941 Commits

• feat: load ExecPolicyManager from ConfigLayerStack (#8453)

  https://github.com/openai/codex/pull/8354 added support for in-repo
  `.config/` files, so this PR updates the logic for loading `*.rules`
  files to load `*.rules` files from all relevant layers. The main change
  to the business logic is `load_exec_policy()` in
  `codex-rs/core/src/exec_policy.rs`.
  
  Note this adds a `config_folder()` method to `ConfigLayerSource` that
  returns `Option<AbsolutePathBuf>` so that it is straightforward to
  iterate over the sources and get the associated config folder, if any.

  Michael Bolin · 2025-12-22 17:24:17 -08:00
  277babba79
• chore: include User layer in ConfigLayerStack even if config.toml is empty (#8456)

  This is necessary so that `$CODEX_HOME/skills` and `$CODEX_HOME/rules`
  still get loaded even if `$CODEX_HOME/config.toml` does not exist. See
  #8453.
  
  For now, it is possible to omit this layer when creating a dummy
  `ConfigLayerStack` in a test. We can revisit that later, if it turns out
  to be the right thing to do.

  Michael Bolin · 2025-12-22 16:40:26 -08:00
  14dbd0610a
• chore: add ConfigLayerStack as a field of Config (#8448)

  This should make it easier to load `.codex/skills/` and `.codex/rules/`
  properly throughout.

  Michael Bolin · 2025-12-22 14:16:33 -08:00
  8e900c210c
• remove minimal client version (#8447)

  This isn't needed value by client

  Ahmed Ibrahim · 2025-12-22 12:52:24 -08:00
  6b2ef216f1
• Handle concatenation nodes in bash command parser for exec policy (#8395)

  The bash command parser in exec_policy was failing to parse commands
  with concatenated flag-value patterns like `-g"*.py"` (no space between
  flag and quoted value). This caused policy rules like
  `prefix_rule(pattern=["rg"])` to not match commands such as `rg -n "foo"
  -g"*.py"`.
  
  When tree-sitter-bash parses `-g"*.py"`, it creates a "concatenation"
  node containing a word (`-g`) and a string (`"*.py"`). The parser
  previously rejected any node type not in the ALLOWED_KINDS list, causing
  the entire command parsing to fail and fall back to matching against the
  wrapped `bash -lc` command instead of the inner command.
  
  This change:
  - Adds "concatenation" to ALLOWED_KINDS in
  try_parse_word_only_commands_sequence
  - Adds handling for concatenation nodes in parse_plain_command_from_node
  that recursively extracts and joins word/string/raw_string children
  - Adds test cases for concatenated flag patterns with double and single
  quotes
  
  Fixes #8394

  Ivan Murashko · 2025-12-22 19:59:27 +00:00
  0237459f71
• feat: add support for project_root_markers in config.toml (#8359)

  - allow configuring `project_root_markers` in `config.toml`
  (user/system/MDM) to control project discovery beyond `.git`
  - honor the markers after merging pre-project layers; default to
  `[".git"]` when unset and skip ancestor walk when set to an empty array
  - document the option and add coverage for alternate markers in config
  loader tests

  Michael Bolin · 2025-12-22 19:45:45 +00:00
  314937fb11
• feat: support in-repo .codex/config.toml entries as sources of config info (#8354)

  - We now support `.codex/config.toml` in repo (from `cwd` up to the
  first `.git` found, if any) as layers in `ConfigLayerStack`. A new
  `ConfigLayerSource::Project` variant was added to support this.
  - In doing this work, I realized that we were resolving relative paths
  in `config.toml` after merging everything into one `toml::Value`, which
  is wrong: paths should be relativized with respect to the folder
  containing the `config.toml` that was deserialized. This PR introduces a
  deserialize/re-serialize strategy to account for this in
  `resolve_config_paths()`. (This is why `Serialize` is added to so many
  types as part of this PR.)
  - Added tests to verify this new behavior.
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/8354).
  * #8359
  * __->__ #8354

  Michael Bolin · 2025-12-22 11:07:36 -08:00
  8ff16a7714
• Add ExecPolicyManager (#8349)

  Move exec policy management into services to keep turn context
  immutable.

  pakrym-oai · 2025-12-22 09:59:32 -08:00
  96fdbdd434
• feat(windows) start powershell in utf-8 mode (#7902)

  ## Summary
  Adds a FeatureFlag to enforce UTF8 encoding in powershell, particularly
  Windows Powershell v5. This should help address issues like #7290.
  
