Eric Traut

Separate TUI preferences from server configuration (#42202) ## Why TUI preferences and persistence paths belong to the local client, while thread configuration and account requirements may come from the active app server. Keeping both in the same resolved `Config` can replace live local preferences when a thread is resumed, forked, reconnected, or switched. ## What changed - Add `LocalSettings` as the TUI-owned source for UI, history, notice, and local persistence settings, and preserve it across session lifecycle transitions. - Write preference changes to the selected user config file and reload local settings from disk when changing roots. - Use the app server's account response for authentication-dependent onboarding and status UI instead of the local model-provider configuration. - Retain platform family and OS metadata reported by remote app servers. ## Testing - Cover local setting defaults, overrides, persistence destinations, reloads, and preservation across widget replacement and root switching. - Cover remote platform metadata and server-controlled authentication UI. GitOrigin-RevId: dbc2965fb1d6cbecb3f973f6133f3dcd4467b753

Add TUI tools for managing Codex tasks (#40308) ## Why The TUI rejected app-server dynamic tool calls as unsupported, so agents could not inspect or manage other Codex tasks through a TUI session. ## What changed - Add the `codex_tui` tool namespace for listing, reading, waiting on, creating, forking, messaging, renaming, archiving, and restoring tasks. - Handle tool calls through existing app-server thread operations, with bounded inputs and responses and cleanup when calls complete or the TUI disconnects. - Route delegation tools through an authenticated local MCP server with explicit approval prompts, while respecting configured and managed MCP policies. - Fall back to starting threads without dynamic tools when connected to an older app server that does not support them. ## Testing Add coverage for tool schemas and response bounds, task lifecycle operations, approval-gated MCP transport, namespace dispatch, cancellation, and legacy app-server fallback behavior. GitOrigin-RevId: c782c11f0a3edceb3fa6909a4b92d6ce01a6eed3

Add task mentions to the TUI composer (#40315) ## What changed - Include matching Codex tasks in the `@` mention popup when the active thread supports task tools, prioritizing tasks from the current working directory. - Submit selected tasks as bounded live thread references so Codex can load their contents with `read_thread`. - Preserve task mentions across composer history and thread start, resume, and fork flows. ## Testing - Add coverage for task search and capability propagation, popup selection and rendering, submission encoding, history round-trips, and reference validation and limits. GitOrigin-RevId: 17502be91bf6d4b01745668829eb69fb318cb5b9

Preserve TUI drafts after app-server disconnects (#41911) ## Why Losing an external app-server connection can leave a submission's outcome uncertain. The TUI must preserve local work without retrying it or allowing stale server events to trigger more actions. ## What changed - Enter an offline state when an external app-server transport disconnects during startup, event streaming, or submission. - Keep conversation drafts, queued input, expanded pastes, attachments, and agent-overview input editable while blocking submissions, remote actions, and automatic queue replay. - Show a connection-lost notice that directs users to copy their work and relaunch, while retaining `Ctrl-C` and an empty-composer `Ctrl-D` as quit shortcuts. - Cancel pending views and asynchronous work, and ignore stale completions after the disconnect. Embedded app-server behavior is unchanged. ## Testing Added unit, snapshot, and pseudo-terminal coverage for lost startup and mutation replies, offline draft editing, queued-input recovery, stale-event quarantine, agent-overview behavior, and end-to-end preservation without reconnection or resubmission. GitOrigin-RevId: 7219a95fad676dda447d625db9e465345b469d58

Enable remote named permission profile selection in the TUI (#43340) ## Why The permissions picker displayed profiles from the connected app server but disabled selection of remote custom profiles. ## What changed - Enable named profile selection through `thread/settings/update` and track pending selections until server confirmation. - Use pending or confirmed server permissions for subsequent turns, preserve profiles across forks and prompt edits, and reconcile pending selections on reconnect. - Block conflicting permission changes and forks while selection is pending. Preserve input when selection fails and report unsupported app servers. - Reject working directory changes while a remote named profile is active. ## Testing Add regression coverage for profile selection, turn permissions, pending-selection guards, prompt-edit profile preservation, reconnect reconciliation, and profile inheritance in forks and side conversations. GitOrigin-RevId: 76e9bb7b4d631b1066974da013d9915a89dc54a7

