193 Commits

• feat: add auth login diagnostics (#13797)

  ## Problem
  
  Browser login failures historically leave support with an incomplete
  picture. HARs can show that the browser completed OAuth and reached the
  localhost callback, but they do not explain why the native client failed
  on the final `/oauth/token` exchange. Direct `codex login` also relied
  mostly on terminal stderr and the browser error page, so even when the
  login crate emitted better sign-in diagnostics through TUI or app-server
  flows, the one-shot CLI path still did not leave behind an easy artifact
  to collect.
  
  ## Mental model
  
  This implementation treats the browser page, the returned `io::Error`,
  and the normal structured log as separate surfaces with different safety
  requirements. The browser page and returned error preserve the detail
  that operators need to diagnose failures. The structured log stays
  narrower: it records reviewed lifecycle events, parsed safe fields, and
  redacted transport errors without becoming a sink for secrets or
  arbitrary backend bodies.
  
  Direct `codex login` now adds a fourth support surface: a small
  file-backed log at `codex-login.log` under the configured `log_dir`.
  That artifact carries the same login-target events as the other
  entrypoints without changing the existing stderr/browser UX.
  
  ## Non-goals
  
  This does not add auth logging to normal runtime requests, and it does
  not try to infer precise transport root causes from brittle string
  matching. The scope remains the browser-login callback flow in the
  `login` crate plus a direct-CLI wrapper that persists those events to
  disk.
  
  This also does not try to reuse the TUI logging stack wholesale. The TUI
  path initializes feedback, OpenTelemetry, and other session-oriented
  layers that are useful for an interactive app but unnecessary for a
  one-shot login command.
  
  ## Tradeoffs
  
  The implementation favors fidelity for caller-visible errors and
  restraint for persistent logs. Parsed JSON token-endpoint errors are
  logged safely by field. Non-JSON token-endpoint bodies remain available
  to the returned error so CLI and browser surfaces still show backend
  detail. Transport errors keep their real `reqwest` message, but attached
  URLs are surgically redacted. Custom issuer URLs are sanitized before
  logging.
  
  On the CLI side, the code intentionally duplicates a narrow slice of the
  TUI file-logging setup instead of sharing the full initializer. That
  keeps `codex login` easy to reason about and avoids coupling it to
  interactive-session layers that the command does not need.
  
  ## Architecture
  
  The core auth behavior lives in `codex-rs/login/src/server.rs`. The
  callback path now logs callback receipt, callback validation,
  token-exchange start, token-exchange success, token-endpoint non-2xx
  responses, and transport failures. App-server consumers still use this
  same login-server path via `run_login_server(...)`, so the same
  instrumentation benefits TUI, Electron, and VS Code extension flows.
  
  The direct CLI path in `codex-rs/cli/src/login.rs` now installs a small
  file-backed tracing layer for login commands only. That writes
  `codex-login.log` under `log_dir` with login-specific targets such as
  `codex_cli::login` and `codex_login::server`.
  
  ## Observability
  
  The main signals come from the `login` crate target and are
  intentionally scoped to sign-in. Structured logs include redacted issuer
  URLs, redacted transport errors, HTTP status, and parsed token-endpoint
  fields when available. The callback-layer log intentionally avoids
  `%err` on token-endpoint failures so arbitrary backend bodies do not get
  copied into the normal log file.
  
  Direct `codex login` now leaves a durable artifact for both failure and
  success cases. Example output from the new file-backed CLI path:
  
  Failing callback:
  
  ```text
  2026-03-06T22:08:54.143612Z  INFO codex_cli::login: starting browser login flow
  2026-03-06T22:09:03.431699Z  INFO codex_login::server: received login callback path=/auth/callback has_code=false has_state=true has_error=true state_valid=true
  2026-03-06T22:09:03.431745Z  WARN codex_login::server: oauth callback returned error error_code="access_denied" has_error_description=true
  ```
  
  Succeeded callback and token exchange:
  
  ```text
  2026-03-06T22:09:14.065559Z  INFO codex_cli::login: starting browser login flow
  2026-03-06T22:09:36.431678Z  INFO codex_login::server: received login callback path=/auth/callback has_code=true has_state=true has_error=false state_valid=true
  2026-03-06T22:09:36.436977Z  INFO codex_login::server: starting oauth token exchange issuer=https://auth.openai.com/ redirect_uri=http://localhost:1455/auth/callback
  2026-03-06T22:09:36.685438Z  INFO codex_login::server: oauth token exchange succeeded status=200 OK
  ```
  
  ## Tests
  
  - `cargo test -p codex-login`
  - `cargo clippy -p codex-login --tests -- -D warnings`
  - `cargo test -p codex-cli`
  - `just bazel-lock-update`
  - `just bazel-lock-check`
  - manual direct `codex login` smoke tests for both a failing callback
  and a successful browser login
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Josh McKinney · 2026-03-06 15:00:37 -08:00
  4e68fb96e2
• Clarify js_repl image emission and encoding guidance (#13639)

  ## Summary
  
  This updates the `js_repl` prompt and docs to make the image guidance
  less confusing.
  
  ## What changed
  
  - Clarified that `codex.emitImage(...)` adds one image per call and can
  be called multiple times to emit multiple images.
  - Reworded the image-encoding guidance to be general `js_repl` advice
  instead of `ImageDetailOriginal`-specific behavior.
  - Updated the guidance to recommend JPEG at about quality 85 when lossy
  compression is acceptable, and PNG when transparency or lossless detail
  matters.
  - Mirrored the same wording in the public `js_repl` docs.

  Curtis 'Fjord' Hawthorne · 2026-03-05 16:02:37 -08:00
  1ed542bf31
• Harden js_repl emitImage to accept only data: URLs (#13507)

  ### Motivation
  
  - Prevent untrusted js_repl code from supplying arbitrary external URLs
  that the host would forward into model input and cause external fetches
  / data exfiltration. This change narrows the emitImage contract to safe,
  self-contained data URLs.
  
  ### Description
  
  - Kernel: added `normalizeEmitImageUrl` and enforce that string-valued
  `codex.emitImage(...)` inputs and `input_image`/content-item paths only
  accept non-empty `data:` URLs; byte-based paths still produce data URLs
  as before (`kernel.js`).
  - Host: added `validate_emitted_image_url` and check `EmitImage`
  requests before creating `FunctionCallOutputContentItem::InputImage`,
  returning an error to the kernel if the URL is not a `data:` URL
  (`mod.rs`).
  - Tests/docs: added a runtime test
  `js_repl_emit_image_rejects_non_data_url` to assert rejection of
  non-data URLs and updated user-facing docs/instruction text to state
  `data URL` support instead of generic direct image URLs (`mod.rs`,
  `docs/js_repl.md`, `project_doc.rs`).
  
  ### Testing
  
  - Ran `just fmt` in `codex-rs`; it completed successfully.
  - Added a runtime test (`cargo test -p codex-core
  js_repl_emit_image_rejects_non_data_url`) but executing the test in this
  environment failed due to a missing system dependency required by
  `codex-linux-sandbox` (the vendored `bubblewrap` build requires
  `libcap.pc` via `pkg-config`), so the test could not be run here.
  - Attempted a focused `cargo test` invocation with and without default
  features; both compile/test attempts were blocked by the same missing
  system `libcap` dependency in this environment.
  
