## What changed
Pass `BUILDBUDDY_API_KEY` to Linux, macOS, and Windows voice release builds, and give the dedicated macOS and Windows voice jobs access to the `bazel` environment without creating deployments.
Use the shared Bazel preparation action and BuildBuddy wrapper for Linux and macOS voice builds so they inherit the existing repository cache and remote cache configuration.
GitOrigin-RevId: 52cdf05bc4567f3e8c460d2509e57bb30e667868
## Why
Publishing a draft prerelease emits a `published` event instead of a `prereleased` event.
## What changed
Create GitHub prereleases with `--draft=false` so they emit `prereleased` events. Keep stable releases as drafts until all asset uploads succeed.
GitOrigin-RevId: 145fd84f852d7ee9cb3c4edff7007a34c3389e1c
## Why
Prereleases were published before their assets finished uploading, exposing incomplete releases.
## What changed
Create new prereleases as drafts, matching stable releases, and publish them only after all asset uploads succeed. Publishing a draft emits a `published` event rather than a `prereleased` event.
GitOrigin-RevId: 0d1c52038bb9b7beb4b5b9bf52f0ef4c3734de61
## What changed
Add `third_party/v8/icu.BUILD.bazel` and wire V8's ICU repository to use it instead of patching upstream `bazel/BUILD.icu`.
Select ICU's custom libc++ flags and runtime dependencies through `//third_party/v8:use_rusty_v8_custom_libcxx`, keeping ICU aligned with V8 and its host generators.
GitOrigin-RevId: 92a1b883f5d42d9a3a464002e922295ab166f2bd
## What changed
Read `desktop.uninstall_codex_home` from the owner's current `config.toml` before recursively deleting a desktop-created Codex home during Windows sandbox uninstall.
- Preserve the home by default for ordinary installations; retain the deletion default for OEM preinstalls when no preference is set.
- Let an explicit boolean preference override either default. Preserve the home when configuration is unreadable, malformed, or contains an invalid preference.
- Capture OEM metadata before Windows removes it during uninstall, and revoke sandbox permissions on retained homes.
## Testing
Add unit tests for missing preferences, explicit overrides, malformed or invalid configuration, and configuration read failures across both installation defaults.
GitOrigin-RevId: 46afc2a7b0f4ecf7f447e46b515e50d0d278e4a8
## Why
MCP tool discovery discarded response-level `_meta`, leaving server-status clients unable to inspect metadata associated with the tool catalog.
## What changed
- Preserve opaque `_meta` from the first `tools/list` page through catalog refreshes and caches.
- Expose it as `toolListMeta` in `McpServerStatus`, with `null` when unavailable, and update generated schemas and bindings.
- Scope cached Apps catalog metadata to discovery settings, including client capabilities and extensions, while retaining tools from older caches without metadata.
- Restrict server capabilities in status snapshots to the selected servers.
## Testing
Add regression coverage for listing legacy cached Apps tools during failed startup, and update protocol serialization expectations for nullable `toolListMeta`.
GitOrigin-RevId: 62335e2fd8c482067a7a78a7612b58c3eaa9fb55
## Why
A thread ID alone does not identify the backend that owns a session. Resume and fork selections must retain that ownership across connection replacement so they cannot operate on another backend, even when thread IDs match.
## What changed
- Add a process-local `BackendId` to app-server sessions and session targets, preserving it across reconnects and auxiliary picker connections.
- Reject selections from a different backend before changing session state or sending resume, fork, or unarchive requests.
- Disable local-daemon fallback to an embedded server for auxiliary pickers and after selecting a session, while retaining fallback for fresh startup.
## Testing
Add regression coverage for foreign selections with matching thread IDs, startup resume and fork rejection before requests, shared ownership across picker connections, and fallback eligibility.
GitOrigin-RevId: 05a3ca0a901a8dc24337d130548aa2c048b4d586
## Why
MCP tool calls reported every aborted approval as "user cancelled MCP tool call", including interrupted requests and automatic cancellations in `exec` mode.
