260 Commits

• chore: rm remote models fflag (#11699)

  rm `remote_models` feature flag.
  
  We see issues like #11527 when a user has `remote_models` disabled, as
  we always use the default fallback `ModelInfo`. This causes issues with
  model performance.
  
  Builds on #11690, which helps by warning the user when they are using
  the default fallback. This PR will make that happen much less frequently
  as an accidental consequence of disabling `remote_models`.

  sayan-oai · 2026-02-17 11:43:16 -08:00
  41800fc876
• Exit early when session initialization fails (#11908)

  Summary
  - wait for the initial session startup loop to finish and handle exit
  before waiting for the first message in fresh sessions
  - propagate AppRunControl::Exit to return immediately when
  initialization fails

  jif-oai · 2026-02-17 11:22:30 +00:00
  5ae84197b2
• tui: preserve remote image attachments across resume/backtrack (#10590)

  ## Summary
  This PR makes app-server-provided image URLs first-class attachments in
  TUI, so they survive resume/backtrack/history recall and are resubmitted
  correctly.
  
  <img width="715" height="491" alt="Screenshot 2026-02-12 at 8 27 08 PM"
  src="https://github.com/user-attachments/assets/226cbd35-8f0c-4e51-a13e-459ef5dd1927"
  />
  
  Can delete the attached image upon backtracking:
  <img width="716" height="301" alt="Screenshot 2026-02-12 at 8 27 31 PM"
  src="https://github.com/user-attachments/assets/4558d230-f1bd-4eed-a093-8e1ab9c6db27"
  />
  
  In both history and composer, remote images are rendered as normal
  `[Image #N]` placeholders, with numbering unified with local images.
  
  ## What changed
  - Plumb remote image URLs through TUI message state:
    - `UserHistoryCell`
    - `BacktrackSelection`
    - `ChatComposerHistory::HistoryEntry`
    - `ChatWidget::UserMessage`
  - Show remote images as placeholder rows inside the composer box (above
  textarea), and in history cells.
  - Support keyboard selection/deletion for remote image rows in composer
  (`Up`/`Down`, `Delete`/`Backspace`).
  - Preserve remote-image-only turns in local composer history (Up/Down
  recall), including restore after backtrack.
  - Ensure submit/queue/backtrack resubmit include remote images in model
  input (`UserInput::Image`), and keep request shape stable for
  remote-image-only turns.
  - Keep image numbering contiguous across remote + local images:
    - remote images occupy `[Image #1]..[Image #M]`
    - local images start at `[Image #M+1]`
    - deletion renumbers consistently.
  - In protocol conversion, increment shared image index for remote images
  too, so mixed remote/local image tags stay in a single sequence.
  - Simplify restore logic to trust in-memory attachment order (no
  placeholder-number parsing path).
  - Backtrack/replay rollback handling now queues trims through
  `AppEvent::ApplyThreadRollback` and syncs transcript overlay/deferred
  lines after trims, so overlay/transcript state stays consistent.
  - Trim trailing blank rendered lines from user history rendering to
  avoid oversized blank padding.
  
  ## Docs + tests
  - Updated: `docs/tui-chat-composer.md` (remote image flow,
  selection/deletion, numbering offsets)
  - Added/updated tests across `tui/src/chatwidget/tests.rs`,
  `tui/src/app.rs`, `tui/src/app_backtrack.rs`, `tui/src/history_cell.rs`,
  and `tui/src/bottom_pane/chat_composer.rs`
  - Added snapshot coverage for remote image composer states, including
  deleting the first of two remote images.
  
  ## Validation
  - `just fmt`
  - `cargo test -p codex-tui`
  
  ## Codex author
  `codex fork 019c2636-1571-74a1-8471-15a3b1c3f49d`

  Charley Cunningham · 2026-02-13 14:54:06 -08:00
  26a7cd21e2
• [apps] Improve app listing filtering. (#11697)

  - [x] If an installed app is not on the app listing, remove it from the
  final list.

  Matthew Zeng · 2026-02-13 11:54:16 -08:00
  8468871e2b
• feat: switch on dying sub-agents (#11477)

  [codex-generated]
  
  ## Updated PR Description (Ready To Paste)
  
  ## Problem
  
  When a sub-agent thread emits `ShutdownComplete`, the TUI switches back
  to the primary thread.
  That was also happening for user-requested exits (for example `Ctrl+C`),
  which could prevent a
  clean app exit and unexpectedly resurrect the main thread.
  