  Notably, this PR does not include the ability to parse `apply_patch`
  invocations within UTF8 shell commands (calls to the freeform tool
  should not be impacted). I am leaving this out of scope for now. We
  should address before this feature becomes Stable, but those cases are
  not the default behavior at this time so we're okay for experimentation
  phase. We should continue cleaning up the `apply_patch::invocation`
  logic and then can handle it more cleanly.
  
  ## Testing
  - [x] Adds additional testing

  Dylan Hurd · 2025-12-22 09:36:44 -08:00
  33e1d0844a
• chore: un-ship undo (#8424)
  jif-oai · 2025-12-22 09:53:03 +01:00
  7a8407bbb6
• fix: do not panic on alphas (#8406)

  alphas are used sometimes as stable release

  Ahmed Ibrahim · 2025-12-22 00:20:53 +00:00
  aa83d7da24
• Remove plan from system skills (#8374)

  Removes plan from system skills. It has been rewritten into
  `create-plan` for evaluation and feedback:
  https://github.com/openai/skills/pull/22

  Gav Verma · 2025-12-20 19:42:53 -08:00
  fab1ded484
• Chore: remove rmcp feature and exp flag usages (#8087)

  ### Summary
  With codesigning on Mac, Windows and Linux, we should be able to safely
  remove `features.rmcp_client` and `use_experimental_use_rmcp_client`
  check from the codebase now.

  Shijie Rao · 2025-12-20 14:18:00 -08:00
  987dd7fde3
• feat(tui2): tune scrolling inpu based on (#8357)

  ## TUI2: Normalize Mouse Scroll Input Across Terminals (Wheel +
  Trackpad)
  
  This changes TUI2 scrolling to a stream-based model that normalizes
  terminal scroll event density into consistent wheel behavior (default:
  ~3 transcript lines per physical wheel notch) while keeping trackpad
  input higher fidelity via fractional accumulation.
  
  Primary code: `codex-rs/tui2/src/tui/scrolling/mouse.rs`
  
  Doc of record (model + probe-derived data):
  `codex-rs/tui2/docs/scroll_input_model.md`
  
  ### Why
  
  Terminals encode both mouse wheels and trackpads as discrete scroll
  up/down events with direction but no magnitude, and they vary widely in
  how many raw events they emit per physical wheel notch (commonly 1, 3,
  or 9+). Timing alone doesn’t reliably distinguish wheel vs trackpad, so
  cadence-based heuristics are unstable across terminals/hardware.
  
  This PR treats scroll input as short *streams* separated by silence or
  direction flips, normalizes raw event density into tick-equivalents,
  coalesces redraws for dense streams, and exposes explicit config
  overrides.
  
  ### What Changed
  
  #### Scroll Model (TUI2)
  
  - Stream detection
    - Start a stream on the first scroll event.
    - End a stream on an idle gap (`STREAM_GAP_MS`) or a direction flip.
  - Normalization
  - Convert raw events into tick-equivalents using per-terminal
  `tui.scroll_events_per_tick`.
  - Wheel-like vs trackpad-like behavior
  - Wheel-like: fixed “classic” lines per wheel notch; flush immediately
  for responsiveness.
  - Trackpad-like: fractional accumulation + carry across stream
  boundaries; coalesce flushes to ~60Hz to avoid floods and reduce “stop
  lag / overshoot”.
  - Trackpad divisor is intentionally capped: `min(scroll_events_per_tick,
  3)` so terminals with dense wheel ticks (e.g. 9 events per notch) don’t
  make trackpads feel artificially slow.
  - Auto mode (default)
    - Start conservatively as trackpad-like (avoid overshoot).
  - Promote to wheel-like if the first tick-worth of events arrives
  quickly.
  - Fallback for 1-event-per-tick terminals (no tick-completion timing
  signal).
  
  #### Trackpad Acceleration
  
  Some terminals produce relatively low vertical event density for
  trackpad gestures, which makes large/faster swipes feel sluggish even
  when small motions feel correct. To address that, trackpad-like streams
  apply a bounded multiplier based on event count:
  
  - `multiplier = clamp(1 + abs(events) / scroll_trackpad_accel_events,
  1..scroll_trackpad_accel_max)`
  
  The multiplier is applied to the trackpad stream’s computed line delta
  (including carried fractional remainder). Defaults are conservative and
  bounded.
  
