## Why
The permissions menu needs to reflect the profiles and configuration requirements available in the active app-server scope, including remote workspaces.
## What changed
- Load permission profiles and configuration requirements asynchronously when opening the permissions menu, using the active thread working directory.
- Render loading, retry, empty-catalog, and unsupported-server states, and fall back to the legacy permissions menu when explicit profiles are not configured.
- Disable profiles rejected by server requirements or unavailable in the catalog. Remote custom profiles remain visible but cannot yet be selected.
- Bound pagination and request time, reject malformed catalogs, and ignore responses made stale by account, thread, or modal changes.
## Testing
- Cover local, session-only, remote, legacy, empty, unsupported, pagination, malformed-response, and timeout discovery paths.
- Add TUI tests for loading, failures, retries, empty results, remote catalogs, stale responses, and working-directory changes.
GitOrigin-RevId: 3e2ab53a4eae1179587d064f9a4c605765ea7880
## Why
Completion receipts for identical user messages could acknowledge the wrong
pending steer. When the receipt arrived while another thread was displayed,
the stale pending state could later be restored and resubmitted.
## What changed
- Assign each TUI submission a client message ID and pass it through turn start
and steer requests.
- Preserve pending steer IDs across thread input snapshots and match completion
receipts by ID, while retaining content-based matching for older app servers
that do not echo IDs.
- Acknowledge matching receipts for inactive threads before their notifications
can be discarded, including threads stored in the agents overview.
## Testing
Added coverage for identical steer receipts and for switching within and
between tasks before interrupting an active turn.
GitOrigin-RevId: 28bd80a735ff86cd7bf836f24b448e7499f0a902
## What changed
- Replace the command center's single-line new-task input with the shared chat composer, including multiline editing, paste handling, Vim mode, configured keybindings, cursor behavior, and input validation.
- Keep task drafts and editor state across dashboard refreshes and reconnects while separating composer focus from list, search, and rename actions.
- Preserve whitespace in dispatched task prompts, block submission while offline, and restore unsent prompts after dispatch failures when the composer is still available.
## Testing
- Add coverage for focus routing, draft retention, multiline pastes, custom keybindings, Vim mode, offline editing, failed-dispatch recovery, and responsive rendering.
GitOrigin-RevId: a609ae95d497cbae0ebcac4cdcc50fe49d74832a
## What changed
- Load the `/experimental` catalog from the running server for the active thread, with loading, empty, and failure states in the popup.
- Show beta features in server order and preserve server-reported names, descriptions, and configured values. Mark features as read-only when the local config writer cannot safely update them.
- Persist only changed, writable feature flags. Bound discovery with page-size and page-count limits, repeated-cursor detection, deduplication, cancellation, and a timeout.
## Testing
- Cover paginated discovery, malformed or unresponsive servers, popup cancellation, read-only controls, selective writes, and the new popup states.
GitOrigin-RevId: 1f49eb961c8ab220a466e15f032c1dc61ed86d38
## What changed
- Add a configurable `agents.resume` action, bound to `Ctrl+O` by default, that opens the session resume picker from the agent command center.
- Preserve command-center state when the picker is cancelled, and preserve per-thread composer and queued-input state when switching sessions.
- Keep resume failures within the command-center flow and wrap footer shortcuts on narrow terminals.
## Testing
- Add coverage for picker cancellation, active-session selection, resume failures, per-thread input restoration, custom keybindings, and narrow footer layout.
GitOrigin-RevId: 59159f838a0c642200cd164e3af45b0971d29bf8
## What changed
- Add `application.network` managed requirements with exact-domain allow/deny
rules, default-enabled behavior, domain normalization, and normal managed TOML
precedence.
- Return the policy separately from agent network requirements through the
experimental `configRequirements/read` API. The endpoint reports the policy
but does not enforce it.
- Export the new protocol types and schemas, and document the TOML format.
## Testing
- Cover parsing, validation, normalization, layered precedence, and cloud
requirement composition.
- Verify app-server responses, defaults, separation from agent policy, and
rejection of invalid domains.
GitOrigin-RevId: 563eeed296d9748430b819797204a44a8db92f3b
## Why
Misalignment policy failures pause the current chat. When the server provides findings and a continuation request, users should be able to inspect them and explicitly decide whether to proceed.
