3122 Commits

This Branch

This Branch

All Branches

• Ask user question UI footer improvements (#9949)

  ## Summary
  
  Polishes the `request_user_input` TUI overlay
  
  Question 1 (unanswered)
  <img width="853" height="167" alt="Screenshot 2026-01-27 at 1 30 09 PM"
  src="https://github.com/user-attachments/assets/3c305644-449e-4e8d-a47b-d689ebd8702c"
  />
  
  Tab to add notes
  <img width="856" height="198" alt="Screenshot 2026-01-27 at 1 30 25 PM"
  src="https://github.com/user-attachments/assets/0d2801b0-df0c-49ae-85af-e6d56fc2c67c"
  />
  
  Question 2 (unanswered)
  <img width="854" height="168" alt="Screenshot 2026-01-27 at 1 30 55 PM"
  src="https://github.com/user-attachments/assets/b3723062-51f9-49c9-a9ab-bb1b32964542"
  />
  
  Ctrl+p or h to go back to q1 (answered)
  <img width="853" height="195" alt="Screenshot 2026-01-27 at 1 31 27 PM"
  src="https://github.com/user-attachments/assets/c602f183-1c25-4c51-8f9f-e565cb6bd637"
  />
  
  Unanswered freeform
  <img width="856" height="126" alt="Screenshot 2026-01-27 at 1 31 42 PM"
  src="https://github.com/user-attachments/assets/7e3d9d8b-820b-4b9a-9ef2-4699eed484c5"
  />
  
  ## Key changes
  
  - Footer tips wrap at tip boundaries (no truncation mid‑tip); footer
  height scales to wrapped tips.
  - Keep tooltip text as Esc: interrupt in all states.
  - Make the full Tab: add notes tip cyan/bold when applicable; hide notes
  UI by default.
  - Notes toggling/backspace:
  - Tab opens notes when an option is selected; Tab again clears notes and
  hides the notes UI.
      - Backspace in options clears the current selection.
      - Backspace in empty notes closes notes and returns to options.
  - Selection/answering behavior:
  - Option questions highlight a default option but are not answered until
  Enter.
  - Enter no longer auto‑selects when there’s no selection (prevents
  accidental answers).
      - Notes submission can commit the selected option when present.
  - Freeform questions require Enter with non‑empty text to mark answered;
  drafts are not submitted unless committed.
  - Unanswered cues:
      - Skipped option questions count as unanswered.
      - Unanswered question titles are highlighted for visibility.
  - Typing/navigation in options:
      - Typing no longer opens notes; notes are Tab‑only.
  - j/k move option selection; h/l switch questions (Ctrl+n/Ctrl+p still
  work).
  
  ## Tests
  
  - Added unit coverage for:
      - tip‑level wrapping
      - focus reset when switching questions with existing drafts
      - backspace clearing selection
      - backspace closing empty notes
      - typing in options does not open notes
      - freeform draft submission gating
      - h/l question navigation in options
  - Updated snapshots, including narrow footer wrap.
  
  ## Why
  
  These changes make the ask‑user‑question overlay:
  
  - safer (no silent auto‑selection or accidental freeform submission),
  - clearer (tips wrap cleanly and unanswered states stand out),
  - more ergonomic (Tab explicitly controls notes; backspace acts like
  undo/close).
  
  ## Codex author
  `codex fork 019bfc3c-2c42-7982-9119-fee8b9315c2f`
  
  ---------
  
  Co-authored-by: Ahmed Ibrahim <aibrahim@openai.com>

  Charley Cunningham · 2026-01-27 14:57:07 -08:00
  19d8f71a98
• Clarify external editor env var message (#10030)

  ### Motivation
  - Improve UX by making it explicit that `VISUAL`/`EDITOR` must be set
  before launching Codex, not during a running session.
  
  ### Description
  - Update the external editor error text in `codex-rs/tui/src/app.rs` to:
  `"Cannot open external editor: set $VISUAL or $EDITOR before starting
  Codex."` and run `just fmt` to apply formatting.
  
  ### Testing
  - Ran `just fmt` successfully; attempted `cargo test -p codex-tui` but
  it failed due to network errors when fetching git dependencies (tests
  did not complete).
  
  ------
  [Codex
  Task](https://chatgpt.com/codex/tasks/task_i_6972c2c984948329b1a37d5c5839aff3)

  Josh McKinney · 2026-01-27 13:29:55 -08:00
  3ae966edd8
• Show OAuth error descriptions in callback responses (#9654)

  ### Motivation
  - The local OAuth callback server returned a generic "Invalid OAuth
  callback" on failures even when the query contained an
  `error_description`, making it hard to debug OAuth failures.
  
  ### Description
  - Update `codex-rs/rmcp-client/src/perform_oauth_login.rs` to surface
  `error_description` values from the callback query in the HTTP response.
  - Introduce a `CallbackOutcome` enum and change `parse_oauth_callback`
  to return it, parsing `code`, `state`, and `error_description` from the
  query string.
  - Change `spawn_callback_server` to match on `CallbackOutcome` and
  return `OAuth error: <description>` with a 400 status when
  `error_description` is present, while preserving the existing success
  and invalid flows.
  - Use inline formatting for the error response string.
  
  ### Testing
  - Ran `just fmt` in the `codex-rs` workspace to format changes
  successfully.
  - Ran `cargo test -p codex-rmcp-client` and all tests passed.
  