  ------
  [Codex
  Task](https://chatgpt.com/codex/tasks/task_i_69a7837bce98832d91db92d5f76d6cbe)

  Curtis 'Fjord' Hawthorne · 2026-03-05 12:12:32 -08:00
  cfbbbb1dda
• Persist initialized js_repl bindings after failed cells (#13482)

  ## Summary
  
  - Change `js_repl` failed-cell persistence so later cells keep prior
  bindings plus only the current-cell bindings whose initialization
  definitely completed before the throw.
  - Preserve initialized lexical bindings across failed cells via
  module-namespace readability, including top-level destructuring that
  partially succeeds before a later throw.
  - Preserve hoisted `var` and `function` bindings only when execution
  clearly reached their declaration site, and preserve direct top-level
  pre-declaration `var` writes and updates through explicit write-site
  markers.
  - Preserve top-level `for...in` / `for...of` `var` bindings when the
  loop body executes at least once, using a first-iteration guard to avoid
  per-iteration bookkeeping overhead.
  - Keep prior module state intact across link-time failures and
  evaluation failures before the prelude runs, while still allowing failed
  cells that already recreated prior bindings to persist updates to those
  existing bindings.
  - Hide internal commit hooks from user `js_repl` code after the prelude
  aliases them, so snippets cannot spoof committed bindings by calling the
  raw `import.meta` hooks directly.
  - Add focused regression coverage for the supported failed-cell
  behaviors and the intentionally unsupported boundaries.
  - Update `js_repl` docs and generated instructions to describe the new,
  narrower failed-cell persistence model.
  
  ## Motivation
  
  We saw `js_repl` drop bindings that had already been initialized
  successfully when a later statement in the same cell threw, for example:
  
      const { context: liveContext, session } =
        await initializeGoogleSheetsLiveForTab(tab);
      // later statement throws
  
  That was surprising in practice because successful earlier work
  disappeared from the next cell.
  
  This change makes failed-cell persistence more useful without trying to
  model every possible partially executed JavaScript edge case. The
  resulting behavior is narrower and easier to reason about:
  
  - prior bindings are always preserved
  - lexical bindings persist when their initialization completed before
  the throw
  - hoisted `var` / `function` bindings persist only when execution
  clearly reached their declaration or a supported top-level `var` write
  site
  - failed cells that already recreated prior bindings can persist writes
  to those existing bindings even if they introduce no new bindings
  
  The detailed edge-case matrix stays in `docs/js_repl.md`. The
  model-facing `project_doc` guidance is intentionally shorter and focused
  on generation-relevant behavior.
  
  ## Supported Failed-Cell Behavior
  
  - Prior bindings remain available after a failed cell.
  - Initialized lexical bindings remain available after a failed cell.
  - Top-level destructuring like `const { a, b } = ...` preserves names
  whose initialization completed before a later throw.
  - Hoisted `function` bindings persist when execution reached the
  declaration statement before the throw.
  - Direct top-level pre-declaration `var` writes and updates persist, for
  example:
    - `x = 1`
    - `x += 1`
    - `x++`
  - short-circuiting logical assignments only persist when the write
  branch actually runs
  - Non-empty top-level `for...in` / `for...of` `var` loops persist their
  loop bindings.
  - Failed cells can persist updates to existing carried bindings after
  the prelude has run, even when the cell commits no new bindings.
  - Link failures and eval failures before the prelude do not poison
  `@prev`.
  
  ## Intentionally Unsupported Failed-Cell Cases
  
  - Hoisted function reads before the declaration, such as `foo(); ...;
  function foo() {}`
  - Aliasing or inference-based recovery from reads before declaration
  - Nested writes inside already-instrumented assignment RHS expressions
  - Destructuring-assignment recovery for hoisted `var`
  - Partial `var` destructuring recovery
  - Pre-declaration `undefined` reads for hoisted `var`
  - Empty top-level `for...in` / `for...of` loop vars
  - Nested or scope-sensitive pre-declaration `var` writes outside direct
  top-level expression statements

  Curtis 'Fjord' Hawthorne · 2026-03-05 11:01:46 -08:00
  657841e7f5
• [js_repl] Support local ESM file imports (#13437)

  ## Summary
  - add `js_repl` support for dynamic imports of relative and absolute
  local ESM `.js` / `.mjs` files
  - keep bare package imports on the native Node path and resolved from
  REPL-global search roots (`CODEX_JS_REPL_NODE_MODULE_DIRS`, then `cwd`),
  even when they originate from imported local files
  - restrict static imports inside imported local files to other local
  relative/absolute `.js` / `.mjs` files, and surface a clear error for
  unsupported top-level static imports in the REPL cell
  - run imported local files inside the REPL VM context so they can access
  `codex.tmpDir`, `codex.tool`, captured `console`, and Node-like
  `import.meta` helpers
  - reload local files between execs so later `await import("./file.js")`
  calls pick up edits and fixed failures, while preserving package/builtin
  caching and persistent top-level REPL bindings
  - make `import.meta.resolve()` self-consistent by allowing the returned
  `file://...` URLs to round-trip through `await import(...)`
  - update both public and injected `js_repl` docs to clarify the narrowed
  contract, including global bare-import resolution behavior for local
  absolute files
  
  ## Testing
  - `cargo test -p codex-core js_repl_`
  - built codex binary and verified behavior
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  aaronl-openai · 2026-03-04 22:40:31 -08:00
  ff0341dc94
• Make js_repl image output controllable (#13331)

  ## Summary
  
  Instead of always adding inner function call outputs to the model
  context, let js code decide which ones to return.
  
  - Stop auto-hoisting nested tool outputs from `codex.tool(...)` into the
  outer `js_repl` function output.
  - Keep `codex.tool(...)` return values unchanged as structured JS
  objects.
  - Add `codex.emitImage(...)` as the explicit path for attaching an image
  to the outer `js_repl` function output.
  - Support emitting from a direct image URL, a single `input_image` item,
  an explicit `{ bytes, mimeType }` object, or a raw tool response object
  containing exactly one image.
  - Preserve existing `view_image` original-resolution behavior when JS
  emits the raw `view_image` tool result.
  - Suppress the special `ViewImageToolCall` event for `js_repl`-sourced
  `view_image` calls so nested inspection stays side-effect free until JS
  explicitly emits.
  - Update the `js_repl` docs and generated project instructions with both
  recommended patterns:
    - `await codex.emitImage(codex.tool("view_image", { path }))`
  - `await codex.emitImage({ bytes: await page.screenshot({ type: "jpeg",
  quality: 85 }), mimeType: "image/jpeg" })`
  
  #### [git stack](https://github.com/magus/git-stack-cli)
  - ✅ `1` https://github.com/openai/codex/pull/13050
  - 👉 `2` https://github.com/openai/codex/pull/13331
  - ⏳ `3` https://github.com/openai/codex/pull/13049

  Curtis 'Fjord' Hawthorne · 2026-03-03 16:25:59 -08:00
  c4cb594e73
• tui: preserve kill buffer across submit and slash-command clears (#12006)

  ## Problem
  
  Before this change, composer paths that cleared the textarea after
  submit or slash-command dispatch
  also cleared the textarea kill buffer. That meant a user could `Ctrl+K`
  part of a draft, trigger a
  composer action that cleared the visible draft, and then lose the
  ability to `Ctrl+Y` the killed
  text back.
  
  This was especially awkward for workflows where the user wants to
  temporarily remove text, run a
  composer action such as changing reasoning level or dispatching a slash
  command, and then restore
  the killed text into the now-empty draft.
  
  ## Mental model
  
  This change separates visible draft state from editing-history state.
  
  The visible draft includes the current textarea contents and text
  elements that should be cleared
  when the composer submits or dispatches a command. The kill buffer is
  different: it represents the
  most recent killed text and should survive those composer-driven clears
  so the user can still yank
  it back afterward.
  
  After this change, submit and slash-command dispatch still clear the
  visible textarea contents, but
  they no longer erase the most recent kill.
  
  ## Non-goals
  
  This does not implement a multi-entry kill ring or change the semantics
  of `Ctrl+K` and `Ctrl+Y`
  beyond preserving the existing yank target across these clears.
  
  It also does not change how submit, slash-command parsing, prompt
  expansion, or attachment handling
  work, except that those flows no longer discard the textarea kill buffer
  as a side effect of
  clearing the draft.
  