Add app-server `thread/delete` API (#25018) ## Why Clients can archive and unarchive threads today, but there is no app-server API for permanently removing a thread. Deletion also needs to cover the full session tree: deleting a main thread should remove spawned subagent threads and the related local metadata instead of leaving orphaned rollout files, goals, or subagent state behind. ## What - Adds the v2 `thread/delete` request and `thread/deleted` notification, with the response shape kept consistent with `thread/archive`. - Implements local hard delete for active and archived rollout files. - Deletes the requested thread's state DB row as the commit point, then best-effort cleans associated state including spawned descendants, goals, spawn edges, logs, dynamic tools, and agent job assignments. - Updates app-server API docs and generated protocol schema/TypeScript fixtures.

Scope TUI approval requests to their threads (#39372) ## Why Approval and item IDs can collide across concurrent threads. Tracking pending app-server approvals by ID alone can therefore resolve, submit, or dismiss a request from the wrong thread. ## What changed - Key command execution, file change, and permissions approvals by both thread ID and approval ID. - Route approval responses through the originating thread and require the thread to match when processing resolution notifications or dismissing approval prompts. - Canonicalize parseable thread IDs so equivalent UUID representations still match. ## Testing - Cover colliding approval IDs across threads, mismatched resolution notifications, prompt dismissal, and response routing for primary and background threads. GitOrigin-RevId: c2d899a1e4b6a6413c78a0595a5311f5fabb9815

Show recent sessions in the agent command center (#42104) ## Why The agent command center only listed sessions currently loaded by the app server, so completed or otherwise unloaded tasks could not be revisited from the overview. ## What changed - Seed the overview with up to 20 recent root sessions in addition to loaded sessions, retain discovered sessions for the lifetime of the TUI, and update rows from thread lifecycle notifications. - Allow unloaded sessions to be resumed from the overview using the normal working-directory selection and configuration rebuild flow. Explicit runtime permission choices carry across a cold resume, while settings inherited from the previously selected task do not. - Fall back from `recency_at` to `updated_at` when connected to an older server, and continue showing loaded sessions when recent-history listing is unavailable. ## Testing Added coverage for recent-session discovery and retention, notification races, legacy and failed listing fallbacks, cold-resume working-directory and permission handling, reconnect behavior, and unloaded-session rendering and selection. GitOrigin-RevId: 668068b1594eb24b2ea7faccd0327804b8cd22ef

Reject lossy legacy permission projections (#39117) ## Why Some managed filesystem permission profiles cannot be represented by the legacy app-server sandbox policy without changing which paths are accessible. ## What changed - Require legacy sandbox conversion to preserve the filesystem policy's semantics, and reject unsupported profiles with an actionable error. - Keep queued follow-up messages and safety-buffered retries intact when permissions are rejected, resuming queued input only after a compatible profile is selected. - Cover compatible profiles, lossy restrictions and write roots, turn-start handling, and safety-buffered retries with regression tests. GitOrigin-RevId: 345cc2a839206b2b1997e8981feb59f91b6975cc

Use the shared composer in the agent command center (#42428) ## What changed - Replace the command center's single-line new-task input with the shared chat composer, including multiline editing, paste handling, Vim mode, configured keybindings, cursor behavior, and input validation. - Keep task drafts and editor state across dashboard refreshes and reconnects while separating composer focus from list, search, and rename actions. - Preserve whitespace in dispatched task prompts, block submission while offline, and restore unsent prompts after dispatch failures when the composer is still available. ## Testing - Add coverage for focus routing, draft retention, multiline pastes, custom keybindings, Vim mode, offline editing, failed-dispatch recovery, and responsive rendering. GitOrigin-RevId: a609ae95d497cbae0ebcac4cdcc50fe49d74832a