  ## Mental model
  
  The app has one primary thread and one active thread. A non-primary
  active thread shutting down
  usually means "agent died, fail back to primary," but during
  `ExitMode::ShutdownFirst` shutdown
  means "the user is exiting," not "recover this session."
  
  ## Non-goals
  
  No change to thread lifecycle, thread-manager ownership, or shutdown
  protocol wire format.
  No behavioral changes to non-shutdown events.
  
  ## Tradeoffs
  
  This adds a small local marker (`pending_shutdown_exit_thread_id`)
  instead of inferring intent
  from event timing. It is deterministic and simple, but relies on
  correctly setting and clearing
  that marker around exit.
  
  ## Architecture
  
  `App` tracks which thread is intentionally being shut down for exit.
  `active_non_primary_shutdown_target` centralizes failover eligibility
  for `ShutdownComplete` and
  skips failover when shutdown matches the pending-exit thread.
  `handle_active_thread_event` handles non-primary failover before generic
  forwarding and clears the
  pending-exit marker only when the matching active thread completes
  shutdown.
  
  ## Observability
  
  User-facing info/error messages continue to indicate whether failover to
  the main thread succeeded.
  The shutdown-intent path is now explicitly documented inline for easier
  debugging.
  
  ## Tests
  
  Added targeted tests for `active_non_primary_shutdown_target` covering
  non-shutdown events,
  primary-thread shutdown, non-primary shutdown failover, pending exit on
  active thread (no failover),
  and pending exit for another thread (still failover).
  
  Validated with:
  - `cargo test -p codex-tui` (pass)
  
  ---------
  
  Co-authored-by: Josh McKinney <joshka@openai.com>

  jif-oai · 2026-02-13 18:29:03 +00:00
  851fcc377b
• sandbox NUX metrics update (#11667)

  just updating metrics to match the NUX tweaks we made this week.

  iceweasel-oai · 2026-02-13 10:01:47 -08:00
  99466f1f90
• fix: dont show NUX for upgrade-target models that are hidden (#11679)

  dont show NUX for models marked with `visibility:hide`.
  
  Tested locally

  sayan-oai · 2026-02-12 20:29:22 -08:00
  abeafbdca1
• [apps] Add is_enabled to app info. (#11417)

  - [x] Add is_enabled to app info and the response of `app/list`.
  - [x] Update TUI to have Enable/Disable button on the app detail page.

  Matthew Zeng · 2026-02-13 00:30:52 +00:00
  c37560069a
• feat: introduce Permissions (#11633)

  ## Why
  We currently carry multiple permission-related concepts directly on
  `Config` for shell/unified-exec behavior (`approval_policy`,
  `sandbox_policy`, `network`, `shell_environment_policy`,
  `windows_sandbox_mode`).
  
  Consolidating these into one in-memory struct makes permission handling
  easier to reason about and sets up the next step: supporting named
  permission profiles (`[permissions.PROFILE_NAME]`) without changing
  behavior now.
  
  This change is mostly mechanical: it updates existing callsites to go
  through `config.permissions`, but it does not yet refactor those
  callsites to take a single `Permissions` value in places where multiple
  permission fields are still threaded separately.
  
  This PR intentionally **does not** change the on-disk `config.toml`
  format yet and keeps compatibility with legacy config keys.
  
  ## What Changed
  - Introduced `Permissions` in `core/src/config/mod.rs`.
  - Added `Config::permissions` and moved effective runtime permission
  fields under it:
    - `approval_policy`
    - `sandbox_policy`
    - `network`
    - `shell_environment_policy`
    - `windows_sandbox_mode`
  - Updated config loading/building so these effective values are still
  derived from the same existing config inputs and constraints.
  - Updated Windows sandbox helpers/resolution to read/write via
  `permissions`.
  - Threaded the new field through all permission consumers across core
  runtime, app-server, CLI/exec, TUI, and sandbox summary code.
  - Updated affected tests to reference `config.permissions.*`.
  - Renamed the struct/field from
  `EffectivePermissions`/`effective_permissions` to
  `Permissions`/`permissions` and aligned variable naming accordingly.
  
  ## Verification
  - `just fix -p codex-core -p codex-tui -p codex-cli -p codex-app-server
  -p codex-exec -p codex-utils-sandbox-summary`
  - `cargo build -p codex-core -p codex-tui -p codex-cli -p
  codex-app-server -p codex-exec -p codex-utils-sandbox-summary`

  Michael Bolin · 2026-02-12 14:42:54 -08:00
  a4cc1a4a85
• add a slash command to grant sandbox read access to inaccessible directories (#11512)

  There is an edge case where a directory is not readable by the sandbox.
  In practice, we've seen very little of it, but it can happen so this
  slash command unlocks users when it does.
  