  ------
  [Codex
  Task](https://chatgpt.com/codex/tasks/task_i_6971aadc68d0832e93159efea8cd48a9)

  blevy-oai · 2026-01-27 13:22:54 -08:00
  c7c2b3cf8d
• Fix: Render MCP image outputs regardless of ordering (#9815)

  ## What?
  - Render an MCP image output cell whenever a decodable image block
  exists in `CallToolResult.content` (including text-before-image or
  malformed image before valid image).
  
  ## Why?
  - Tool results that include caption text before the image currently drop
  the image output cell.
  - A malformed image block can also suppress later valid image output.
  
  ## How?
  - Iterate `content` and return the first successfully decoded image
  instead of only checking the first block.
  - Add unit tests that cover text-before-image ordering and
  invalid-image-before-valid.
  
  ## Before
  ```rust
  let image = match result {
      Ok(mcp_types::CallToolResult { content, .. }) => {
          if let Some(mcp_types::ContentBlock::ImageContent(image)) = content.first() {
              // decode image (fails -> None)
          } else {
              None
          }
      }
      _ => None,
  }?;
  ```
  ## After
  ```rust
  let image = result
      .as_ref()
      .ok()?
      .content
      .iter()
      .find_map(decode_mcp_image)?;
  ```
  
  ## Risk / Impact
  - Low: only affects image cell creation for MCP tool results; no change
  for non-image outputs.
  
  ## Tests
  - [x] `just fmt`
  - [x] `cargo test -p codex-tui`
  - [x] Rerun after branch update (2026-01-27): `just fmt`, `cargo test -p
  codex-tui`
  
  Manual testing
  
  # Manual testing: MCP image tool result rendering (Codex TUI)
  
  # Build the rmcp stdio test server binary:
  cd codex-rs
  cargo build -p codex-rmcp-client --bin test_stdio_server
  
  # Register the server as an MCP server (absolute path to the built binary):
  codex mcp add mcpimg -- /Users/joshka/code/codex-pr-review/codex-rs/target/debug/test_stdio_server
  
  # Then in Codex TUI, ask it to call:
  - mcpimg.image_scenario({"scenario":"image_only"})
  - mcpimg.image_scenario({"scenario":"text_then_image","caption":"Here is the image:"})
  - mcpimg.image_scenario({"scenario":"invalid_base64_then_image"})
  - mcpimg.image_scenario({"scenario":"invalid_image_bytes_then_image"})
  - mcpimg.image_scenario({"scenario":"multiple_valid_images"})
  - mcpimg.image_scenario({"scenario":"image_then_text","caption":"Here is the image:"})
  - mcpimg.image_scenario({"scenario":"text_only","caption":"Here is the image:"})
  
  # Expected:
  # - You should see an extra history cell: "tool result (image output)" when the
  #   tool result contains at least one decodable image block (even if earlier
  #   blocks are text or invalid images).
  
  
  Fixes #9814
  
  ---------
  
  Co-authored-by: Josh McKinney <joshka@openai.com>

  K Bediako · 2026-01-27 21:14:08 +00:00
  337643b00a
• enable live web search for DangerFullAccess sandbox policy (#10008)

  Auto-enable live `web_search` tool when sandbox policy is
  `DangerFullAccess`.
  
  Explicitly setting `web_search` (canonical setting), or enabling
  `web_search_cached` or `web_search_request` still takes precedence over
  this sandbox-policy-driven enablement.

  sayan-oai · 2026-01-27 20:09:05 +00:00
  28051d18c6
• Remove load from SKILL.toml fallback (#10007)
  alexsong-oai · 2026-01-27 12:06:40 -08:00
  2f8a44baea
• really fix pwd for windows codex zip (#10011)

  Co-authored-by: Michael Bolin <mbolin@openai.com>

  iceweasel-oai · 2026-01-27 19:29:28 +00:00
  30eb655ad1
• chore: introduce *Args types for new() methods (#10009)

  Constructors with long param lists can be hard to reason about when a
  number of the args are `None`, in practice. Introducing a struct to use
  as the args type helps make things more self-documenting.

  Michael Bolin · 2026-01-27 19:15:38 +00:00
  700a29e157
• remove sandbox globals. (#9797)

  Threads sandbox updates through OverrideTurnContext for active turn
  Passes computed sandbox type into safety/exec

  iceweasel-oai · 2026-01-27 11:04:23 -08:00
  c40ad65bd8
• feat: make it possible to specify --config flags in the SDK (#10003)

  Updates the `CodexOptions` passed to the `Codex()` constructor in the
  SDK to support a `config` property that is a map of configuration data
  that will be transformed into `--config` flags passed to the invocation
  of `codex`.
  
  Therefore, something like this:
  
  ```typescript
  const codex = new Codex({
    config: {
      show_raw_agent_reasoning: true,
      sandbox_workspace_write: { network_access: true },
    },
  });
  ```
  
  would result in the following args being added to the invocation of
  `codex`:
  
  ```shell
  --config show_raw_agent_reasoning=true --config sandbox_workspace_write.network_access=true
  ```

  Michael Bolin · 2026-01-27 10:47:07 -08:00
  894923ed5d
• fix(app-server, core): defer initial context write to rollout file until first turn (#9950)

  ### Overview
  Currently calling `thread/resume` will always bump the thread's
  `updated_at` timestamp. This PR makes it the `updated_at` timestamp
  changes only if a turn is triggered.
  
  ### Additonal context
  What we typically do on resuming a thread is **always** writing “initial
  context” to the rollout file immediately. This initial context includes:
  - Developer instructions derived from sandbox/approval policy + cwd
  - Optional developer instructions (if provided)
  - Optional collaboration-mode instructions
  - Optional user instructions (if provided)
  - Environment context (cwd, shell, etc.)
  