  #### Config Knobs (TUI2)
  
  All keys live under `[tui]`:
  
  - `scroll_wheel_lines`: lines per physical wheel notch (default: 3).
  - `scroll_events_per_tick`: raw vertical scroll events per physical
  wheel notch (terminal-specific default; fallback: 3).
  - Wheel-like per-event contribution: `scroll_wheel_lines /
  scroll_events_per_tick`.
  - `scroll_trackpad_lines`: baseline trackpad sensitivity (default: 1).
  - Trackpad-like per-event contribution: `scroll_trackpad_lines /
  min(scroll_events_per_tick, 3)`.
  - `scroll_trackpad_accel_events` / `scroll_trackpad_accel_max`: bounded
  trackpad acceleration (defaults: 30 / 3).
  - `scroll_mode = auto|wheel|trackpad`: force behavior or use the
  heuristic (default: `auto`).
  - `scroll_wheel_tick_detect_max_ms`: auto-mode promotion threshold (ms).
  - `scroll_wheel_like_max_duration_ms`: auto-mode fallback for
  1-event-per-tick terminals (ms).
  - `scroll_invert`: invert scroll direction (applies to wheel +
  trackpad).
  
  Config docs: `docs/config.md` and field docs in
  `codex-rs/core/src/config/types.rs`.
  
  #### App Integration
  
  - The app schedules follow-up ticks to close idle streams (via
  `ScrollUpdate::next_tick_in` and `schedule_frame_in`) and finalizes
  streams on draw ticks.
    - `codex-rs/tui2/src/app.rs`
  
  #### Docs
  
  - Single doc of record describing the model + preserved probe
  findings/spec:
    - `codex-rs/tui2/docs/scroll_input_model.md`
  
  #### Other (jj-only friendliness)
  
  - `codex-rs/tui2/src/diff_render.rs`: prefer stable cwd-relative paths
  when the file is under the cwd even if there’s no `.git`.
  
  ### Terminal Defaults
  
  Per-terminal defaults are derived from scroll-probe logs (see doc).
  Notable:
  
  - Ghostty currently defaults to `scroll_events_per_tick = 3` even though
  logs measured ~9 in one setup. This is a deliberate stopgap; if your
  Ghostty build emits ~9 events per wheel notch, set:
  
    ```toml
    [tui]
    scroll_events_per_tick = 9
    ```
  
  ### Testing
  
  - `just fmt`
  - `just fix -p codex-core --allow-no-vcs`
  - `cargo test -p codex-core --lib` (pass)
  - `cargo test -p codex-tui2` (scroll tests pass; remaining failures are
  known flaky VT100 color tests in `insert_history`)
  
  ### Review Focus
  
  - Stream finalization + frame scheduling in `codex-rs/tui2/src/app.rs`.
  - Auto-mode promotion thresholds and the 1-event-per-tick fallback
  behavior.
  - Trackpad divisor cap (`min(events_per_tick, 3)`) and acceleration
  defaults.
  - Ghostty default tradeoff (3 vs ~9) and whether we should change it.

  Josh McKinney · 2025-12-20 12:48:12 -08:00
  63942b883c
• chore: enusre the logic that creates ConfigLayerStack has access to cwd (#8353)

  `load_config_layers_state()` should load config from a
  `.codex/config.toml` in any folder between the `cwd` for a thread and
  the project root. Though in order to do that,
  `load_config_layers_state()` needs to know what the `cwd` is, so this PR
  does the work to thread the `cwd` through for existing callsites.
  
  A notable exception is the `/config` endpoint in app server for which a
  `cwd` is not guaranteed to be associated with the query, so the `cwd`
  param is `Option<AbsolutePathBuf>` to account for this case.
  
  The logic to make use of the `cwd` will be done in a follow-up PR.

  Michael Bolin · 2025-12-19 20:11:27 -08:00
  a6974087e5
• Rename OpenAI models to models manager (#8346)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2025-12-19 16:20:05 -08:00
  f0dc6fd3c7
• feat: support allowed_sandbox_modes in requirements.toml (#8298)

  This adds support for `allowed_sandbox_modes` in `requirements.toml` and
  provides legacy support for constraining sandbox modes in
  `managed_config.toml`. This is converted to `Constrained<SandboxPolicy>`
  in `ConfigRequirements` and applied to `Config` such that constraints
  are enforced throughout the harness.
  
  Note that, because `managed_config.toml` is deprecated, we do not add
  support for the new `external-sandbox` variant recently introduced in
  https://github.com/openai/codex/pull/8290. As noted, that variant is not
  supported in `config.toml` today, but can be configured programmatically
  via app server.

  Michael Bolin · 2025-12-19 21:09:20 +00:00
  dc61fc5f50
• feat: make ConstraintError an enum (#8330)

  This will make it easier to test for expected errors in unit tests since
  we can compare based on the field values rather than the message (which
  might change over time). See https://github.com/openai/codex/pull/8298
  for an example.
  
