## Why
Linux voice needs system ALSA plugins and enough buffering to accommodate PipeWire graph cycles without losing capture samples. Voice startup failures also need actionable diagnostics without exposing native error details.
## What changed
- Build and bundle GNU voice helpers and runtimes with primary Linux musl release archives, and sign the archives. Keep Python wheels free of these libraries to preserve `manylinux_2_17` compatibility.
- Discover ALSA plugins in fixed system directories and increase Linux capture and playback buffering to support larger PipeWire graph cycles.
- Report voice failures by stage, preserve negotiation timeout classification, and discard native error sources. Suppress the misleading `requested` closure message after failure cleanup.
- Add explicit Windows MSVC, pkgconf, and CMake toolchain configuration and preserve host architecture in native build environments.
## Testing
Add coverage for Linux release assembly, ALSA plugin discovery, PipeWire capture and playback, classified startup failures, failure cleanup rendering, and Windows build environment handling.
GitOrigin-RevId: d805eace96a669ce3a4489f12e2db6f68f9f7f53
## Why
Deleting a session, canceling an archived session resume or fork, and pressing `Esc` in a conversation open in another app previously exited the TUI. Local daemon and remote connections can instead return to the command center to select another conversation.
## What changed
- Return to the command center after successful deletion on local daemon and remote connections. Shut down side conversations before deletion and clear the deleted thread's local state.
- Return to the command center when an unarchive prompt is canceled, discarding startup input intended for the canceled resume or fork. Keep explicit quit actions and embedded server exit behavior.
- Make `Esc` open the command center from a conversation open in another app. Reselecting that conversation preserves its read-only snapshot and draft; `R` explicitly retries attachment.
- Update deletion confirmation text and keyboard hints to reflect these destinations.
## Testing
Add lifecycle tests for deletion success and failure, side conversation cleanup, unarchive cancellation and quitting, and read-only snapshot preservation. Add snapshots for command center navigation hints and deletion confirmation.
GitOrigin-RevId: 55a96358edb7af73949877a515614943bdc73643
## Why
Managed new-thread defaults could overwrite model, reasoning effort, and service tier settings from an explicitly selected profile.
## What changed
- Treat effective profile settings as explicit launch choices when applying managed defaults. A profile setting for either `model` or `model_reasoning_effort` opts out of both managed values; `service_tier` remains independent.
- Count a profile setting only when it supplies the highest-precedence active value, so settings shadowed by project configuration do not block defaults.
## Testing
Add regression coverage for profile precedence at startup, session replacement, and background task creation, plus custom-provider profiles, service tiers, unrelated profile settings, and project settings that shadow profiles.
GitOrigin-RevId: 98f036b8b7059bab8598283600dbc6967c71d3e3
## Why
Unrecognized settings can be silently ignored, leaving typos or deprecated configuration unnoticed.
## What changed
- Collect warnings for unrecognized fields in effective configuration and requirements layers, including unknown feature keys in configuration.
- Report sources and field names without configuration values, show up to three entries, and provide migration hints for `network_proxy`, `allowed_permissions`, and `include_view_image_tool`.
- Emit project-specific warnings when starting a thread and suppress repeated startup warnings in the app server and TUI.
## Testing
Add coverage for merged configuration, disabled layers, startup and project warning delivery, omission of configuration values, and warning deduplication.
GitOrigin-RevId: 464cef87882502b19865ae10b50b6f82defb7296
## Why
Audio queue saturation and processing delays could terminate voice sessions. Muted sessions also need outgoing audio to keep the peer alive.
## What changed
- Drop stale or excess incoming, capture, render-reference, and playback audio so fresh audio can resume. Reset affected processing state while preserving queue bounds and mute generations.
- Send paced, generated Opus silence while muted, without using device or processing buffers.
- Add fixed helper exit stages and session failure categories to default TUI logs without logging raw native errors, SDP, or device error text. Preserve observed helper exit status for shutdown.
## Testing
Extend tests to cover decoded mute silence and RTP sequence continuity, recovery after stale audio and queue saturation, and shutdown after observing helper output closure. Verify the helper's exit stage when the parent pipe closes during blocked startup.
GitOrigin-RevId: 17d580a72acd4423fb0b4f5107d9b541b964d069
## Why
The TUI should respect the host's accessibility preference even when `tui.animations` is enabled.