  ## Tradeoffs
  
  The main tradeoff is that clearing the visible textarea is no longer
  equivalent to fully resetting
  all editing state. That is intentional here, because submit and
  slash-command dispatch are composer
  actions, not requests to forget the user's most recent kill.
  
  The benefit is better editing continuity. The cost is that callers must
  understand that full-buffer
  replacement resets visible draft state but not the kill buffer.
  
  ## Architecture
  
  The behavioral change is in `TextArea`: full-buffer replacement now
  rebuilds text and elements
  without clearing `kill_buffer`.
  
  `ChatComposer` already clears the textarea after successful submit and
  slash-command dispatch by
  calling into those textarea replacement paths. With this change, those
  existing composer flows
  inherit the new behavior automatically: the visible draft is cleared,
  but the last killed text
  remains available for `Ctrl+Y`.
  
  The tests cover both layers:
  
  - `TextArea` verifies that the kill buffer survives full-buffer
  replacement.
  - `ChatComposer` verifies that it survives submit.
  - `ChatComposer` also verifies that it survives slash-command dispatch.
  
  ## Observability
  
  There is no dedicated logging for kill-buffer preservation. The most
  direct way to reason about the
  behavior is to inspect textarea-wide replacement paths and confirm
  whether they treat the kill
  buffer as visible-buffer state or as editing-history state.
  
  If this regresses in the future, the likely failure mode is simple and
  user-visible: `Ctrl+Y` stops
  restoring text after submit or slash-command clears even though ordinary
  kill/yank still works
  within a single uninterrupted draft.
  
  ## Tests
  
  Added focused regression coverage for the new contract:
  
  - `kill_buffer_persists_across_set_text`
  - `kill_buffer_persists_after_submit`
  - `kill_buffer_persists_after_slash_command_dispatch`
  
  Local verification:
  - `just fmt`
  - `cargo test -p codex-tui`
  
  ---------
  
  Co-authored-by: Josh McKinney <joshka@openai.com>

  rakan-oai · 2026-03-03 02:06:08 +00:00
  56cc2c71f4
• notify: include client in legacy hook payload (#12968)

  ## Why
  
  The `notify` hook payload did not identify which Codex client started
  the turn. That meant downstream notification hooks could not distinguish
  between completions coming from the TUI and completions coming from
  app-server clients such as VS Code or Xcode. Now that the Codex App
  provides its own desktop notifications, it would be nice to be able to
  filter those out.
  
  This change adds that context without changing the existing payload
  shape for callers that do not know the client name, and keeps the new
  end-to-end test cross-platform.
  
  ## What changed
  
  - added an optional top-level `client` field to the legacy `notify` JSON
  payload
  - threaded that value through `core` and `hooks`; the internal session
  and turn state now carries it as `app_server_client_name`
  - set the field to `codex-tui` for TUI turns
  - captured `initialize.clientInfo.name` in the app server and applied it
  to subsequent turns before dispatching hooks
  - replaced the notify integration test hook with a `python3` script so
  the test does not rely on Unix shell permissions or `bash`
  - documented the new field in `docs/config.md`
  
  ## Testing
  
  - `cargo test -p codex-hooks`
  - `cargo test -p codex-tui`
  - `cargo test -p codex-app-server
  suite::v2::initialize::turn_start_notify_payload_includes_initialize_client_name
  -- --exact --nocapture`
  - `cargo test -p codex-core` (`src/lib.rs` passed; `core/tests/all.rs`
  still has unrelated existing failures in this environment)
  
  ## Docs
  
  The public config reference on `developers.openai.com/codex` should
  mention that the legacy `notify` payload may include a top-level
  `client` field. The TUI reports `codex-tui`, and the app server reports
  `initialize.clientInfo.name` when it is available.

  Michael Bolin · 2026-02-26 22:27:34 -08:00
  e6cd75a684
• Log js_repl nested tool responses in rollout history (#12837)

  ## Summary
  
  - add tracing-based diagnostics for nested `codex.tool(...)` calls made
  from `js_repl`
  - emit a bounded, sanitized summary at `info!`
  - emit the exact raw serialized response object or error string seen by
  JavaScript at `trace!`
  - document how to enable these logs and where to find them, especially
  for `codex app-server`
  
  ## Why
  
  Nested `codex.tool(...)` calls inside `js_repl` are a debugging
  boundary: JavaScript sees the tool result, but that result is otherwise
  hard to inspect from outside the kernel.
  
  This change adds explicit tracing for that path using the repo’s normal
  observability pattern:
  - `info` for compact summaries
  - `trace` for exact raw payloads when deep debugging is needed
  
  ## What changed
  
  - `js_repl` now summarizes nested tool-call results across the response
  shapes it can receive:
    - message content
    - function-call outputs
    - custom tool outputs
    - MCP tool results and MCP error results
    - direct error strings
  - each nested `codex.tool(...)` completion logs:
    - `exec_id`
    - `tool_call_id`
    - `tool_name`
    - `ok`
    - a bounded summary struct describing the payload shape
  - at `trace`, the same path also logs the exact serialized response
  object or error string that JavaScript received
  - docs now include concrete logging examples for `codex app-server`
  - unit coverage was added for multimodal function output summaries and
  error summaries
  
  ## How to use it
  
  ### Summary-only logging
  
  Set:
  
  ```sh
  RUST_LOG=codex_core::tools::js_repl=info
  ```
  
  For `codex app-server`, tracing output is written to the server process
  `stderr`.
  
  Example:
  
  ```sh
  RUST_LOG=codex_core::tools::js_repl=info \
  LOG_FORMAT=json \
  codex app-server \
  2> /tmp/codex-app-server.log
  ```
  
  This emits bounded summary lines for nested `codex.tool(...)` calls.
  
  ### Full raw debugging
  
  Set:
  
  ```sh
  RUST_LOG=codex_core::tools::js_repl=trace
  ```
  
  Example:
  
  ```sh
  RUST_LOG=codex_core::tools::js_repl=trace \
  LOG_FORMAT=json \
  codex app-server \
  2> /tmp/codex-app-server.log
  ```
  
  At `trace`, you get:
  - the same `info` summary line
  - a `trace` line with the exact serialized response object seen by
  JavaScript
  - or the exact error string if the nested tool call failed
  
  ### Where the logs go
  
  For `codex app-server`, these logs go to process `stderr`, so redirect
  or capture `stderr` to inspect them.
  
  Example:
  
  ```sh
  RUST_LOG=codex_core::tools::js_repl=trace \
  LOG_FORMAT=json \
  /Users/fjord/code/codex/codex-rs/target/debug/codex app-server \
  2> /tmp/codex-app-server.log
  ```
  
  Then inspect:
  
  ```sh
  rg "js_repl nested tool call" /tmp/codex-app-server.log
  ```
  
  Without an explicit `RUST_LOG` override, these `js_repl` nested
  tool-call logs are typically not visible.

  Curtis 'Fjord' Hawthorne · 2026-02-26 10:12:28 -08:00
  eb77db2957
• Agent jobs (spawn_agents_on_csv) + progress UI (#10935)

  ## Summary
  - Add agent job support: spawn a batch of sub-agents from CSV, auto-run,
  auto-export, and store results in SQLite.
  - Simplify workflow: remove run/resume/get-status/export tools; spawn is
  deterministic and completes in one call.
  - Improve exec UX: stable, single-line progress bar with ETA; suppress
  sub-agent chatter in exec.
  
  ## Why
  Enables map-reduce style workflows over arbitrarily large repos using
  the existing Codex orchestrator. This addresses review feedback about
  overly complex job controls and non-deterministic monitoring.
  
