## What changed
Allow Guardian Decisions to use `OPENAI_API_KEY` when the default `openai` provider has no custom base URL and neither `CODEX_GUARDIAN_DECISIONS_API_KEY` nor a cached API key is available. Preserve cached API key precedence over the environment fallback.
Report missing credentials as `credentials_unavailable` instead of `provider_error` in Decisions failure metrics.
## Testing
Add tests for cached API key precedence and the environment fallback with ChatGPT authentication. Run each test in a child process to isolate environment changes.
GitOrigin-RevId: fbb772dcb9287d9e1be1b34292ad9bdffeb3d6b3
## Why
Non-parallel tool calls can acquire their lock in either order, making the shared board scenario's `last_message_id` snapshot nondeterministic.
## What changed
Send each `collaboration.post` call in a separate mocked response to order the writes before snapshotting. Update the `board_connections` snapshot and expected request count from 15 to 17 to reflect the additional responses.
GitOrigin-RevId: a290a01f5071a2081d4d0b1531b1b31bfbb8a6e6
Empty drafts need not survive a daemon restart. Update the `discovered`
scenario in `codex-rs/cli/tests/daemon_startup.rs` to rename the thread before
restarting the daemon and include `thread-name` in the status line. Wait for
the confirmed footer name before issuing `/daemon` so the test proceeds only
after the thread is materialized.
GitOrigin-RevId: a91508582826fa1bd0cc7b89d9a1af7e8b4e1999
## What changed
Emit `codex.guardian.review.truncation` counts and `codex.guardian.review.truncation.bytes` histograms after successful input finalization. Aggregate observations across reduction stages by component and disposition (`truncated` or `omitted`), recording original, retained, and omitted byte totals. Exclude feasibility checks and failed retries from loss telemetry.
Keep blocking command-hook cancellation fixtures in the local environment and use double quotes for the Python command.
## Testing
Add metric-export tests covering aggregation across multiple reductions, separate truncation and omission totals, no loss metrics for rejected inputs, and no duplicate reporting on repeated finalization.
GitOrigin-RevId: 69182fc7afe230be69dd2469caedb5ae4494947b
## Why
Remote process exit can arrive before the final output, and inherited pipes can keep the output stream open after exit. Removing the session at exit can lose output that should remain available to `write_stdin` polls.
## What changed
- Retain remote sessions with open or unread output after exit, including early exits and cancelled initial collection.
- Collect pending output when `write_stdin` races with exit, skipping stdin writes once remote exit is known.
- After initial collection finishes and the process exits, allow a five-second grace period before a final background read. Respect active polling deadlines and keep later polls available while that read recovers retained output.
- Let explicit termination stop output collection even when the process has already exited, and install the exit watcher before cancellable cleanup.
## Testing
Extend remote process event tests to cover output arriving after the initial yield, polling during a delayed final read, active polls exceeding the background grace period, resumable cancellation, and termination before the initial yield.
GitOrigin-RevId: b1671fad8b61a2cdecf7cf9fdf92e57c028c7af8
## What changed
- Await a compatible pending background request when foreground compaction is needed, and share the result installation path with foreground requests.
- Validate the captured history generation, prefix length, model, and authentication owner before installing a prepared result. Fall back to foreground compaction when required if the result is rejected.
- Replace only the captured history prefix, preserving later messages, retained tool outputs, goal edits, and the current world-state baseline. Record installation analytics and completion events only after a result is installed.
GitOrigin-RevId: 798963f2fc603c3febba2c21eafa1bcb094b3ebf
## What changed
Add `features.multi_agent_v2.disable_native_tools` to hide native multi-agent tools while keeping the V2 runtime and its instructions enabled for host-provided tools. The option defaults to `false`, preserving existing tool exposure.
## Testing
Extend configuration parsing tests for the new option and parameterize the multi-agent catalog scenario to cover both settings. Add a snapshot showing native tools are absent while the V2 runtime and instructions remain enabled.
GitOrigin-RevId: 21a53584d2395bb678813c876a8b7927bea61c90
## What changed
- Capture history, prompt metadata, routing state, authentication ownership, and context-window identity for background compaction requests.
- Send background requests over HTTP while preserving foreground routing, and retain the latest candidate in session memory.
- Add feature and threshold eligibility checks and deduplicate attempts by history version, model, compaction hash, and authentication ownership.
- Cancel and drain background tasks during session shutdown, preserving completed usage accounting.
