87 Commits

• fix: update build cache key in .github/workflows/codex.yml (#2534)

  Change to match `.github/workflows/rust-ci.yml`, which was updated in
  https://github.com/openai/codex/pull/2242:
  
  
  https://github.com/openai/codex/blob/250ae37c8492f475b5f2af3f7a9f3e96973b2657/.github/workflows/rust-ci.yml#L120-L128

  Michael Bolin · 2025-08-20 15:57:33 -07:00
  5ab30c73f3
• Enable Dependabot updates for Rust toolchain (#2460)

  This change allows Dependabot to update the Rust toolchain version
  defined in `rust-toolchain.toml`. See [Dependabot now supports Rust
  toolchain updates - GitHub
  Changelog](https://github.blog/changelog/2025-08-19-dependabot-now-supports-rust-toolchain-updates/)
  for more details.

  Jamie Magee · 2025-08-19 18:07:21 -07:00
  17c98a7fd3
• chore: upgrade to Rust 1.89 (#2465)

  Codex created this PR from the following prompt:
  
  > upgrade this entire repo to Rust 1.89. Note that this requires
  updating codex-rs/rust-toolchain.toml as well as the workflows in
  .github/. Make sure that things are "clippy clean" as this change will
  likely uncover new Clippy errors. `just fmt` and `cargo clippy --tests`
  are sufficient to check for correctness
  
  Note this modifies a lot of lines because it folds nested `if`
  statements using `&&`.
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/2465).
  * #2467
  * __->__ #2465

  Michael Bolin · 2025-08-19 13:22:02 -07:00
  50c48e88f5
• fix: prefer cargo check to cargo build to save time and space (#2466)

  The `ubuntu-24.04 - x86_64-unknown-linux-gnu` build is failing with `No
  space left on device` on #2465, so let's get this in first, which should
  help.
  
  Note that `cargo check` should be faster and use less disk than `cargo
  build` because it does not write out the object files.

  Michael Bolin · 2025-08-19 12:57:31 -07:00
  aafa00dbe0
• chore(deps): bump actions/checkout from 4 to 5 (#2407)

  Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to
  5.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/checkout/releases">actions/checkout's
  releases</a>.</em></p>
  <blockquote>
  <h2>v5.0.0</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Update actions checkout to use node 24 by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
  <li>Prepare v5.0.0 release by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2238">actions/checkout#2238</a></li>
  </ul>
  <h2>⚠️ Minimum Compatible Runner Version</h2>
  <p><strong>v2.327.1</strong><br />
  <a
  href="https://github.com/actions/runner/releases/tag/v2.327.1">Release
  Notes</a></p>
  <p>Make sure your runner is updated to this version or newer to use this
  release.</p>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/checkout/compare/v4...v5.0.0">https://github.com/actions/checkout/compare/v4...v5.0.0</a></p>
  <h2>v4.3.0</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>docs: update README.md by <a
  href="https://github.com/motss"><code>@​motss</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
  <li>Add internal repos for checking out multiple repositories by <a
  href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
  <li>Documentation update - add recommended permissions to Readme by <a
  href="https://github.com/benwells"><code>@​benwells</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
  <li>Adjust positioning of user email note and permissions heading by <a
  href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
  <li>Update README.md by <a
  href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
  <li>Update CODEOWNERS for actions by <a
  href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
  <li>Update package dependencies by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
  <li>Prepare release v4.3.0 by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2237">actions/checkout#2237</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/motss"><code>@​motss</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
  <li><a href="https://github.com/mouismail"><code>@​mouismail</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
  <li><a href="https://github.com/benwells"><code>@​benwells</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
  <li><a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
  <li><a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/checkout/compare/v4...v4.3.0">https://github.com/actions/checkout/compare/v4...v4.3.0</a></p>
  <h2>v4.2.2</h2>
  <h2>What's Changed</h2>
  <ul>
  <li><code>url-helper.ts</code> now leverages well-known environment
  variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
  <li>Expand unit test coverage for <code>isGhes</code> by <a
  href="https://github.com/jww3"><code>@​jww3</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/checkout/compare/v4.2.1...v4.2.2">https://github.com/actions/checkout/compare/v4.2.1...v4.2.2</a></p>
  <h2>v4.2.1</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Check out other refs/* by commit if provided, fall back to ref by <a
  href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/Jcambass"><code>@​Jcambass</code></a>
  made their first contribution in <a
  href="https://redirect.github.com/actions/checkout/pull/1919">actions/checkout#1919</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/actions/checkout/compare/v4.2.0...v4.2.1">https://github.com/actions/checkout/compare/v4.2.0...v4.2.1</a></p>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Changelog</summary>
  <p><em>Sourced from <a
  href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
  changelog</a>.</em></p>
  <blockquote>
  <h1>Changelog</h1>
  <h2>V5.0.0</h2>
  <ul>
  <li>Update actions checkout to use node 24 by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
  </ul>
  <h2>V4.3.0</h2>
  <ul>
  <li>docs: update README.md by <a
  href="https://github.com/motss"><code>@​motss</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
  <li>Add internal repos for checking out multiple repositories by <a
  href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
  <li>Documentation update - add recommended permissions to Readme by <a
  href="https://github.com/benwells"><code>@​benwells</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
  <li>Adjust positioning of user email note and permissions heading by <a
  href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
  <li>Update README.md by <a
  href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
  <li>Update CODEOWNERS for actions by <a
  href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
  <li>Update package dependencies by <a
  href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
  </ul>
  <h2>v4.2.2</h2>
  <ul>
  <li><code>url-helper.ts</code> now leverages well-known environment
  variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
  in <a
  href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
  <li>Expand unit test coverage for <code>isGhes</code> by <a
  href="https://github.com/jww3"><code>@​jww3</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
  </ul>
  <h2>v4.2.1</h2>
  <ul>
  <li>Check out other refs/* by commit if provided, fall back to ref by <a
  href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
  </ul>
  <h2>v4.2.0</h2>
  <ul>
  <li>Add Ref and Commit outputs by <a
  href="https://github.com/lucacome"><code>@​lucacome</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li>
  <li>Dependency updates by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a>- <a
  href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>,
  <a
  href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li>
  </ul>
  <h2>v4.1.7</h2>
  <ul>
  <li>Bump the minor-npm-dependencies group across 1 directory with 4
  updates by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li>
  <li>Bump actions/checkout from 3 to 4 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li>
  <li>Check out other refs/* by commit by <a
  href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li>
  <li>Pin actions/checkout's own workflows to a known, good, stable
  version. by <a href="https://github.com/jww3"><code>@​jww3</code></a> in
  <a
  href="https://redirect.github.com/actions/checkout/pull/1776">actions/checkout#1776</a></li>
  </ul>
  <h2>v4.1.6</h2>
  <ul>
  <li>Check platform to set archive extension appropriately by <a
  href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
  <a
  href="https://redirect.github.com/actions/checkout/pull/1732">actions/checkout#1732</a></li>
  </ul>
  <h2>v4.1.5</h2>
  <ul>
  <li>Update NPM dependencies by <a
  href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
  <a
  href="https://redirect.github.com/actions/checkout/pull/1703">actions/checkout#1703</a></li>
  <li>Bump github/codeql-action from 2 to 3 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1694">actions/checkout#1694</a></li>
  <li>Bump actions/setup-node from 1 to 4 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1696">actions/checkout#1696</a></li>
  <li>Bump actions/upload-artifact from 2 to 4 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1695">actions/checkout#1695</a></li>
  <li>README: Suggest <code>user.email</code> to be
  <code>41898282+github-actions[bot]@users.noreply.github.com</code> by <a
  href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
  <a
  href="https://redirect.github.com/actions/checkout/pull/1707">actions/checkout#1707</a></li>
  </ul>
  <h2>v4.1.4</h2>
  <ul>
  <li>Disable <code>extensions.worktreeConfig</code> when disabling
  <code>sparse-checkout</code> by <a
  href="https://github.com/jww3"><code>@​jww3</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1692">actions/checkout#1692</a></li>
  <li>Add dependabot config by <a
  href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
  <a
  href="https://redirect.github.com/actions/checkout/pull/1688">actions/checkout#1688</a></li>
  <li>Bump the minor-actions-dependencies group with 2 updates by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1693">actions/checkout#1693</a></li>
  <li>Bump word-wrap from 1.2.3 to 1.2.5 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
  href="https://redirect.github.com/actions/checkout/pull/1643">actions/checkout#1643</a></li>
  </ul>
  <h2>v4.1.3</h2>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8"><code>08c6903</code></a>
  Prepare v5.0.0 release (<a
  href="https://redirect.github.com/actions/checkout/issues/2238">#2238</a>)</li>
  <li><a
  href="https://github.com/actions/checkout/commit/9f265659d3bb64ab1440b03b12f4d47a24320917"><code>9f26565</code></a>
  Update actions checkout to use node 24 (<a
  href="https://redirect.github.com/actions/checkout/issues/2226">#2226</a>)</li>
  <li>See full diff in <a
  href="https://github.com/actions/checkout/compare/v4...v5">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=4&new-version=5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-08-19 10:28:52 -07:00
  8f544153a7
• Release zip archived binaries (#2438)