  Future idea is to make this a tool that the agent knows about so it can
  be more integrated.

  iceweasel-oai · 2026-02-12 12:48:36 -08:00
  5c3ca73914
• feat(app-server): experimental flag to persist extended history (#11227)

  This PR adds an experimental `persist_extended_history` bool flag to
  app-server thread APIs so rollout logs can retain a richer set of
  EventMsgs for non-lossy Thread > Turn > ThreadItems reconstruction (i.e.
  on `thread/resume`).
  
  ### Motivation
  Today, our rollout recorder only persists a small subset (e.g. user
  message, reasoning, assistant message) of `EventMsg` types, dropping a
  good number (like command exec, file change, etc.) that are important
  for reconstructing full item history for `thread/resume`, `thread/read`,
  and `thread/fork`.
  
  Some clients want to be able to resume a thread without lossiness. This
  lossiness is primarily a UI thing, since what the model sees are
  `ResponseItem` and not `EventMsg`.
  
  ### Approach
  This change introduces an opt-in `persist_full_history` flag to preserve
  those events when you start/resume/fork a thread (defaults to `false`).
  
  This is done by adding an `EventPersistenceMode` to the rollout
  recorder:
  - `Limited` (existing behavior, default)
  - `Extended` (new opt-in behavior)
  
  In `Extended` mode, persist additional `EventMsg` variants needed for
  non-lossy app-server `ThreadItem` reconstruction. We now store the
  following ThreadItems that we didn't before:
  - web search
  - command execution
  - patch/file changes
  - MCP tool calls
  - image view calls
  - collab tool outcomes
  - context compaction
  - review mode enter/exit
  
  For **command executions** in particular, we truncate the output using
  the existing `truncate_text` from core to store an upper bound of 10,000
  bytes, which is also the default value for truncating tool outputs shown
  to the model. This keeps the size of the rollout file and command
  execution items returned over the wire reasonable.
  
  And we also persist `EventMsg::Error` which we can now map back to the
  Turn's status and populates the Turn's error metadata.
  
  #### Updates to EventMsgs
  To truly make `thread/resume` non-lossy, we also needed to persist the
  `status` on `EventMsg::CommandExecutionEndEvent` and
  `EventMsg::PatchApplyEndEvent`. Previously it was not obvious whether a
  command failed or was declined (similar for apply_patch). These
  EventMsgs were never persisted before so I made it a required field.

  Owen Lin · 2026-02-12 19:34:22 +00:00
  efc8d45750
• feat: make sandbox read access configurable with ReadOnlyAccess (#11387)

  `SandboxPolicy::ReadOnly` previously implied broad read access and could
  not express a narrower read surface.
  This change introduces an explicit read-access model so we can support
  user-configurable read restrictions in follow-up work, while preserving
  current behavior today.
  
  It also ensures unsupported backends fail closed for restricted-read
  policies instead of silently granting broader access than intended.
  
  ## What
  
  - Added `ReadOnlyAccess` in protocol with:
    - `Restricted { include_platform_defaults, readable_roots }`
    - `FullAccess`
  - Updated `SandboxPolicy` to carry read-access configuration:
    - `ReadOnly { access: ReadOnlyAccess }`
    - `WorkspaceWrite { ..., read_only_access: ReadOnlyAccess }`
  - Preserved existing behavior by defaulting current construction paths
  to `ReadOnlyAccess::FullAccess`.
  - Threaded the new fields through sandbox policy consumers and call
  sites across `core`, `tui`, `linux-sandbox`, `windows-sandbox`, and
  related tests.
  - Updated Seatbelt policy generation to honor restricted read roots by
  emitting scoped read rules when full read access is not granted.
  - Added fail-closed behavior on Linux and Windows backends when
  restricted read access is requested but not yet implemented there
  (`UnsupportedOperation`).
  - Regenerated app-server protocol schema and TypeScript artifacts,
  including `ReadOnlyAccess`.
  
  ## Compatibility / rollout
  
  - Runtime behavior remains unchanged by default (`FullAccess`).
  - API/schema changes are in place so future config wiring can enable
  restricted read access without another policy-shape migration.