  It also ensures more consistency in the way a `ConstraintError` is
  constructed.

  Michael Bolin · 2025-12-19 19:03:50 +00:00
  7e5c343ef5
• Update system skills from OSS repo (#8328)

  https://github.com/openai/skills/tree/main/skills/.system

  Gav Verma · 2025-12-19 09:31:04 -08:00
  37071e7e5c
• Revert "Keep skills feature flag default OFF for windows." (#8325)

  Reverts openai/codex#8308

  xl-openai · 2025-12-19 16:22:14 +00:00
  eeda6a5004
• Keep skills feature flag default OFF for windows. (#8308)

  Keep windows OFF first.

  xl-openai · 2025-12-18 21:57:15 -08:00
  6f94a90797
• Fix admin skills. (#8305)

  We were assembling the skill roots in two different places, and the
  admin root was missing in one of them. This change centralizes root
  selection into a helper so both paths stay in sync.

  xl-openai · 2025-12-19 04:10:19 +00:00
  339b052d68
• Add short descriptions to system skills (#8301)
  Gav Verma · 2025-12-19 02:44:53 +00:00
  f4371d2f6c
• Support admin scope skills. (#8296)

  a new scope reads from /etc/codex

  xl-openai · 2025-12-19 02:28:56 +00:00
  8120c8765b
• skills feature default on. (#8297)

  skills default on.

  xl-openai · 2025-12-18 18:26:46 -08:00
  d35337227a
• UI tweaks on skills popup. (#8250)

  Only display the skill name (not the folder), and truncate the skill
  description to a maximum of two lines.

  xl-openai · 2025-12-19 01:16:51 +00:00
  dcc01198e2
• feat: introduce ExternalSandbox policy (#8290)

  ## Description
  
  Introduced `ExternalSandbox` policy to cover use case when sandbox
  defined by outside environment, effectively it translates to
  `SandboxMode#DangerFullAccess` for file system (since sandbox configured
  on container level) and configurable `network_access` (either Restricted
  or Enabled by outside environment).
  
  as example you can configure `ExternalSandbox` policy as part of
  `sendUserTurn` v1 app_server API:
  
  ```
   {
              "conversationId": <id>,
              "cwd": <cwd>,
              "approvalPolicy": "never",
              "sandboxPolicy": {
                    "type": ""external-sandbox",
                    "network_access": "enabled"/"restricted"
              },
              "model": <model>,
              "effort": <effort>,
              ....
          }
  ```

  Anton Panasenko · 2025-12-18 17:02:03 -08:00
  3429de21b3
• chore: migrate from Config::load_from_base_config_with_overrides to ConfigBuilder (#8276)

  https://github.com/openai/codex/pull/8235 introduced `ConfigBuilder` and
  this PR updates all call non-test call sites to use it instead of
  `Config::load_from_base_config_with_overrides()`.
  
  This is important because `load_from_base_config_with_overrides()` uses
  an empty `ConfigRequirements`, which is a reasonable default for testing
  so the tests are not influenced by the settings on the host. This method
  is now guarded by `#[cfg(test)]` so it cannot be used by business logic.
  
  Because `ConfigBuilder::build()` is `async`, many of the test methods
  had to be migrated to be `async`, as well. On the bright side, this made
  it possible to eliminate a bunch of `block_on_future()` stuff.

  Michael Bolin · 2025-12-18 16:12:52 -08:00
  3d4ced3ff5
• fix: remove duplicate shell_snapshot FeatureSpec (#8274)

  regression: #8199
  
  Signed-off-by: Koichi Shiraishi <zchee.io@gmail.com>

  Koichi Shiraishi · 2025-12-18 15:55:47 -08:00
  2d9826098e
• fix: change codex/sandbox-state/update from a notification to a request (#8142)

  Historically, `accept_elicitation_for_prompt_rule()` was flaky because
  we were using a notification to update the sandbox followed by a `shell`
  tool request that we expected to be subject to the new sandbox config,
  but because [rmcp](https://crates.io/crates/rmcp) MCP servers delegate
  each incoming message to a new Tokio task, messages are not guaranteed
  to be processed in order, so sometimes the `shell` tool call would run
  before the notification was processed.
  
  Prior to this PR, we relied on a generous `sleep()` between the
  notification and the request to reduce the change of the test flaking
  out.
  
  This PR implements a proper fix, which is to use a _request_ instead of
  a notification for the sandbox update so that we can wait for the
  response to the sandbox request before sending the request to the
  `shell` tool call. Previously, `rmcp` did not support custom requests,
  but I fixed that in
  https://github.com/modelcontextprotocol/rust-sdk/pull/590, which made it
  into the `0.12.0` release (see #8288).
  