  Adds zip archives to release workflow to improve compatibility (mainly
  older versions Windows which don't support `tar.gz` or `.zst` out of the
  box).
  
  Test release:
  https://github.com/UnownPlain/codex/releases/tag/rust-v0.0.0
  Test run: https://github.com/UnownPlain/codex/actions/runs/16981943609

  UnownPlain · 2025-08-18 17:43:19 -07:00
  5b1989f4d7
• chore(deps-dev): bump @types/node from 24.2.1 to 24.3.0 in /.github/actions/codex (#2411)

  Bumps
  [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
  from 24.2.1 to 24.3.0.
  <details>
  <summary>Commits</summary>
  <ul>
  <li>See full diff in <a
  href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@types/node&package-manager=bun&previous-version=24.2.1&new-version=24.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-08-18 08:33:17 -07:00
  be6a4faa45
• fix: include an entry for windows-x86_64 in the generated DotSlash file (#2361)

  Now that we are improving our Windows support, we should be including an
  entry for it in the DotSlash file.
  
  Though anyone using the DotSlash file with Windows should use the new
  Windows shim introduced in https://github.com/facebook/dotslash/pull/46.
  For more info, see https://dotslash-cli.com/docs/windows/.

  Michael Bolin · 2025-08-15 14:47:36 -07:00
  379106d3eb
• fix: trying to simplify rust-ci.yml (#2327)

  It turns out that https://github.com/openai/codex/pull/2324 did not
  quite work as intended. Chat's new idea is to have this catch-all "CI
  results" job and update our branch protection rules to require this
  instead.

  Michael Bolin · 2025-08-14 17:44:10 -07:00
  dd63d61a59
• fix: ensure rust-ci always "runs" when a PR is submitted (#2324)

  Our existing path filters for `rust-ci.yml`:
  
  
  https://github.com/openai/codex/blob/235987843c3d6647c0819c1071f9b9f064673e9c/.github/workflows/rust-ci.yml#L1-L11
  
  made it so that PRs that touch only `README.md` would not trigger those
  builds, which is a problem because our branch protection rules are set
  as follows:
  
  <img width="1569" height="1883" alt="Screenshot 2025-08-14 at 4 45
  59 PM"
  src="https://github.com/user-attachments/assets/5a61f8cc-cdaf-4341-abda-7faa7b46dbd4"
  />
  
  With the existing setup, a change to `README.md` would get stuck in
  limbo because not all the CI jobs required to merge would get run. It
  turns out that we need to "run" all the jobs, but make them no-ops when
  the `codex-rs` and `.github` folders are untouched to get the best of
  both worlds.
  