## What changed
- Read the system motion preference once at launch on macOS, Windows, and Linux. Changes to that preference require restarting the TUI.
- Suppress animations when reduced motion is requested without changing saved configuration. Preserve configured behavior when detection is unavailable, and limit the Linux portal query to 250 ms.
- Use the effective animation setting for voice controls and transcripts, and honor system reduced motion in the startup composer.
## Testing
Add tests for animation preference resolution and preservation of saved settings, plus composer snapshots without sparkles at widths of 40 and 80 columns.
GitOrigin-RevId: 3ea4e721ae23220a040a06123a27286a8c8f1c7c
## Why
Command center failures need to remain visible while users retain their task selection and composer draft, including when a task is already managed by another app server.
## What changed
- Show action errors above the retained dashboard with a return option and a clear explanation for tasks open elsewhere.
- Keep the dashboard open until task attachment succeeds, and return to the conversation when selecting the already displayed task.
- Offer “View unsent task” in a pager when restoring a failed submission would overwrite newer input.
- Show task refresh failures inline and clear the notice after a successful refresh.
## Testing
Add regression tests and snapshots for attachment conflicts, preserved selection and drafts, successful attachment, inline refresh recovery, unsent task viewing, and visible action failures.
GitOrigin-RevId: 19670c5ea506414a835296141004db567b0cafef
## What changed
- Support `model_provider` and `model_providers` in managed requirements. Required selection overrides local and session configuration; each required provider definition replaces the corresponding local entry, including its authentication and headers.
- Merge provider requirement fragments before validation, preserving source-relative `auth.cwd` paths. Reject invalid cloud provider definitions before replacing the cached bundle, including unsupported Bedrock overrides.
- Expose `modelProvider` and `modelProviders` through the configuration requirements API and generated schemas. Reject writes to managed provider settings and omit their local origins, including for provider IDs containing dots.
## Testing
Add tests for requirement precedence, authentication fragment merging, path resolution, cloud cache preservation, and read-only configuration RPCs. Integration tests verify that model discovery and inference use the required gateway and ChatGPT authentication without leaking local headers, and that provider requirements survive configuration rebuilds.
GitOrigin-RevId: d1448604d4ef5662ebb5df7b693712d3b8ad6d54
## Why
Reopening the agent command center focused the composer, requiring an extra focus change before browsing tasks.
## What changed
- Focus the task list when opening the overview from a session or returning after task lifecycle actions. Keep composer focus when starting directly in the overview.
- Fall back to the composer when no visible tasks remain, after discovery and pending metadata have resolved.
- Preserve unsent drafts and explicit focus changes across populated refreshes.
## Testing
Add regression coverage for requested focus, draft and cursor preservation, arrow-key and Vim navigation, and empty-list fallback while metadata is pending. Add a snapshot of the reopened overview with list focus.
GitOrigin-RevId: 8713eadc4a2a72e2db4a962184d43c4028c7178d
## Why
The TUI has no voice picker, and realtime start requests omit the voice preference. Voice selection also needs to reflect the active project's effective server settings, which can differ from cached local settings.
## What changed
- Add `/voice settings` with the server's voice catalog and current effective selection, falling back to the built-in catalog when unavailable.
- Save `realtime.voice` through the app server and reread effective settings before confirming the selection. Report save failures and overrides.
- Resolve the effective voice for each realtime start. Apply selections to the next voice conversation without interrupting live audio, and retain compatibility with servers that lack `config/read` or return unknown voice names.
## Testing
Add picker and confirmation snapshots, plus request tests covering persistence, server defaults, catalog fallback, unknown voices, config read failures, overrides, and project settings after thread switches.
GitOrigin-RevId: d47e3da6c1164053c5be9d1da0f5932f2a09261f
## Why
Persisted turn-start events lack the originating root turn ID, so they cannot directly associate child turns with the root turn that initiated them.
## What changed
- Add optional `root_turn_id` to `TurnStartedEvent`. Use the inherited root turn ID when available, otherwise the turn's own ID.
- Centralize turn-start emission for regular turns, shell commands, and manual compaction so they record attribution consistently.
- Carry attribution into `ThreadHistoryTurnChange` when processing turn-start events and retain it through completion in the history builder.
- Keep older records compatible by defaulting missing attribution to `None`.