  ## Demo (progress bar)
  ```
  ./codex-rs/target/debug/codex exec \
    --enable collab \
    --enable sqlite \
    --full-auto \
    --progress-cursor \
    -c agents.max_threads=16 \
    -C /Users/daveaitel/code/codex \
    - <<'PROMPT'
  Create /tmp/agent_job_progress_demo.csv with columns: path,area and 30 rows:
  path = item-01..item-30, area = test.
  
  Then call spawn_agents_on_csv with:
  - csv_path: /tmp/agent_job_progress_demo.csv
  - instruction: "Run `python - <<'PY'` to sleep a random 0.3–1.2s, then output JSON with keys: path, score (int). Set score = 1."
  - output_csv_path: /tmp/agent_job_progress_demo_out.csv
  PROMPT
  ```
  
  ## Review feedback addressed
  - Auto-start jobs on spawn; removed run/resume/status/export tools.
  - Auto-export on success.
  - More descriptive tool spec + clearer prompts.
  - Avoid deadlocks on spawn failure; pending/running handled safely.
  - Progress bar no longer scrolls; stable single-line redraw.
  
  ## Tests
  - `cd codex-rs && cargo test -p codex-exec`
  - `cd codex-rs && cargo build -p codex-cli`

  daveaitel-openai · 2026-02-24 21:00:19 +00:00
  dcab40123f
• feat: discourage the use of the --all-features flag (#12429)

  ## Why
  
  Developers are frequently running low on disk space, and routine use of
  `--all-features` contributes to larger Cargo build caches in `target/`
  by compiling additional feature combinations.
  
  This change updates local workflow guidance to avoid `--all-features` by
  default and reserve it for cases where full feature coverage is
  specifically needed.
  
  ## What Changed
  
  - Updated `AGENTS.md` guidance for `codex-rs` to recommend `cargo test`
  / `just test` for full-suite local runs, and to call out the disk-usage
  cost of routine `--all-features` usage.
  - Updated the root `justfile` so `just fix` and `just clippy` no longer
  pass `--all-features` by default.
  - Updated `docs/install.md` to explicitly describe `cargo test
  --all-features` as an optional heavier-weight run (more build time and
  `target/` disk usage).
  
  ## Verification
  
  - Confirmed the `justfile` parses and the recipes list successfully with
  `just --list`.

  Michael Bolin · 2026-02-20 23:02:24 -08:00
  264fc444b6
• Improve Plan mode reasoning selection flow (#12303)

  Addresses https://github.com/openai/codex/issues/11013
  
  ## Summary
  - add a Plan implementation path in the TUI that lets users choose
  reasoning before switching to Default mode and implementing
  - add Plan-mode reasoning scope handling (Plan-only override vs
  all-modes default), including config/schema/docs plumbing for
  `plan_mode_reasoning_effort`
  - remove the hardcoded Plan preset medium default and make the reasoning
  popup reflect the active Plan override as `(current)`
  - split the collaboration-mode switch notification UI hint into #12307
  to keep this diff focused
  
  If I have `plan_mode_reasoning_effort = "medium"` set in my
  `config.toml`:
  <img width="699" height="127" alt="Screenshot 2026-02-20 at 6 59 37 PM"
  src="https://github.com/user-attachments/assets/b33abf04-6b7a-49ed-b2e9-d24b99795369"
  />
  
  If I don't have `plan_mode_reasoning_effort` set in my `config.toml`:
  <img width="704" height="129" alt="Screenshot 2026-02-20 at 7 01 51 PM"
  src="https://github.com/user-attachments/assets/88a086d4-d2f1-49c7-8be4-f6f0c0fa1b8d"
  />
  
  ## Codex author
  `codex resume 019c78a2-726b-7fe3-adac-3fa4523dcc2a`

  Charley Cunningham · 2026-02-20 20:08:56 -08:00
  4c1744afb2
• docs: use --locked when installing cargo-nextest (#12377)

  ## What
  
  Updates the optional `cargo-nextest` install command in
  `docs/install.md`:
  
  - `cargo install cargo-nextest` -> `cargo install --locked
  cargo-nextest`
  
  ## Why
  
  The current docs command can fail during source install because recent
  `cargo-nextest` releases intentionally require `--locked`.
  
  Repro (macOS, but likely not platform-specific):
  - `cargo install cargo-nextest`
  - Fails with a compile error from `locked-tripwire` indicating:
    - `Nextest does not support being installed without --locked`
    - suggests `cargo install --locked cargo-nextest`
  
  Using the locked command succeeds:
  - `cargo install --locked cargo-nextest`
  
  ## How
  
  Single-line docs change in `docs/install.md` to match current
  `cargo-nextest` install requirements.
  
  ## Validation
  
  - Reproduced failure locally using a temporary `CARGO_HOME` directory
  (clean Cargo home)
  - Example command used: `CARGO_HOME=/tmp/cargo-home-test cargo install
  cargo-nextest`
  - Confirmed success with `cargo install --locked cargo-nextest`

  derekf-oai · 2026-02-20 14:12:13 -08:00
  9176f09cb8
• js_repl: remove codex.state helper references (#12275)

  ## Summary
  
  This PR removes `codex.state` from the `js_repl` helper surface and
  removes all corresponding documentation/instruction references.
  
  ## Motivation
  
  Top-level bindings in `js_repl` now persist across cells, so the extra
  `codex.state` helper is redundant and adds unnecessary API/docs surface.
  
  ## Changes
  
  - Removed the long-lived `state` object from the Node kernel helper
  wiring.
  - Stopped exposing `codex.state` (and `context.state`) during `js_repl`
  execution.
  - Updated user-facing `js_repl` docs to remove `codex.state`.
  - Updated generated instruction text and related test expectations to
  list only:
    - `codex.tmpDir`
    - `codex.tool(name, args?)`
  
  
  #### [git stack](https://github.com/magus/git-stack-cli)
  - ✅ `1` https://github.com/openai/codex/pull/12300
  - 👉 `2` https://github.com/openai/codex/pull/12275
  - ⏳ `3` https://github.com/openai/codex/pull/12205
  - ⏳ `4` https://github.com/openai/codex/pull/12185
  - ⏳ `5` https://github.com/openai/codex/pull/10673

  Curtis 'Fjord' Hawthorne · 2026-02-20 11:20:45 -08:00
  097620218d
• [js_repl] paths for node module resolution can be specified for js_repl (#11944)

  # External (non-OpenAI) Pull Request Requirements
  
  In `js_repl` mode, module resolution currently starts from
  `js_repl_kernel.js`, which is written to a per-kernel temp dir. This
  effectively means that bare imports will not resolve.
  
  This PR adds a new config option, `js_repl_node_module_dirs`, which is a
  list of dirs that are used (in order) to resolve a bare import. If none
  of those work, the current working directory of the thread is used.
  
  For example:
  ```toml
  js_repl_node_module_dirs = [
      "/path/to/node_modules/",
      "/other/path/to/node_modules/",
  ]
  ```

  aaronl-openai · 2026-02-17 23:29:49 -08:00
  f600453699
• tui: preserve remote image attachments across resume/backtrack (#10590)

  ## Summary
  This PR makes app-server-provided image URLs first-class attachments in
  TUI, so they survive resume/backtrack/history recall and are resubmitted
  correctly.
  
  <img width="715" height="491" alt="Screenshot 2026-02-12 at 8 27 08 PM"
  src="https://github.com/user-attachments/assets/226cbd35-8f0c-4e51-a13e-459ef5dd1927"
  />
  
  Can delete the attached image upon backtracking:
  <img width="716" height="301" alt="Screenshot 2026-02-12 at 8 27 31 PM"
  src="https://github.com/user-attachments/assets/4558d230-f1bd-4eed-a093-8e1ab9c6db27"
  />
  
  In both history and composer, remote images are rendered as normal
  `[Image #N]` placeholders, with numbering unified with local images.
  