The background launch helper is not yet connected to the turn loop.
GitOrigin-RevId: 0e5e6ab7dac4d98a836733668a775ac48b5a59f1
## What changed
- Extract an HTTP Responses executor that can run without owning a turn's WebSocket state, with optional authentication-owner checks.
- Add cancellation-aware compaction output collection that records background token usage against the rollout budget.
- Support installing a compacted history prefix while preserving later history items and placing initial context around real user or agent messages.
- Allow callers to supply a context window for history trimming and a captured window for compaction request metadata.
GitOrigin-RevId: 29f3ca0ae8841f295058feb207e3a225af9a1487
## What changed
Register the disabled-by-default `async_compaction` feature and accept either a boolean or a `[features.async_compaction]` table. Add `model_async_compact_threshold_percent` with a default of 65 and a valid range of 1–100, validated even when the feature is disabled. Setting a threshold alone does not enable the feature.
Expose the threshold in the runtime configuration and update the JSON schema for both configuration forms.
## Testing
Add configuration loader tests covering boolean and table forms, default and custom thresholds, explicit enablement, and rejection of out-of-range values.
GitOrigin-RevId: cf33de76878e7044bc8cf5d146375a07ea9eb078
## What changed
- Reuse `custom_terminal::ModifierDiff` when writing history spans.
- Share the terminal default-color probe and cache implementation between Unix and Windows.
Both changes remove duplicate implementations while preserving existing behavior.
GitOrigin-RevId: 35f8d77ade972b791c6beac0678d2fe2be3aa763
## Why
Policy evaluation and upstream parsers must not select different `Host` field lines from the same request.
## What changed
Return `400 Bad Request` for multiple `Host` headers, including identical values, before policy evaluation, upstream forwarding, or Unix socket routing. Apply the check to both plain HTTP requests and `CONNECT` requests.
## Testing
Add regression tests covering identical and conflicting headers in origin-form, absolute-form, and `CONNECT` requests, verifying rejection without an upstream connection. Also cover single-header forwarding and rejection before Unix socket routing.
GitOrigin-RevId: 8ec95171e120f784629d3121b9a1bedbaf88e7cd
## Why
Saving an Effects preference refreshes the picker. When users toggle repeatedly before saves finish, that refresh can discard newer choices and cause subsequent toggles to use stale values.
## What changed
- Update Effects checkboxes immediately and track pending saves per row, preserving newer choices when an earlier save takes effect.
- Preserve pending Composer stars choices while Animations disables the row, and clear pending state on a regular panel refresh.
- Use the shared list toggle handling for Effects, including Space support, while giving configured key bindings precedence over Space toggling.
## Testing
Add regression tests for repeated toggles across save refreshes, pending Composer stars choices while disabled, clearing pending state, and a Space cancel binding taking precedence over toggling. Update the Effects picker snapshot.
GitOrigin-RevId: 847dcc2dfd40448c7adc56c8c40879db28b1fc39
## What changed
Update `codex-rs/Cargo.lock` and `MODULE.bazel.lock` for `quinn-proto` 0.11.18, replacing 0.11.15. Refresh its resolved dependencies to use `rand` 0.10.1 and `getrandom` 0.4.2, and add `rand_pcg` 0.10.2.
GitOrigin-RevId: 642bdeccbff8017f2f97b640a2b2c48294c97bba
## Why
WSLg clipboard initialization can block indefinitely, and PowerShell clipboard writes can stall while receiving input or exiting. These stalls can prevent subsequent TUI copy requests from completing.
## What changed
- Try the Windows clipboard first for `/copy` and `Ctrl+O` on WSL, falling back to the native clipboard and terminal delivery when needed.
- Give Windows executable discovery and writing a shared five-second deadline, with a separate one-second deadline for native clipboard setup. Reuse pending setup tasks after timeouts to avoid accumulating blocked threads.
- Launch PowerShell through a native shell and stop its process group on write failures or timeouts. Reap the writer before returning so an older copy cannot overwrite a newer one, and suppress stderr that could expose clipboard contents.
## Testing
Add tests for command compatibility, large Unicode input, expired requests, and cleanup of stalled writers and subprocesses. Update routing tests to cover Windows-first copying and native fallback with HTML and clipboard leases.
GitOrigin-RevId: 218c8541a169a16536db0370455e076a31a42b1f
## Why
Inputs arriving during turn finalization could be queued after the final batch had already been drained, or recorded ahead of that batch.