  Michael Bolin · 2026-02-11 18:31:14 -08:00
  abbd74e2be
• Promote Windows Sandbox (#11341)

  1. Move Windows Sandbox NUX to right after trust directory screen
  2. Don't offer read-only as an option in Sandbox NUX.
  Elevated/Legacy/Quit
  3. Don't allow new untrusted directories. It's trust or quit
  4. move experimental sandbox features to `[windows]
  sandbox="elevated|unelevatd"`
  5. Copy tweaks = elevated -> default, non-elevated -> non-admin

  iceweasel-oai · 2026-02-11 11:48:33 -08:00
  87279de434
• Remove test-support feature from codex-core and replace it with explicit test toggles (#11405)

  ## Why
  
  `codex-core` was being built in multiple feature-resolved permutations
  because test-only behavior was modeled as crate features. For a large
  crate, those permutations increase compile cost and reduce cache reuse.
  
  ## Net Change
  
  - Removed the `test-support` crate feature and related feature wiring so
  `codex-core` no longer needs separate feature shapes for test consumers.
  - Standardized cross-crate test-only access behind
  `codex_core::test_support`.
  - External test code now imports helpers from
  `codex_core::test_support`.
  - Underlying implementation hooks are kept internal (`pub(crate)`)
  instead of broadly public.
  
  ## Outcome
  
  - Fewer `codex-core` build permutations.
  - Better incremental cache reuse across test targets.
  - No intended production behavior change.

  Michael Bolin · 2026-02-10 22:44:02 -08:00
  476c1a7160
• tui: queue non-pending rollback trims in app-event order (#11373)

  ## Summary
  
  This PR fixes TUI transcript-sync behavior for
  `EventMsg::ThreadRolledBack` and makes rollback application order
  deterministic.
  
  Previously, rollback handling depended on `pending_rollback`:
  
  - if `pending_rollback` was set (local backtrack), TUI trimmed correctly
  - otherwise, replayed/external rollbacks were either ignored or could be
  applied at the wrong time relative to queued transcript inserts
  
  This change keeps the local backtrack path intact and routes non-pending
  rollbacks through the app event queue so rollback trims are applied in
  FIFO order with transcript cell inserts.
  
  ## What changed
  
  - Added/used `trim_transcript_cells_drop_last_n_user_turns(...)` for
  rollback-by-`num_turns` semantics.
  - Renamed rollback app event:
  - `AppEvent::ApplyReplayedThreadRollback` ->
  `AppEvent::ApplyThreadRollback`
  - Replay path (`ChatWidget`) now emits `ApplyThreadRollback`.
  - Live non-pending rollback path (`App::handle_backtrack_event`) now
  emits `ApplyThreadRollback` instead of trimming immediately.
  - App-level event handler applies `ApplyThreadRollback` after queued
  `InsertHistoryCell` events and schedules redraw only when a trim
  occurred.
  - When a trim occurs with an overlay open, TUI now syncs transcript
  overlay committed cells, clamps backtrack preview selection, and clears
  stale `deferred_history_lines` so closed overlays do not re-append
  rolled-back lines.
  - Clarified inline comments around the `pending_rollback` branch so
  future readers can reason about why there are two paths.
  
  ## Why queueing matters
  
  During resume/replay, transcript cells are populated via queued
  `InsertHistoryCell` app events. If a rollback is applied immediately
  outside that queue, it can run against an incomplete transcript and
  under-trim. Queueing non-pending rollbacks ensures consistent ordering
  and correct final transcript state.
  
  ## Behavior by rollback source
  
  - `pending_rollback = Some(...)` (local backtrack requested by this
  TUI):
    - use `finish_pending_backtrack()` and the stored selection boundary
  - `pending_rollback = None` (replay/external/non-local rollback):
  - enqueue `AppEvent::ApplyThreadRollback { num_turns }` and trim in
  app-event order
  
  ## Tests
  
  Added/updated tests covering ordering and semantics:
  
  -
  `app_backtrack::tests::trim_drop_last_n_user_turns_applies_rollback_semantics`
  - `app_backtrack::tests::trim_drop_last_n_user_turns_allows_overflow`
  - `app::tests::replayed_initial_messages_apply_rollback_in_queue_order`
  -
  `app::tests::live_rollback_during_replay_is_applied_in_app_event_order`
  -
  `app::tests::queued_rollback_syncs_overlay_and_clears_deferred_history`
  - `chatwidget::tests::replayed_thread_rollback_emits_ordered_app_event`
  
  Validation run:
  
  - `just fmt`
  - `cargo test -p codex-tui`

  Charley Cunningham · 2026-02-10 18:53:43 -08:00
  8b46c0ce00
• fix: reduce usage of open_if_present (#11344)
  jif-oai · 2026-02-10 19:25:07 +00:00
  847a6092e6
• [apps] Improve app installation flow. (#11249)

  - [x] Add buttons to start the installation flow and verify installation
  completes.
  - [x] Hard refresh apps list when the /apps view opens.