## What changed
- Add a `Review findings` flow that shows the detailed explanation and quoted continuation request in an overlay.
- Require explicit acknowledgement before starting a continuation turn, while preserving the active approval and sandbox settings.
- Keep ordinary input blocked and reject stale, replaced, invalid, or duplicate continuation attempts.
- Label the overlay shortcut as `q close` to match its behavior.
## Testing
- Add TUI tests covering findings review, explicit confirmation, successful and failed continuation, stale findings, duplicate events, and invalid continuation data.
GitOrigin-RevId: 36a738adf272f95db92eaee5712fb00061d0fa52
## What changed
- Keep `!`, `/`, and `?` prefixes literal in plain-text composers instead of activating command modes or shortcuts.
- Preserve buffered characters when changing Vim mode, cancelling a draft, or pressing Enter during a paste burst.
- Show over-limit errors in embedded composer footers, retain the rejected draft, and schedule redraws when the message expires.
- Clear stale validation errors when replacing a draft or switching form fields.
## Testing
- Add coverage for literal prefixes, buffered typing, single-character paste lines, retained over-limit drafts, and clearing validation errors between fields.
GitOrigin-RevId: ed9d5b2c087abdfefd92d93033ea1c20211d56d7
## Why
The managed app-server daemon and automatic TUI attachment were limited to
Unix, so Windows users could not share a background server across Codex
sessions.
## What changed
- Enable daemon lifecycle commands, `codex agents` startup, and AF_UNIX daemon
discovery on Windows.
- Require Windows daemons to start non-elevated and verify the discovered
socket directory and peer before connecting.
- Preflight detached process support, preserve path-based environment settings,
and keep daemon processes out of the launching project's working directory.
- Fall back to an embedded server when an implicitly discovered daemon cannot
connect, while preserving errors for explicit remote endpoints and bypassing
daemon reuse when `CODEX_EXEC_SERVER_URL` is set.
## Testing
Add coverage for Windows launch restrictions and socket validation, implicit
connection fallback, executor selection, daemon discovery, and the agents
dashboard startup result.
GitOrigin-RevId: e7fd63cf8690bcca8b5155266416f31f2f792aa2
## What changed
- Fetch `collaborationMode/list` during TUI startup and reconnect, and use the
returned catalog for visible collaboration-mode selection.
- Keep collaboration-mode discovery optional with a two-second timeout so an
unavailable, invalid, or unsupported response does not block bootstrap.
- Preserve discovered modes when the model catalog refreshes, clear restored
developer-instruction overrides when selecting a server mode, and retain a
`/plan` draft when plan mode is unavailable.
## Testing
- Cover optional discovery failures and catalog refresh on reconnect.
- Cover server mode selection, model refreshes, restored settings, and
unavailable plan mode.
GitOrigin-RevId: a6e35c14aab2e38526606164091ac64c500151bb
## Why
Replaying a thread after a later turn has continued can treat an earlier
misalignment policy violation as still active, clearing the restored draft and
queued follow-up input.
## What changed
- Track the latest turn independently of the bounded replay buffer.
- Omit misalignment errors from older turns during snapshot and stored-turn
replay while preserving an error on the latest turn.
- Keep interrupted tool calls from the older turn visible in history.
## Testing
Added buffered replay coverage for restored drafts and queued messages, buffer
eviction, current-turn violations, and interrupted tool rendering.
GitOrigin-RevId: d6c223d9c5a1905fe1b48dc5f9514a7ccbf61d92
## What changed
- Move `AgentsOverviewView` rendering and cursor placement into
`agents_overview_render.rs`.
- Extract paste-burst Enter handling from the main chat composer into the
reconnect module while preserving the existing submission behavior.
GitOrigin-RevId: 641daf9ad6cba79d805a9ae100f63ef81470757d
## What changed
- Add the experimental `Thread.environments` field with each selected environment's ID, working directory, and runtime workspace roots.
- Populate the field from live thread state in start, resume, read, list, and unarchive responses. Use `null` for unloaded threads and an empty list when a loaded thread has no environment selection.
- Document that the field reports selection rather than connection status and does not affect executor selection or resume behavior.
## Testing
- Cover selection updates, unloaded and resumed threads, loaded pathless unarchives, and clients that subscribe after environment connection notifications.