## Testing
Add coverage for root and child turn attribution, persistence when tool collisions fail a turn before sampling, history change propagation, and deserialization of older turn-start records.
GitOrigin-RevId: 54a80b828ca7d1c4c19f13d468c01d052e1b9130
## What changed
- Add `thread/attachment/add`, `thread/attachment/list`, and `thread/attachment/remove` to manage durable resource references without loading the owning thread or changing conversation history.
- Identify attachments by thread, `attachmentType`, and `identityKey`. Repeated adds return the existing attachment; repeated removals succeed without emitting another update. Listing supports cursor pagination.
- Broadcast `thread/attachment/updated` after creation or deletion, after responding to the requester. Serialize attachment mutations with thread lifecycle operations and reject stores that do not support attachments.
- Update protocol schemas, TypeScript and Python bindings, documentation, and TUI notification handling so attachment updates do not add untracked threads to the agent picker.
## Testing
Add coverage for unloaded threads, pagination, idempotent addition and removal, reattachment, invalid inputs, unsupported stores, response-before-notification ordering across clients, and TUI notification routing.
GitOrigin-RevId: 0d29cf903afd4e931a70a9cf96300475213b34aa
## What changed
- Add `Ctrl+E` to archive the selected task and its child agents, and `Delete` to permanently delete their history. Both actions require confirmation, with Cancel selected by default.
- Expose `agents.archive` and `agents.delete` in keymap configuration and the shortcut picker. Default bindings yield to existing custom bindings and chords.
- Show progress while requests run, keeping rendering responsive and blocking task switching. Refresh overview state afterward and keep the dashboard open when the current task is removed.
- Report failures and preserve the current attachment and draft when a rejected operation leaves the task loaded.
## Testing
Add coverage for confirmation and cancellation, active and background task removal, child-agent attachments, stale refresh invalidation, failure recovery, and draft preservation. Add progress input-isolation tests, shortcut conflict tests, and snapshots for confirmation, errors, progress, and keymap rendering.
GitOrigin-RevId: b327bb8834699d0058f9ffb903ace525ae270500
## What changed
- Add `Ctrl+W` to hide the selected task without stopping it. Hidden tasks stay hidden through activity and metadata refreshes until explicitly resumed or the TUI restarts.
- Expose `agents.hide` in keymap configuration and the shortcut picker, and let the default binding yield to existing custom shortcuts.
- Wrap overview footer hints while keeping shortcuts and their labels together when they fit.
## Testing
Add coverage for hiding filtered tasks across statuses, visibility through activity and refreshes, explicit resume, existing keybinding compatibility, and custom chord footer rendering at narrow widths.
GitOrigin-RevId: 980726e1095b8d5bad8901be919decdde8c0f925
## Why
Pressing `Esc` in the agents overview task list dismissed the overview or
exited Codex when no primary thread existed, instead of returning to the draft.
## What changed
Make list cancellation return focus to the composer, including while
reconnecting, preserving the draft and cursor position.
## Testing
Add regression coverage for returning from the list to the composer with Vim
mode enabled or disabled, both online and reconnecting. Verify draft and cursor
preservation, resumed text entry, and the absence of app events.
GitOrigin-RevId: 8920677c42b0c9ff5023979e198f069abcfcf54b
## What changed
Replace duplicated footer wrapping in the MCP elicitation and request-user-input overlays with `wrap_hint_rows`. Preserve whole-hint grouping, display-width and separator accounting, oversized hints, and the single empty row for empty input.
## Testing
Add unit tests for Unicode display widths, whole-hint wrapping, oversized hints at zero width, and empty input.
GitOrigin-RevId: 4d8ead0acbfa3bf9241baedb86d2476566d26ebc
## What changed
Allow `Right` to open the selected task from the task list or an empty, focused composer. Preserve editor keybindings and guard against pending input, active popups, and offline state. Keep metadata editing unaffected and show the shortcut in navigation hints.
## Testing
Add regression tests for opening the current or highlighted task, preserving cursor movement and renaming, and preventing navigation while offline. Update snapshots to cover the new hints.
GitOrigin-RevId: 9fc01b62ad0829b964509ae6286a041fc4936b9d
## Why
`/archive` exits the TUI even when connected to a local daemon or remote app server, interrupting access to other tasks.