  I asked chat how to fix this, as we want CI to be fast for
  documentation-only changes. It had two suggestions:
  
  - Use https://github.com/dorny/paths-filter or some other third-party
  action.
  - Write an inline Bash script to avoid a third-party dependency.
  
  This PR takes the latter approach so that we are clear about what we're
  running in CI.

  Michael Bolin · 2025-08-14 17:00:19 -07:00
  333803ed04
• Use enhancement tag for feature requests (#2282)
  Kazuhiro Sera · 2025-08-14 12:08:35 +09:00
  6d0eb9128e
• Clarify PR/Contribution guidelines and issue templates (#2281)

  Co-authored-by: Dylan <dylan.hurd@openai.com>

  Gabriel Peal · 2025-08-13 21:56:29 -04:00
  e8ffecd632
• fix: skip cargo test for release builds on ordinary CI because it is slow, particularly with --all-features set (#2276)

  I put this PR together because I noticed I have to wait quite a bit
  longer on my PRs since we added
  https://github.com/openai/codex/pull/2242 to catch more build issues.
  
  I think we should think about reigning in our use of create features,
  but this should be good enough to speed things up for now.

  Michael Bolin · 2025-08-13 16:27:20 -07:00
  3a0656df63
• Fix build break and build release (#2242)

  Build release profile for one configuration.

  pakrym-oai · 2025-08-12 15:56:45 -07:00
  97a27ffc77
• chore(deps-dev): bump @types/bun from 1.2.19 to 1.2.20 in /.github/actions/codex (#2163)

  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@types/bun&package-manager=bun&previous-version=1.2.19&new-version=1.2.20)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-08-11 21:54:30 -07:00
  7051a528a3
• chore(deps-dev): bump @types/node from 24.1.0 to 24.2.1 in /.github/actions/codex (#2164)

  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@types/node&package-manager=bun&previous-version=24.1.0&new-version=24.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-08-11 17:58:07 -07:00
  5188c8b6e6
• fix: change the model used with the GitHub action from o3 to gpt-5 (#2198)

  `gpt-5` has been a valid slug since
  https://github.com/openai/codex/pull/1942.

  Michael Bolin · 2025-08-11 15:08:58 -07:00
  52bd7f6660
• fix: improve npm release process (#2055)

  This improves the release process by introducing
  `scripts/publish_to_npm.py` to automate publishing to npm (modulo the
  human 2fac step).
  
  As part of this, it updates `.github/workflows/rust-release.yml` to
  create the artifact for npm using `npm pack`.
  
  And finally, while it is long overdue, this memorializes the release
  process in `docs/release_management.md`.

  Michael Bolin · 2025-08-08 19:07:36 -07:00
  e87974ae83
• chore: remove the TypeScript code from the repository (#2048)

  This deletes the bulk of the `codex-cli` folder and eliminates the logic
  that builds the TypeScript code and bundles it into the release.
  
  Since this PR modifies `.github/workflows/rust-release.yml`, to test
  changes to the release process, I locally commented out all of the "is
  this commit on upstream `main`" checks in
  `scripts/create_github_release.sh` and ran:
  
  ```
  ./codex-rs/scripts/create_github_release.sh 0.20.0-alpha.4
  ```
  
  Which kicked off:
  
  https://github.com/openai/codex/actions/runs/16842085113
  
  And the release artifacts appear legit!
  
  https://github.com/openai/codex/releases/tag/rust-v0.20.0-alpha.4

  Michael Bolin · 2025-08-08 16:09:39 -07:00
  408c7ca142
• fix: try building the npm package in CI (#2043)

  Historically, the release process for the npm module has been:
  
  - I run `codex-rs/scripts/create_github_release.sh` to kick off a
  release for the native artifacts.
  - I wait until it is done.
  - I run `codex-cli/scripts/stage_rust_release.py` to build the npm
  release locally
  - I run `npm publish` from my laptop
  
  It has been a longstanding issue to move the npm build to CI. I may
  still have to do the `npm publish` manually because it requires 2fac
  with `npm`, though I assume we can work that out later.
  