## What changed
Carry `user`, `interrupted`, or `non_interactive` cancellation reasons through MCP approval metadata and resolution. Mark explicit TUI cancellations as user actions, interrupted requests as interruptions, and automatic `exec` cancellations as non-interactive.
Use the reason to report when a call was cancelled before approval or because interactive approval is unavailable in `exec` mode. Preserve the existing cancellation message for clients that omit the reason.
## Testing
Update tests to verify that a closed approval response carries the interruption reason and that `exec` cancellation responses include the non-interactive reason.
GitOrigin-RevId: be2a5f7fef539b5db2add53b46aea27e2b8a66fc
## What changed
Add the `codex-multi-env-copy-file` extension, exposing `multi_env_copy_file` when registered by the host. Copy files between distinct selected environments without loading their contents into model context, and return `bytes_copied` on completion.
Require absolute paths in each environment's native path convention and enforce each endpoint's sandbox policy and permission grants. Stream file contents where supported, with a buffered fallback for older executors. Reject same-environment copies and report I/O error kinds without exposing connection details. Warn that failed writes may leave a truncated or partially written target.
## Testing
Add integration tests for binary transfers in both directions, local and remote executors, path validation, opt-in tool visibility, endpoint permissions and grants, and unavailable or disconnected executors. Verify that copied contents stay outside model context.
GitOrigin-RevId: f5d9e423d105019834e0288828cb68c5711b3a49
## What changed
- Switch argument-comment lint, rusty-v8 release, and V8 canary jobs to `prepare-bazel-ci` to restore repository caches and configure execution logs. Use `bazel-argument-comment-lint` and `bazel-v8` cache scopes.
- Include changes to `prepare-bazel-ci` in V8 canary path detection.
- Pass `BUILDBUDDY_API_KEY` to the `MODULE.bazel.lock` check.
GitOrigin-RevId: 6ef150f93413d1d30287f0728358eed26e792204
## What changed
Add `ThreadStoreError::Retryable` for transient failures known to be safe to retry and `ThreadStoreError::OutcomeUnknown` for writes that may already have committed. Recovery remains the operation owner's responsibility; neither category automatically triggers retries.
Preserve existing app-server error mappings and fatal session startup behavior, and report the new categories in shutdown diagnostics without exposing raw error payloads.
## Testing
Add coverage for conservative SQLx error classification, mutation error mappings, session initialization categories, and shutdown diagnostics that omit raw error payloads.
GitOrigin-RevId: 259a9bfaa6ff3cbfa2ee61a01a1f1e744c90f118
## Why
MCP servers can expose new tools during discovery. Refreshing the catalog after a tool-list notification lets Codex discover and call those tools in the same turn.
## What changed
- Add the disabled-by-default `mcp_tool_list_changed` feature for ordinary MCP servers.
- Track notifications in transport order and refresh catalogs before subsequent discovery or tool binding. Coalesce concurrent refreshes and retry listings invalidated by notifications, including during pagination.
- Retain the previous catalog on refresh failure, apply a retry cooldown, and invalidate affected startup caches. Allow notification refreshes to proceed while admitted calls finish.
## Testing
Add coverage for same-turn discovery and invocation in direct and Code Mode, notifications during startup and pagination, disabled behavior, cache invalidation, and concurrent refreshes with timeout recovery.
GitOrigin-RevId: 9afee8deba00dd9851b5f32625f61f96965aa00c
## Why
Dynamic tool calls should remain independent while waiting for client responses, so one pending call does not block another from reaching the client.
## What changed
Enable parallel execution in `DynamicToolHandler`, allowing code mode programs to issue concurrent dynamic tool calls with `Promise.all`.
## Testing
Add a code mode regression test that waits for two dynamic tool requests before responding, resolves them in reverse order, and verifies that `Promise.all` preserves the expected result order.
GitOrigin-RevId: c93c1fea720f76c772b0e3452ddc8c01fb1a08d8
## Why
Authorization server metadata can advertise scopes unrelated to the MCP resource. Using that list for discovery can request broader scopes than the resource requires.