  This PR updates `shell-tool-mcp` to expect
  `"codex/sandbox-state/update"` as a _request_ instead of a notification
  and sends the appropriate ack. Note this behavior is tied to our custom
  `codex/sandbox-state` capability, which Codex honors as an MCP client,
  which is why `core/src/mcp_connection_manager.rs` had to be updated as
  part of this PR, as well.
  
  This PR also updates the docs at `shell-tool-mcp/README.md`.

  Michael Bolin · 2025-12-18 15:32:01 -08:00
  46baedd7cb
• Support skills shortDescription. (#8278)

  Allow SKILL.md to specify a more human-readable short description as
  skill metadata.

  xl-openai · 2025-12-18 23:13:18 +00:00
  358a5baba0
• Update system skills bundled with codex-rs (#8253)

  Synced with https://github.com/openai/skills/tree/main/skills/.system

  Gav Verma · 2025-12-18 14:30:00 -08:00
  1cd1cf17c6
• Set exclude to true by default in app server (#8281)
  Andrew Ambrosino · 2025-12-18 14:28:30 -08:00
  9fb9ed6cea
• model list (#8286)

  <img width="200" alt="7ff2254b-e96f-42fc-8232-b4e76cb26248"
  src="https://github.com/user-attachments/assets/1f56799d-e2cd-4b69-9290-854943f7c6b6"
  />

  pakrym-oai · 2025-12-18 14:13:49 -08:00
  8f0b383621
• feat: add support for /etc/codex/requirements.toml on UNIX (#8277)

  This implements the new config design where config _requirements_ are
  loaded separately (and with a special schema) as compared to config
  _settings_. In particular, on UNIX, with this PR, you could define
  `/etc/codex/requirements.toml` with:
  
  ```toml
  allowed_approval_policies = ["never", "on-request"]
  ```
  
  to enforce that `Config.approval_policy` must be one of those two values
  when Codex runs.
  
  We plan to expand the set of things that can be restricted by
  `/etc/codex/requirements.toml` in short order.
  
  Note that requirements can come from several sources:
  
  - new MDM key on macOS (not implemented yet)
  - `/etc/codex/requirements.toml`
  - re-interpretation of legacy MDM key on macOS
  (`com.openai.codex/config_toml_base64`)
  - re-interpretation of legacy `/etc/codex/managed_config.toml`
  
  So our resolution strategy is to load TOML data from those sources, in
  order. Later TOMLs are "merged" into previous TOMLs, but any field that
  is already set cannot be overwritten. See
  `ConfigRequirementsToml::merge_unset_fields()`.

  Michael Bolin · 2025-12-18 13:36:55 -08:00
  2f048f2063
• Terminal Detection Metadata for Per-Terminal Scroll Scaling (#8252)

  # Terminal Detection Metadata for Per-Terminal Scroll Scaling
  
  ## Summary
  Expand terminal detection into structured metadata (`TerminalInfo`) with
  multiplexer awareness, plus a testable environment shim and
  characterization tests.
  
  ## Context / Motivation
  - TUI2 owns its viewport and scrolling model (see
  `codex-rs/tui2/docs/tui_viewport_and_history.md`), so scroll behavior
  must be consistent across terminals and independent of terminal
  scrollback quirks.
  - Prior investigations show mouse wheel scroll deltas vary noticeably by
  terminal. To tune scroll scaling (line increments per wheel tick) we
  need reliable terminal identification, including when running inside
  tmux/zellij.
  - tmux is especially tricky because it can mask the underlying terminal;
  we now consult `tmux display-message` client termtype/name to attribute
  sessions to the actual terminal rather than tmux itself.
  - This remains backwards compatible with the existing OpenTelemetry
  user-agent token because `user_agent()` is still derived from the same
  environment signals (now via `TerminalInfo`).
  
  ## Changes
  - Introduce `TerminalInfo`, `TerminalName`, and `Multiplexer` with
  `TERM_PROGRAM`/`TERM`/multiplexer detection and user-agent formatting in
  `codex-rs/core/src/terminal.rs`.
  - Add an injectable `Environment` trait + `FakeEnvironment` for testing,
  and comprehensive characterization tests covering known terminals, tmux
  client termtype/name, and zellij.
  - Document module usage and detection order; update `terminal_info()` to
  be the primary interface for callers.
  