  ## What changed
  - Plumb remote image URLs through TUI message state:
    - `UserHistoryCell`
    - `BacktrackSelection`
    - `ChatComposerHistory::HistoryEntry`
    - `ChatWidget::UserMessage`
  - Show remote images as placeholder rows inside the composer box (above
  textarea), and in history cells.
  - Support keyboard selection/deletion for remote image rows in composer
  (`Up`/`Down`, `Delete`/`Backspace`).
  - Preserve remote-image-only turns in local composer history (Up/Down
  recall), including restore after backtrack.
  - Ensure submit/queue/backtrack resubmit include remote images in model
  input (`UserInput::Image`), and keep request shape stable for
  remote-image-only turns.
  - Keep image numbering contiguous across remote + local images:
    - remote images occupy `[Image #1]..[Image #M]`
    - local images start at `[Image #M+1]`
    - deletion renumbers consistently.
  - In protocol conversion, increment shared image index for remote images
  too, so mixed remote/local image tags stay in a single sequence.
  - Simplify restore logic to trust in-memory attachment order (no
  placeholder-number parsing path).
  - Backtrack/replay rollback handling now queues trims through
  `AppEvent::ApplyThreadRollback` and syncs transcript overlay/deferred
  lines after trims, so overlay/transcript state stays consistent.
  - Trim trailing blank rendered lines from user history rendering to
  avoid oversized blank padding.
  
  ## Docs + tests
  - Updated: `docs/tui-chat-composer.md` (remote image flow,
  selection/deletion, numbering offsets)
  - Added/updated tests across `tui/src/chatwidget/tests.rs`,
  `tui/src/app.rs`, `tui/src/app_backtrack.rs`, `tui/src/history_cell.rs`,
  and `tui/src/bottom_pane/chat_composer.rs`
  - Added snapshot coverage for remote image composer states, including
  deleting the first of two remote images.
  
  ## Validation
  - `just fmt`
  - `cargo test -p codex-tui`
  
  ## Codex author
  `codex fork 019c2636-1571-74a1-8471-15a3b1c3f49d`

  Charley Cunningham · 2026-02-13 14:54:06 -08:00
  26a7cd21e2
• Add js_repl_tools_only model and routing restrictions (#10671)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.
  
  
  #### [git stack](https://github.com/magus/git-stack-cli)
  - ✅ `1` https://github.com/openai/codex/pull/10674
  - ✅ `2` https://github.com/openai/codex/pull/10672
  - 👉 `3` https://github.com/openai/codex/pull/10671
  - ⏳ `4` https://github.com/openai/codex/pull/10673
  - ⏳ `5` https://github.com/openai/codex/pull/10670

  Curtis 'Fjord' Hawthorne · 2026-02-12 15:41:05 -08:00
  0dcfc59171
• Add js_repl host helpers and exec end events (#10672)

  ## Summary
  
  This PR adds host-integrated helper APIs for `js_repl` and updates model
  guidance so the agent can use them reliably.
  
  ### What’s included
  
  - Add `codex.tool(name, args?)` in the JS kernel so `js_repl` can call
  normal Codex tools.
  - Keep persistent JS state and scratch-path helpers available:
    - `codex.state`
    - `codex.tmpDir`
  - Wire `js_repl` tool calls through the standard tool router path.
  - Add/align `js_repl` execution completion/end event behavior with
  existing tool logging patterns.
  - Update dynamic prompt injection (`project_doc`) to document:
    - how to call `codex.tool(...)`
    - raw output behavior
  - image flow via `view_image` (`codex.tmpDir` +
  `codex.tool("view_image", ...)`)
  - stdio safety guidance (`console.log` / `codex.tool`, avoid direct
  `process.std*`)
  
  ## Why
  
  - Standardize JS-side tool usage on `codex.tool(...)`
  - Make `js_repl` behavior more consistent with existing tool execution
  and event/logging patterns.
  - Give the model enough runtime guidance to use `js_repl` safely and
  effectively.
  
  ## Testing
  
  - Added/updated unit and runtime tests for:
    - `codex.tool` calls from `js_repl` (including shell/MCP paths)
    - image handoff flow via `view_image`
    - prompt-injection text for `js_repl` guidance
    - execution/end event behavior and related regression coverage
  
  
  
  
  #### [git stack](https://github.com/magus/git-stack-cli)
  - ✅ `1` https://github.com/openai/codex/pull/10674
  - 👉 `2` https://github.com/openai/codex/pull/10672
  - ⏳ `3` https://github.com/openai/codex/pull/10671
  - ⏳ `4` https://github.com/openai/codex/pull/10673
  - ⏳ `5` https://github.com/openai/codex/pull/10670

  Curtis 'Fjord' Hawthorne · 2026-02-12 12:10:25 -08:00
  466be55abc
• Add feature-gated freeform js_repl core runtime (#10674)

  ## Summary
  
  This PR adds an **experimental, feature-gated `js_repl` core runtime**
  so models can execute JavaScript in a persistent REPL context across
  tool calls.
  
  The implementation integrates with existing feature gating, tool
  registration, prompt composition, config/schema docs, and tests.
  
  ## What changed
  
  - Added new experimental feature flag: `features.js_repl`.
  - Added freeform `js_repl` tool and companion `js_repl_reset` tool.
  - Gated tool availability behind `Feature::JsRepl`.
  - Added conditional prompt-section injection for JS REPL instructions
  via marker-based prompt processing.
  - Implemented JS REPL handlers, including freeform parsing and pragma
  support (timeout/reset controls).
  - Added runtime resolution order for Node:
    1. `CODEX_JS_REPL_NODE_PATH`
    2. `js_repl_node_path` in config
    3. `PATH`
  - Added JS runtime assets/version files and updated docs/schema.
  
  ## Why
  
  This enables richer agent workflows that require incremental JavaScript
  execution with preserved state, while keeping rollout safe behind an
  explicit feature flag.
  
  ## Testing
  
  Coverage includes:
  
  - Feature-flag gating behavior for tool exposure.
  - Freeform parser/pragma handling edge cases.
  - Runtime behavior (state persistence across calls and top-level `await`
  support).
  
  ## Usage
  
  ```toml
  [features]
  js_repl = true
  ```
  
  Optional runtime override:
  
  - `CODEX_JS_REPL_NODE_PATH`, or
  - `js_repl_node_path` in config.
  
  #### [git stack](https://github.com/magus/git-stack-cli)
  - 👉 `1` https://github.com/openai/codex/pull/10674
  - ⏳ `2` https://github.com/openai/codex/pull/10672
  - ⏳ `3` https://github.com/openai/codex/pull/10671
  - ⏳ `4` https://github.com/openai/codex/pull/10673
  - ⏳ `5` https://github.com/openai/codex/pull/10670

  Curtis 'Fjord' Hawthorne · 2026-02-11 12:05:02 -08:00
  42e22f3bde
• tui: keep history recall cursor at line end (#11295)

  ## Summary
  - keep cursor at end-of-line after Up/Down history recall
  - allow continued history navigation when recalled text cursor is at
  start or end boundary
  - add regression tests and document the history cursor contract in
  composer docs
  
  ## Testing
  - just fmt
  - cargo test -p codex-tui --lib
  history_navigation_leaves_cursor_at_end_of_line
  - cargo test -p codex-tui --lib
  should_handle_navigation_when_cursor_is_at_line_boundaries
  - cargo test -p codex-tui *(fails in existing integration test
  `suite::no_panic_on_startup::malformed_rules_should_not_panic` because
  `target/debug/codex` is not present in this environment)*

  Josh McKinney · 2026-02-10 17:21:46 +00:00
  e704f488bd
• fix(tui): tab submits when no task running in steer mode (#10035)

  When steer mode is enabled, Tab used to only queue while a task was
  running and otherwise did nothing. Treat Tab as an immediate submit when
  no task is running so input isn't dropped when the inflight turn ends
  mid-typing.
  
  Adds a regression test and updates docs/tooltips.

  Josh McKinney · 2026-02-10 00:39:09 +00:00
  a3e4bd3bc0
• fix(tui): rehydrate drafts and restore image placeholders (#9040)

  Fixes #9050
  
  When a draft is stashed with Ctrl+C, we now persist the full draft state
  (text elements, local image paths, and pending paste payloads) in local
  history. Up/Down recall rehydrates placeholder elements and attachments
  so styling remains correct and large pastes still expand on submit.
  Persistent (cross‑session) history remains text‑only.
  