  This PR defers writing the “initial context” to the rollout file until
  the first `turn/start`, so we don't inadvertently bump the thread's
  `updated_at` timestamp until a turn is actually triggered.
  
  This works even though both `thread/resume` and `turn/start` accept
  overrides (such as `model`, `cwd`, etc.) because the initial context is
  seeded from the effective `TurnContext` in memory, computed at
  `turn/start` time, after both sets of overrides have been applied.
  
  **NOTE**: This is a very short-lived solution until we introduce sqlite.
  Then we can remove this.

  Owen Lin · 2026-01-27 10:41:54 -08:00
  fc0fd85349
• feat(network-proxy): add a SOCKS5 proxy with policy enforcement (#9803)

  ### Summary
  - Adds an optional SOCKS5 listener via `rama-socks5`
  - SOCKS5 is disabled by default and gated by config
  - Reuses existing policy enforcement and blocked-request recording
  - Blocks SOCKS5 in limited mode to prevent method-policy bypass
  - Applies bind clamping to the SOCKS5 listener
  
  ### Config
  New/used fields under `network_proxy`:
  - `enable_socks5`
  - `socks_url`
  - `enable_socks5_udp`
  
  ### Scope
  - Changes limited to `codex-rs/network-proxy` (+ `codex-rs/Cargo.lock`)
  
  ### Testing
  ```bash
  cd codex-rs
  just fmt
  cargo test -p codex-network-proxy --offline

  viyatb-oai · 2026-01-27 10:09:39 -08:00
  877b76bb9d
• TUI footer: right-align context and degrade shortcut summary + mode cleanly (#9944)

  ## Summary
  Refines the bottom footer layout to keep `% context left` right-aligned
  while making the left side degrade cleanly
  
  ## Behavior with empty textarea
  Full width:
  <img width="607" height="62" alt="Screenshot 2026-01-26 at 2 59 59 PM"
  src="https://github.com/user-attachments/assets/854f33b7-d714-40be-8840-a52eb3bda442"
  />
  Less:
  <img width="412" height="66" alt="Screenshot 2026-01-26 at 2 59 48 PM"
  src="https://github.com/user-attachments/assets/9c501788-c3a2-4b34-8f0b-8ec4395b44fe"
  />
  Min width:
  <img width="218" height="77" alt="Screenshot 2026-01-26 at 2 59 33 PM"
  src="https://github.com/user-attachments/assets/0bed2385-bdbf-4254-8ae4-ab3452243628"
  />
  
  ## Behavior with message in textarea and agent running (steer enabled)
  Full width:
  <img width="753" height="63" alt="Screenshot 2026-01-26 at 4 33 54 PM"
  src="https://github.com/user-attachments/assets/1856b352-914a-44cf-813d-1cb50c7f183b"
  />
  
  Less:
  <img width="353" height="61" alt="Screenshot 2026-01-26 at 4 30 12 PM"
  src="https://github.com/user-attachments/assets/d951c4d5-f3e7-4116-8fe1-6a6c712b3d48"
  />
  
  Less:
  <img width="304" height="64" alt="Screenshot 2026-01-26 at 4 30 51 PM"
  src="https://github.com/user-attachments/assets/1433e994-5cbc-4e20-a98a-79eee13c8699"
  />
  
  Less:
  <img width="235" height="61" alt="Screenshot 2026-01-26 at 4 30 56 PM"
  src="https://github.com/user-attachments/assets/e216c3c6-84cd-40fc-ae4d-83bf28947f0e"
  />
  
  Less:
  <img width="165" height="59" alt="Screenshot 2026-01-26 at 4 31 08 PM"
  src="https://github.com/user-attachments/assets/027de5de-7185-47ce-b1cc-5363ea33d9b1"
  />
  
  ## Notes / Edge Cases
  - In steer mode while typing, the queue hint no longer replaces the mode
  label; it renders as `tab to queue message · {Mode}`.
  - Collapse priorities differ by state:
  - With the queue hint active, `% context left` is hidden before
  shortening or dropping the queue hint.
  - In the empty + non-running state, `? for shortcuts` is dropped first,
  and `% context left` is only shown if `(shift+tab to
  cycle)` can also fit.
  - Transient instructional states (`?` overlay, Esc hint, Ctrl+C/D
  reminders, and flash/override hints) intentionally suppress the
  mode label (and context) to focus the next action.
  