## What changed
Mark active turns as finishing before draining pending input. Reject injection into finishing turns and make late client responses and notifications wait until the final batch is recorded before appending to history. Continue accepting input into turns reserved but not yet started.
## Testing
Extend the task-completion test to block final recording, verify that input admission is closed, and confirm that a late notification is recorded after queued input while preserving the notification truncation budget. Strengthen the retained-tool-output scenario to assert tool output names and ordering.
GitOrigin-RevId: a57e44bd974e60e134183dab989795e2c3538596
## Why
Incomplete responses such as `max_output_tokens` were classified as stream errors, allowing retries and compaction model fallback after the response had hit its output limit.
## What changed
Introduce `ResponseIncomplete` errors that preserve the server-provided reason and stop stream processing immediately. Make these errors non-retryable and stop compaction without falling back to the selected model. Record incomplete responses separately in sampler failure metrics.
## Testing
Add regression tests that verify incomplete responses surface a terminal error without retries over SSE and WebSocket, and that compaction stops without retrying or switching models for both local and remote compaction.
GitOrigin-RevId: 6e107d441b9bf03fa47ea47b88eeb94b71a9f729
## Why
Repeated turn diff notifications can print the same file changes multiple times, including after an unrelated command.
## What changed
Track the last diff and print nonempty updates only when they differ from the previous notification. Remember empty updates so a restored diff prints again, and reset the tracked diff when a new turn starts.
## Testing
Add a stderr snapshot test covering repeated, changed, empty, restored, and new-turn diffs. Add an integration test that applies one edit, runs an unrelated command, and verifies that the diff appears exactly once.
GitOrigin-RevId: db0a2aa8b77b800ca661e7d1314ed1e571743e74
## Why
Hermetic LLVM targets the GNU ABI on Windows even when an MSVC platform is selected. Native MSVC builds need the runner's MSVC toolchains and SDK environment.
## What changed
- Register the local x64 and ARM64 C++ toolchains in `ci-windows-msvc`.
- Apply `--config=ci-windows-msvc` to the native Windows Bazel test job.
- Allow the native Windows test job to run on `workflow_dispatch` as well as pushes to `main` so toolchain changes can be tested manually.
GitOrigin-RevId: b9fbd3f2bba8a3a8bf226cafda19a921c8738acd
## Why
RGB and extended indexed theme colors cannot be displayed directly on 16-color terminals, causing status line items to lose their color accents.
## What changed
Use each status line item's existing ANSI fallback accent when its theme foreground requires RGB or an indexed color beyond the first 16 colors.
## Testing
Add regression coverage for uncolored output with `FORCE_COLOR=0` and ANSI status line accents with `FORCE_COLOR=1`. Give the RGB styling test explicit terminal colors so it consistently exercises true-color behavior.
GitOrigin-RevId: 213ca5c6c366f0a3c696aab256a0b146558a2837
## Why
`TERM_SESSION_ID` is not specific to Apple Terminal. Treating it as an Apple Terminal identifier can mask Windows Terminal detection and the `TERM` fallback.
## What changed
Remove the `TERM_SESSION_ID` detection heuristic. Apple Terminal remains detectable through `TERM_PROGRAM=Apple_Terminal`.
## Testing
Update tests to cover Windows Terminal detection and the `TERM` fallback when `TERM_SESSION_ID` is present, and Apple Terminal detection with its version and user-agent token.
GitOrigin-RevId: 27db11cb7bcca8f94888f9e21a6cdfcf31561b1b
## Why
Pending requests can outlive a session switch, and different threads or connections can reuse request IDs. Replies and resolution notifications must stay associated with the request that prompted them.
## What changed
- Retain the original app-server reply handle for pending and buffered requests, including requests replayed after thread attachment or session reset.
- Scope user input, MCP elicitation, and user verification bookkeeping by thread, and send user input answers to the requesting thread.
- Keep background resolution notifications from dismissing foreground prompts.
- Consume failed replies to closed connections and clear pending replay state without falling through to another request route.
## Testing
Add WebSocket regression tests for direct and buffered approvals with colliding request IDs and replies to closed connections. Extend coverage for foreground prompt preservation and thread-scoped user verification cancellation.
GitOrigin-RevId: 541acb9910e92f6f2e83c27d2a2384185d4f8fec
## Why
Several configuration toggles required restarting Codex, and settings search only filtered the current group. Narrow terminals also truncated setting values and descriptions.