## What changed
Update `rmcp` and use its initial scope selection during OAuth discovery: prefer scopes from the initial `WWW-Authenticate` challenge, fall back to protected resource metadata, and include `offline_access` when supported. Stop using the authorization server's general scope list as the discovered resource scopes.
## Testing
Add coverage for challenge scope precedence, resource metadata fallback, scope normalization, and exclusion of unrelated authorization server scopes. Add a no-browser login regression test for a preregistered client whose authorization server advertises neither scopes nor dynamic registration.
GitOrigin-RevId: 68d83cf61fb0b73dac9e861e476f484990fd93b6
## What changed
Wait for the rejected socket to close before advancing Tokio's clock through
capped retry delays. Keep socket I/O on real time so pending handshakes cannot
auto-advance their own timeouts.
Return bodyless HTTP 409 responses in the test server, check that neither
rejection restarts fast retries, and assert that recovery preserves the expected
reconnect attempt count. Both cursor and cursorless cases use the updated helper.
GitOrigin-RevId: da167312f28b7e24b864e6929be749865ea70081
## What changed
- Attempt each `npm publish` up to three times, with 10- and 20-second delays and fresh OIDC credentials on each attempt. Continue skipping already-published versions.
- Enable verbose npm logging and retain debug logs as artifacts for seven days, including on failure.
- Use `macos-15-intel` to verify provisioned `x86_64-apple-darwin` packages, while keeping `aarch64-apple-darwin` verification on `macos-15-xlarge`.
GitOrigin-RevId: 1876c66993ecd8cdb44088ab17a3363d21135ec4
## Why
Thread history materialization allocated a buffer for the entire unread rollout suffix before processing records, increasing memory use for large rollouts.
## What changed
Read records incrementally with a buffered reader bounded to the captured file end. Reuse the line buffer, preserve trailing partial records for the next pass, and report unexpected EOF if the rollout shrinks during reading.
## Testing
Extend the partial-line boundary test with 64 KiB of padding per record to verify byte offsets and deferred processing until the final newline is durable.
GitOrigin-RevId: c0426e3e364748b117285b248f6988a4fe064b94
## Why
Noise handshake failures before connection readiness returned a generic error even when the transport had reported a specific disconnect reason. No `RpcClient` was reading the connection event channel at that point.
## What changed
Read the pending disconnect event when a Noise rendezvous handshake fails and append its reason to the handshake error when available.
## Testing
Add a regression test covering unexpected text frames and relay stream resets, checking that each produces the expected transport reason in the handshake error.
GitOrigin-RevId: 9b8ef9c8dcba75b46d51dc67784af46d4ca74b85
## What changed
Replace fixed release pins for app-server/exec-server compatibility tests with the latest stable version and the stable release published closest to 60 days ago. Exclude drafts and prereleases, and prefer the higher version when publication dates are equally close.
Resolve release versions and SHA-256 asset digests before Linux Bazel CI runs, passing them through `CODEX_COMPAT_RELEASES` to the release archive repositories. Reuse the argument comment lint action so it also prepares compatibility releases. Add bounded retries for transient GitHub release reads.
## Testing
Add unit coverage for stable release filtering, version ordering, nearest publication dates, tie-breaking, and deduplication when both selections resolve to the same release.
GitOrigin-RevId: 5a8cf8bdabd77ab3fa89bbb711367b5d9ce8044b
## Why
A plugin's scripts can change without changing its hook declaration. Declaration-only approval therefore lets changed plugin code run under an existing hook approval.
## What changed
- Fingerprint plugin bundle contents and include the content hash in the approval value returned by `hooks/list`. Persist it as `trusted_content_hash`, keeping `trusted_hash` compatible with older clients.
- Verify contents before each command or MCP hook execution, within the hook's timeout, and require renewed approval when approved contents change.
- Migrate legacy declaration-only approvals to a shared, immutable content baseline per plugin and config home.
- Exclude generated Python bytecode, `.venv`, and `.egg-info` entries from fingerprints. Run app-server hook listing on blocking tasks.
## Testing
Extend integration coverage for plugin upgrades and rollbacks requiring approval, same-turn script changes preventing further hook execution, shared legacy approval baselines, and generated Python artifacts preserving trust.
