn completes.
## What changed
- Allow the input queue to drain while only MCP startup remains active.
- Keep queued input blocked while a review, foreground shell command, or
compaction is pending or running.
- Resume queue draining after session-selection flows close.
## Testing
Add TUI tests covering queued follow-ups, slash commands, reviews, shell
commands, and compaction while MCP startup is pending.
GitOrigin-RevId: f5684f61c32e3728ff71cf222f0486df637dc3a5
## Why
Opening the subagent picker could wait on thread metadata and live event-store locks, delaying terminal input. Its cached entries could also omit descendants that were not observed in the current TUI session.
## What changed
- Render the picker immediately from cached navigation state and refresh root descendants asynchronously with `thread/list`.
- Merge discovered descendants into an open picker while preserving its selection and live status, and coalesce concurrent refresh requests.
- Ignore refresh responses from a previous session and avoid blocking on busy event stores.
## Testing
- Extend session lifecycle coverage for nonblocking picker opens, refresh coalescing, descendant discovery, selection preservation, and status updates.
- Add coverage for rejecting a refresh response after navigation state is cleared.
GitOrigin-RevId: 7eae7f696f8d2d323a47b3fd2800ea1c1cdbf2a0
## What changed
- Add a configurable `toggle_side_conversation` TUI action, bound to `ctrl-/` by default, to switch between a side conversation and its parent without closing either.
- Show the active binding in the footer and distinguish switching from closing with `ctrl-c`.
- Allow starting a replacement side conversation from the parent, while cleaning up the previous side thread and preserving it if cleanup fails.
- Clean up retained side conversations when shutting down the current thread.
## Testing
- Cover shortcut remapping, conflicts, and compatibility with existing `ctrl-/` and `ctrl-7` bindings.
- Cover side-thread replacement and footer states for both the parent and side conversation.
GitOrigin-RevId: a621c21e1c45ba73197d59750b2e05efa5ee1081
## What changed
- Handle app-server `turn/start` rejections for pending user turns as turn
errors instead of exiting the TUI.
- Finalize the pending turn, display the failure in the transcript, and resume
queued input handling.
- Add coverage that submits a turn to a missing thread and verifies that the
error is shown while the app continues running.
GitOrigin-RevId: 6d291ba62b9e50d49dd4e3d7c429e98c1f754680
## What changed
- Accept an optional session name after `/new` or `/clear`.
- Set the requested name through the app server when starting the new thread and update the attached session with that name.
- Report naming failures in the chat while still attaching the newly created thread.
## Testing
- Cover named `/new` and `/clear` dispatch, app-server name persistence, and the existing unnamed `/clear` behavior.
GitOrigin-RevId: 570886abb4af522123f0693ce05d2415e1c0d902
## What changed
- Skip loaded-subagent backfills for fresh and forked threads, which cannot have pre-existing descendants.
- Keep the backfill after resuming a thread so agent navigation is populated immediately.
- Reuse thread status collected during backfill when opening the agent picker, avoiding duplicate `thread/read` requests while preserving liveness from live event channels.
## Testing
- Add a WebSocket-backed session lifecycle test that records app-server requests across fork, fresh-session, resume, and agent-picker flows.
GitOrigin-RevId: 604742b3cb495da12c97908d7a0ffa4ebc6a6da3
## Why
Assistant-authored inline visualizations need a terminal fallback that lets users open generated artifacts in a browser.
## What changed
- Recognize `::codex-inline-vis{file="..."}` directives in assistant Markdown and replace them with browser links during streaming, finalized history rendering, and local transcript previews.
- Materialize visualization fragments in sandboxed viewer documents with a content security policy, while restricting artifacts to HTML files within the thread's visualization directory and limiting their size.
- Show an explicit unavailable message for invalid or missing artifacts, hide incomplete streaming directives, and preserve directive text in code blocks and user Markdown.
- Add a trusted file-link path for generated viewers without enabling arbitrary `file:` links in Markdown.
## Testing
Add coverage for directive rewriting, streaming and replay, artifact validation, sandboxed viewer generation, trusted terminal hyperlinks, and literal preservation.