  Note I asked Codex to make these updates, and while they look pretty
  good to me, I'm not 100% certain, but let's just merge this and I'll
  kick off another alpha build and we'll see what happens?

  Michael Bolin · 2025-08-08 15:17:54 -07:00
  39a4d4ed8e
• fix: stop building codex-exec and codex-linux-sandbox binaries (#2036)

  Release builds are taking awhile and part of the reason that we are
  building binaries that we are not really using. Adding Windows binaries
  into releases (https://github.com/openai/codex/pull/2035) slows things
  down, so we need to get some time back.
  
  - `codex-exec` is basically a standalone `codex exec` that we were
  offering because it's a bit smaller as it does not include all the bits
  to power the TUI. We were using it in our experimental GitHub Action, so
  this PR updates the Action to use `codex exec` instead.
  - `codex-linux-sandbox` was a helper binary for the TypeScript version
  of the CLI, but I am about to axe that, so we don't need this either.
  
  If we decide to bring `codex-exec` back at some point, we should use a
  separate instances so we can build it in parallel with `codex`. (I think
  if we had beefier build machines, this wouldn't be so bad, but that's
  not the case with the default runners from GitHub.)

  Michael Bolin · 2025-08-08 13:42:33 -07:00
  8a26ea0fe0
• feat: include windows binaries in GitHub releases (#2035)

  We should stop shipping the old TypeScript CLI to Windows users. I did
  some light testing of the Rust CLI on Windows in `cmd.exe` and it works
  better than I expected!

  Michael Bolin · 2025-08-08 13:03:11 -07:00
  18eb157000
• update readme (#1948)

  Co-authored-by: Alexander Embiricos <ae@openai.com>

  Ed Bayes · 2025-08-07 11:20:53 -07:00
  e07776ccc9
• fix: add more instructions to ensure GitHub Action reviews only the necessary code (#1887)

  Empirically, we have seen the GitHub Action comment on code outside of
  the PR, so try to provide additional instructions in the prompt to avoid
  this.

  Michael Bolin · 2025-08-06 10:39:58 -07:00
  ae88b69b09
• docs: add more detail to the codex-rust-review (#1875)

  This PR attempts to break `codex-rust-review.md` into sections so that
  it is easier to consume.
  
  It also adds a healthy new section on "Assertions in Tests" that has
  been on my mind for awhile.

  Michael Bolin · 2025-08-06 06:36:10 +00:00
  7b3ab968a0
• fix: only tag as prerelease when the version has an -alpha or -beta suffix (#1872)

  Hardcoding to `prerelease: true` is a holdover from before we had
  migrated to the Rust CLI for releases and decided on how we were doing
  version numbers.
  
  To date, I have had to change the release status from "prerelease" to
  "actual release" manually through the GitHub Releases web page. This is
  a semi-serious problem because I've discovered that it messes up
  Homebrew's automation if the version number _looks_ like a real release
  but turns out to be a prerelease. The release potentially gets skipped
  from being published on Homebrew, so it's important to set the value
  correctly from the start.
  
  I verified that `steps.release_name.outputs.name` does not include the
  `rust-v` prefix from the tag name.

  Michael Bolin · 2025-08-05 23:11:29 -07:00
  493e4c9463
• chore(deps-dev): bump typescript from 5.8.3 to 5.9.2 in /.github/actions/codex (#1814)

  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=typescript&package-manager=bun&previous-version=5.8.3&new-version=5.9.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-08-04 14:25:00 -07:00
  6db597ec0c
• chore: add support for a new label, codex-rust-review (#1744)

  The goal of this change is to try an experiment where we try to get AI
  to take on more of the code review load. The idea is that once you
  believe your PR is ready for review, please add the `codex-rust-review`
  label (as opposed to the `codex-review` label).
  
  Admittedly the corresponding prompt currently represents my personal
  biases in terms of code review, but we should massage it over time to
  represent the team's preferences.