GitOrigin-RevId: a6daa06aff7089d7c5a1e4c7d03109b41f12fa3c
## What changed
- Add the under-development `features.context_management.experimental_mode` configuration and schema.
- For eligible ChatGPT Plus, Pro, and Pro Lite sessions using the Codex backend, enable token-budget context, history notes, and the `new_context` tool when experimental context management is configured.
- Keep the feature disabled for custom providers, provider credentials, non-Codex endpoints, and temporary structured threads.
## Testing
- Cover subscription eligibility, backend restrictions, configuration resolution, token-budget guidance, and temporary-thread overrides.
GitOrigin-RevId: 19402af19c4d69e09a7cdb3687ee7d233f6a562a
## What changed
- Show a confirmation before stopping a safety-buffered attempt and retrying
with the server-selected faster model.
- Explain that the retry starts a new thread, preserves actions already taken,
and may use a less capable model; allow the user to keep waiting instead.
- Dismiss the buffering or confirmation view when the response starts or the
turn is no longer eligible for retry.
- Refresh the buffering copy and wrap confirmation text correctly in narrow
terminals.
## Testing
- Cover retry confirmation, cancellation, turn completion, response startup,
stale updates, and narrow-terminal rendering.
GitOrigin-RevId: 013bc47174811dd104b421774577c2808c732bfa
## Why
Directly deserializing the flattened `RolloutLine` envelope can reject nested
decimal values, preventing affected paginated sessions from resuming.
## What changed
- Add canonical string, byte, and reverse-scanner helpers that decode rollout
records through `serde_json::Value` before decoding the flattened item.
- Route rollout readers across session discovery, history, migration, search,
thread storage, and transcript previews through those helpers.
- Remove `Deserialize` from `RolloutLine` so new readers cannot bypass the
canonical persistence decoder.
## Testing
Add coverage that resumes a paginated rollout after a token-count record with
a decimal rate-limit value and verifies that ordinal sequencing continues.
GitOrigin-RevId: 49abac1e0751c073daa5a93a840d8a483fd2d013
## Why
When ordinary included usage is exhausted, eligible users need a way to keep working with the backend-provided Luna Reserve quota and return to their previous model once ordinary usage recovers.
## What changed
- Automatically switch eligible TUI tasks to Luna Reserve after an authoritative account usage read, preserving the prior model and reasoning effort per task.
- Restrict model selection while on Reserve to its supported reasoning levels, keep queued turns on the accepted model, and restore the saved model after a fresh read confirms recovery.
- Surface Reserve usage in the composer and `/status`, and expose `normalModelSlug` in app-server rate-limit snapshots so clients can use the associated model's display metadata without changing the request model.
- Poll account limits more frequently near exhaustion and retain compatibility with app servers that only accept the legacy null request parameters.
## Testing
- Added coverage for Reserve entry, queued-turn handling, task reconstruction, recovery authorization, account changes, model selection, usage rendering, and banner dismissal.
GitOrigin-RevId: 46a435e9531051f8cec3f6a46c4b9f7cfa479747
## What changed
- Accept optional `account/rateLimits/read` capabilities for Luna Reserve support
and lightweight background polling while preserving omitted and `null` params.
- Forward the Luna Reserve capability only for eligible ChatGPT sessions, and let
lightweight polls skip the separate reset-credit detail request.
- Return the backend's `ordinaryUsageAllowed` decision only when its account and
user identity match the active session.
## Testing
- Cover capability defaults, eligible and restricted authentication modes,
lightweight polling, identity filtering, and backend permission handling.
GitOrigin-RevId: f407a3ae1e70e411fdf245f072a16e453f59cd87
## What changed
Set `questions` to `None` when the buffered replay tests construct an
ordinary completed agent message.
GitOrigin-RevId: 8b5ff14ff8ef25f4f760441767cfaed8542f8b94
## Why
Buffered thread snapshots can contain both streaming deltas and the completed
assistant item. Replaying both reconstructs an already-finished stream instead
of restoring its finalized transcript entry.
## What changed
- Omit superseded assistant deltas from replay snapshots when a matching
completed item follows them.
- Preserve unfinished or unrelated deltas and treat other events as replay
barriers so text needed before tools or prompts is not dropped.
- Render completed replay items directly as formatted history cells while
preserving message order, separators, and composer drafts.