GitOrigin-RevId: a666b4ebc82bb5798ad45bd137fd815d538e1de2
## Why
Reverse search fetched persistent history one entry at a time, making a deep or unsuccessful search require a lookup for every older entry.
## What changed
- Keep the newest-entry probe lightweight, then scan older persistent history in bounded batches.
- Cache batch results by absolute offset and preserve continuation cursors across repeated searches.
- Ignore stale responses, retry failed batch reads a bounded number of times, and restore the draft without reporting a false “no match” state when history is unavailable.
## Testing
- Cover batch continuation, caching after query changes or cancellation, stale metadata, retry exhaustion, and thread routing.
- Verify that scanning 1,024 entries uses one single-entry lookup and eight batch lookups.
GitOrigin-RevId: efc791fcbd5290050af703dd31c5c21b33240e23
## Why
Selecting a usage-limit reset from the picker immediately started redemption,
leaving no opportunity to verify the choice.
## What changed
- Open a separate confirmation popup before redeeming a selected reset, with
`No, go back` selected by default.
- Show backend-provided reset titles and descriptions in the picker and
confirmation, with generic fallback copy when those details are absent.
- Ignore duplicate or stale confirmation and redemption events, while retaining
the idempotency key needed to retry a failed redemption.
## Testing
- Added coverage for confirmation, cancellation, backend copy, duplicate and
stale events, successful redemption, and retry behavior.
GitOrigin-RevId: 828945f99f06e8c73941fd864e4aa9ac52729f98
## What changed
Give command, permissions, patch, and MCP elicitation approvals dedicated
request structs, and update TUI routing and rendering to use the wrapped
payloads.
GitOrigin-RevId: ffee4058dd27505be2a11de3758ac12bb707b6b8
## Why
Starting a user turn can wait on remote work. Show the submitted prompt immediately instead of leaving the input invisible during that wait.
## What changed
- Queue optimistic prompt history before app-event submissions and render a frame before starting the turn.
- Preserve the existing submit-failure behavior for direct submissions.
## Testing
- Verify that an initial prompt is added to history before its user-turn event is submitted during session replay.
GitOrigin-RevId: 57f30c6e0067127e6b082a206f7d154fcfef8d7d
## What changed
- Add experimental `beforeTurnId` support to `thread/fork` for copying history strictly before a turn, including an in-progress turn.
- Use before-turn forks for TUI backtracking and safety retries so the replacement prompt retains thread context instead of recreating the branch from the preceding turn or a new thread.
- Add experimental `deferGoalContinuation` support so safety-retry forks can inherit an active goal while waiting for the replacement turn before automatic continuation resumes.
- Hide duplicated nested-review prompts when replaying history or selecting a prompt to edit.
## Testing
- Cover before-turn truncation, fork validation, active-goal inheritance, TUI safety retries, backtracking, and nested-review replay.
GitOrigin-RevId: 4915d85ae1929a0b8c40f3ed7dca29c7a5bdcdf3
## Why
Retrying a safety-buffered turn by rolling back the active thread rewrites the
source conversation and requires the TUI to repair its local transcript state.
## What changed
- Interrupt the buffered turn, then fork after the preceding completed turn and
submit the prompt on the new thread with the faster model and low reasoning
effort.
- Start a new thread when the buffered request is the conversation's first turn.
- Preserve committed steering input in the retry, leave the source thread
intact, and restore the prompt alongside any existing draft if branching
fails.
- Do not offer the retry action for side conversations or stale and in-progress
turns.
## Testing
Added coverage for retries with prior context, first-turn retries, committed
steering input, branch failures, existing composer drafts and attachments, and
side conversations.
GitOrigin-RevId: adb49da8236e9212ef0082e033e6f715986b5cd9
## What changed
- Fork the conversation immediately before the selected prompt instead of rolling back the current thread in place, preserving the original conversation.
- Reopen the selected prompt in the new conversation with its images, text elements, and mention bindings intact.
- Start a fresh conversation when editing the first prompt, show a dedicated continuation notice, and restore the prompt with an error if branching fails.
## Testing
- Cover branching before first and later prompts, source preservation, prompt restoration, hidden review prompts, mid-turn steering, in-progress turns, stale transcript entries, and mention bindings.