  Michael Bolin · 2025-07-30 17:49:07 -07:00
  35010812c7
• chore(deps-dev): bump @types/node from 24.0.13 to 24.0.15 in /.github/actions/codex (#1636)

  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@types/node&package-manager=bun&previous-version=24.0.13&new-version=24.0.15)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-07-23 15:32:31 -07:00
  4fc4e410bd
• chore(deps-dev): bump @types/bun from 1.2.18 to 1.2.19 in /.github/actions/codex (#1635)

  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@types/bun&package-manager=bun&previous-version=1.2.18&new-version=1.2.19)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-07-23 15:20:47 -07:00
  6dd62ffa3b
• chore: for release build, build specific targets instead of --all-targets (#1656)

  I noticed that releases have taken longer and longer to build.
  Originally, I think I did `--all-targets` to be confident that
  everything builds cleanly, but that's really the job of CI that runs on
  `main`, so we're spending a lot of time in `rust-release.yml` for not
  that much additional signal.

  Michael Bolin · 2025-07-22 14:35:50 -07:00
  3ef544fb95
• chore(deps-dev): bump @types/bun from 1.2.13 to 1.2.18 in /.github/actions/codex (#1509)

  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@types/bun&package-manager=bun&previous-version=1.2.13&new-version=1.2.18)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-07-12 10:29:37 -07:00
  fa6d507c51
• chore(deps-dev): bump @types/node from 22.15.21 to 24.0.12 in /.github/actions/codex (#1507)

  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@types/node&package-manager=bun&previous-version=22.15.21&new-version=24.0.12)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-07-12 09:56:54 -07:00
  a52a2fe7a9
• chore(deps-dev): bump prettier from 3.5.3 to 3.6.2 in /.github/actions/codex (#1508)

  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=prettier&package-manager=bun&previous-version=3.5.3&new-version=3.6.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-07-10 12:13:59 -07:00
  341c091c5b
• chore: drop codex-cli from dependabot (#1523)

  We are not actively developing `codex-cli`, so I would rather leave the
  existing `pnpm-lock.yaml` files as-is.

  Michael Bolin · 2025-07-10 11:23:24 -07:00
  c8051b906f
• chore(rs): update dependencies (#1494)

  ### Chores
  - Update cargo dependencies
  - Remove unused cargo dependencies
  - Fix clippy warnings
  - Update Dockerfile (package.json requires node 22)
  - Let Dependabot update bun, cargo, devcontainers, docker,
  github-actions, npm (nix still not supported)
  
  ### TODO
  - Upgrade dependencies with breaking changes
  
  ```shell
  $ cargo update --verbose
     Unchanged crossterm v0.28.1 (available: v0.29.0)
     Unchanged schemars v0.8.22 (available: v1.0.4)
  ```

  Rene Leonhardt · 2025-07-10 11:08:16 -07:00
  82b0cebe8b
• chore: default to the latest version of the Codex CLI in the GitHub Action (#1485)

  Now we no longer have to update the default value of `codex_release_tag`
  in the GitHub Action going forward.

  Michael Bolin · 2025-07-08 12:00:13 -07:00
  f80fc86f18
• docs: update documentation to reflect Rust CLI release (#1440)

  As promised on https://github.com/openai/codex/discussions/1405, we are
  making the first official release of the Rust CLI as v0.2.0. As part of
  this move, we are making it available in Homebrew:
  
  https://github.com/Homebrew/homebrew-core/pull/228615
  
  Ultimately, we also plan to continue to make the CLI available in npm,
  as well, though brew is a bit nicer in that `brew install` will download
  only the binary for your platform whereas an npm module is expected to
  contain the binaries for _all_ supported platforms, so it is a bit more
  heavyweight.
  
  A big part of this change is updating the root `README.md` to document
  the behavior of the Rust CLI, which differs in a number of ways from the
  TypeScript CLI. The existing `README.md` is moved to
  `codex-cli/README.md` as part of this PR, as it is still applicable to
  that folder.
  
  As this is still early days for the Rust CLI, I encourage folks to
  provide feedback on the command line flags and configuration options.