GitOrigin-RevId: faaf7658210d8adb2534ddd614c72ec993920840
## What changed
Recognize `codex_app.create_thread` deliveries when capturing sender context so Guardian receives the sender's recent user messages and assistant context for delegated tasks.
## Testing
Extend the sender-context integration test to cover `create_thread`, including reviewer-only context and clearing the snapshot on a subsequent delivery without sender provenance.
GitOrigin-RevId: 7a47c3ac5b9c9405e6728010c494529274b7b73d
## Why
The optional Guardian Decisions comparison rejected non-user messages and trusted skill evidence, and folded trusted tool evidence into the classification rubric.
## What changed
Send evidence as separate messages with their original roles, content order, boundaries, and optional `phase`. Support both `input_text` and `output_text`, keeping trusted tool and skill evidence separate from the rubric. Continue to accept inline images only in user messages and reject unsupported evidence.
## Testing
Update adapter and HTTP contract tests to cover mixed message roles and assistant output. Extend lifecycle coverage to verify that trusted skill evidence reaches Decisions while comparison results leave the baseline risk unchanged.
GitOrigin-RevId: 1b6814fe6db5891fb61604d6846a008c9e456054
## Why
Optimized `Array.prototype.sort` can write objects into incompatible array element storage when receiver element kinds differ and the comparator mutates the array.
## What changed
- Upgrade `v8` to `152.2.0`, the Bazel V8 source to `15.2.124.1`, and ICU data and initialization to version 78.
- Backport element-kind agreement checks for sort inlining in TurboFan and Maglev. Apply the patch to Bazel builds and Windows MSVC source builds, and include it in source-build cache keys and canary triggers.
- Refresh pinned sandbox archives and bindings, extend Bazel prebuilt coverage to musl Linux, and use matching sandbox bindings on Windows MSVC.
- Update Bazel integration patches and runtime dependencies for the new V8 release, and download the pinned Windows build tools in source-build workflows.
## Testing
Include the upstream sort regression test covering mixed element kinds, comparator mutation, and continued optimization for matching kinds. Add a test requiring canary and Windows source builds when the backport changes, and update artifact-fetch tests for the new version.
GitOrigin-RevId: 138b7821cddd25466c10aced1dd22be24837caf0
## What changed
Add `write_file_stream` to `ExecutorFileSystem` and `EnvironmentAccess`, preserving the accessor's captured sandbox permissions. Local and streaming-capable remote filesystems replace files one bounded chunk at a time and return the byte count. Older executors buffer the input before sending a single `writeFile` request.
Close remote handles on completion or failure, perform best-effort cleanup after cancellation, and invalidate pending metadata lookups. Document that failure or cancellation can leave a truncated or partial file and that in-flight I/O may outlive cancellation.
## Testing
Add coverage for sequential writes, binary and empty files across local and remote filesystems, source failures, handle cleanup, metadata invalidation after cancellation, and compatibility with older executors.
GitOrigin-RevId: d3eb44e0ac2f0f336e9e157d686464f4d45a3f26
## What changed
Replace the Tokio mutex protecting `RemoteFileSystem`'s in-flight metadata request map with `std::sync::Mutex`. Keep metadata I/O outside the lock and centralize locking in a helper that recovers poisoned guards.
Update the existing concurrent metadata request test to use the locking helper.
GitOrigin-RevId: 78aaecfbd8e8af9c1e5ea273758a414b0ad679a5
## Why
Missing protected metadata paths already receive read-only synthetic mounts, as established in https://github.com/openai/codex/pull/39629. The fallback creation monitor no longer receives any targets because those paths are included in the read-only mount list.
## What changed
Remove `ProtectedCreateTarget` tracking and its inotify monitor, deletion fallback, registry markers, startup pipe, and policy-violation exit override. Keep synthetic mount cleanup and propagate the bubblewrap child's exit status directly.