## What changed
- Keep the TUI running after a successful archive on local daemon and remote connections, and reopen the agent command center.
- Shut down side conversations before archiving, then clear the archived thread's local state, transcript, and unsent draft.
- Preserve exit-on-archive behavior for the embedded app server and remove the exit promise from `/archive` help and confirmation text.
## Testing
Add coverage for local daemon and remote connections, including side-thread cleanup, archive requests, cleared session state, and the resulting command center snapshot. Retain coverage for embedded archive success and failure.
GitOrigin-RevId: 36c61ec76a13a3fc1b5d6725e3b8f42a97fe6793
## What changed
- Mark `realtime_conversation` as experimental, keeping it disabled by default, and label it “Voice conversations” in `/experimental`.
- Add an announcement directing users to enable the feature, restart Codex, and run `/voice`.
- Hide server-discovered voice entries and the announcement when the client lacks native voice runtime support.
## Testing
Add tests and snapshots for voice discovery and announcement visibility with and without runtime support, and update the experimental features popup snapshot.
GitOrigin-RevId: 709655f3733cb88191eb78b40ac1f67e27c9816e
## Why
Unanswered questions from the previous prompt remain visible after a new follow-up. Clear them when the user moves on to new work.
## What changed
- Clear pending questions when a model prompt is submitted or queued, and when a review starts. Clear again on queued prompt delivery to remove questions that arrived while waiting.
- Retain seen question IDs so replay cannot restore cleared questions.
- Track question answers separately from prompts through queues, retries, thread restoration, and reconnects so delivering an answer preserves other pending questions.
- Preserve questions for local commands and rejected submissions.
## Testing
Add regression tests for immediate and queued follow-ups, replay suppression, slash prompts, reviews, rejected input, and answer preservation across delivery and recovery. Add a snapshot of the composer after questions are cleared.
GitOrigin-RevId: 76353c6ee098c1505678ac43b1dc6391ea9fa738
## What changed
Remove the TUI command introduced in https://github.com/openai/codex/pull/11512 for granting sandbox read access to additional directories, along with its event handlers and non-elevated read-root grant helper.
## Testing
Enable the existing voice command popup snapshot test on Windows as well as macOS.
GitOrigin-RevId: 8a3a06b76749420101e34aa6587a8beab8eb5fdd
## Why
Saved model selections can outlive their bundled catalog entries and still need migration guidance.
## What changed
- Remove `gpt-5.2` and `gpt-5.4-mini` from the bundled model catalog.
- Preserve migration from saved `gpt-5.4-mini` selections to `gpt-5.6-luna` when the old model is absent, while respecting catalog-provided migration metadata.
- Update tests and snapshots to use current models or explicit test fixtures, and remove the obsolete prompt fixture.
## Testing
Extend migration tests to cover catalog metadata precedence, saved selections, replacement model and reasoning-effort persistence, acknowledged prompts, and missing or hidden migration targets.
GitOrigin-RevId: 82beea504cc4a15699677c28a61ec0939af3069c
## Why
Rendering the voice strip over sparkle stars can leave voice indicators with a star's color even when their glyphs are unchanged.
## What changed
Render the voice strip after effort ignition and before sparkle effects so stars skip its text and preserve its styles.
## Testing
Add a regression test comparing all nonblank composer cells, including their styles, across 80 sparkle frames while confirming stars still appear. Add a snapshot of the active voice composer.
GitOrigin-RevId: 48774408646c1281df3a6f7b1e12ab9d03a1babd
## Why
Session transitions need stack headroom to rebuild configuration and the chat widget. Tokio stores task outputs inline even when it boxes the task future, so returning a large `Config` adds stack pressure during task allocation.
## What changed
Box the configuration build result inside the runtime worker and unbox it after joining. Box the `App::run` future to keep the large event loop out of enclosing startup futures.
## Testing
Extend the production-stack TUI integration test to enter `/side`, verify the process remains running, and return to the saved conversation with Ctrl+C.
GitOrigin-RevId: 44975300bb837bf3645ff762cf7bcdc44a277f41
## Why
Cold rollout files can still have active writers. Compression must not replace their files while writes are pending, including background work that outlives the local thread store.
## What changed
- Share cross-process writer locks between the rollout compressor and local thread store. Skip busy threads and recheck file state under coordination before publishing compressed files.