  ## Implementation Notes
  - Renamed the base footer modes to make the state explicit:
  `ComposerEmpty` and `ComposerHasDraft`, and compute the base mode
  directly from emptiness.
  - Unified collapse behavior in `single_line_footer_layout` for both base
  modes, with:
  - Queue-hint behavior that prefers keeping the queue hint over context.
  - A cycle-hint guard that prevents context from reappearing after
  `(shift+tab to cycle)` is dropped.
  - Kept rendering responsibilities explicit:
    - `single_line_footer_layout` decides what fits.
    - `render_footer_line` renders a chosen line.
  - `render_footer_from_props` renders the canonical mode-to-text mapping.
  - Expanded snapshot coverage:
  - Added `footer_collapse_snapshots` in `chat_composer.rs` to lock the
  distinct collapse states across widths.
  - Consolidated the width-aware snapshot helper usage (e.g.,
  `snapshot_composer_state_with_width`,
  `snapshot_footer_with_mode_indicator`).

  Charley Cunningham · 2026-01-27 17:43:09 +00:00
  538e1059a3
• description in role type (#9993)
  jif-oai · 2026-01-27 17:20:07 +00:00
  067922a734
• update pnpm to 10.28.2 to address security issues (#9992)

  Updates pnpm to 10.28.2. to address security issues in prior versions of
  pnpm that can allow deps to execute lifecycle scripts against policy.
  
  I have read the CLA Document and I hereby sign the CLA

  mjr-openai · 2026-01-27 09:19:43 -08:00
  dd24ac6b26
• backend-client: add get_config_requirements_file (#10001)

  Adds getting config requirement to backend-client.
  
  I made a slash command to test it (not included in this PR):
  <img width="726" height="330" alt="Screenshot 2026-01-27 at 15 20 41"
  src="https://github.com/user-attachments/assets/97222e7c-5078-485a-a5b2-a6630313901e"
  />

  gt-oai · 2026-01-27 16:59:53 +00:00
  ddc704d4c6
• chore: clean orchestrator prompt (#9994)
  jif-oai · 2026-01-27 16:32:05 +00:00
  3b726d9550
• nit: better unused prompt (#9991)
  jif-oai · 2026-01-27 13:03:12 +00:00
  74ffbbe7c1
• nit: better tool description (#9988)
  jif-oai · 2026-01-27 12:46:51 +00:00
  742f086ee6
• Fix: cap aggregated exec output consistently (#9759)

  ## WHAT?
  - Bias aggregated output toward stderr under contention (2/3 stderr, 1/3
  stdout) while keeping the 1 MiB cap.
  - Rebalance unused stderr share back to stdout when stderr is tiny to
  avoid underfilling.
  - Add tests for contention, small-stderr rebalance, and under-cap
  ordering (stdout then stderr).
  
  ## WHY?
  - Review feedback requested stderr priority under contention.
  - Avoid underfilled aggregated output when stderr is small while
  preserving a consistent cap across exec paths.
  
  ## HOW?
  - Update `aggregate_output` to compute stdout/stderr shares, then
  reassign unused capacity to the other stream.
  - Use the helper in both Windows and async exec paths.
  - Add regression tests for contention/rebalance and under-cap ordering.
  
  ## BEFORE
  ```rust
  // Best-effort aggregate: stdout then stderr (capped).
  let mut aggregated = Vec::with_capacity(
      stdout
          .text
          .len()
          .saturating_add(stderr.text.len())
          .min(EXEC_OUTPUT_MAX_BYTES),
  );
  append_capped(&mut aggregated, &stdout.text, EXEC_OUTPUT_MAX_BYTES);
  append_capped(&mut aggregated, &stderr.text, EXEC_OUTPUT_MAX_BYTES);
  let aggregated_output = StreamOutput {
      text: aggregated,
      truncated_after_lines: None,
  };
  ```
  
  ## AFTER
  ```rust
  fn aggregate_output(
      stdout: &StreamOutput<Vec<u8>>,
      stderr: &StreamOutput<Vec<u8>>,
  ) -> StreamOutput<Vec<u8>> {
      let total_len = stdout.text.len().saturating_add(stderr.text.len());
      let max_bytes = EXEC_OUTPUT_MAX_BYTES;
      let mut aggregated = Vec::with_capacity(total_len.min(max_bytes));
  