GitOrigin-RevId: ac747860cad845ebb89ada5a9c1009e56835c4fb
## What changed
- Add `--executor-credential-stdin` to read newline-delimited JSON credentials bound to the configured environment. Require an initial credential within 30 seconds and accept subsequent rotations.
- Reject expired credentials on each request, and stop the executor on invalid input or stdin closure. Limit credential frames to 16 KiB.
- Use scoped bearer authentication for registry requests without account credential fallback or WebSocket authentication headers. Skip workload identity loading and configured telemetry exporters in this mode.
## Testing
Add unit and integration coverage for rotation, expiry, malformed frames, environment mismatches, stdin closure, registry-only authentication, credential redaction, and telemetry exporter isolation.
GitOrigin-RevId: 30a94478165395144a765450f5ec6b3697acdd55
## What changed
- Show `Exited (status N)` instead of `Failed (exit N)` for compact command output, and remove the red bullet styling.
- Label compact exploration counts as `nonzero exit` or `nonzero exits` instead of `failed`, and remove the red styling from the count.
## Testing
Update snapshots for compact command output and exploration summaries to reflect the new labels and styling.
GitOrigin-RevId: 043593720cc3837ca530d1c008565695abcd5af1
## Why
Remote credential masking previously supported only Bash commands without login startup or shell snapshots, leaving Zsh commands with unmasked credentials.
## What changed
- Enable masking for Zsh login commands using shell snapshots on Linux and macOS.
- Capture trusted startup profiles per launch, bind the credential broker to the resulting environment, and replace credentials and supported aliases with placeholders before snapshot replay.
- Preserve explicit environment overrides, credential unsets, and launcher-managed proxy settings during replay.
- Warn and fall back to unmasked startup when a snapshot cannot safely replay credentials; stop execution if protected snapshot restoration fails.
## Testing
Extend remote execution tests for inherited and profile-defined credentials, overrides, destination changes, and unsupported-profile fallback. Add a Zsh scenario snapshot showing a credential placeholder in command output.
GitOrigin-RevId: 83193d6cbc05f3deb0d6d0b9ae80974b353ce900
## What changed
Add optional `remote_plugin_id`, `release_id`, and `auto_provision` fields to `PluginConfig` and the configuration schema. Store remote plugin identity, release, and provisioning metadata without fetching releases or triggering provisioning. Entries containing only this metadata continue to inherit existing plugin activation defaults.
## Testing
Extend configuration round-trip and plugin loader tests to cover remote metadata entries with inherited enablement and with `plugins._default.enabled = false`.
GitOrigin-RevId: bb657c25929cab100982b37120ab62b089eb7044
## Why
Explicitly selecting the default daemon socket previously classified the TUI connection as remote, changing how local configuration and thread parameters were handled. A socket at that path may also be an SSH forward, so the path alone cannot establish that the daemon is local.
## What changed
- Verify the default daemon endpoint before classifying an explicit connection as local. On Unix, check the expected symlink target and the private socket directory's ownership and permissions, then connect to the protected endpoint directly.
- Preserve local workspace behavior and local thread parameters for verified attachments while keeping directly bound Unix sockets classified as remote.
- Report a missing explicitly requested socket, disable embedded fallback for explicit attachments, and restrict daemon auto-start to implicit connections.
## Testing
Extend tests to cover explicit and implicit local target selection, verified socket resolution, and rejection of a directly bound socket as a local daemon endpoint.
GitOrigin-RevId: ac2226ca1c5f60b26aad9571f945e3325d3bebfa
## What changed
Add optional `inputImages` metadata containing each referenced local image's path and SHA-256 hash of the bytes read before normalization. Compute the hash from the same bytes used to prepare the edit request.
Preserve this metadata through completion events, persisted thread history, resume, and legacy rollout migration. Update app-server schemas and generated TypeScript and Python types; older items continue to deserialize without the field.
## Testing
Add coverage for input ordering, changed contents at the same path, unreadable or invalid references, serialization, persisted history and resume, and legacy migration.
GitOrigin-RevId: 522be8ec1e39c9b2bbe5b9ccb37ea67d17f0e21a
## Why
Flowcharts with `<br>` tags in node labels previously fell back to source instead of rendering as terminal diagrams.