- Retain writer ownership through recorder background I/O and compressed rollout materialization. Wait for writers to exit on shutdown or discard, and stop queued file work before deletion.
- Route rollout metadata patches through owned recorders, reject competing writers before updating SQLite, and serialize metadata appends with shutdown.
## Testing
Add regression coverage for compression with live and detached writers, parallel cold-file compression, publication locking, metadata ownership conflicts, updates to compressed rollouts, concurrent shutdown, and discarding deferred items.
GitOrigin-RevId: c52f4037eb2019e8095b554e29bf531af95aa4bd
## What changed
Support `model_providers.amazon-bedrock.aws.credential_export` with `command`, `args`, and `timeout_ms` to supply SigV4 signing credentials from a command's JSON output. Accept both flat credential-process output and nested STS `Credentials` objects.
Cache credentials in memory, refresh before expiration, and share exports across sessions with matching AWS configuration. On recoverable authentication failures, run the optional `aws.auth_refresh` command before exporting fresh credentials, coalescing concurrent recovery attempts.
Bound command execution time and output size, and keep credential values out of errors. Reject combining `aws.credential_export` with `aws.profile`. Bedrock setup and login reject changes while an exporter is configured, preserving configuration and saved credentials.
## Testing
Add coverage for output formats, expiration, credential precedence, caching, concurrent recovery, command failures, and secret redaction. Integration tests verify request signing with rotated credentials, bounded recovery attempts, and setup/login rejection across configuration layers.
GitOrigin-RevId: 4ef799f88ab5e3b2578f8f41a5e56e4f30e2cd81
## Why
The agents overview submitted background task prompts as plain text, without image attachments or their text elements.
## What changed
- Enable image pasting in the overview composer and include attachments and text elements in the first task prompt.
- Resolve local image paths and send image bytes when using a remote workspace.
- Reject image inputs for models declared text-only before starting a thread.
- Restore unsent text and attachments after failures, or show image reattachment paths when a newer draft prevents restoration.
## Testing
Add tests for attachment rendering and submission, remote image payloads, draft recovery without overwriting newer text, and text-only model rejection.
GitOrigin-RevId: 08e3db8bace51ec007f5741f1b2be94658cbaea4
## Why
History events queued by the previous thread can repopulate the transcript after a thread switch, mixing old content into the new thread's replay.
## What changed
- Reset the transcript immediately and queue another reset before replaying the new thread, covering both snapshot switches and app-server thread replacement.
- Leave the alternate screen when resetting, and pause terminal event handling until queued resets finish.
- Process queued resets even when the transport is offline.
## Testing
Add regression tests for both switch paths, including queued history, an open transcript overlay, and a disconnect before replay events are handled. Snapshot the replacement transcript to verify it contains only the new thread's content.
GitOrigin-RevId: b68b07fb10ff35e908c2c184f80859dda637f977
Use `Box::pin` in
`cached_legacy_resume_revalidates_history_across_migration_settings` to
keep the large resume future off the Windows test thread's stack.
GitOrigin-RevId: 2539b7733e9f92e65a27bbea8f75170ce01b1884
Raise the Tokio worker thread stack size from 8 MiB to 12 MiB in
`selected_and_resumed_threads_use_server_capability_for_v1_and_v2_children`.
GitOrigin-RevId: 5f2462e50f0d67eeb1f5668d196431c7dc08d27f
## What changed
Parse optional `generation_id` values from image API responses and carry the selected image's ID through the image generation tool into analytics events. Keep the ID out of serialized extension items, JSON schemas, and TypeScript types. Responses without an ID remain supported.
## Testing
Add coverage for distinct IDs in multi-image responses and responses without IDs. Extend analytics and app-server tests to verify that the selected image's ID reaches analytics, and item tests to verify that it is omitted from serialization and TypeScript types.
GitOrigin-RevId: 70a600856990140b76fdbda51a0d73b3414338b1
## What changed
- Display owner thread titles, relative update times, and archived or unavailable status in the managed worktree browser. Offer resume only for resumable owners, including those with compressed thread history.
- Add a delete action with a confirmation dialog that defaults to Cancel and preserves thread history.
- Restrict removal to managed worktrees in the current repository. Refuse the current checkout, including path aliases, and checkouts containing local changes, untracked files, or ignored files.