## What changed
- Apply animations, composer stars, paste detection, automatic recaps, and tips without restarting Codex. Update active motion effects and paste detection when their preferences change.
- Group animations and composer stars in an Effects picker that refreshes after saving and requires animations for composer stars.
- Search across all configuration groups, show each result's group, and preserve the query when switching groups.
- Keep setting values visible in narrow terminals and show the selected description below the list. Reserve space to keep the panel height stable and tailor footer hints to the selected action.
- Simplify configuration notices and omit routine save confirmations.
## Testing
Add and update tests and snapshots for live preference saves while offline, paste detection updates, Effects picker refreshes, global search, and stable panel height at narrow widths.
GitOrigin-RevId: 83773da2f6457ce461ef16f0cddde0df640a36c3
## Why
Managed runtime package registration errors lacked the terminal status, separate async and deployment error codes, and deployment activity ID needed to diagnose failures.
## What changed
Include these diagnostics in registration errors and distinguish failures in `GetResults`, the `ExtendedErrorCode` getter, and deployment itself. Preserve the original completion error; failures to read diagnostic fields do not turn successful registration into failure. Keep free-form Windows error text out of diagnostic summaries.
## Testing
Add unit tests for distinct async and deployment errors, failed or canceled result retrieval, and diagnostic getter failures, including preservation of native error codes and omission of free-form diagnostic text.
GitOrigin-RevId: 7f3a46741304ef04f5c3e2aa575bcfc4392dff62
## What changed
Add a Linux app-server integration test that resumes a saved read-only thread after the default permissions change to `:danger-full-access`. Verify that the live network proxy honors restored grants, requests approval for a new host, persists the approved rule, and reuses it without another approval.
The test also verifies that proxied requests succeed while direct access remains blocked.
GitOrigin-RevId: 08f63efb8752d738df0ee97e4e98c3366ae54f56
## Why
Restoring unnamed thread permissions after configuration loading leaves network proxy initialization and permission validation using the configured default. A saved read-only thread should also resume when that default is incompatible with current managed requirements.
## What changed
Apply eligible saved permission profiles during configuration loading, before network preparation and final validation. Keep explicit permission overrides and managed requirements authoritative, preserve managed deny-read restrictions, and reject saved external enforcement or materialized filesystem grants. Include the saved profile in the app-server's prepared resume configuration state.
## Testing
Add regression coverage for resuming saved read-only permissions with an incompatible full-access default and for retaining managed, remembered, and newly approved network domains in the restored profile's proxy allowlist.
GitOrigin-RevId: 73e32b0a31ac678fd3f60a8ccf8fa9df627f16c3
## Why
Windows and WSL can share `CODEX_HOME` without sharing a lock namespace, allowing cleanup to remove another platform's live helpers. Older clients can also clean helpers stored under the shared `tmp/arg0` root.
## What changed
Create helpers under `CODEX_HOME/tmp/arg0-<os>` and limit stale-directory cleanup to that operating system's root. Keep permission discovery compatible with both the current platform's root and legacy `tmp/arg0` directories, while ignoring other platforms' aliases.
## Testing
Add regression coverage for cleanup isolation, live helper preservation during legacy cleanup, and selection of the first session alias directory from either supported root.
GitOrigin-RevId: f34292748b5b1d3c25629604d849db4b133dfa3a
## Why
Local message boards were scoped to an agent tree. Independently created Codex runtimes need a way to share a board while receiving different access permissions.
## What changed
- Add `LocalBoard` and `LocalBoardConnection` so hosts can supply read-only or read-write access through `thread_extension_init`, including for isolated, ephemeral runtimes.
- Allow read-only connections to read and manage their own subscriptions; reject posting, replying, channel creation, and changes to another agent's subscriptions. Expose effective permissions in channel discovery.
- Use unique runtime paths and require matching board IDs and canonical database paths when resolving agents or delivering notifications.
- Document explicit extension installation and connection setup for new runtimes, cold resumes, and forks.
## Testing
Add a scenario and context snapshot covering an independent writer and isolated Guardian sharing a board through a symlink alias, read-only permission denials, subscription and explicit notifications, and rejection of notifications to an unconnected runtime before a post is written.
GitOrigin-RevId: f92410c3a5c6a46920c3e0e71849c85dc83d9c31
## Why
The generic `parent_compaction_error` classification metric does not distinguish serialization failures, oversized compactions, and unusable compactions.