  Backtrack prefills now reuse the selected user message’s text elements
  and local image paths, so image placeholders/attachments rehydrate when
  rolling back.
  
  External editor replacements keep only attachments whose placeholders
  remain and then normalize image placeholders to `[Image #1]..[Image #N]`
  to keep the attachment mapping consistent.
  
  Docs:
  - docs/tui-chat-composer.md
  
  Testing:
  - just fix -p codex-tui
  - cargo test -p codex-tui
  
  Co-authored-by: Eric Traut <etraut@openai.com>

  Chriss4123 · 2026-02-07 20:08:45 -08:00
  d68e9c0f19
• feat(core): add configurable log_dir (#10678)

  Adds a top-level `log_dir` config key (defaults to `$CODEX_HOME/log`) so
  one-off runs can redirect `codex-tui.log` via `-c`, e.g.:
  
    codex -c log_dir=./.codex-log
  
  Also resolves relative paths in CLI `-c/--config` overrides for
  `AbsolutePathBuf` values against the effective cwd (when available).
  
  Tests:
  - cargo test -p codex-core

  Josh McKinney · 2026-02-05 01:23:30 +00:00
  cddfd1e675
• tui: make Esc clear request_user_input notes while notes are shown (#10569)

  ## Summary
  
  This PR updates the `request_user_input` TUI overlay so `Esc` is
  context-aware:
  
  - When notes are visible for an option question, `Esc` now clears notes
  and exits notes mode.
  - When notes are not visible (normal option selection UI), `Esc` still
  interrupts as before.
  
  It also updates footer guidance text to match behavior.
  
  ## Changes
  
  - Added a shared notes-clear path for option questions:
  - `Tab` and `Esc` now both clear notes and return focus to options when
  notes are visible.
  - Updated footer hint text in notes-visible state:
    - from: `tab to clear notes | ... | esc to interrupt`
    - to: `tab or esc to clear notes | ...`
  - Hid `esc to interrupt` hint while notes are visible for option
  questions.
  - Kept `esc to interrupt` visible and functional in normal
  option-selection mode.
  - Updated tests to assert the new `Esc` behavior in notes mode.
  - Updated snapshot output for the notes-visible footer row.
  - Updated docs in `docs/tui-request-user-input.md` to reflect
  mode-specific `Esc` behavior.

  Charley Cunningham · 2026-02-03 16:17:06 -08:00
  a9eb766f33
• feat(tui): pace catch-up stream chunking with hysteresis (#10461)

  ## Summary
  - preserve baseline streaming behavior (smooth mode still commits one
  line per 50ms tick)
  - extract adaptive chunking policy and commit-tick orchestration from
  ChatWidget into `streaming/chunking.rs` and `streaming/commit_tick.rs`
  - add hysteresis-based catch-up behavior with bounded batch draining to
  reduce queue lag without bursty single-frame jumps
  - document policy behavior, tuning guidance, and debug flow in rustdoc +
  docs
  
  ## Testing
  - just fmt
  - cargo test -p codex-tui

  Josh McKinney · 2026-02-03 15:01:51 -08:00
  aec58ac29b
• [Codex][CLI] Gate image inputs by model modalities (#10271)

  ###### Summary
  
  - Add input_modalities to model metadata so clients can determine
  supported input types.
  - Gate image paste/attach in TUI when the selected model does not
  support images.
  - Block submits that include images for unsupported models and show a
  clear warning.
  - Propagate modality metadata through app-server protocol/model-list
  responses.
    - Update related tests/fixtures.
  
    ###### Rationale
  
    - Models support different input modalities.
  - Clients need an explicit capability signal to prevent unsupported
  requests.
  - Backward-compatible defaults preserve existing behavior when modality
  metadata is absent.
  
    ###### Scope
  
    - codex-rs/protocol, codex-rs/core, codex-rs/tui
    - codex-rs/app-server-protocol, codex-rs/app-server
    - Generated app-server types / schema fixtures
  
    ###### Trade-offs
  
  - Default behavior assumes text + image when field is absent for
  compatibility.
    - Server-side validation remains the source of truth.
  
    ###### Follow-up
  
  - Non-TUI clients should consume input_modalities to disable unsupported
  attachments.
  - Model catalogs should explicitly set input_modalities for text-only
  models.
  
    ###### Testing
  
    - cargo fmt --all
    - cargo test -p codex-tui
    - env -u GITHUB_APP_KEY cargo test -p codex-core --lib
    - just write-app-server-schema
  - cargo run -p codex-cli --bin codex -- app-server generate-ts --out
  app-server-types
    - test against local backend
    
  <img width="695" height="199" alt="image"
  src="https://github.com/user-attachments/assets/d22dd04f-5eba-4db9-a7c5-a2506f60ec44"
  />
  
  ---------
  
  Co-authored-by: Josh McKinney <joshka@openai.com>

  Colin Young · 2026-02-02 18:56:39 -08:00
  7e07ec8f73
• Nicer highlighting of slash commands, /plan accepts prompt args and pasted images (#10269)

  ## Summary
  - Make typed slash commands become text elements when the user hits
  space, including paste‑burst spaces.
  - Enable `/plan` to accept inline args and submit them in plan mode,
  mirroring `/review` behavior and blocking submission while a task is
  running.
  - Preserve text elements/attachments for slash commands that take args.
  
  <img width="1510" height="500" alt="image"
  src="https://github.com/user-attachments/assets/446024df-b69a-4249-85db-1a85110e07f1"
  />
  
  ## Changes
  - Add safe helper to insert element ranges in the textarea.
  - Extend command‑with‑args pipeline to carry text elements and reuse
  submission prep.
  - Update `/plan` dispatch to switch to plan mode then submit prompt +
  elements.
  - Document new composer behavior and add tests.
  
  ## Notes
  - `/plan` is blocked during active tasks (same as `/review`).
  - Slash‑command elementization recognizes built‑ins and `/prompts:`
  custom commands only.
  
  ## Codex author
  `codex fork 019c16d3-4520-7bb0-9b9d-48720d40a8ab`

  Charley Cunningham · 2026-02-02 09:53:29 -08:00
  3392c5af24
• Restore image attachments/text elements when recalling input history (Up/Down) (#9628)

  **Summary**
  - Up/Down input history now restores image attachments and text elements
  for local entries.
  - Composer history stores rich local entries (text + text elements +
  local image paths) while persistent history remains text-only.
  - Added tests to verify history recall rehydrates image placeholders and
  attachments in both `tui` and `tui2`.
  
  **Changes**
  - `tui/src/bottom_pane/chat_composer_history.rs`: store `HistoryEntry`
  (text + elements + image paths) for local history; adapt navigation +
  tests.
  - `tui2/src/bottom_pane/chat_composer_history.rs`: same as above.
  - `tui/src/bottom_pane/chat_composer.rs`: record rich history entries
  and restore them on Up/Down; update Ctrl+C history and tests.
  - `tui2/src/bottom_pane/chat_composer.rs`: same as above.

  Charley Cunningham · 2026-01-27 18:39:59 -08:00
  add648df82
• Updated contribution guidelines (#9933)
  Eric Traut · 2026-01-26 17:13:25 -08:00
  6a279f6d77
• Add composer config and shared menu surface helpers (#9891)

  Centralize built-in slash-command gating and extract shared menu-surface
  helpers.
  
  - Add bottom_pane::slash_commands and reuse it from composer + command
  popup.
  - Introduce ChatComposerConfig + shared menu surface rendering without
  changing default behavior.

  Ahmed Ibrahim · 2026-01-26 23:16:29 +00:00
  a8f195828b
• [connectors] Support connectors part 1 - App server & MCP (#9667)

  In order to make Codex work with connectors, we add a built-in gateway
  MCP that acts as a transparent proxy between the client and the
  connectors. The gateway MCP collects actions that are accessible to the
  user and sends them down to the user, when a connector action is chosen
  to be called, the client invokes the action through the gateway MCP as
  well.
  