      if total_len <= max_bytes {
          aggregated.extend_from_slice(&stdout.text);
          aggregated.extend_from_slice(&stderr.text);
          return StreamOutput {
              text: aggregated,
              truncated_after_lines: None,
          };
      }
  
      // Under contention, reserve 1/3 for stdout and 2/3 for stderr; rebalance unused stderr to stdout.
      let want_stdout = stdout.text.len().min(max_bytes / 3);
      let want_stderr = stderr.text.len();
      let stderr_take = want_stderr.min(max_bytes.saturating_sub(want_stdout));
      let remaining = max_bytes.saturating_sub(want_stdout + stderr_take);
      let stdout_take = want_stdout + remaining.min(stdout.text.len().saturating_sub(want_stdout));
  
      aggregated.extend_from_slice(&stdout.text[..stdout_take]);
      aggregated.extend_from_slice(&stderr.text[..stderr_take]);
  
      StreamOutput {
          text: aggregated,
          truncated_after_lines: None,
      }
  }
  ```
  
  ## TESTS
  - [x] `just fmt`
  - [x] `just fix -p codex-core`
  - [x] `cargo test -p codex-core aggregate_output_`
  - [x] `cargo test -p codex-core`
  - [x] `cargo test --all-features`
  
  ## FIXES
  Fixes #9758

  K Bediako · 2026-01-27 09:29:12 +00:00
  ab99df0694
• Fixing main and make plan mode reasoning effort medium (#9980)

  It's overthinking so much on high and going over the context window.

  Ahmed Ibrahim · 2026-01-26 22:30:24 -08:00
  509ff1c643
• make plan prompt less detailed (#9977)

  This was too much to ask for

  Ahmed Ibrahim · 2026-01-26 21:42:01 -08:00
  cabb2085cc
• tui: wrapping user input questions (#9971)
  Ahmed Ibrahim · 2026-01-26 21:30:09 -08:00
  4db6da32a3
• make cached web_search client-side default (#9974)

  [Experiment](https://console.statsig.com/50aWbk2p4R76rNX9lN5VUw/experiments/codex_web_search_rollout/summary)
  for default cached `web_search` completed; cached chosen as default.
  
  Update client to reflect that.

  sayan-oai · 2026-01-26 21:25:40 -08:00
  0adcd8aa86
• plan prompt (#9975)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2026-01-26 21:14:05 -08:00
  28bd7db14a
• prompt (#9970)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2026-01-26 20:27:57 -08:00
  0c72d8fd6e
• Fix resume --last with --json option (#9475)

  Fix resume --last prompt parsing by dropping the clap conflict on the
  codex resume subcommand so a positional prompt is accepted when --last
  is set. This aligns interactive resume behavior with exec-mode logic and
  avoids the “--last cannot be used with SESSION_ID” error.
  
  This addresses #6717

  Eric Traut · 2026-01-26 20:20:57 -08:00
  7c96f2e84c
• prompt final (#9969)

  hopefully final this time (at least tonight) >_<

  Ahmed Ibrahim · 2026-01-26 20:12:43 -08:00
  f45a8733bf
• Improve plan mode prompt (#9968)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2026-01-26 19:56:16 -08:00
  b655a092ba
• plan prompt v7 (#9966)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2026-01-26 19:34:18 -08:00
  b7bba3614e
• fix: handle all web_search actions and in progress invocations (#9960)

  ### Summary
  - Parse all `web_search` tool actions (`search`, `find_in_page`,
  `open_page`).
  - Previously we only parsed + displayed `search`, which made the TUI
  appear to pause when the other actions were being used.
  - Show in progress `web_search` calls as `Searching the web`
    - Previously we only showed completed tool calls
  
  <img width="308" height="149" alt="image"
  src="https://github.com/user-attachments/assets/90a4e8ff-b06a-48ff-a282-b57b31121845"
  />
  
  ### Tests
  Added + updated tests, tested locally
  
  ### Follow ups
  Update VSCode extension to display these as well

  sayan-oai · 2026-01-27 03:33:48 +00:00
  86adf53235
• Use test_codex more (#9961)

  Reduces boilderplate.

  pakrym-oai · 2026-01-26 18:52:10 -08:00
  998e88b12a
• Warn users on enabling underdevelopment features (#9954)

  <img width="938" height="73" alt="image"
  src="https://github.com/user-attachments/assets/a2d5ac46-92c5-4828-b35e-0965c30cdf36"
  />

  Ahmed Ibrahim · 2026-01-27 01:58:05 +00:00
  c900de271a
• feat: load interface metadata from SKILL.json (#9953)
  alexsong-oai · 2026-01-27 01:38:06 +00:00
  a641a6427c
• NIT larger buffer (#9957)
  jif-oai · 2026-01-27 01:26:55 +00:00
  5d13427ef4
• Reuse ChatComposer in request_user_input overlay (#9892)

  Reuse the shared chat composer for notes and freeform answers in
  request_user_input.
  
  - Build the overlay composer with ChatComposerConfig::plain_text.
  - Wire paste-burst flushing + menu surface sizing through the bottom
  pane.

  Ahmed Ibrahim · 2026-01-26 17:21:41 -08:00
  394b967432
• Updated contribution guidelines (#9933)
  Eric Traut · 2026-01-26 17:13:25 -08:00
  6a279f6d77
• Reject request_user_input outside Plan/Pair (#9955)

  ## Context
  
  Previous work in https://github.com/openai/codex/pull/9560 only rejected
  `request_user_input` in Execute and Custom modes. Since then, additional
  modes
  (e.g., Code) were added, so the guard should be mode-agnostic.
  
  ## What changed
  
  - Switch the handler to an allowlist: only Plan and PairProgramming are
  allowed
  - Return the same error for any other mode (including Code)
  - Add a Code-mode rejection test alongside the existing Execute/Custom
  tests
  
  ## Why
  
  This prevents `request_user_input` from being used in modes where it is
  not
  intended, even as new modes are introduced.

  Charley Cunningham · 2026-01-26 17:12:17 -08:00
  47aa1f3b6a
• fix: try to fix freezes 2 (#9951)

  Fixes a TUI freeze caused by awaiting `mpsc::Sender::send()` that blocks
  the tokio thread, stopping the consumption runtime and creating a
  deadlock. This could happen if the server was producing enough chunks to
  fill the `mpsc` fast enough. To solve this we try on insert using a
  `try_send()` (not requiring an `await`) and delegate to a tokio task if
  this does not work
  
  This is a temporary solution as it can contain races for delta elements
  and a stronger design should come here

  jif-oai · 2026-01-27 01:02:22 +00:00
  73bd84dee0
• fix: use brew upgrade --cask codex to avoid warnings and ambiguity (#9823)

  Fixes #9822 
  
  ### Summary
  
  Make the Homebrew upgrade command explicit by using `brew upgrade --cask
  codex`.
  