  ## Testing
  - `cargo test -p codex-core terminal::tests`
  - manually checked ghostty, iTerm2, Terminal.app, vscode, tmux, zellij,
  Warp, alacritty, kitty.
  ```
  2025-12-18T07:07:49.191421Z  INFO Detected terminal info terminal=TerminalInfo { name: Iterm2, term_program: Some("iTerm.app"), version: Some("3.6.6"), term: None, multiplexer: None }
  2025-12-18T07:07:57.991776Z  INFO Detected terminal info terminal=TerminalInfo { name: AppleTerminal, term_program: Some("Apple_Terminal"), version: Some("455.1"), term: None, multiplexer: None }
  2025-12-18T07:08:07.732095Z  INFO Detected terminal info terminal=TerminalInfo { name: WarpTerminal, term_program: Some("WarpTerminal"), version: Some("v0.2025.12.10.08.12.stable_03"), term: None, multiplexer: None }
  2025-12-18T07:08:24.860316Z  INFO Detected terminal info terminal=TerminalInfo { name: Kitty, term_program: None, version: None, term: None, multiplexer: None }
  2025-12-18T07:08:38.302761Z  INFO Detected terminal info terminal=TerminalInfo { name: Alacritty, term_program: None, version: None, term: None, multiplexer: None }
  2025-12-18T07:08:50.887748Z  INFO Detected terminal info terminal=TerminalInfo { name: VsCode, term_program: Some("vscode"), version: Some("1.107.1"), term: None, multiplexer: None }
  2025-12-18T07:10:01.309802Z  INFO Detected terminal info terminal=TerminalInfo { name: WezTerm, term_program: Some("WezTerm"), version: Some("20240203-110809-5046fc22"), term: None, multiplexer: None }
  2025-12-18T08:05:17.009271Z  INFO Detected terminal info terminal=TerminalInfo { name: Ghostty, term_program: Some("ghostty"), version: Some("1.2.3"), term: None, multiplexer: None }
  2025-12-18T08:05:23.819973Z  INFO Detected terminal info terminal=TerminalInfo { name: Ghostty, term_program: Some("ghostty"), version: Some("1.2.3"), term: Some("xterm-ghostty"), multiplexer: Some(Tmux { version: Some("3.6a") }) }
  2025-12-18T08:05:35.572853Z  INFO Detected terminal info terminal=TerminalInfo { name: Ghostty, term_program: Some("ghostty"), version: Some("1.2.3"), term: None, multiplexer: Some(Zellij) }
  ```
  
  ## Notes / Follow-ups
  - Next step is to wire `TerminalInfo` into TUI2’s scroll scaling
  configuration and add a per-terminal tuning table.
  - The log output in TUI2 helps validate real-world detection before
  applying behavior changes.

  Josh McKinney · 2025-12-18 12:50:00 -08:00
  df46ea48a2
• splash screen (#8270)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2025-12-18 10:59:53 -08:00
  7157421daa
• feat: migrate to new constraint-based loading strategy (#8251)

  This is a significant change to how layers of configuration are applied.
  In particular, the `ConfigLayerStack` now has two important fields:
  
  - `layers: Vec<ConfigLayerEntry>`
  - `requirements: ConfigRequirements`
  
  We merge `TomlValue`s across the layers, but they are subject to
  `ConfigRequirements` before creating a `Config`.
  
  How I would review this PR:
  
  - start with `codex-rs/app-server-protocol/src/protocol/v2.rs` and note
  the new variants added to the `ConfigLayerSource` enum:
  `LegacyManagedConfigTomlFromFile` and `LegacyManagedConfigTomlFromMdm`
  - note that `ConfigLayerSource` now has a `precedence()` method and
  implements `PartialOrd`
  - `codex-rs/core/src/config_loader/layer_io.rs` is responsible for
  loading "admin" preferences from `/etc/codex/managed_config.toml` and
  MDM. Because `/etc/codex/managed_config.toml` is now deprecated in favor
  of `/etc/codex/requirements.toml` and `/etc/codex/config.toml`, we now
  include some extra information on the `LoadedConfigLayers` returned in
  `layer_io.rs`.
  - `codex-rs/core/src/config_loader/mod.rs` has major changes to
  `load_config_layers_state()`, which is what produces `ConfigLayerStack`.
  The docstring has the new specification and describes the various layers
  that will be loaded and the precedence order.
  - It uses the information from `LoaderOverrides` "twice," both in the
  spirit of legacy support:
  - We use one instances to derive an instance of `ConfigRequirements`.
  Currently, the only field in `managed_config.toml` that contributes to
  `ConfigRequirements` is `approval_policy`. This PR introduces
  `Constrained::allow_only()` to support this.
  - We use a clone of `LoaderOverrides` to derive
  `ConfigLayerSource::LegacyManagedConfigTomlFromFile` and
  `ConfigLayerSource::LegacyManagedConfigTomlFromMdm` layers, as
  appropriate. As before, this ends up being a "best effort" at enterprise
  controls, but is enforcement is not guaranteed like it is for
  `ConfigRequirements`.
  - Now we only create a "user" layer if `$CODEX_HOME/config.toml` exists.
  (Previously, a user layer was always created for `ConfigLayerStack`.)
  - Similarly, we only add a "session flags" layer if there are CLI
  overrides.
  - `config_loader/state.rs` contains the updated implementation for
  `ConfigLayerStack`. Note the public API is largely the same as before,
  but the implementation is quite different. We leverage the fact that
  `ConfigLayerSource` is now `PartialOrd` to ensure layers are in the
  correct order.
  - A `Config` constructed via `ConfigBuilder.build()` will use
  `load_config_layers_state()` to create the `ConfigLayerStack` and use
  the associated `ConfigRequirements` when constructing the `Config`
  object.
  - That said, a `Config` constructed via
  `Config::load_from_base_config_with_overrides()` does _not_ yet use
  `ConfigBuilder`, so it creates a `ConfigRequirements::default()` instead
  of loading a proper `ConfigRequirements`. I will fix this in a
  subsequent PR.
  