## What changed
Render `<br>`, `<br/>`, and `<br />` as line breaks in quoted and unquoted flowchart node labels. Apply the 40-display-cell label limit per line and keep the decision marker on the first line. Continue rejecting other HTML, break tags in edge labels, and labels containing only breaks or whitespace.
## Testing
Extend rendering snapshots across all four flowchart directions and cover per-line width limits and unsupported markup. Update TUI streaming tests to cover multiline rendering, resizing, source fallback, and preservation of the original source for copying.
GitOrigin-RevId: 61f2a84c8bb161ac4a1c26ddaa0569f52bfea749
## Why
SQLite page reclamation on NFS creates I/O load and contention.
## What changed
Detect whether `sqlite_home` is on NFS on Linux and skip reclamation before opening a maintenance connection. Cache successful filesystem probes across `SqliteConfig` clones while allowing failed probes to retry.
## Testing
Add tests for shared probe caching and recovery after a missing directory is created. Update reclamation coverage to expect no reclaimed pages or file shrinkage on NFS.
GitOrigin-RevId: 4f627cabc6ad712171654c3f8b8659d2f632bbba
## Why
Live descendants previously blocked suspension of an unfinished root turn, requiring callers to stop and unload them before recovering the root elsewhere.
## What changed
Allow `suspend_turn_and_shutdown` to suspend the root and initiate shutdown of all sessions sharing its local agent runtime, fencing new starts. Remove `SuspendTurnOutcome::HasLiveDescendants`.
Success confirms that the root has stopped and its history writer is flushed and closed; descendant cleanup completes separately. Callers must finish tree shutdown or fence and terminate the tree's persistence writers before transferring ownership. Interrupted descendants are not automatically recovered.
## Testing
Extend integration coverage to verify child shutdown, recovery under the original root turn ID without restarting children, and separate reporting of child writer failures.
GitOrigin-RevId: 5adc240ae6e34654209154ee9324621a2bd604d5
## What changed
- Launch managed processes through `taskpolicy -b` on macOS when a five-second probe succeeds, preserving the managed process PID. Fall back to direct launch if the probe fails or times out.
- Increase the macOS startup timeout from 10 to 30 seconds to accommodate background CPU and I/O scheduling, and serialize daemon startup test fixtures on macOS.
- Use the shared background command helper and retain `CREATE_NO_WINDOW` alongside Windows detachment flags.
## Testing
Add macOS tests for PID preservation, background priority when available, and direct-launch fallback after a probe timeout.
GitOrigin-RevId: ab3328e2e8f62218ac9602e4172563c00056875b
## What changed
- Upload generated images to the attachment store and expose `fileId` in image-generation items when available, with inline `result` fallback on upload or decoding failure.
- Preserve file references through legacy events, persisted rollouts, thread history, and task output summaries. Keep model-facing image preparation separate.
- Add attachment request tags and mark generated-image uploads with `usage=image_gen`, preserving the thread's ephemeral setting.
- Update public schemas and SDK types to accept either image representation, retain the Python `ImageGenerationThreadItem` alias, and prefer `fileId` when reading records containing both fields.
## Testing
Add coverage for file-backed generation and rollout persistence, legacy history replay, inline and transitional serialization, task output visibility, and Python SDK alias compatibility.
GitOrigin-RevId: f7a2bb5707e2f277348a547a988bc33c8e96d891
## Why
Opening an initialized database in `DELETE` journal mode previously attempted to convert it to `WAL`, which could fail while another connection held a write lock.
## What changed
- Initialize `WAL` and incremental auto-vacuum only for databases without a schema, including files left by interrupted initialization.
- Preserve journal and vacuum modes for initialized databases, use `synchronous = EXTRA` for `DELETE` connections, and retain `NORMAL` for `WAL`.
- Close failed initialization pools before retrying and restrict background page reclamation to `WAL` databases.
## Testing
Extend SQLite tests to cover interrupted initialization, opening `DELETE` databases under a write lock across all pool connections, persistence after reopening, and lock release after failed initialization.