## What changed
Record separate `failure_reason` values for each case: `parent_compaction_serialization`, `parent_compaction_oversized`, and `parent_compaction_unusable`.
## Testing
Extend parent-compaction reuse tests to cover unusable checkpoints in parent-context mode and assert specific failure reasons. Verify rejected compactions receive the maximum risk score, provide no cached approval, and do not reuse stale context.
GitOrigin-RevId: 103c4173b2ebbdc33eb71bce7f8ecb56f73055f6
## Why
Reading `OPENAI_API_KEY` directly bypasses login credentials reloaded by `AuthManager`.
## What changed
Use the API key from `AuthManager`'s cached authentication for Guardian decisions when the provider is `openai` and has no custom base URL. Keep `CODEX_GUARDIAN_DECISIONS_API_KEY` as the highest-priority override.
## Testing
Add a regression test covering a reloaded API-key login, override precedence, and rejection of the login-key fallback for a custom base URL. Assertions avoid printing credentials on failure.
GitOrigin-RevId: 10b2e6c28d3268c3808c25b2be94d9b6c31f597a
## Why
`unsafe-libyaml` is unmaintained and has no patched release. It remains a transitive dependency through `serde_yaml`.
## What changed
Add `RUSTSEC-2024-0449` to the ignore lists in `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml`. Document the dependency path and require removing the exception when the affected users migrate off `serde_yaml`/`unsafe-libyaml`.
GitOrigin-RevId: 6f4cf32e55d2877d90bf00d2c12a1c85f18d229e
## Why
With `multi_agent_v2.disable_direct_message` enabled, an unavailable agent message board could cause tool router construction to reject the turn.
## What changed
Remove the requirement that the router expose the board's `post` tool. Unavailable board calls return an unsupported-call error to the model, allowing the turn to continue.
## Testing
Update scenario coverage for a disabled board feature, legacy agents, and ephemeral sessions. Assert that unavailable board calls return an error to the model, that `post`, `send_message`, and `followup_task` are not advertised, and that no board database is created.
GitOrigin-RevId: cb9571459c128d84c3c96f185e70c404e0463473
## What changed
Remove eight tests covering experimental API schema filtering and marking,
end-of-file unified diffs, MCP prompt auto-approval, and local-link regex
initialization. Remove the associated unused test imports and regex coverage
comment. Runtime behavior is unchanged.
GitOrigin-RevId: 91f59cab82393d43000eadf4e7c55e3a6ec2aa14
## What changed
Add a unified execution test where `exec_command` yields a session and a subsequent `write_stdin` poll completes after the remote process exits while its output stream remains open. Verify that the poll returns the delayed output and exit code, emits the command completion event, and removes the background session without issuing a `process/read` request.
GitOrigin-RevId: 3a316eb9f6b29682da81a2ecbdda52f659f4b792
## Why
A remote process can exit while its output stream remains open, leaving the exit watcher waiting and delaying `ExecCommandEnd` even after output collection finishes.
## What changed
Cancel the process output token after final collection or polling, on one-shot cancellation, and after confirmed termination. This releases the exit watcher while allowing delayed output to be collected before the final poll completes.
## Testing
Add remote process event tests for output streams that remain open at the collection deadline, during interruption, and during explicit termination. Assert that `ExecCommandEnd` preserves the exit code and aggregated output, background terminals are cleared, and interruption and termination require no extra `process/read` requests.
GitOrigin-RevId: 8346e5ce446280915b6e2ffa362fcfd79280bfff
## Why
`Ctrl+V` previously attempted only image paste, so a text-only clipboard produced an image-paste error. `Shift+Insert` did not use the clipboard paste path.
## What changed
- On Windows, let `Ctrl+V` and `Shift+Insert` paste images first, then read clipboard text asynchronously when no image is available. Keep clipboard access errors distinct from missing images.
- Allow keyboard paste into composer selections and active history or Vim search queries, including inline mode with right-click paste disabled.
- Flush buffered typing before explicit paste to preserve input order. Discard pending clipboard text when the thread or editable target changes, while allowing shortcut releases and repeated paste shortcuts to leave the read pending.
## Testing
Extend shortcut and clipboard-worker tests to cover text fallback, multiline Unicode text, stale-read cancellation, shortcut releases and repeats, and read-only drafts. Add assertions for history-search preview stability and selection changes.