  Then the following files are mostly test changes:
  
  ```
  codex-rs/app-server/tests/suite/v2/config_rpc.rs
  codex-rs/core/src/config/service.rs
  codex-rs/core/src/config_loader/tests.rs
  ```
  
  Again, because we do not always include "user" and "session flags"
  layers when the contents are empty, `ConfigLayerStack` sometimes has
  fewer layers than before (and the precedence order changed slightly),
  which is the main reason integration tests changed.

  Michael Bolin · 2025-12-18 10:06:05 -08:00
  b903285746
• feat: add name to beta features (#8266)

  Add a name to Beta features
  
  <img width="906" height="153" alt="Screenshot 2025-12-18 at 16 42 49"
  src="https://github.com/user-attachments/assets/d56f3519-0613-4d9a-ad4d-38b1a7eb125a"
  />

  jif-oai · 2025-12-18 16:59:46 +00:00
  aea47b6553
• caribou (#8265)

  Welcome caribou
  
  <img width="1536" height="1024" alt="image"
  src="https://github.com/user-attachments/assets/2a67b21f-40cf-4518-aee4-691af331ab50"
  />

  Ahmed Ibrahim · 2025-12-18 08:58:44 -08:00
  f084e5264b
• chore: prefer AsRef<Path> to &Path (#8249)

  This is some minor API cleanup that will make it easier to use
  `AbsolutePathBuf` in more places in a subsequent PR.

  Michael Bolin · 2025-12-18 08:50:13 -08:00
  deafead169
• chores: clean picker (#8232)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2025-12-18 08:41:34 -08:00
  374d591311
• chore: simplify loading of Mac-specific logic in config_loader (#8248)

  Over in `config_loader/macos.rs`, we were doing this complicated `mod`
  thing to expose one version of `load_managed_admin_config_layer()` for
  Mac:
  
  
  https://github.com/openai/codex/blob/580c59aa9af61cb4bffb5b204bd16a5dcc4bc911/codex-rs/core/src/config_loader/macos.rs#L4-L5
  
  While exposing a trivial implementation for non-Mac:
  
  
  https://github.com/openai/codex/blob/580c59aa9af61cb4bffb5b204bd16a5dcc4bc911/codex-rs/core/src/config_loader/macos.rs#L110-L117
  
  That was being used like this:
  
  
  https://github.com/openai/codex/blob/580c59aa9af61cb4bffb5b204bd16a5dcc4bc911/codex-rs/core/src/config_loader/layer_io.rs#L47-L48
  
  This PR simplifies that callsite in `layer_io.rs` to just be:
  
  ```rust
      #[cfg(not(target_os = "macos"))]
      let managed_preferences = None;
  ```
  
  And updates `config_loader/mod.rs` so we only pull in `macos.rs` on Mac:
  
  ```rust
  #[cfg(target_os = "macos")]
  mod macos;
  ```
  
  This simplifies `macos.rs` considerably, though it looks like a big
  change because everything gets unindented and reformatted because we can
  drop the whole `mod native` thing now.
  