  Matthew Zeng · 2026-02-10 17:59:43 +00:00
  48e415bdef
• feat: retain NetworkProxy, when appropriate (#11207)

  As of this PR, `SessionServices` retains a
  `Option<StartedNetworkProxy>`, if appropriate.
  
  Now the `network` field on `Config` is `Option<NetworkProxySpec>`
  instead of `Option<NetworkProxy>`.
  
  Over in `Session::new()`, we invoke `NetworkProxySpec::start_proxy()` to
  create the `StartedNetworkProxy`, which is a new struct that retains the
  `NetworkProxy` as well as the `NetworkProxyHandle`. (Note that `Drop` is
  implemented for `NetworkProxyHandle` to ensure the proxies are shutdown
  when it is dropped.)
  
  The `NetworkProxy` from the `StartedNetworkProxy` is threaded through to
  the appropriate places.
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/11207).
  * #11285
  * __->__ #11207

  Michael Bolin · 2026-02-10 02:09:23 -08:00
  44ebf4588f
• fix: do not show closed agents in /agent (#11175)
  jif-oai · 2026-02-09 11:25:31 +00:00
  13de744296
• [apps] Improve app loading. (#10994)

  There are two concepts of apps that we load in the harness:
  
  - Directory apps, which is all the apps that the user can install.
  - Accessible apps, which is what the user actually installed and can be
  $ inserted and be used by the model. These are extracted from the tools
  that are loaded through the gateway MCP.
  
  Previously we wait for both sets of apps before returning the full apps
  list. Which causes many issues because accessible apps won't be
  available to the UI or the model if directory apps aren't loaded or
  failed to load.
  
  In this PR we are separating them so that accessible apps can be loaded
  separately and are instantly available to be shown in the UI and to be
  provided in model context. We also added an app-server event so that
  clients can subscribe to also get accessible apps without being blocked
  on the full app list.
  
  - [x] Separate accessible apps and directory apps loading.
  - [x] `app/list` request will also emit `app/list/updated` notifications
  that app-server clients can subscribe. Which allows clients to get
  accessible apps list to render in the $ menu without being blocked by
  directory apps.
  - [x] Cache both accessible and directory apps with 1 hour TTL to avoid
  reloading them when creating new threads.
  - [x] TUI improvements to redraw $ menu and /apps menu when app list is
  updated.

  Matthew Zeng · 2026-02-08 15:24:56 -08:00
  45b7763c3f
• Defer persistence of rollout file (#11028)

  - Defer rollout persistence for fresh threads (`InitialHistory::New`):
  keep rollout events in memory and only materialize rollout file + state
  DB row on first `EventMsg::UserMessage`.
  - Keep precomputed rollout path available before materialization.
  - Change `thread/start` to build thread response from live config
  snapshot and optional precomputed path.
  - Improve pre-materialization behavior in app-server/TUI: clearer
  invalid-request errors for file-backed ops and a friendlier `/fork` “not
  ready yet” UX.
  - Update tests to match deferred semantics across
  start/read/archive/unarchive/fork/resume/review flows.
  - Improved resilience of user_shell test, which should be unrelated to
  this change but must be affected by timing changes
  
  For Reviewers:
  * The primary change is in recorder.rs
  * Most of the other changes were to fix up broken assumptions in
  existing tests
  
  Testing:
  * Manually tested CLI
  * Exercised app server paths by manually running IDE Extension with
  rebuilt CLI binary
  * Only user-visible change is that `/fork` in TUI generates visible
  error if used prior to first turn

  Eric Traut · 2026-02-07 23:05:03 -08:00
  b3de6c7f2b
• add originator to otel (#10826)
  alexsong-oai · 2026-02-06 15:13:56 -08:00
  daeef06bec
• Add analytics for /rename and /fork (#10655)
  pap-openai · 2026-02-05 20:18:29 +00:00
  529b539564
• fix(auth): isolate chatgptAuthTokens concept to auth manager and app-server (#10423)

  So that the rest of the codebase (like TUI) don't need to be concerned
  whether ChatGPT auth was handled by Codex itself or passed in via
  app-server's external auth mode.