GitOrigin-RevId: 080c1c05a4587e325cea938a6e28c646b9ac5837
## Why
After a thread was archived externally, the TUI still advertised the Left-arrow agents shortcut, but pressing it in an empty composer did not open the agents view.
## What changed
Reuse the agents navigation handler when connected to an unavailable thread. Preserve the existing empty-composer and editor guards, and require a key press so repeated Left-arrow events do not open the view.
## Testing
Add a regression test for external thread archiving that verifies draft editing, the shortcut hint, ignored key repeats, and opening the agents command center, with a snapshot of the resulting view.
GitOrigin-RevId: a3f36b42bafee948ed7f5842fcb425e414d7e024
## Why
Startup configuration warnings can reflect settings from when the background server started, even after those settings have been fixed. A restart lets users refresh the server without leaving the TUI.
## What changed
- Add a confirmed restart action to `/daemon`, warning that active or queued work in other chats may be interrupted. Reconnect automatically and let an in-progress restart finish if the TUI exits.
- Verify that Codex manages a local server before enabling restart, including servers discovered with auto-start disabled and those started by `codex agents`.
- Show a restart hint on the first startup configuration warning for managed servers, preserving the original diagnostic for copying and dismissal.
- Repaint the full surface of centered dialogs to restore background colors over cached blank cells.
## Testing
Add CLI integration coverage for agents startup and restarting a discovered daemon with auto-start disabled. Extend TUI tests for confirmation, cancellation, unmanaged servers, warning hints and dismissal, and dialog background rendering.
GitOrigin-RevId: 8e4319fab84f13bf6e7335deb93364fccaff14a7
## What changed
Remove `Terminal::autoresize` and the fallible `try_draw` helpers. Render directly in `draw_with_size`, retaining automatic size updates and the existing buffer flush and cursor handling.
Update the cursor-ordering test to use `draw`, preserving its assertion that the cursor moves before it is shown.
GitOrigin-RevId: 5889e9603d772945660e7ae35690d2b7326b10ae
## Why
Dropping the event receiver before shutdown lets an in-flight notification fail delivery and terminate the worker before it sends the WebSocket close frame.
## What changed
Keep the event receiver alive until `RemoteAppServerClient::shutdown` finishes waiting for the worker, allowing it to process the shutdown command and close the WebSocket.
## Testing
Extend regression tests to verify that an event remains deliverable after shutdown is queued and that the server receives `Message::Close(None)` with an extra notification in flight.
GitOrigin-RevId: ba14bc97ffa3453b7b59660144db6da9e688983d
## What changed
Add `Alt+Left` / `Alt+Right` to the shortcut overlay's Session group as “Subagents (empty prompt)”, using the existing previous/next agent binding labels.
## Testing
Update shortcut help snapshots for narrow and wide layouts, configured bindings, and running sessions to include the new entry.
GitOrigin-RevId: 534be840e1fe5646cfb9465e78049322d7e72b4c
## Why
Turn tips are visible outside transcript history, but their text could not be selected for copying.
## What changed
Register rendered working and completion tip rows for mouse selection. Keep tips in place when selection hints or copy status appear, and use the hint “Selecting text · esc cancel”.
## Testing
Extend mouse-selection tests and snapshots to cover selecting `/help` in working and completion tips with copy-on-select enabled, and clearing the selection when a working tip disappears.
GitOrigin-RevId: 25b3f02e7e93a53e777de455943d47fbab388ff1
## Why
Cold resume can replace saved unnamed permissions with current configuration defaults or recover an executor's permissions from turn context. A first-turn context can also predate an acknowledged settings update.
## What changed
- Restore eligible unnamed permission profiles from settings snapshots owned by the resumed thread, honoring explicit caller overrides and current managed requirements.
- Use owned snapshots as the authority for named permission profiles and reapply workspace permissions for the resumed workspace roots.
- Persist a thread-owned settings checkpoint after the first turn's context, serialized with settings updates so older checkpoints cannot supersede newer settings.
## Testing
Extend regression coverage for cold resume with changed defaults, managed permission restrictions, workspace-root overrides, foreign snapshots, and settings updates during first-turn processing.
GitOrigin-RevId: e411d9fd3d586a4162498c9c77c4184459071bd1
## Why
Startup recovery treated a buffered Vim Replace key as an insertion, so the recovered unsent text could differ from the eventual edit. Replacing the first character of `abcd` with `X` should recover `Xbcd`, not `Xabcd`.