## Testing
Add browser snapshots and tests for owner states, deletion confirmation, and compressed thread history. Add worktree removal coverage for unrelated checkouts, current-directory aliases, untracked and ignored files, and successful removal of a clean checkout.
GitOrigin-RevId: e5867f1540d5d5bc8130acc76875e51e3d8b3b6a
## What changed
Add `terminal_name` and `multiplexer` attributes to `codex.tui.start` alongside `app_server_mode`. Use fixed terminal categories rather than versioned or user-provided identifiers, with `unknown` for unrecognized terminals. Report the multiplexer as `tmux`, `zellij`, or `none`.
## Testing
Extend the CLI worktree test to parse metric payloads and assert the exact startup attributes for an unrecognized terminal without a multiplexer. Keep coverage that no metrics are sent when analytics is disabled.
GitOrigin-RevId: 024c82653098b9bddd6c5e8d7133ff798b58dcd1
## What changed
- Record voice session starts, connections, failures, endings, and active duration under `codex.voice.session.*`.
- Deduplicate failure accounting and distinguish errors during startup retry cleanup from errors during a requested stop.
- Record failures on rejected voice operations and disconnects, and clear the owned session when a stop request is rejected.
## Testing
Add regression tests for failure accounting during retry cleanup and session cleanup after rejected stop requests, including replay-only threads.
GitOrigin-RevId: d67cab5ff1e8fc85ce7a3d61a1763d38a5d537f0
## What changed
- Update the status heading from the latest usable reasoning line and retain it through tool activity and empty reasoning items. Keep completed reasoning in the expanded transcript only.
- Restore active reasoning after resume, thread switches, and session refreshes, including when earlier events have left the replay buffer.
- Default new embedded TUI threads to `model_reasoning_summary = "detailed"`, honoring explicit summary settings. Keep `concurrent_reasoning_summaries` opt-in and disable it when summaries are `none`.
- Persist the request's captured reasoning summary setting in context updates and local and remote compaction checkpoints.
- Animate status text with a smooth, grapheme-aware shimmer that respects terminal colors and reduced motion.
## Testing
Add regression coverage for reasoning status updates, transcript visibility, resume and buffered replay, outbound summary configuration, and summary settings across all three compaction modes. Add shimmer snapshots and checks for smooth brightness changes and Unicode grapheme preservation.
GitOrigin-RevId: 725c7de20f23166d7a3da6daeca617add5cbc600
## Why
Switching providers or authentication could reuse a previous identity's model catalog, including its default service tier. An in-flight refresh could also overwrite a newer account's catalog after cache storage completed.
## What changed
- Require a matching provider and auth identity for disk and in-memory catalog reuse. Treat legacy entries without an identity as cache misses and fall back to bundled metadata when the in-memory identity no longer matches.
- Recheck identity after fetching and storing a catalog before publishing it.
- Renew cache freshness only when the client version, identity, and ETag match the stored entry.
- Update cache fixtures to include the configured provider and auth identity.
## Testing
Add regression coverage for provider and auth switches, credential rotation, legacy and mismatched cache entries, conditional TTL renewal, and an account switch during cache storage. Verify that API-key requests do not inherit a ChatGPT catalog's default `service_tier`, while explicit tier selection still works.
GitOrigin-RevId: e15d7ffff238d951d7a1c6a68381cbb479994146
## Why
Repeated alternate-screen entry can overwrite the saved inline viewport, and half-page scrolling can use a different height from the rendered transcript.
## What changed
- Make alternate-screen entry idempotent to preserve the inline viewport for restoration.
- Defer transcript reflow after raw output mode changes while an overlay is open, preserving queued history until the overlay closes.
- Use the last rendered content height for half-page scrolling, matching full-page scrolling.
## Testing
Add regression coverage for restoring the inline viewport and draft after closing the transcript with pending history and a raw output mode change, plus half-page scrolling when the rendered height differs from the terminal viewport.
GitOrigin-RevId: 30847df4b6383db26791ebda20470c9b169f9680
## Why
During an active turn, `/copy` could still offer the previous final response even after a new commentary message had completed.
## What changed
Record every completed agent message with non-empty visible Markdown for copying, including commentary. The picker can then offer the latest completed commentary as a whole response and expose its code blocks.
## Testing
Add a regression test and picker snapshot covering completed commentary during an active turn after a previous final response. Verify that selecting “Whole response” copies the commentary and that the picker lists its shell code block.