## Testing
Added replay tests covering completed, unfinished, unrelated, and
barrier-separated deltas, plus deterministic Markdown rendering and draft
preservation.
GitOrigin-RevId: 2870b09a04b32c0a4c0e9ab76970a8ebc3f5a7d4
## Why
Automatic startup work and `codex doctor` can run before a workspace is
trusted. A repository-controlled `PATH` must not be able to make those flows
execute workspace-provided helpers.
## What changed
- Resolve helpers used by automatic startup from trusted system installation
directories, and give plugin-sync Git subprocesses a sanitized environment.
- Make terminal detection environment-only and have doctor inspect executable
locations without running them. Fetch update metadata with the HTTP client
instead of `curl`.
- Fall back conservatively when trusted terminal helpers are unavailable,
including for tmux keyboard enhancement flags.
## Testing
Add black-box coverage with hostile workspace `PATH` entries for startup,
interactive tmux startup, support log collection, doctor, and curated plugin
sync. Add unit coverage for trusted executable resolution and bounded update
HTTP responses.
GitOrigin-RevId: 3b8995eb422b60ed53b0386951de59e8f9bfc542
## Why
Context compaction was only reported after it completed, so the TUI did not
show when compaction was actively making room to continue.
## What changed
- Show `Compacting context` as soon as manual or server-driven compaction
starts, with an elapsed timer independent of the current turn timer.
- Preserve the compaction status across follow-up input and transient activity,
while still allowing retry errors to take precedence.
- Restore in-progress compaction timing from thread snapshots and add the live
duration to the completion message.
- Clear stale compaction state when the turn starts, completes, or terminates.
## Testing
Added TUI tests covering manual and server-driven compaction, narrow rendering,
follow-up input, replay and task switching, retry status, timer preservation,
and turn termination.
GitOrigin-RevId: 804e1bc553315da24ff1f99462e8e282818cada3
## Why
Permission requests can originate in an environment whose path convention differs from the Codex host. Requiring the request working directory to be host-native prevents those requests from reaching interactive approval.
## What changed
- Carry the request `cwd` as a `LegacyAppPathString` through core events and the app-server protocol so the target environment's native representation is preserved.
- Convert the preserved value back to a `PathUri` when materializing permission grants.
- Regenerate the JSON and TypeScript protocol schemas for the updated `cwd` type.
## Testing
- Exercise the app-server permission request round trip with a target-native working directory across host path conventions.
- Verify remote permission requests retain their environment working directory and granted access still unblocks later execution.
GitOrigin-RevId: 97dc9707d9048883d20bab1b69c93871039f3188
## What changed
- Limit elevated interactive setup to provisioning sandbox identities and proxy settings; do not include caller workspace or ACL roots in its payload.
- Always run the non-elevated setup refresh during sandbox activation so the current permission profile supplies read, write, and deny paths, including when provisioning was completed previously.
- Add an `interactive-provision` setup mode that performs provisioning without the full ACL setup path.
## Testing
- Verify elevated provisioning payloads contain no caller ACL roots and use the new mode.
- Verify the setup helper accepts `interactive-provision` payloads.
GitOrigin-RevId: 081b1b43abd2388773c230fb35da82896e7be2ea
## Why
Compaction replaces the model history window, but host-verified user answers may
still be needed for the rest of the owning thread.
## What changed
- Add bounded, model-invisible retained context for verified
`request_user_input` answers.
- Persist retained context in rollout events and compaction checkpoints, and
restore it when a thread resumes.
- Remove answers when their source turns are rolled back, and prevent
parent-local answers from being inherited by child forks.
## Testing
Add lifecycle coverage for deduplication and size limits, compaction and resume,
rollback, rollout migration, and child forks.
GitOrigin-RevId: c32900d3e8120a9899b71f0576683acd67a4b898
## Why
An app-server thread can still be closing when the TUI reconnects. Its
`thread/resume` request then uses the same `-32600` error code as an unavailable
thread, even though the thread can be resumed once closing finishes.
## What changed
Treat the thread-specific "is closing" response as a transient reconnect error
so the existing reconnect loop retries instead of marking the conversation
unavailable.
## Testing
Extend the active reconnect and end-to-end reconnect tests to cover a closing
thread that resumes successfully on the next attempt.