  Owen Lin · 2026-02-05 10:46:06 -08:00
  3582b74d01
• feat(tui): add /statusline command for interactive status line configuration (#10546)

  ## Summary
  - Adds a new `/statusline` command to configure TUI footer status line
  - Introduces reusable `MultiSelectPicker` component with keyboard
  navigation, optional ordering and toggle support
  - Implement status line setup modal that persist configuration to
  config.toml
  
    ## Status Line Items
    The following items can be displayed in the status line:
    - **Model**: Current model name (with optional reasoning level)
    - **Context**: Remaining/used context window percentage
    - **Rate Limits**: 5-day and weekly usage limits
    - **Git**: Current branch (with optimized lookups)
    - **Tokens**: Used tokens, input/output token counts
    - **Session**: Session ID (full or shortened prefix)
    - **Paths**: Current directory, project root
    - **Version**: Codex version
  
    ## Features
    - Live preview while configuring status line items
    - Fuzzy search filtering in the picker
    - Intelligent truncation when items don't fit
    - Items gracefully omit when data is unavailable
    - Configuration persists to `config.toml`
    - Validates and warns about invalid status line items
  
    ## Test plan
    - [x] Run `/statusline` and verify picker UI appears
    - [x] Toggle items on/off and verify live preview updates
    - [x] Confirm selection persists after restart
    - [x] Verify truncation behavior with many items selected
    - [x] Test git branch detection in and out of git repos
  
  ---------
  
  Co-authored-by: Josh McKinney <joshka@openai.com>

  Felipe Coury · 2026-02-05 08:50:21 -08:00
  b0e5a6305b
• adding fork information (UI) when forking (#10246)

  - shows `/fork` command that ran in prev session
  - shows `session forked from name (uuid) || uuid (if name is not set)` as an event in new session

  pap-openai · 2026-02-05 13:24:55 +00:00
  b2424cb635
• add none personality option (#10688)

  - add none personality enum value and empty placeholder behavior\n- add
  docs/schema updates and e2e coverage

  Ahmed Ibrahim · 2026-02-04 15:40:33 -08:00
  f9c38f531c
• feat(tui): pace catch-up stream chunking with hysteresis (#10461)

  ## Summary
  - preserve baseline streaming behavior (smooth mode still commits one
  line per 50ms tick)
  - extract adaptive chunking policy and commit-tick orchestration from
  ChatWidget into `streaming/chunking.rs` and `streaming/commit_tick.rs`
  - add hysteresis-based catch-up behavior with bounded batch draining to
  reduce queue lag without bursty single-frame jumps
  - document policy behavior, tuning guidance, and debug flow in rustdoc +
  docs
  
  ## Testing
  - just fmt
  - cargo test -p codex-tui

  Josh McKinney · 2026-02-03 15:01:51 -08:00
  aec58ac29b
• chore: nuke chat/completions API (#10157)
  jif-oai · 2026-02-03 11:31:57 +00:00
  d2394a2494
• emit a separate metric when the user cancels UAT during elevated setup (#10399)

  Currently this shows up as elevated setup failure, which isn't quite
  accurate.

  iceweasel-oai · 2026-02-02 15:31:08 -08:00
  a5066bef78
• Add credits tooltip (#10274)
  pakrym-oai · 2026-02-02 10:06:43 -08:00
  9d976962ec
• chore(config) Rename config setting to personality (#10314)

  ## Summary
  Let's make the setting name consistent with the SlashCommand!
  
  ## Testing
  - [x] Updated tests

  Dylan Hurd · 2026-01-31 19:38:06 -08:00
  a33fa4bfe5
• fix: update file search directory when session CWD changes (#9279)

  ## Summary
  
  Fixes #9041
  
  - Adds update_search_dir() method to FileSearchManager to allow updating
  the search directory after initialization
  - Calls this method when the session CWD changes: new session, resume,
  or fork
  
  ## Problem
  
  The FileSearchManager was created once with the initial search_dir and
  never updated. When a user:
  
  1. Starts Codex in a non-git directory (e.g., /tmp/random)
  2. Resumes or forks a session from a different workspace
  3. The @filename lookup still searched the original directory
  
  This caused no matches to be returned even when files existed in the
  current workspace.
  
  ## Solution
  
  Update FileSearchManager.search_dir whenever the session working
  directory changes:
  - AppEvent::NewSession: Use current config CWD
  - SessionSelection::Resume: Use resumed session CWD
  - SessionSelection::Fork: Use forked session CWD
  
  ## Test plan
  
  - [ ] Start Codex in /tmp/test-dir (non-git)
  - [ ] Resume a session from a project with actual files
  - [ ] Verify @filename returns matches from the resumed session
  directory
  
  ---------
  
  Co-authored-by: Eric Traut <etraut@openai.com>

  Yuvraj Angad Singh · 2026-01-30 14:59:20 -08:00
  13e85b1549
• Fix deploy (#10251)