  Michael Bolin · 2025-07-01 15:00:31 -07:00
  abcca30d93
• fix: softprops/action-gh-release@v2 should use existing tag instead of creating a new tag (#1436)

  https://github.com/Homebrew/homebrew-core/pull/228521 details the issues
  I was having with the **Source code (tar.gz)** artifact for our GitHub
  releases not being quite right. I landed these PRs as stabs in the dark
  to fix this:
  
  - https://github.com/openai/codex/pull/1423
  - https://github.com/openai/codex/pull/1430
  
  Based on the insights from
  https://github.com/Homebrew/homebrew-core/pull/228521, I think those
  were wrong and the real problem was this:
  
  
  https://github.com/openai/codex/blob/6dad5c3b1799ac18f7c76a9612f24936682b3c1d/.github/workflows/rust-release.yml#L162
  
  That is, I was manufacturing a new tag name on the fly instead of using
  the existing one.
  
  This PR reverts #1423 and #1430 and hopefully fixes how `tag_name` is
  set for the `softprops/action-gh-release@v2` step so the **Source code
  (tar.gz)** includes the correct files. Assuming this works, this should
  make the Homebrew formula straightforward.

  Michael Bolin · 2025-06-30 12:10:48 -07:00
  4cb3c76798
• fix: support pre-release identifiers in tags (#1422)

  Had to update the regex in the GitHub workflow to allow suffixes like
  `-alpha.4`.
  
  Successfully ran:
  
  ```
  ./scripts/create_github_release.sh 0.1.0-alpha.4
  ```
  
  to create
  https://github.com/openai/codex/releases/tag/codex-rs-b289c9207090b2e27494545d7b5404e063bd86f3-1-rust-v0.1.0-alpha.4
  
  and verified that when I run `codex --version`, it prints `codex-cli
  0.1.0-alpha.4`.

  Michael Bolin · 2025-06-28 16:05:53 -07:00
  f30bf4bbcf
• fix: use aarch64-unknown-linux-musl instead of aarch64-unknown-linux-gnu (#1228)

  Now that we have published a GitHub Release that contains arm64 musl
  artifacts for Linux, update the following scripts to take advantage of
  them:
  
  - `dotslash-config.json` now uses musl artifacts for the `linux-aarch64`
  target
  - `install_native_deps.sh` for the TypeScript CLI now includes
  `codex-linux-sandbox-aarch64-unknown-linux-musl` instead of
  `codex-linux-sandbox-aarch64-unknown-linux-gnu` for sandboxing
  - `codex-cli/bin/codex.js` now checks for `aarch64-unknown-linux-musl`
  artifacts instead of `aarch64-unknown-linux-gnu` ones

  Michael Bolin · 2025-06-05 22:45:45 -07:00
  2d5246050a
• fix: include codex-linux-sandbox-aarch64-unknown-linux-musl in the set of release artifacts (#1230)

  This was missed in https://github.com/openai/codex/pull/1225. Once we
  create a new GitHub Release with this change, we can use the URL from
  the workflow that triggered the release in
  https://github.com/openai/codex/pull/1228.

  Michael Bolin · 2025-06-05 22:03:07 -07:00
  c02d25fbad
• fix: support arm64 build for Linux (#1225)

  Users were running into issues with glibc mismatches on arm64 linux. In
  the past, we did not provide a musl build for arm64 Linux because we had
  trouble getting the openssl dependency to build correctly. Though today
  I just tried the same trick in `Cargo.toml` that we were doing for
  `x86_64-unknown-linux-musl` (using `openssl-sys` with `features =
  ["vendored"]`), so I'm not sure what problem we had in the past the
  builds "just worked" today!
  
  Though one tweak that did have to be made is that the integration tests
  for Seccomp/Landlock empirically require longer timeouts on arm64 linux,
  or at least on the `ubuntu-24.04-arm` GitHub Runner. As such, we change
  the timeouts for arm64 in `codex-rs/linux-sandbox/tests/landlock.rs`.
  
  Though in solving this problem, I decided I needed a turnkey solution
  for testing the Linux build(s) from my Mac laptop, so this PR introduces
  `.devcontainer/Dockerfile` and `.devcontainer/devcontainer.json` to
  facilitate this. Detailed instructions are in `.devcontainer/README.md`.
  