GitOrigin-RevId: 23acecfe472618dde8545815e9a1058a51591235
## What changed
Add current terminal title and status line options to the preset picker. Generate `/title` and `/statusline` commands that preserve item order and duplicates, normalize item aliases, and retain the status line color setting. Use `--clear` for empty layouts and disable options containing unavailable items.
## Testing
Extend picker tests and snapshots to cover the new options, generated commands, empty layouts, and unavailable terminal title items.
GitOrigin-RevId: b836b15e87c03249cf479b1c3baf0bd71931a6be
## What changed
Allow inline item selection, such as `/title model reasoning` and `/statusline current-dir --no-colors`, without changing saved defaults. Support `--clear` for both commands and `--colors` or `--no-colors` for `/statusline`, including color-only updates that preserve the current items.
Carry overrides with per-thread input state across navigation and reconnects, and allow these local commands in parent-owned subagent threads. Reject invalid or conflicting arguments before applying changes. Saved editor selections supersede the corresponding overrides.
## Testing
Add coverage for argument parsing, atomic updates, rate-limit item aliases and ambiguity, thread-state restoration, saved-setting interactions, and local command submission in parent-owned threads.
GitOrigin-RevId: 909cc2ede026fbf5c7f9cd52c8cf2ae835084f14
## Why
Creating a preset from current settings only offered the model. Permission presets need to preserve the profile, approval policy, and reviewer to restore the same settings.
## What changed
- Add a “Current permissions” option alongside “Current model” when creating a preset from settings.
- Extend `/permissions` with `--approval-policy` and `--reviewer`, including granular policies and quoted profile names.
- Share argument parsing between `/model` and `/permissions`, supporting quoted arguments and both `--setting=value` and `--setting value` forms.
- Keep full-access confirmation for every reviewer and reject automatic review when unavailable.
## Testing
Add parser tests, preset picker snapshots, and permission-selection tests covering complete settings restoration, invalid arguments, unavailable automatic review, and full-access confirmation.
GitOrigin-RevId: f4c9c3f6e264ee8ea4c5244c79f39f2deb15b771
## What changed
Allow `/permissions <profile-id>` to select a built-in or custom permission profile, for example `/permissions :read-only`. Support `:ask-for-approval` and `:approve-for-me` aliases while preserving feature gates, profile requirements, full-access confirmation, and Windows sandbox setup.
Hold queued input until the selection is confirmed, and retain it on cancellation or failure. Reload custom profile definitions on re-selection without leaving unchanged requests pending.
## Testing
Add coverage for unknown and disabled profiles, approval aliases, confirmation and cancellation, discovery retries, Windows sandbox setup, and queued prompts waiting for server confirmation.
GitOrigin-RevId: ada38d3cfc6d6ac4e84ce5645fe33432c55d63cc
## What changed
Replace the `/presets` recall picker with a responsive menu above the composer. Press `0`–`9` to run a saved preset or create one in an empty slot; use `n`, `s`, `e`, and `d` to create, start from current settings, edit, and delete presets.
Add `tui.keymap.chat.open_presets` with an implicit `leader p` shortcut that yields to existing bindings and explicit configuration. Show the action in `/keymap` and add a shortcut tooltip.
Preserve the composer draft, respect popup ownership, and consume held-key repeats after menu actions.
## Testing
Add snapshots for empty, populated, and narrow preset menus, plus coverage for draft preservation, cancellation, held-key handling, transcript search precedence, and default shortcut conflicts.
GitOrigin-RevId: f438c7015dbd416c90cdeb479d2a15d9d6d24954
## What changed
- Add a TUI picker with ten numbered preset slots, an editor, and confirmation before replacement or deletion.
- Create presets from composer text or current model, reasoning effort, and speed settings. Run saved inputs through the normal queued submission path while preserving the composer draft.
- Persist presets under `tui.presets` in the active user configuration, respecting configuration layer ownership and leaving in-memory settings unchanged when writes fail.
- Preserve permissions when changing effort or speed for the effective model, keep default collaboration settings intact in Plan mode, and allow standard-speed selection with older app servers.
