Keep raw commands, paths, and provider errors out of ordinary chat while preserving explicit raw diagnostics and structured admin history.
Default command progress is status-only; `/verbose full` and `commandText: "raw"` retain diagnostic detail.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Give Control UI managed images bounded previews and shared full-image Open, Download, and Copy actions. Keep artifact access transcript-bound; the existing ticket is intentionally attachment-scoped to the lower-fidelity thumbnail.
Co-authored-by: Ittiz <github@daein.org>
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Completes the hasWildcard -> isPattern rename in oc-path (exports the
canonical predicate, migrates all callers, deletes the deprecated alias)
and removes the retired buildOpenAICodexProvider catalog module with its
api.ts re-export and contract-list entries. The dead-option-flag half of
this branch converged with an equivalent change that landed on main first.
Use fs-safe 0.5.4 for nonblocking, descriptor-validated reads. Resolve one unambiguous Unicode-equivalent path and return explicit empty/EOF results.
Default local reads now reject final symlinks and special files.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
* fix(plugin-sdk): make the API baseline hash path-free and surface-reachable
Manifest hashes now cover only surface-reachable, path-independent facts.
Rewrite closure from whole-file/path-keyed traversal to declaration-granular reachability with fail-toward-recall fallbacks and taint-tracked cycles.
Exclude source paths from the committed hash and split declaration printing into api-baseline-declaration-print.ts.
* fix(plugin-sdk): close side-effect and namespace-import gaps in baseline closure
Address ClawSweeper findings:
- Traverse side-effect imports before collecting globals.
- Normalize repo-owned namespace import types.
* refactor(plugin-sdk): rebase precision closure onto the JSONL contract
* fix(codex): report harness context window as session contextTokens
Codex app-server reports model_context_window per turn. Carry it through the projector into the run result meta so session rows show the real window instead of the catalog's standard-tier input cap (272k vs 1M for gpt-5.6 models).
* improve(ui): compact chat context popover
Inline stat rows replace boxed tiles; zero-value cost rows and the whole cost section when empty are omitted; provider/model provenance lines are removed because the footer already shows the model; and the popover is narrowed to 300px.
* refactor(codex): split attempt-result assembly out of event projector
* fix(codex): seed attempt context window from startup binding
App-server v2 turn/started omits the core model_context_window, so thread/tokenUsage/updated is the only live carrier. Seed usage-less attempts from the retained startup binding rollout/session window so session metadata cannot regress to the catalog fallback.
* fix(codex): prefer native startup context window
Persisted session contextTokens has no source provenance and may contain the catalog fallback. Keep the minimum window for the conservative rotation fuse, but seed the projector from the native rollout when it is available.
* chore(plugin-sdk): regenerate api baseline (new format)
* revert(gateway): "prevent restart replay after final delivery" (broke 5 CI jobs)
Treat message(final=false) as progress and final=true or omission as the terminal source reply. Repeated terminal delivery now returns a non-error outcome without another provider send.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
Co-authored-by: 宇宙熊Yzx <53250620+849261680@users.noreply.github.com>
Co-authored-by: Markus <markuscontasul@gmail.com>
* feat(ui): show unsent-draft pencil on sidebar session rows
Typed-but-unsent composer text now surfaces as a pencil badge on the
owning session's sidebar row (and Home row) once you switch away.
Draft persistence now notifies stored-outbox subscribers so the
indicator appears and clears live. The active session suppresses the
badge since its composer is already visible.
* chore: refresh merge ref for CI against current main
* chore: refresh merge ref against healed main
* fix(ui): notify draft indicator only on presence transitions
Unconditional notify on every draft persist let outbox-projection
subscribers re-persist a stale pane over a newer draft (chat-state
route-fallback invariant). The sidebar pencil only consumes presence,
so notify on empty/non-empty transitions only.
- forward taskSuggestionDeliveryMode through the Codex app-server dynamic tool build (same sibling-harness omission class previously fixed for clientCaps); spawn_task/dismiss_task silently never existed for GPT-backed sessions
- regression test asserting the forward, mirroring the existing clientCaps case
- spawn_task/dismiss_task descriptions rewritten with usage calibration: when to flag, when not to, scope-vs-flagging, prose-is-lost, operator-phrasing bridge, prompt self-containment, git-checkout cwd, registry ephemerality; param descriptions state where each field renders
Release-note context: GPT-backed sessions can now create suggested-task cards (the tools were silently absent on the Codex harness), and the tools carry much clearer model-facing guidance.
Record channel delivery custody before recipient-visible sends so restart recovery cannot duplicate accepted finals.
Ambiguous legacy markers now fail closed with a visible interruption instead of blind replay.
Co-authored-by: Ayaan Zaidi <hi@obviy.us>
* fix(gateway): unify media privacy in chat history
Centralize image, audio, video, and persisted media-fact privacy at the shared Gateway history projection. Remove duplicate sessions_history redaction, validate managed media claims canonically, and keep safe media-only user turns renderable.
* test(gateway): type history RPC integration
* test(agents): align history fixture with gateway projection
Peter Steinberger