GitOrigin-RevId: 30ce232b8894065fef346a86128b3ff9bf36ba1f
## Why
TUI preferences and persistence paths belong to the local client, while thread
configuration and account requirements may come from the active app server.
Keeping both in the same resolved `Config` can replace live local preferences
when a thread is resumed, forked, reconnected, or switched.
## What changed
- Add `LocalSettings` as the TUI-owned source for UI, history, notice, and local
persistence settings, and preserve it across session lifecycle transitions.
- Write preference changes to the selected user config file and reload local
settings from disk when changing roots.
- Use the app server's account response for authentication-dependent onboarding
and status UI instead of the local model-provider configuration.
- Retain platform family and OS metadata reported by remote app servers.
## Testing
- Cover local setting defaults, overrides, persistence destinations, reloads,
and preservation across widget replacement and root switching.
- Cover remote platform metadata and server-controlled authentication UI.
GitOrigin-RevId: dbc2965fb1d6cbecb3f973f6133f3dcd4467b753
## What changed
- Centralize app-level keymap actions in a shared dispatcher, including raw-output and external-editor chords.
- Move read-only transcript input handling into its own module while preserving prompt backtracking and older-history loading.
- Add regression coverage for transcript draft isolation, backtrack selection, global chords, and cached history when a thread is unavailable.
GitOrigin-RevId: a1465942d1ea6c57c2f54e5e313025aceb9f8510
## What changed
- Add Vim Replace mode, entered with `R`, which overwrites graphemes and appends at the end of a line.
- Restore overwritten text with Backspace and record replace edits for undo and dot-repeat.
- Preserve composer behavior for attachments, completions, paste bursts, history previews, and external editor imports while replacing text.
- Expose `vim_normal.enter_replace_mode` in the configurable TUI keymap.
## Testing
- Add coverage for grapheme replacement, Backspace recovery, dot-repeat, custom bindings, atomic attachments, completions, paste handling, and history interactions.
GitOrigin-RevId: cb04e3adcce013c1eb7b82c994b00e944310c481
## What changed
- Replace `send_user_message_async` with `request_user_input_async`, accepting one or more questions with optional suggested answers while allowing the turn to continue.
- Attach structured question metadata to asynchronous agent messages while retaining readable fallback text, and preserve it through app-server events, thread history, and generated schemas.
- Continue enabling the new tool for model catalogs that advertise either the old or new tool name.
## Testing
- Cover tool registration, question validation, emitted items, continued turn execution, history preservation, and backwards-compatible deserialization.
GitOrigin-RevId: ffc49aebde2e854c3c50a122aa52805fec3fc6b3
## What changed
- Parse `experimental_network.header_injections` rules with host, method, path-prefix, and header mappings and carry them into `NetworkConstraints`.
- Export the rule type from `codex_config`.
- Summarize configured rule counts and hosts in the TUI debug configuration without exposing header values.
## Testing
- Cover managed configuration parsing and redaction of header values from debug output.
GitOrigin-RevId: 623b047e6c6111a9f2ccbe79c9ace054631a3c67
## What changed
- Add nullable `model` and `reasoningEffort` fields to the shared app-server `Thread` object and generated schemas.
- Report current settings for loaded threads and the latest persisted settings for unloaded threads across thread read, list, start, resume, rollback, metadata update, and notification paths.
- Keep unavailable legacy or filesystem-only settings nullable, and allow metadata reads without loading a thread or dispatching queued work.
## Testing
- Cover live-setting precedence, persisted settings after restart, null legacy values, and model metadata returned by thread lifecycle operations.
GitOrigin-RevId: 22ebe8a8d1910a820d90a97730d812a00d8c1372
## What changed
- Warn Plus and Team users when they have less than 50% of an approximately five-hour usage window remaining.
- Preserve the existing 75%, 90%, and 95% usage thresholds for other plans and window lengths.
- Continue deduplicating warnings across rolling rate-limit updates.
## Testing
- Cover eligible and ineligible plan and window combinations, retained plan metadata, and warning deduplication.
GitOrigin-RevId: b221def052b979c91490e7878829db2478c6e264
## What changed
- Add a bounded redo stack for complete composer drafts, including paste payloads and image attachments. `Ctrl+R` now reapplies the last undone edit in Vim normal mode, while new edits clear stale redo history.