   - [x] Add the system built-in gateway MCP to list and run connectors.
   - [x] Add the app server methods and protocol

  Matthew Zeng · 2026-01-22 16:48:43 -08:00
  a2c829a808
• feat(tui): retire the tui2 experiment (#9640)

  ## Summary
  - Retire the experimental TUI2 implementation and its feature flag.
  - Remove TUI2-only config/schema/docs so the CLI stays on the
  terminal-native path.
  - Keep docs aligned with the legacy TUI while we focus on redraw-based
  improvements.
  
  ## Customer impact
  - Retires the TUI2 experiment and keeps Codex on the proven
  terminal-native UI while we invest in redraw-based improvements to the
  existing experience.
  
  ## Migration / compatibility
  - If you previously set tui2-related options in config.toml, they are
  now ignored and Codex continues using the existing terminal-native TUI
  (no action required).
  
  ## Context
  - What worked: a transcript-owned viewport delivered excellent resize
  rewrap and high-fidelity copy (especially for code).
  - Why stop: making that experience feel fully native across the
  environment matrix (terminal emulator, OS, input modality, multiplexer,
  font/theme, alt-screen behavior) creates a combinatorial explosion of
  edge cases.
  - What next: we are focusing on redraw-based improvements to the
  existing terminal-native TUI so scrolling, selection, and copy remain
  native while resize/redraw correctness improves.
  
  ## Testing
  - just write-config-schema
  - just fmt
  - cargo clippy --fix --all-features --tests --allow-dirty --allow-no-vcs
  -p codex-core
  - cargo clippy --fix --all-features --tests --allow-dirty --allow-no-vcs
  -p codex-cli
  - cargo check
  - cargo test -p codex-core
  - cargo test -p codex-cli

  Josh McKinney · 2026-01-22 01:02:29 +00:00
  a489b64cb5
• Add request-user-input overlay (#9585)

  - Add request-user-input overlay and routing in the TUI

  Ahmed Ibrahim · 2026-01-21 00:19:35 -08:00
  5f55ed666b
• fix CI by running pnpm (#9587)
  Ahmed Ibrahim · 2026-01-20 20:54:15 -08:00
  465da00d02
• Prompt Expansion: Preserve Text Elements (#9518)

  Summary
  - Preserve `text_elements` through custom prompt argument parsing and
  expansion (named and numeric placeholders).
  - Translate text element ranges through Shlex parsing using sentinel
  substitution, and rehydrate text + element ranges per arg.
  - Drop image attachments when their placeholder does not survive prompt
  expansion, keeping attachments consistent with rendered elements.
  - Mirror changes in TUI2 and expand tests for prompt parsing/expansion
  edge cases.
  
  Tests
  - placeholders with spaces as single tokens (positional + key=value,
  quoted + unquoted),
    - prompt expansion with image placeholders,
    - large paste + image arg combinations,
    - unused image arg dropped after expansion.

  charley-oai · 2026-01-20 18:30:20 -08:00
  531748a080
• Rename hierarchical_agents to child_agents_md (#9215)

  Clearer name

  pakrym-oai · 2026-01-14 19:14:24 +00:00
  e6d2ef432d
• tui: double-press Ctrl+C/Ctrl+D to quit (#8936)

  ## Problem
  
  Codex’s TUI quit behavior has historically been easy to trigger
  accidentally and hard to reason
  about.
  
  - `Ctrl+C`/`Ctrl+D` could terminate the UI immediately, which is a
  common key to press while trying
    to dismiss a modal, cancel a command, or recover from a stuck state.
  - “Quit” and “shutdown” were not consistently separated, so some exit
  paths could bypass the
    shutdown/cleanup work that should run before the process terminates.
  
  This PR makes quitting both safer (harder to do by accident) and more
  uniform across quit
  gestures, while keeping the shutdown-first semantics explicit.
  
  ## Mental model
  
  After this change, the system treats quitting as a UI request that is
  coordinated by the app
  layer.
  
  - The UI requests exit via `AppEvent::Exit(ExitMode)`.
  - `ExitMode::ShutdownFirst` is the normal user path: the app triggers
  `Op::Shutdown`, continues
  rendering while shutdown runs, and only ends the UI loop once shutdown
  has completed.
  - `ExitMode::Immediate` exists as an escape hatch (and as the
  post-shutdown “now actually exit”
  signal); it bypasses cleanup and should not be the default for
  user-triggered quits.
  
  User-facing quit gestures are intentionally “two-step” for safety:
  
  - `Ctrl+C` and `Ctrl+D` no longer exit immediately.
  - The first press arms a 1-second window and shows a footer hint (“ctrl
  + <key> again to quit”).
  - Pressing the same key again within the window requests a
  shutdown-first quit; otherwise the
    hint expires and the next press starts a fresh window.
  
  Key routing remains modal-first:
  
  - A modal/popup gets first chance to consume `Ctrl+C`.
  - If a modal handles `Ctrl+C`, any armed quit shortcut is cleared so
  dismissing a modal cannot
    prime a subsequent `Ctrl+C` to quit.
  - `Ctrl+D` only participates in quitting when the composer is empty and
  no modal/popup is active.
  
  The design doc `docs/exit-confirmation-prompt-design.md` captures the
  intended routing and the
  invariants the UI should maintain.
  
  ## Non-goals
  
  - This does not attempt to redesign modal UX or make modals uniformly
  dismissible via `Ctrl+C`.
  It only ensures modals get priority and that quit arming does not leak
  across modal handling.
  - This does not introduce a persistent confirmation prompt/menu for
  quitting; the goal is to keep
    the exit gesture lightweight and consistent.
  - This does not change the semantics of core shutdown itself; it changes
  how the UI requests and
    sequences it.
  
  ## Tradeoffs
  
  - Quitting via `Ctrl+C`/`Ctrl+D` now requires a deliberate second
  keypress, which adds friction for
    users who relied on the old “instant quit” behavior.
  - The UI now maintains a small time-bounded state machine for the armed
  shortcut, which increases
    complexity and introduces timing-dependent behavior.
  
  This design was chosen over alternatives (a modal confirmation prompt or
  a long-lived “are you
  sure” state) because it provides an explicit safety barrier while
  keeping the flow fast and
  keyboard-native.
  
  ## Architecture
  
  - `ChatWidget` owns the quit-shortcut state machine and decides when a
  quit gesture is allowed
    (idle vs cancellable work, composer state, etc.).
  - `BottomPane` owns rendering and local input routing for modals/popups.
  It is responsible for
  consuming cancellation keys when a view is active and for
  showing/expiring the footer hint.
  - `App` owns shutdown sequencing: translating
  `AppEvent::Exit(ShutdownFirst)` into `Op::Shutdown`
    and only terminating the UI loop when exit is safe.
  
  This keeps “what should happen” decisions (quit vs interrupt vs ignore)
  in the chat/widget layer,
  while keeping “how it looks and which view gets the key” in the
  bottom-pane layer.
  
  ## Observability
  
  You can tell this is working by running the TUIs and exercising the quit
  gestures:
  
  - While idle: pressing `Ctrl+C` (or `Ctrl+D` with an empty composer and
  no modal) shows a footer
  hint for ~1 second; pressing again within that window exits via
  shutdown-first.
  - While streaming/tools/review are active: `Ctrl+C` interrupts work
  rather than quitting.
  - With a modal/popup open: `Ctrl+C` dismisses/handles the modal (if it
  chooses to) and does not
  arm a quit shortcut; a subsequent quick `Ctrl+C` should not quit unless
  the user re-arms it.
  
  Failure modes are visible as:
  
  - Quits that happen immediately (no hint window) from `Ctrl+C`/`Ctrl+D`.
  - Quits that occur while a modal is open and consuming `Ctrl+C`.
  - UI termination before shutdown completes (cleanup skipped).
  