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/8248).
  * #8251
  * #8249
  * __->__ #8248

  Michael Bolin · 2025-12-18 07:35:16 -08:00
  9bf41e9262
• chore: add beta features (#8201)
  jif-oai · 2025-12-18 13:09:12 +00:00
  1cfacbf56d
• Reintroduce feature flags for skills. (#8244)

  1. Reintroduce feature flags for skills;
  2. UI tweaks (truncate descriptions, better validation error display).

  xl-openai · 2025-12-18 01:14:11 -08:00
  5c8d22138a
• fix: introduce ConfigBuilder (#8235)

  Introduce `ConfigBuilder` as an alternative to our existing `Config`
  constructors.
  
  I noticed that the existing constructors,
  `Config::load_with_cli_overrides()` and
  `Config::load_with_cli_overrides_and_harness_overrides()`, did not take
  `codex_home` as a parameter, which can be a problem.
  
  Historically, when Codex was purely a CLI, we wanted to be extra sure
  that the creation of `codex_home` was always done via
  `find_codex_home()`, so we did not expose `codex_home` as a parameter
  when creating `Config` in business logic. But in integration tests,
  `codex_home` nearly always needs to be configured (as a temp directory),
  which is why callers would have to go through
  `Config::load_from_base_config_with_overrides()` instead.
  
  Now that the Codex harness also functions as an app server, which could
  conceivably load multiple threads where `codex_home` is parameterized
  differently in each one, I think it makes sense to make this
  configurable. Going to a builder pattern makes it more flexible to
  ensure an arbitrary permutation of options can be set when constructing
  a `Config` while using the appropriate defaults for the options that
  aren't set explicitly.
  
  Ultimately, I think this should make it possible for us to make
  `Config::load_from_base_config_with_overrides()` private because all
  integration tests should be able to leverage `ConfigBuilder` instead.
  Though there could be edge cases, so I'll pursue that migration after we
  get through the current config overhaul.
  
  
  
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/8235).
  * #8237
  * __->__ #8235

  Michael Bolin · 2025-12-17 23:45:09 -08:00
  580c59aa9a
• Support SYSTEM skills. (#8220)

  1. Remove PUBLIC skills and introduce SYSTEM skills embedded in the
  binary and installed into $CODEX_HOME/skills/.system at startup.
  2. Skills are now always enabled (feature flag removed).
  3. Update skills/list to accept forceReload and plumb it through (not
  used by clients yet).

  xl-openai · 2025-12-17 18:48:28 -08:00
  da3869eeb6
• Show migration link (#8228)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2025-12-18 02:03:40 +00:00
  6f102e18c4
• chore: cleanup Config instantiation codepaths (#8226)

  This PR does various types of cleanup before I can proceed with more
  ambitious changes to config loading.
  
  First, I noticed duplicated code across these two methods:
  
  
  https://github.com/openai/codex/blob/774bd9e432fa2e0f4e059e97648cf92216912e19/codex-rs/core/src/config/mod.rs#L314-L324
  
  
  https://github.com/openai/codex/blob/774bd9e432fa2e0f4e059e97648cf92216912e19/codex-rs/core/src/config/mod.rs#L334-L344
  
  This has now been consolidated in
  `load_config_as_toml_with_cli_overrides()`.
  
  Further, I noticed that `Config::load_with_cli_overrides()` took two
  similar arguments:
  
  
  https://github.com/openai/codex/blob/774bd9e432fa2e0f4e059e97648cf92216912e19/codex-rs/core/src/config/mod.rs#L308-L311
  
  The difference between `cli_overrides` and `overrides` was not
  immediately obvious to me. At first glance, it appears that one should
  be able to be expressed in terms of the other, but it turns out that
  some fields of `ConfigOverrides` (such as `cwd` and
  `codex_linux_sandbox_exe`) are, by design, not configurable via a
  `.toml` file or a command-line `--config` flag.
  
  That said, I discovered that many callers of
  `Config::load_with_cli_overrides()` were passing
  `ConfigOverrides::default()` for `overrides`, so I created two separate
  methods:
  
  - `Config::load_with_cli_overrides(cli_overrides: Vec<(String,
  TomlValue)>)`
  - `Config::load_with_cli_overrides_and_harness_overrides(cli_overrides:
  Vec<(String, TomlValue)>, harness_overrides: ConfigOverrides)`
  
  The latter has a long name, as it is _not_ what should be used in the
  common case, so the extra typing is designed to draw attention to this
  fact. I tried to update the existing callsites to use the shorter name,
  where possible.
  
  Further, in the cases where `ConfigOverrides` is used, usually only a
  limited subset of fields are actually set, so I updated the declarations
  to leverage `..Default::default()` where possible.

  Michael Bolin · 2025-12-17 18:01:17 -08:00
  a8797019a1
• feat: model picker (#8209)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2025-12-17 16:12:35 -08:00
  774bd9e432