## Testing
Add persistence tests for save, replace, delete, configuration ownership, and write failures; picker and confirmation snapshots; and regression coverage for model permissions and standard-speed fallback.
GitOrigin-RevId: 5f11699112cd404cc8e954872d53495c6edd0c0a
## What changed
Add `tui.presets` entries keyed by a single digit from `0` to `9`, each with an `input` prompt or slash command and an optional `label`. Expose presets in the configuration schema, load them into runtime configuration, and preserve them in TUI local settings.
Reject invalid slots, blank inputs, shell commands beginning with `!` after leading whitespace, and inputs exceeding 8,000 UTF-8 bytes.
## Testing
Extend the runtime configuration test to verify loading both a slash command with a label and a prompt without one.
GitOrigin-RevId: d2911e540bc50f05b4a5224abf17ce4ef5a18ea3
## What changed
Allow `/model [model] --reasoning <level> --speed <tier>` to update the current session without changing saved defaults. Both space-separated and `=` flag values are supported; omitting the model applies settings to the current model. Bare `/model` still opens the picker.
Validate model availability, supported reasoning levels, and speed tiers before applying changes. Reject unknown flags, duplicate settings, and missing values. Apply model, reasoning, and speed together after server acceptance.
Restore each thread's speed when switching threads, and use destination configuration defaults for new sessions instead of carrying over the active session's speed.
## Testing
Extend regression coverage for inline commands, invalid arguments, unchanged saved defaults, settings-only updates to hidden current models, destination speed defaults, and speed restoration on the next turn after switching threads.
GitOrigin-RevId: ad9cecbdb3554e34a6518367364978a37fb68439
## Why
Competing SQLite writers can cause database opening and writes to fail with `SQLITE_BUSY`. Deferred write transactions can also encounter contention after taking a read snapshot.
## What changed
- Add up to two retries with 100 ms and 200 ms delays for SQLite busy errors during pool opening, writer admission, and standalone writes.
- Use a shared `BEGIN IMMEDIATE` helper across state, thread history, and agent message board writes to acquire the writer slot before reading.
- Preserve bound arguments when retrying standalone writes, and commit writes using `RETURNING` before exposing their results. Retry transaction admission without replaying an already-started transaction.
## Testing
Add tests using real SQLite writer contention to verify recovery after a competing writer releases its lock. Queue tests cover enqueue, update, and delete, checking preserved payloads, single revision increments, and no duplicate messages or unintended deletions.
GitOrigin-RevId: ac5bd31a87c67cc47fb385bf3fa5435a54ff70f0
## Why
When a command starts before an assistant message completes, the TUI can flush the streamed text and then render it again when the completion arrives. This duplicates the preamble in both live output and replay.
## What changed
Track the turn ID, item ID, and source text of the flushed message. Skip rendering its completion again when the identity and text match, allowing for the trailing newline added during stream finalization. Continue rendering completions whose identity or text differs.
## Testing
Add an end-to-end test that delays message completion until a command starts and checks that live and replayed transcripts contain the preamble once. Add regression coverage for completions with different text or item IDs.
GitOrigin-RevId: 59af0198a99f26ba8ba2a47644ba662301c30011
## What changed
On Windows, omit network roots whose filesystem identity cannot be inspected when expanding implicit `:root` read access. Retain inspectable shares and roots containing the policy or command working directory, and apply the same filtering during policy inspection and command launch.
Keep explicit grants unchanged and continue expanding `:root` write and deny rules across all executor volumes.
## Testing
Extend policy tests to cover filtered read roots, explicit grant precedence, and approved-command write access across all volumes.
GitOrigin-RevId: c4d7c8ce2c9138cdb4518385e2cd05f66518628e
## Why
A thread-wide index can scan earlier turns when a turn's final item page is underfilled.
## What changed
Force `idx_thread_items_by_turn_page` for turn-scoped item queries when neither `item_ids` nor `after_updated_at_ordinal` is set.
GitOrigin-RevId: 63c86fafa08446351a5d9828b479c497c76a8555
Adam Perry @ OpenAI