- Add the configurable `vim_normal.redo` action to the keymap schema and picker. Preserve reverse prompt-history search in Vim insert mode and non-Vim mode, and honor explicitly configured bindings.
- Keep pending edit snapshots outside the shared undo/redo byte budget so canceled commands cannot evict committed history.
## Testing
- Cover grouped edits, Vim searches, direct draft changes, history limits, empty redo stacks, and custom or unbound shortcuts.
GitOrigin-RevId: 0cf5bb376ff865ddc0a77705dcb322ef6b57b3a3
## What changed
- Render descriptive Markdown labels alongside canonical local file targets instead of discarding them.
- Collapse labels that resolve to the same path, accounting for relative and absolute forms, `file://` URLs, percent encoding, case, separators, and location suffixes.
- Preserve `~/` destinations for display and keep absolute paths unless they can be shortened relative to the session working directory.
## Testing
- Add unit and snapshot coverage for descriptive and path-equivalent labels, invalid percent encoding, trailing separators, Unix and Windows paths, UNC paths, `file://` URLs, and table wrapping.
GitOrigin-RevId: 636bf4485b2899d96c6273be3f3b7f38728c9013
## What changed
- Show revealed running hooks in the bottom activity area instead of the conversation viewport or transcript overlay. Fold the hook message into the active status row when space permits and reflow it below the row without displacing background-process controls or status details.
- Keep fast hooks hidden, collapse concurrent hooks to a shared summary when needed, and support hook activity outside an active agent turn.
- Simplify durable hook output into user-facing messages and actionable failure, block, and stop states. Suppress model-facing context and quiet successful completions from all TUI history surfaces.
## Testing
- Add lifecycle, layout, narrow-width, multi-width Unicode, transcript, restart, and completion-output coverage for hook status and history rendering.
GitOrigin-RevId: 4c52b7a736e9e466e109107eb3c04a39d089597f
## What changed
- Render complete patch contents directly in TUI history cells.
- Render all input sent to background terminals inline.
- Remove the preview row and byte limits and their transcript hints so inline and transcript views contain the same content.
## Testing
Update snapshots to cover patches and terminal input longer than the former 12-row preview limit.
GitOrigin-RevId: 9960818a9b51fc0c7f84d9def77b9b1bd8acad6c
## Why
The agent command center only listed sessions currently loaded by the app server, so completed or otherwise unloaded tasks could not be revisited from the overview.
## What changed
- Seed the overview with up to 20 recent root sessions in addition to loaded sessions, retain discovered sessions for the lifetime of the TUI, and update rows from thread lifecycle notifications.
- Allow unloaded sessions to be resumed from the overview using the normal working-directory selection and configuration rebuild flow. Explicit runtime permission choices carry across a cold resume, while settings inherited from the previously selected task do not.
- Fall back from `recency_at` to `updated_at` when connected to an older server, and continue showing loaded sessions when recent-history listing is unavailable.
## Testing
Added coverage for recent-session discovery and retention, notification races, legacy and failed listing fallbacks, cold-resume working-directory and permission handling, reconnect behavior, and unloaded-session rendering and selection.
GitOrigin-RevId: 668068b1594eb24b2ea7faccd0327804b8cd22ef
## Why
Vite+ launches Codex through the same JavaScript shim as npm, so Codex could
misidentify Vite+-owned installations and recommend npm for updates.
## What changed
- Detect Vite+ global installs from their package ownership metadata and pass a
dedicated `CODEX_MANAGED_BY_VITE_PLUS` marker to the native binary.
- Represent Vite+ in install context and `codex doctor` output.
- Recommend `vp install -g @openai/codex` in update and repair flows for
Vite+-managed installs.
See https://github.com/openai/codex/pull/30880.
GitOrigin-RevId: 8add724eefd31170a078086392609dbbd7f20b26
## Why
Guardian review evidence must remain available after a compacted thread is resumed or forked, while rolled-back or parent-local evidence must not grant authorization in a different context.
## What changed
- Store the bounded, model-invisible Guardian transcript alongside compacted rollout history and restore it from the newest surviving checkpoint during replay.
- Trim Guardian history at rollback boundaries, clearing it when the boundary has already been evicted.
- Preserve the checkpoint for user-initiated forks, but remove it when spawning a subagent so parent review evidence is not inherited.