GitOrigin-RevId: 0ea1d5e3952ccac21f2ee951d482619de82f28e0
## Why
The TUI automatically canceled MCP user verification requests, preventing users from completing verification and approving them.
## What changed
- Show verification prompts for active and inactive threads, with actions to verify and approve or cancel.
- Run approved verification through the local app-server's `userVerification/verify` RPC and return the proof to the original request. Cancel on failure and show a warning in the requesting thread; remote workspaces remain unsupported.
- Deduplicate prompts, preserve foreground streaming when another thread requests verification, and surface queued prompts when returning from a side conversation.
- Cancel verification when its thread is discarded and ignore stale results after cancellation.
## Testing
Add RPC, routing, and snapshot tests covering successful verification, unsupported binaries and remote workspaces, cancellation and late proofs, prompt replay, side conversation switching, and foreground stream preservation.
GitOrigin-RevId: 2ae12f47c443e17de25f4ec033f6078ac28b1e03
## What changed
- Track verification parameters and attempt IDs with cancellation tokens so callers can reject stale results after cancellation, server resolution, or reconnect.
- Add `ResolveUserVerification` to send acceptance proofs or cancellation through MCP elicitation responses, omit proofs from session recordings, and remove resolved prompts from thread replay.
- Add typed verification error messages with safe fallbacks that omit raw provider diagnostics.
## Testing
Add unit coverage for attempt invalidation, duplicate attempt prevention, proof serialization, resolved prompt replay, and safe error messages.
GitOrigin-RevId: 3466c9a83fe5f512a861fec062bef10dcd3025c8
## What changed
Add a presentation-only `UserVerificationView` with explicit verify and cancel choices, request details, and a waiting state. Report decisions through a callback, suppress duplicate approvals while waiting, and allow cancellation before or during verification. Dismiss the view when its matching MCP elicitation request resolves.
Add a full-screen request details overlay that can be opened without making a decision. Wrap prompt text and long URLs for narrow terminals. The view is not yet connected to incoming verification requests.
## Testing
Add tests and snapshots covering prompt and waiting rendering, narrow layouts, long URLs, duplicate approval suppression, cancellation, matching request dismissal, and full-screen inspection and scrolling.
GitOrigin-RevId: de1ff80d0defb3707b641e9bfccff9e2b91255ec
## Why
Trimming the live voice transcript to its 1,024-byte window could restart
animations for retained words or skip animations for new text that repeats
existing text.
## What changed
Track discarded prefix bytes and render the retained text to identify which
tiles survive. Preserve their arrival times and animation phase so only new
tiles begin animating. Start fresh when the speaker changes or the retained
text no longer matches.
## Testing
Add regression coverage for repeated text, retained-word visibility, Unicode
and Markdown rendering, reduced motion, and replaced or changed-speaker windows.
GitOrigin-RevId: dd33f76441baa4d7787d0a9a1e72b281476acb4c
## What changed
Add `tui.show_server_version_notice`, enabled by default. Set it to `false` to suppress informational notices about older stable app servers at startup, on reconnect, and in the agents overview. Compatibility errors and version status remain unaffected.
Refresh the overview notice when local settings change, clearing pending notices when the setting is disabled.
## Testing
Add coverage for disabling and re-enabling overview notices, clearing pending notice state, and preserving remote version status. Extend reconnect and local-settings tests to cover the new setting.
GitOrigin-RevId: d50dcf4472ee221ce31cdd7ab2cd766f901a8039
## Why
Footer updates and transcript animation can trigger redraws before more audio arrives, consuming peaks too early and adding spurious quiet samples. Old peaks also linger in the meter after a channel becomes quiet.
## What changed
- Sample microphone and speaker peaks at most once every 100 ms, preserving accumulated peaks on early redraws and scheduling the next sampling frame.
- Clear each channel's meter history on its first quiet sample without clearing the other channel.
## Testing
Add regression tests for early redraw scheduling, peak preservation, independent channel silence, delayed sampling, and sampling after a conversation reset. Snapshot the meters at wide and narrow widths and after each channel becomes quiet.
GitOrigin-RevId: d7b116af2c099a2eaeb6db0d66bca93b230db970
## Why
Voice mute used a hard-coded `Ctrl+X` shortcut and footer hint, so keymap customization could not change or disable it.