  ### Motivation
  
  During the Codex self-update, Homebrew can emit an avoidable warning
  because the
  name `codex` resolves to a cask:
  
  ```
  Warning: Formula codex was renamed to homebrew/cask/codex.
  ````
  
  While the upgrade succeeds, this relies on implicit name resolution and
  produces
  unnecessary output during the update flow.
  
  ### Why `--cask`
  
  * Eliminates warning/noise for users
  * Explicitly matches how Codex is distributed via Homebrew
  * Avoids reliance on name resolution behavior
  * Makes the command more robust if a `codex` formula is ever introduced
  
  ### Context
  
  This restores the `--cask` flag that was removed in #6238 after being
  considered
  “not necessary” during review:
  [https://github.com/openai/codex/pull/6238#discussion_r2505947880](https://github.com/openai/codex/pull/6238#discussion_r2505947880).
  
  Co-authored-by: Eric Traut <etraut@openai.com>

  JBallin · 2026-01-26 16:21:09 -08:00
  32b062d0e1
• fix: remove cli tooltip references to custom prompts (#9901)

  Custom prompts are now deprecated, however are still references in
  tooltips. Remove the relevant tips from the repository.
  
  Closes #9900

  Matt Ridley · 2026-01-26 15:55:44 -08:00
  f29a0defa2
• chore(deps): bump globset from 0.4.16 to 0.4.18 in /codex-rs (#9884)

  Bumps [globset](https://github.com/BurntSushi/ripgrep) from 0.4.16 to
  0.4.18.
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/0b0e013f5ac6ae1dbfdf97f6f6aaa27d7c9bc317"><code>0b0e013</code></a>
  globset-0.4.18</li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/cac9870a0264014ab7015bf07e154c06a668a72c"><code>cac9870</code></a>
  doc: update date in man page template</li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/24e88dc15b58b6fcc16d217158994871e756a6ca"><code>24e88dc</code></a>
  ignore/types: add <code>ssa</code> type</li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/5748f81bb107ce65f32cff330fe90dc639af262c"><code>5748f81</code></a>
  printer: use <code>doc_cfg</code> instead of
  <code>doc_auto_cfg</code></li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/d47663b1b4548e4fa02d6e4b575718d0f5f5e7d6"><code>d47663b</code></a>
  searcher: fix regression with <code>--line-buffered</code> flag</li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/38d630261aded3a8e535fe85761e68af35bc462d"><code>38d6302</code></a>
  printer: add Cursor hyperlink alias</li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/b3dc4b09988b4fe7d8ff69ad576623d57f7c3b75"><code>b3dc4b0</code></a>
  globset: improve debug log</li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/ca2e34f37c5fa3021d0c14a67a7f0590166ade4f"><code>ca2e34f</code></a>
  grep-0.4.0</li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/a0d61a063f5ff7c1d1b131882d92999c923c3420"><code>a0d61a0</code></a>
  grep-printer-0.3.0</li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/c22fc0f13ce1cbe3bd40b659628aea21874938a2"><code>c22fc0f</code></a>
  deps: bump to grep-searcher 0.1.15</li>
  <li>Additional commits viewable in <a
  href="https://github.com/BurntSushi/ripgrep/compare/globset-0.4.16...globset-0.4.18">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=globset&package-manager=cargo&previous-version=0.4.16&new-version=0.4.18)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2026-01-26 15:55:19 -08:00
  2e5aa809f4
• chore(deps): bump axum from 0.8.4 to 0.8.8 in /codex-rs (#9883)

  Bumps [axum](https://github.com/tokio-rs/axum) from 0.8.4 to 0.8.8.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/tokio-rs/axum/releases">axum's
  releases</a>.</em></p>
  <blockquote>
  <h2>axum v0.8.8</h2>
  <ul>
  <li>Clarify documentation for <code>Router::route_layer</code> (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3567">#3567</a>)</li>
  </ul>
  <p><a
  href="https://redirect.github.com/tokio-rs/axum/issues/3567">#3567</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3567">tokio-rs/axum#3567</a></p>
  <h2>axum v0.8.7</h2>
  <ul>
  <li>Relax implicit <code>Send</code> / <code>Sync</code> bounds on
  <code>RouterAsService</code>, <code>RouterIntoService</code> (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3555">#3555</a>)</li>
  <li>Make it easier to visually scan for default features (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3550">#3550</a>)</li>
  <li>Fix some documentation typos</li>
  </ul>
  <p><a
  href="https://redirect.github.com/tokio-rs/axum/issues/3550">#3550</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3550">tokio-rs/axum#3550</a>
  <a
  href="https://redirect.github.com/tokio-rs/axum/issues/3555">#3555</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3555">tokio-rs/axum#3555</a></p>
  <h2>axum v0.8.5</h2>
  <ul>
  <li><strong>fixed:</strong> Reject JSON request bodies with trailing
  characters after the JSON document (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3453">#3453</a>)</li>
  <li><strong>added:</strong> Implement <code>OptionalFromRequest</code>
  for <code>Multipart</code> (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3220">#3220</a>)</li>
  <li><strong>added:</strong> Getter methods <code>Location::{status_code,
  location}</code></li>
  <li><strong>added:</strong> Support for writing arbitrary binary data
  into server-sent events (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3425">#3425</a>)]</li>
  <li><strong>added:</strong>
  <code>middleware::ResponseAxumBodyLayer</code> for mapping response body
  to <code>axum::body::Body</code> (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3469">#3469</a>)</li>
  <li><strong>added:</strong> <code>impl FusedStream for WebSocket</code>
  (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3443">#3443</a>)</li>
  <li><strong>changed:</strong> The <code>sse</code> module and
  <code>Sse</code> type no longer depend on the <code>tokio</code> feature
  (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3154">#3154</a>)</li>
  <li><strong>changed:</strong> If the location given to one of
  <code>Redirect</code>s constructors is not a valid header value, instead
  of panicking on construction, the <code>IntoResponse</code> impl now
  returns an HTTP 500, just like <code>Json</code> does when serialization
  fails (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3377">#3377</a>)</li>