## What changed
Preserve the distinction between held typed keys and buffered pastes when building recovery snapshots. Apply Vim Replace semantics to held keys, including mouse selections and the bash-mode prefix offset, without consuming live pending input. Keep buffered pastes literal so the live paste path retains responsibility for large-paste and image classification.
## Testing
Add regression tests for recovery after startup draft handoff and replacement of mouse-selected text with and without the bash-mode prefix. Verify that taking a recovery snapshot leaves live input unchanged and that flushing the held key produces the same text.
GitOrigin-RevId: 97fada635ad9f0f01042b8e96020372d6df9d951
## Why
Piping `codex plugin list` into a consumer such as `head` can close stdout before the full catalog is written, causing a panic.
## What changed
Write both table and JSON output through a fallible writer and treat broken pipes during writing or flushing as success. Continue propagating other output errors.
## Testing
Add unit tests for write and flush failures in both output formats, plus CLI tests that close stdout early and verify a successful exit without a panic.
GitOrigin-RevId: cc4a64e10ad723d26b6de9e731efdc534dbee492
## Why
Server request IDs can be reused across connections. Retained replies need to target the connection that emitted the request, even if the UI selection later changes.
## What changed
- Expose `AppServerReplyHandle` through `AppServerRequestHandle::server_request_reply_handle`, capturing the originating client and request ID for explicit `resolve` or `reject` calls.
- Share single-use completion state across clones so only the first reply is submitted. Dropping a handle sends nothing; stale connections return I/O errors without retrying or switching connections.
- Route existing client reply methods through request handles and use the new API in the managed worktree model test.
## Testing
Add in-process and WebSocket tests for replies on separate connections with identical request IDs, rejection routing, duplicate completion, and stale handles after worker shutdown. Also check that debug output redacts handle details.
GitOrigin-RevId: 940d0951ab67529b05919ca8ec7adb5813834b8c
## What changed
- Group preferences into Appearance, Notifications, Input, Sessions, and Text selection tabs, with search and links to existing theme, status line, terminal title, and keyboard editors.
- Persist preference changes to the selected local configuration file, apply supported changes immediately, and show save errors, configuration overrides, and restart requirements in the panel.
- Add a delayed notification test and controls for notification timing while preserving custom event filters.
- Add `tui.copy_on_select_clear_selection`, disabled by default, to clear transcript selection highlights only after confirmed automatic clipboard delivery.
- Keep local configuration editors usable while disconnected and prevent held activation keys or buffered input from triggering actions across editor and reconnect transitions.
## Testing
Add regression tests and rendering snapshots for panel navigation, search, dependency states, editor handoffs, offline persistence, notification timers, custom filter preservation, and confirmed-copy deselection.
GitOrigin-RevId: a16d218046060fcb6e61705a803fcd9297266e6e
## What changed
- Update the pinned `rmcp` dependency and Cargo/Bazel lockfiles, and migrate MCP handlers and fixtures to `ClientConfig` and `ServerConfig`.
- Stop requiring responses for cancelled elicitation requests in cancellation tests while retaining checks for cleanup and continued connection usability.
- Handle client disconnects during WebSocket writes in the TUI test server, use an asynchronous HTTP mock for loopback proxy testing, and improve remote executor test diagnostics and the Windows subprocess fixture.
- Use `invalid_prompt` for the memory worker failure fixture.
## Testing
Add a regression test covering transport EOF during both form elicitation and user verification. Keep the client alive while checking that pending response channels close, the timeout pause clears, and the service exits with `QuitReason::Closed`.
GitOrigin-RevId: c0166b83fab3b59d84a5207c6630cb6adcf3b230
## Why
An unfinished terminal control sequence can prevent buffered input from draining before a startup modal appears. Propagating that timeout aborts modal handling instead of keeping the screen available for an explicit user decision.
## What changed
Treat input-drain timeouts as a reason to keep startup modal input quarantined. Discard key, paste, and mouse events while retrying the drain, and continue processing server events. Preserve this protection when another request resolves and when the agent overview is restored after reconnecting.
## Testing
Add a Unix PTY regression test covering unfinished control sequences, queued approval and overview shortcuts, unrelated request resolution, and overview reconnection. Verify that buffered input cannot answer an approval or create a task, while fresh shortcuts work after the drain completes.
GitOrigin-RevId: 476bedbd45f13a15d0019e4ce2e875406d4a53ca
jif