GitOrigin-RevId: 15473535b3f9733b0300711a498969e6d389db79
## What changed
- Leave an output-free interrupted prompt in the transcript and open a blank
composer for the user's next instruction.
- Use the normal interruption notice for both `Esc` and `Ctrl-C` interrupts.
- Track safety-buffering prompts separately so failed retries can still restore
the prompt, including after switching between threads.
## Testing
- Cover output-free `Esc` and `Ctrl-C` interrupts, failed safety-buffer retries,
and restoration of safety-buffer state from thread snapshots.
GitOrigin-RevId: 30b368d00dfdb981d06d4c95ce3f252389b7917c
## Why
Sparse and out-of-order rate-limit updates can omit account metadata or let an
older full read overwrite a newer workspace hard stop. Credit availability also
does not always include a displayable balance.
## What changed
- Propagate the backend's `spendControlReached` state through rate-limit
snapshots and the app-server protocol, preserving it across sparse updates.
- Keep workspace hard-stop classifications for error routing and ignore stale
full-read results after a newer hard-stop notification.
- Base TUI warnings and model-switch prompts on credit availability and hard-stop
state, and show `Credits: Available` when a finite balance is hidden.
## Testing
Added coverage for spend-control mapping, snapshot merging, out-of-order reads,
workspace error routing, warning and prompt behavior, and credit status display.
GitOrigin-RevId: 18b09d493d5a620a7c079fb721ec50b38dd5b04c
## Why
Full access significantly increases the risk of data loss, leaks, or unexpected behavior, so users should explicitly confirm each time they select it.
## What changed
- Always open the full access confirmation when user-reviewed approvals are active, regardless of `notices.hide_full_access_warning`.
- Remove the persistent "don't ask again" option and its acknowledgement events.
## Testing
- Update the TUI permission tests and confirmation popup snapshot to cover repeated confirmation.
GitOrigin-RevId: 0ee827332441e13d9445349ed6a5a92dc8fef4b2
## Why
`Max` and `Ultra` consume usage limits faster than standard reasoning levels, so they should not be selected accidentally while navigating the normal effort scale.
## What changed
- Move `Max` and `Ultra` behind a `More reasoning…` entry with a dedicated warning and descriptions.
- Keep the reasoning shortcuts from silently increasing into advanced efforts.
- Apply `Ultra` to the active conversation without changing defaults for new threads, while preserving it across mode switches and thread resumes.
- Record applied thread settings in thread metadata, including explicit clearing of reasoning effort, so resumed threads restore their latest model settings unless the user supplied an override.
## Testing
- Add TUI coverage for the advanced picker, shortcuts, Plan mode, configuration defaults, and resumed conversations.
- Add app-server and thread-store coverage for persisting, clearing, and restoring model and reasoning settings.
GitOrigin-RevId: 6708c7c2e8d38f491bf63000ea34f83476afdfe6
## Why
Users can see that usage-limit reset credits are available, but not
which credits they have, when each one expires, or which credit will be
consumed. The TUI should use the supported rate-limit RPC for that
information without maintaining a second reset-credit request path.
## What changed
- load reset-credit details through the existing
`account/rateLimits/read` refresh when the user opens **Redeem usage
limit reset**
- show available credits sorted by expiry, using the backend title when
present and a scope-based fallback otherwise
- consume the exact selected credit and preserve its idempotency key
across retries
- fall back to the existing generic reset action when the RPC returns a
positive count without detail rows
- remove the dedicated list-RPC event, request, response-combining, and
TUI state plumbing
- handle a selected credit becoming unavailable without incorrectly
caching the user's total count as zero
- handle forward-compatible unknown reset types with the existing
scope-based fallback label
## TUI preview
Rendered from the final standard-width and narrow `insta` snapshots in
this PR.
<img width="1280" height="570" alt="pr30488-reset-picker-preview"
src="https://github.com/user-attachments/assets/8b84cd33-cb35-4a37-aaed-dbd6b62bff51"
/>
## Validation
- `just test -p codex-tui chatwidget::tests::usage` (32 passed)
- `just fix -p codex-tui`
- no pending `insta` snapshots
Uses the reset-credit details added by #30395.
Fixes#29618.
Felipe Coury