  Fix
  https://github.com/openai/codex/actions/runs/21527697445/job/62035898666

  Charley Cunningham · 2026-01-30 11:57:13 -08:00
  2457bb3c40
• feat: refactor CodexAuth so invalid state cannot be represented (#10208)

  Previously, `CodexAuth` was defined as follows:
  
  
  https://github.com/openai/codex/blob/d550fbf41afc09d7d7b5ac813aea38de07b2a73f/codex-rs/core/src/auth.rs#L39-L46
  
  But if you looked at its constructors, we had creation for
  `AuthMode::ApiKey` where `storage` was built using a nonsensical path
  (`PathBuf::new()`) and `auth_dot_json` was `None`:
  
  
  https://github.com/openai/codex/blob/d550fbf41afc09d7d7b5ac813aea38de07b2a73f/codex-rs/core/src/auth.rs#L212-L220
  
  By comparison, when `AuthMode::ChatGPT` was used, `api_key` was always
  `None`:
  
  
  https://github.com/openai/codex/blob/d550fbf41afc09d7d7b5ac813aea38de07b2a73f/codex-rs/core/src/auth.rs#L665-L671
  
  https://github.com/openai/codex/pull/10012 took things further because
  it introduced a new `ChatgptAuthTokens` variant to `AuthMode`, which is
  important in when invoking `account/login/start` via the app server, but
  most logic _internal_ to the app server should just reason about two
  `AuthMode` variants: `ApiKey` and `ChatGPT`.
  
  This PR tries to clean things up as follows:
  
  - `LoginAccountParams` and `AuthMode` in `codex-rs/app-server-protocol/`
  both continue to have the `ChatgptAuthTokens` variant, though it is used
  exclusively for the on-the-wire messaging.
  - `codex-rs/core/src/auth.rs` now has its own `AuthMode` enum, which
  only has two variants: `ApiKey` and `ChatGPT`.
  - `CodexAuth` has been changed from a struct to an enum. It is a
  disjoint union where each variant (`ApiKey`, `ChatGpt`, and
  `ChatGptAuthTokens`) have only the associated fields that make sense for
  that variant.
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/10208).
  * #10224
  * __->__ #10208

  Michael Bolin · 2026-01-30 09:33:23 -08:00
  377ab0c77c
• Conversation naming (#8991)

  Session renaming:
  - `/rename my_session`
  - `/rename` without arg and passing an argument in `customViewPrompt`
  - AppExitInfo shows resume hint using the session name if set instead of
  uuid, defaults to uuid if not set
  - Names are stored in `CODEX_HOME/sessions.jsonl`
  
  Session resuming:
  - codex resume <name> lookup for `CODEX_HOME/sessions.jsonl` first entry
  matching the name and resumes the session
  
  ---------
  
  Co-authored-by: jif-oai <jif@openai.com>

  pap-openai · 2026-01-30 10:40:09 +00:00
  1ef5455eb6
• feat(tui): route employee feedback follow-ups to internal link (#10198)

  ## Problem
  OpenAI employees were sent to the public GitHub issue flow after
  `/feedback`, which is the wrong follow-up path internally.
  
  ## Mental model
  After feedback upload completes, we render a follow-up link/message.
  That link should be audience-aware but must not change the upload
  pipeline itself.
  
  ## Non-goals
  - Changing how feedback is captured or uploaded
  - Changing external user behavior
  
  ## Tradeoffs
  We detect employees via the authenticated account email suffix
  (`@openai.com`). If the email is unavailable (e.g., API key auth), we
  default to the external behavior.
  
  ## Architecture
  - Introduce `FeedbackAudience` and thread it from `App` -> `ChatWidget`
  -> `FeedbackNoteView`
  - Gate internal messaging/links on `FeedbackAudience::OpenAiEmployee`
  - Internal follow-up link is now `http://go/codex-feedback-internal`
  - External GitHub URL remains byte-for-byte identical
  
  ## Observability
  No new telemetry; this only changes rendered follow-up instructions.
  
  ## Tests
  - `just fmt`
  - `cargo test -p codex-tui --lib`

  Josh McKinney · 2026-01-30 02:12:46 +00:00
  36f2fe8af9
• [connectors] Support connectors part 2 - slash command and tui (#9728)

  - [x] Support `/apps` slash command to browse the apps in tui.
  - [x] Support inserting apps to prompt using `$`.
  - [x] Lots of simplification/renaming from connectors to apps.

  Matthew Zeng · 2026-01-28 19:51:58 -08:00
  b9cd089d1f
• Added tui.notifications_method config option (#10043)

  This PR adds a new `tui.notifications_method` config option that accepts
  values of "auto", "osc9" and "bel". It defaults to "auto", which
  attempts to auto-detect whether the terminal supports OSC 9 escape
  sequences and falls back to BEL if not.
  