  <li><strong>changed:</strong> Update minimum rust version to 1.78 (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3412">#3412</a>)</li>
  </ul>
  <p><a
  href="https://redirect.github.com/tokio-rs/axum/issues/3154">#3154</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3154">tokio-rs/axum#3154</a>
  <a
  href="https://redirect.github.com/tokio-rs/axum/issues/3220">#3220</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3220">tokio-rs/axum#3220</a>
  <a
  href="https://redirect.github.com/tokio-rs/axum/issues/3377">#3377</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3377">tokio-rs/axum#3377</a>
  <a
  href="https://redirect.github.com/tokio-rs/axum/issues/3412">#3412</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3412">tokio-rs/axum#3412</a>
  <a
  href="https://redirect.github.com/tokio-rs/axum/issues/3425">#3425</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3425">tokio-rs/axum#3425</a>
  <a
  href="https://redirect.github.com/tokio-rs/axum/issues/3443">#3443</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3443">tokio-rs/axum#3443</a>
  <a
  href="https://redirect.github.com/tokio-rs/axum/issues/3453">#3453</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3453">tokio-rs/axum#3453</a>
  <a
  href="https://redirect.github.com/tokio-rs/axum/issues/3469">#3469</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3469">tokio-rs/axum#3469</a></p>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/d07863f97d2649c414d2cdd162d1a10750e29a25"><code>d07863f</code></a>
  Release axum v0.8.8 and axum-extra v0.12.3</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/287c674b65fa363fa8e60a5b2de7502dfda0decc"><code>287c674</code></a>
  axum-extra: Make typed-routing feature enable routing feature (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3514">#3514</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/f5804aa6a13f8af1ae1a8998b872b300b0859d81"><code>f5804aa</code></a>
  SecondElementIs: Correct a small inconsistency (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3559">#3559</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/f51f3ba4366e1060206efc41fde1227055164c45"><code>f51f3ba</code></a>
  axum-extra: Add trailing newline to pretty JSON response (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3526">#3526</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/816407a8166491217168890ee96856469c3b424c"><code>816407a</code></a>
  Fix integer underflow in <code>try_range_response</code> for empty files
  (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3566">#3566</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/78656ebb4a925329dc19c17a4dbef31d7551d4f5"><code>78656eb</code></a>
  docs: Clarify <code>route_layer</code> does not apply middleware to the
  fallback handler...</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/4404f27cea206b0dca63637b1c76dff23772a5cc"><code>4404f27</code></a>
  Release axum v0.8.7 and axum-extra v0.12.2</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/8f1545adecc86036ed9c8f252edcc099f7016103"><code>8f1545a</code></a>
  Fix typo in extractors guide (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3554">#3554</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/4fc3faa0b4d82db870d8daaf49978da960bcfc42"><code>4fc3faa</code></a>
  Relax implicit Send / Sync bounds (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3555">#3555</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/a05920c906fb5fe3c5b734f80465a3a6f06948f1"><code>a05920c</code></a>
  Make it easier to visually scan for default features (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3550">#3550</a>)</li>
  <li>Additional commits viewable in <a
  href="https://github.com/tokio-rs/axum/compare/axum-v0.8.4...axum-v0.8.8">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=axum&package-manager=cargo&previous-version=0.8.4&new-version=0.8.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2026-01-26 15:54:58 -08:00
  6418e65356
• chore(deps): bump tokio-test from 0.4.4 to 0.4.5 in /codex-rs (#9882)

  Bumps [tokio-test](https://github.com/tokio-rs/tokio) from 0.4.4 to
  0.4.5.
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/41d1877689f8669902b003a6affce60bdfeb3025"><code>41d1877</code></a>
  chore: prepare tokio-test 0.4.5 (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7831">#7831</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/60b083b630ed279d579368e513406d735d739511"><code>60b083b</code></a>
  chore: prepare tokio-stream 0.1.18 (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7830">#7830</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/9cc02cc88d083113cd9889a74b382e39e430e180"><code>9cc02cc</code></a>
  chore: prepare tokio-util 0.7.18 (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7829">#7829</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/d2799d791b10388e60a2a5fe5e4a33b3336e1465"><code>d2799d7</code></a>
  task: improve the docs of <code>Builder::spawn_local</code> (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7828">#7828</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/4d4870f291b69e2426232440e03c9e66fe77b525"><code>4d4870f</code></a>
  task: doc that task drops before JoinHandle completion (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7825">#7825</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/fdb150901afb0456037c6232eab8ce80116ccd02"><code>fdb1509</code></a>
  fs: check for io-uring opcode support (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7815">#7815</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/426a56278017c30e7da7b4c9365a2610f4695f76"><code>426a562</code></a>
  rt: remove <code>allow(dead_code)</code> after <code>JoinSet</code>
  stabilization (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7826">#7826</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/e3b89bbefa7564e2eba2fb9f849ef7bf87d60fad"><code>e3b89bb</code></a>
  chore: prepare Tokio v1.49.0 (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7824">#7824</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/4f577b84e939c8d427d79fdc73919842d8735de2"><code>4f577b8</code></a>
  Merge 'tokio-1.47.3' into 'master'</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/f320197693ee09e28f1fca0e55418081adcdfc25"><code>f320197</code></a>