  ## Tests
  
  - Updated/added unit and snapshot coverage in `codex-tui` and
  `codex-tui2` to validate:
    - The quit hint appears and expires on the expected key.
  - Double-press within the window triggers a shutdown-first quit request.
  - Modal-first routing prevents quit bypass and clears any armed shortcut
  when a modal consumes
      `Ctrl+C`.
  
  These tests focus on the UI-level invariants and rendered output; they
  do not attempt to validate
  real terminal key-repeat timing or end-to-end process shutdown behavior.
  
  ---
  Screenshot:
  <img width="912" height="740" alt="Screenshot 2026-01-13 at 1 05 28 PM"
  src="https://github.com/user-attachments/assets/18f3d22e-2557-47f2-a369-ae7a9531f29f"
  />

  Josh McKinney · 2026-01-14 17:42:52 +00:00
  4283a7432b
• fix(tui): harden paste-burst state transitions (#9124)

  User-facing symptom: On terminals that deliver pastes as rapid
  KeyCode::Char/Enter streams (notably Windows), paste-burst transient
  state
  can leak into the next input. Users can see Enter insert a newline when
  they meant to submit, or see characters appear late / handled through
  the
  wrong path.
  
  System problem: PasteBurst is time-based. Clearing only the
  classification window (e.g. via clear_window_after_non_char()) can erase
  last_plain_char_time without emitting buffered text. If a buffer is
  still
  non-empty after that, flush_if_due() no longer has a timeout clock to
  flush against, so the buffer can get "stuck" until another plain char
  arrives.
  
  This was surfaced while adding deterministic regression tests for
  paste-burst behavior.
  
  Fix: when disabling burst detection, defuse any in-flight burst state:
  flush held/buffered text through handle_paste() (so it follows normal
  paste integration), then clear timing and Enter suppression.
  
  Document the rationale inline and update docs/tui-chat-composer.md so
  "disable_paste_burst" matches the actual behavior.

  Josh McKinney · 2026-01-14 01:42:21 +00:00
  ce49e92848
• fix(tui): document paste-burst state machine (#9020)

  Add a narrative doc and inline rustdoc explaining how `ChatComposer`
  and `PasteBurst` compose into a single state machine on terminals that
  lack reliable bracketed paste (notably Windows).
  
  This documents the key states, invariants, and integration points
  (`handle_input_basic`, `handle_non_ascii_char`, tick-driven flush) so
  future changes are easier to reason about.

  Josh McKinney · 2026-01-13 11:48:31 -08:00
  58e8f75b27
• add generated jsonschema for config.toml (#8956)

  ### What
  Add JSON Schema generation for `config.toml`, with checked‑in
  `docs/config.schema.json`. We can move the schema elsewhere if preferred
  (and host it if there's demand).
  
  Add fixture test to prevent drift and `just write-config-schema` to
  regenerate on schema changes.
  
  Generate MCP config schema from `RawMcpServerConfig` instead of
  `McpServerConfig` because that is the runtime type used for
  deserialization.
  
  Populate feature flag values into generated schema so they can be
  autocompleted.
  
  ### Tests
  Added tests + regenerate script to prevent drift. Tested autocompletions
  using generated jsonschema locally with Even Better TOML.
  
  
  
  https://github.com/user-attachments/assets/5aa7cd39-520c-4a63-96fb-63798183d0bc

  sayan-oai · 2026-01-13 10:22:51 -08:00
  40e2405998
• Add hierarchical agent prompt (#8996)
  pakrym-oai · 2026-01-09 13:47:37 -08:00
  acfd94f625
• fix: add tui.alternate_screen config and --no-alt-screen CLI flag for Zellij scrollback (#8555)

  Fixes #2558
  
  Codex uses alternate screen mode (CSI 1049) which, per xterm spec,
  doesn't support scrollback. Zellij follows this strictly, so users can't
  scroll back through output.
  
  **Changes:**
  - Add `tui.alternate_screen` config: `auto` (default), `always`, `never`
  - Add `--no-alt-screen` CLI flag
  - Auto-detect Zellij and skip alt screen (uses existing `ZELLIJ` env var
  detection)
  
  **Usage:**
  ```bash
  # CLI flag
  codex --no-alt-screen
  
  # Or in config.toml
  [tui]
  alternate_screen = "never"
  ```
  
  With default `auto` mode, Zellij users get working scrollback without
  any config changes.
  
  ---------
  
  Co-authored-by: Josh McKinney <joshka@openai.com>

  Helmut Januschka · 2026-01-09 18:38:26 +00:00
  7daaabc795
• chore: nuke telemetry file (#8985)
  jif-oai · 2026-01-09 08:55:21 -08:00
  46b0c4acbb
• feat: add a few metrics (#8910)
  jif-oai · 2026-01-08 15:39:57 +00:00
  5522663f92
• feat: metrics capabilities (#8318)

  Add metrics capabilities to Codex. The `README.md` is up to date.
  
  This will not be merged with the metrics before this PR of course:
  https://github.com/openai/codex/pull/8350

  jif-oai · 2026-01-08 11:47:36 +00:00
  634650dd25
• perf(tui2): cache transcript view rendering (#8693)

  The transcript viewport draws every frame. Ratatui's Line::render_ref
  does grapheme segmentation and span layout, so repeated redraws can burn
  CPU during streaming even when the visible transcript hasn't changed.
  
  Introduce TranscriptViewCache to reduce per-frame work:
  - WrappedTranscriptCache memoizes flattened+wrapped transcript lines per
  width, appends incrementally as new cells arrive, and rebuilds on width
  change, truncation (backtrack), or transcript replacement.
  - TranscriptRasterCache caches rasterized rows (Vec<Cell>) per line
  index and user-row styling; redraws copy cells instead of rerendering
  spans.
  
  The caches are width-scoped and store base transcript content only;
  selection highlighting and copy affordances are applied after drawing.
  User rows include the row-wide base style in the cached raster.
  
  Refactor transcript_render to expose append_wrapped_transcript_cell for
  incremental building and add a test that incremental append matches the
  full build.
  
  Add docs/tui2/performance-testing.md as a playbook for macOS sample
  profiles and hotspot greps.
  
  Expand transcript_view_cache tests to cover rebuild conditions, raster
  equivalence vs direct rendering, user-row caching, and eviction.
  
  Test: cargo test -p codex-tui2

  Josh McKinney · 2026-01-03 11:44:27 -08:00
  90f37e8549
• chore: update outdated docs (#8701)
  Thibault Sottiaux · 2026-01-03 02:19:52 -08:00
  ee9d441777
• Replaced user documentation with links to developers docs site (#8662)

  This eliminates redundant user documentation and allows us to focus our
  documentation investments.
  
  I left tombstone files for most of the existing ".md" docs files to
  avoid broken links. These now contain brief links to the developers docs
  site.

  Eric Traut · 2026-01-02 13:01:53 -07:00
  ab753387cc
• Remove reasoning format (#8484)

  This isn't very useful parameter. 
  
  logic:
  ```
  if model puts `**` in their reasoning, trim it and visualize the header.
  if couldn't trim: don't render
  if model doesn't support: don't render
  ```
  
  We can simplify to:
  ```
  if could trim, visualize header.
  if not, don't render
  ```

  Ahmed Ibrahim · 2025-12-23 16:01:46 -08:00
  40de81e7af
• feat: add support for project_root_markers in config.toml (#8359)

  - allow configuring `project_root_markers` in `config.toml`
  (user/system/MDM) to control project discovery beyond `.git`
  - honor the markers after merging pre-project layers; default to
  `[".git"]` when unset and skip ancestor walk when set to an empty array
  - document the option and add coverage for alternate markers in config
  loader tests

  Michael Bolin · 2025-12-22 19:45:45 +00:00
  314937fb11