## What changed
- Wire `tui.keymap.chat.toggle_voice_mute` into runtime keybindings and the keymap picker, supporting custom keys, chords, and unbinding.
- Keep `Ctrl+X` as the default, but let existing configured shortcuts and overlapping chord prefixes take precedence. Validate explicitly configured mute bindings for conflicts.
- Activate voice chords only when the microphone shortcut is available, excluding pagers and overlays.
- Refresh the voice footer when bindings change, showing the configured shortcut or `/voice mute` when unbound.
## Testing
Add regression tests for binding resolution, conflicts, voice chord context, and live keymap updates. Add footer snapshots covering custom keys, chords, and unbinding in muted and listening states at wide and narrow widths.
GitOrigin-RevId: ec9385f3956aa268bba34dcf2cc2b0c92a31bfec
## Why
Voice controls replaced the normal footer and could be truncated at narrow widths. Give them dedicated space while keeping the status line visible.
## What changed
- Render voice status, `ctrl+x` mute/unmute, and `/voice stop` above the draft, with separate microphone and Codex audio history meters.
- Keep control positions stable across mute states, prioritize stop at narrow widths, and hide the strip when vertical space is needed for the draft and cursor.
- Reflect actual microphone capture in the recording indicator, respect reduced motion, and allow muting during connection once the audio handle is available.
- Preserve speaker history when muting the microphone and clear speaker samples when playback is suppressed.
## Testing
Add layout and snapshot regressions for voice states, narrow and clipped composers, recording colors, independent audio histories, and status-line visibility. Extend coverage for audio intensity scaling and spoken transcript rendering.
GitOrigin-RevId: 9deb432654f4328cc8a577b8896eee088a0a1d5e
## What changed
- Render spoken user prompts with a bold red chevron, preserving its color during live transcript animation. Trim leading whitespace for display while retaining the raw transcript text.
- Underline and link file references such as `src/lib.rs:42` in spoken assistant transcripts using terminal hyperlinks. Preserve existing links and support Windows-style relative separators.
- Restrict generated file links to existing files with allowed extensions inside the workspace, rejecting hidden paths, traversal, and symlink escapes.
## Testing
Add rendering and transcript tests for the spoken marker, raw text preservation, file links, Unicode column offsets, and Windows-style paths, plus validation tests for rejected file destinations.
GitOrigin-RevId: 5fa180aa606acdc579a916441520602cb2bf3655
## What changed
Render live voice transcripts with a split-flap effect, a black background, and brief speaker-colored highlights as characters settle. Preserve settled characters when text is appended and include animation ticks in the active transcript cache key so frames refresh.
Respect `animations = false`, preserve Unicode graphemes and raw transcript text, and keep completed transcripts as ordinary history cells. Stop requesting animation frames once the effect settles.
## Testing
Add frame snapshots and regression coverage for row styling, speaker colors, appended text, reduced motion, Unicode width, frame scheduling, and unchanged final transcript history.
GitOrigin-RevId: 934f577c7279158f9161d6232634087ab32b0ea3
## What changed
- Add `Ctrl+X` to toggle the microphone for the active voice session on the current thread, with a footer hint and guards for modals, popups, and repeated key events.
- Show a recording dot in the terminal title's activity indicator while the microphone is listening, respecting title settings and clearing it when capture stops.
- Replace the microphone and speaker bars with compact Braille meters showing four recent amplitude samples.
- Briefly show `heard` when voice input interrupts speech, when animations are enabled.
## Testing
Add regression tests for shortcut routing, amplitude glyphs, interruption acknowledgment, and terminal title lifecycle, plus updated voice footer snapshots.
GitOrigin-RevId: e1dc0c1744667e646e0040e247c5a0409b416075
## What changed
- Add app-to-RPC tests for voice startup, shutdown, thread switching, speech delivery, and rejected or stale speech, using a recording app server without audio hardware.
- Cover session retries, typed and voice handoffs, reasoning visibility, and recovery of undelivered answers in focused chat widget test modules.
- Add transcript and buffered replay tests for caption reconciliation, partial transcript preservation, and voice output ownership across thread changes, with rendering snapshots.
GitOrigin-RevId: 8a76523907289f94f257fe97386db7d2e7f33ca5
Benjamin Carlsson