  chore: prepare Tokio v1.47.3 (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7823">#7823</a>)</li>
  <li>Additional commits viewable in <a
  href="https://github.com/tokio-rs/tokio/compare/tokio-test-0.4.4...tokio-test-0.4.5">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tokio-test&package-manager=cargo&previous-version=0.4.4&new-version=0.4.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2026-01-26 15:51:21 -08:00
  764712c116
• chore(deps): bump tracing from 0.1.43 to 0.1.44 in /codex-rs (#9880)

  Bumps [tracing](https://github.com/tokio-rs/tracing) from 0.1.43 to
  0.1.44.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/tokio-rs/tracing/releases">tracing's
  releases</a>.</em></p>
  <blockquote>
  <h2>tracing 0.1.44</h2>
  <h3>Fixed</h3>
  <ul>
  <li>Fix <code>record_all</code> panic (<a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3432">#3432</a>)</li>
  </ul>
  <h3>Changed</h3>
  <ul>
  <li><code>tracing-core</code>: updated to 0.1.36 (<a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3440">#3440</a>)</li>
  </ul>
  <p><a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3432">#3432</a>:
  <a
  href="https://redirect.github.com/tokio-rs/tracing/pull/3432">tokio-rs/tracing#3432</a>
  <a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3440">#3440</a>:
  <a
  href="https://redirect.github.com/tokio-rs/tracing/pull/3440">tokio-rs/tracing#3440</a></p>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/tokio-rs/tracing/commit/2d55f6faf9be83e7e4634129fb96813241aac2b8"><code>2d55f6f</code></a>
  chore: prepare tracing 0.1.44 (<a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3439">#3439</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tracing/commit/10a9e838a35e6ded79d66af246be2ee05417136d"><code>10a9e83</code></a>
  chore: prepare tracing-core 0.1.36 (<a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3440">#3440</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tracing/commit/ee82cf92a8c750f98cfb7a417cc8defb37e26a00"><code>ee82cf9</code></a>
  tracing: fix record_all panic (<a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3432">#3432</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tracing/commit/9978c3663bcd58de14b3cf089ad24cb63d00a922"><code>9978c36</code></a>
  chore: prepare tracing-mock 0.1.0-beta.3 (<a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3429">#3429</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tracing/commit/cc44064b3a41cb586bd633f8a024354928e25819"><code>cc44064</code></a>
  chore: prepare tracing-subscriber 0.3.22 (<a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3428">#3428</a>)</li>
  <li>See full diff in <a
  href="https://github.com/tokio-rs/tracing/compare/tracing-0.1.43...tracing-0.1.44">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tracing&package-manager=cargo&previous-version=0.1.43&new-version=0.1.44)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2026-01-26 15:48:45 -08:00
  5ace350186
• Add composer config and shared menu surface helpers (#9891)

  Centralize built-in slash-command gating and extract shared menu-surface
  helpers.
  
  - Add bottom_pane::slash_commands and reuse it from composer + command
  popup.
  - Introduce ChatComposerConfig + shared menu surface rendering without
  changing default behavior.

  Ahmed Ibrahim · 2026-01-26 23:16:29 +00:00
  a8f195828b
• fix: handle utf-8 in windows sandbox logs (#8647)

  Currently `apply_patch` will fail on Windows if the file contents happen
  to have a multi-byte character at the point where the `preview` function
  truncates.
  
  I've used the existing `take_bytes_at_char_boundary` helper and added a
  regression test (that fails without the fix).
  
  This is related to #4013 but doesn't fix it.

  David Gilbertson · 2026-01-26 15:11:27 -08:00
  313ee3003b
• plan prompt (#9943)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2026-01-26 14:48:54 -08:00
  159ff06281
• Add MCP server scopes config and use it as fallback for OAuth login (#9647)

  ### Motivation
  - Allow MCP OAuth flows to request scopes defined in `config.toml`
  instead of requiring users to always pass `--scopes` on the CLI.
  CLI/remote parameters should still override config values.
  
  ### Description
  - Add optional `scopes: Option<Vec<String>>` to `McpServerConfig` and
  `RawMcpServerConfig`, and propagate it through deserialization and the
  built config types.
  - Serialize `scopes` into the MCP server TOML via
  `serialize_mcp_server_table` in `core/src/config/edit.rs` and include
  `scopes` in the generated config schema (`core/config.schema.json`).
  - CLI: update `codex-rs/cli/src/mcp_cmd.rs` `run_login` to fall back to
  `server.scopes` when the `--scopes` flag is empty, with explicit CLI
  scopes still taking precedence.
  - App server: update
  `codex-rs/app-server/src/codex_message_processor.rs`
  `mcp_server_oauth_login` to use `params.scopes.or_else(||
  server.scopes.clone())` so the RPC path also respects configured scopes.
  - Update many test fixtures to initialize the new `scopes` field (set to
  `None`) so test code builds with the new struct field.
  
  ### Testing
  - Ran config tooling and formatters: `just write-config-schema`
  (succeeded), `just fmt` (succeeded), and `just fix -p codex-core`, `just
  fix -p codex-cli`, `just fix -p codex-app-server` (succeeded where
  applicable).
  - Ran unit tests for the CLI: `cargo test -p codex-cli` (passed).
  - Ran unit tests for core: `cargo test -p codex-core` (ran; many tests
  passed but several failed, including model refresh/403-related tests,
  shell snapshot/timeouts, and several `unified_exec` expectations).
  - Ran app-server tests: `cargo test -p codex-app-server` (ran; many
  integration-suite tests failed due to mocked/remote HTTP 401/403
  responses and wiremock expectations).
  
  If you want, I can split the tests into smaller focused runs or help
  debug the failing integration tests (they appear to be unrelated to the
  config change and stem from external HTTP/mocking behaviors encountered
  during the test runs).
  
  ------
  [Codex
  Task](https://chatgpt.com/codex/tasks/task_i_69718f505914832ea1f334b3ba064553)

  blevy-oai · 2026-01-26 14:13:04 -08:00
  bdc4742bfc
• [app-server] feat: add filtering on thread list (#9897)
  jif-oai · 2026-01-26 21:54:19 +00:00
  247fb2de64