- Keep the new rollout field optional for compatibility with existing compacted records and legacy readers.
## Testing
- Cover Guardian history across compaction, restart, paginated and pathless stores, user forks, rollback, bounded replay, serialization, and subagent forks.
GitOrigin-RevId: 6ab076d5e0c3aac4d6a41ebd50ba2b200c90213e
## What changed
Emit the `codex.tui.start` counter once per TUI launch with an
`app_server_mode` label of `in_process`, `local_daemon`, or `remote`. Recording
the metric during startup keeps reconnects from counting as additional
launches.
GitOrigin-RevId: 7527f319b95ae53f5278fa16120120a433a29ae4
## Why
Composer drafts include attachments, mention targets, and deferred paste payloads in addition to visible text. Vim undo needs to restore that complete state as a single edit.
## What changed
- Add bounded, draft-level Vim undo history, with `u` as the configurable default binding in normal mode.
- Group complete Vim commands and insert sessions into undo steps, including direct composer changes such as pastes and attachments.
- Preserve undo, repeat, and search state when a reverse-history preview is canceled, and start fresh history when another prompt is accepted.
## Testing
- Cover grouped edits, custom bindings, history and search interactions, attachments, and large paste payloads.
GitOrigin-RevId: 12ecdb3c34a2d66f5d856aa2f82dc15bd91b230b
## Why
Moving between prompts in backtrack mode rebuilt every transcript renderable and
discarded their cached heights, causing the entire transcript to be laid out
again for each selection change.
## What changed
Rerender only the previously highlighted cell and the newly highlighted cell.
Keep all other renderables, cached heights, and the live tail intact while
continuing to scroll the selected prompt into view.
## Testing
Add regression tests that verify selection changes preserve unrelated height
caches and produce the same viewport and scroll position as a full rebuild,
including with a live tail and terminal width changes.
GitOrigin-RevId: 685a8ce65ecadef20521ce2ded7b516fdf8499c9
## What changed
- Show the exact `codex resume <thread-id>` command on its own indented line.
- When a thread has a name, also explain that users can run `codex resume` and select the named thread from the picker.
- Apply command highlighting to both resume options when color is enabled.
## Testing
- Cover unnamed, empty-name, named, colored, and embedded-session exit summaries.
GitOrigin-RevId: d97c04db8a34376c6d9ea839b515b04a384b85d1
## Why
Large input sent to a background terminal can require excessive wrapping work and fill the inline history view.
## What changed
- Limit inline input previews to 12 rendered rows and bound preview processing to 64 KiB.
- Show a transcript hint when input is omitted, while preserving the complete input in transcript and raw views.
- Keep URLs intact when they fit and truncate only the final overflowing line when needed.
## Testing
Add regression coverage for long wrapped input, narrow viewports, zero-width Unicode payloads, URLs, and inputs that fit within the preview budget.
GitOrigin-RevId: c20edf156d5c8364083b1690e41cabd29786a279
## What changed
Dispatch `AppEvent::OpenAgentsOverview` in the daemon reconnect navigation test instead of simulating the Alt+A keyboard shortcut.
GitOrigin-RevId: 99729a39496ffb96747f6d0c4be0edf52d1ef3f6
## What changed
- Exercise Rust source discovery through a mocked `git ls-files` call, including files outside `codex-rs`, paths containing spaces, and stale entries that no longer exist.
- Assert that the formatter invokes `rustfmt` from `codex-rs` with the repository configuration in both format and check modes.
- Keep the multiline argument-comment lint fixture stable under formatting and update affected Rust test files to the expected style.
GitOrigin-RevId: 0cfffde1bb91bf620d2118bed1efc68466c0cca6
## What changed
- Start the composer in Vim Insert mode when Vim is enabled and return to
Insert mode after submissions and slash-command dispatch.
- Record the fresh Insert session as a Vim edit so `.` can repeat text entered
in a new draft.
- Keep `/` and `?` as Normal-mode composer searches, and let Backspace cancel
an empty search query and any pending operator without changing the draft.
## Testing
- Add coverage for startup, submitted and queued drafts, inline and goal slash
commands, repeatable edits, and canceled searches.
GitOrigin-RevId: 1a5ee30c44685d2b2a037e46c3ab4ab611024919
Eric Traut