  The PR also removes the inconsistent handling of notifications on
  Windows when WSL was used.

  Eric Traut · 2026-01-28 12:00:32 -08:00
  147e7118e0
• allow elevated sandbox to be enabled without base experimental flag (#10028)

  elevated flag = elevated sandbox
  experimental flag = non-elevated sandbox
  both = elevated

  iceweasel-oai · 2026-01-28 11:38:29 -08:00
  66de985e4e
• file-search: improve file query perf (#9939)

  switch nucleo-matcher for nucleo and use a "file search session" w/ live
  updating query instead of a single hermetic run per query.

  Jeremy Rose · 2026-01-28 10:54:43 -08:00
  b8156706e6
• error code/msg details for failed elevated setup (#9941)
  iceweasel-oai · 2026-01-27 23:06:10 -08:00
  9f79365691
• Clarify external editor env var message (#10030)

  ### Motivation
  - Improve UX by making it explicit that `VISUAL`/`EDITOR` must be set
  before launching Codex, not during a running session.
  
  ### Description
  - Update the external editor error text in `codex-rs/tui/src/app.rs` to:
  `"Cannot open external editor: set $VISUAL or $EDITOR before starting
  Codex."` and run `just fmt` to apply formatting.
  
  ### Testing
  - Ran `just fmt` successfully; attempted `cargo test -p codex-tui` but
  it failed due to network errors when fetching git dependencies (tests
  did not complete).
  
  ------
  [Codex
  Task](https://chatgpt.com/codex/tasks/task_i_6972c2c984948329b1a37d5c5839aff3)

  Josh McKinney · 2026-01-27 13:29:55 -08:00
  3ae966edd8
• remove sandbox globals. (#9797)

  Threads sandbox updates through OverrideTurnContext for active turn
  Passes computed sandbox type into safety/exec

  iceweasel-oai · 2026-01-27 11:04:23 -08:00
  c40ad65bd8
• NIT larger buffer (#9957)
  jif-oai · 2026-01-27 01:26:55 +00:00
  5d13427ef4
• fix: try to fix freezes 2 (#9951)

  Fixes a TUI freeze caused by awaiting `mpsc::Sender::send()` that blocks
  the tokio thread, stopping the consumption runtime and creating a
  deadlock. This could happen if the server was producing enough chunks to
  fill the `mpsc` fast enough. To solve this we try on insert using a
  `try_send()` (not requiring an `await`) and delegate to a tokio task if
  this does not work
  
  This is a temporary solution as it can contain races for delta elements
  and a stronger design should come here

  jif-oai · 2026-01-27 01:02:22 +00:00
  73bd84dee0
• Fix up config disabled err msg (#9916)

  **Before:**
  <img width="745" height="375" alt="image"
  src="https://github.com/user-attachments/assets/d6c23562-b87f-4af9-8642-329aab8e594d"
  />
  
  **After:**
  <img width="1042" height="354" alt="image"
  src="https://github.com/user-attachments/assets/c9a2413c-c945-4c34-8b7e-c6c9b8fbf762"
  />
  
  Two changes:
  1. only display if there is a `config.toml` that is skipped (i.e. if
  there is just `.codex/skills` but no `.codex/config.toml` we do not
  display the error)
  2. clarify the implications and the fix in the error message.

  gt-oai · 2026-01-26 17:49:31 +00:00
  6316e57497
• feat: rebase multi-agent tui on config_snapshot (#9818)
  jif-oai · 2026-01-26 10:18:47 +00:00
  c66662c61b
• feat(tui) /personality (#9718)

  ## Summary
  Adds /personality selector in the TUI, which leverages the new core
  interface in #9644
  
  Notes:
  - We are doing some of our own state management for model_info loading
  here, but not sure if that's ideal. open to opinions on simpler
  approach, but would like to avoid blocking on a larger refactor
  - Right now, the `/personality` selector just hides when the model
  doesn't support it. we can update this behavior down the line
  
  ## Testing
  - [x] Tested locally
  - [x] Added snapshot tests

  Dylan Hurd · 2026-01-25 21:59:42 -08:00
  031bafd1fb
• Use collaboration mode masks without mutating base settings (#9806)

  Keep an unmasked base collaboration mode and apply the active mask on
  demand. Simplify the TUI mask helpers and update tests/docs to match the
  mask contract.

  Ahmed Ibrahim · 2026-01-25 07:35:31 +00:00
  58450ba2a1