  We will update `dotslash-config.json` and other release-related scripts
  in a follow-up PR.

  Michael Bolin · 2025-06-05 20:29:46 -07:00
  9db53b33aa
• fix: set --config hide_agent_reasoning=true in the GitHub Action (#1185)

  Whoops, I had this flipped in https://github.com/openai/codex/pull/1183.

  Michael Bolin · 2025-05-30 23:57:05 -07:00
  1410ae95ca
• fix: disable agent reasoning output by default in the GitHub Action (#1183)
  Michael Bolin · 2025-05-30 23:49:48 -07:00
  fccf5f3221
• fix: add extra debugging to GitHub Action (#1173)

  https://github.com/openai/codex/actions/runs/15352839832/job/43205041563
  appeared to fail around `postComment()`, but I don't see the output from
  `fail()` in the logs. Adding a bit more info.

  Michael Bolin · 2025-05-30 11:16:30 -07:00
  e207f20f64
• fix: missed a step in #1171 for codex.yml (#1172)

  Missed in my copy/paste.

  Michael Bolin · 2025-05-30 11:04:41 -07:00
  0f40ef5a10
• fix: update outdated repo setup in codex.yml (#1171)

  We should do some work to share the setup logic across `codex.yml`,
  `ci.yml`, and `rust-ci.yml`.

  Michael Bolin · 2025-05-30 10:58:57 -07:00
  8676185389
• feat: initial import of experimental GitHub Action (#1170)

  This is a first cut at a GitHub Action that lets you define prompt
  templates in `.md` files under `.github/codex/labels` that will run
  Codex with the associated prompt when the label is added to a GitHub
  pull request.
  
  For example, this PR includes these files:
  
  ```
  .github/codex/labels/codex-attempt.md
  .github/codex/labels/codex-code-review.md
  .github/codex/labels/codex-investigate-issue.md
  ```
  
  And the new `.github/workflows/codex.yml` workflow declares the
  following triggers:
  
  ```yaml
  on:
    issues:
      types: [opened, labeled]
    pull_request:
      branches: [main]
      types: [labeled]
  ```
  
  as well as the following expression to gate the action:
  
  ```
  jobs:
    codex:
      if: |
        (github.event_name == 'issues' && (
          (github.event.action == 'labeled' && (github.event.label.name == 'codex-attempt' || github.event.label.name == 'codex-investigate-issue'))
        )) ||
        (github.event_name == 'pull_request' && github.event.action == 'labeled' && github.event.label.name == 'codex-code-review')
  ```
  
  Note the "actor" who added the label must have write access to the repo
  for the action to take effect.
  
  After adding a label, the action will "ack" the request by replacing the
  original label (e.g., `codex-review`) with an `-in-progress` suffix
  (e.g., `codex-review-in-progress`). When it is finished, it will swap
  the `-in-progress` label with a `-completed` one (e.g.,
  `codex-review-completed`).
  
  Users of the action are responsible for providing an `OPENAI_API_KEY`
  and making it available as a secret to the action.

  Michael Bolin · 2025-05-30 10:55:28 -07:00
  baa92f37e0
• feat: introduce support for shell_environment_policy in config.toml (#1061)

  To date, when handling `shell` and `local_shell` tool calls, we were
  spawning new processes using the environment inherited from the Codex
  process itself. This means that the sensitive `OPENAI_API_KEY` that
  Codex needs to talk to OpenAI models was made available to everything
  run by `shell` and `local_shell`. While there are cases where that might
  be useful, it does not seem like a good default.
  
  This PR introduces a complex `shell_environment_policy` config option to
  control the `env` used with these tool calls. It is inevitably a bit
  complex so that it is possible to override individual components of the
  policy so without having to restate the entire thing.
  
  Details are in the updated `README.md` in this PR, but here is the
  relevant bit that explains the individual fields of
  `shell_environment_policy`:
  
  | Field | Type | Default | Description |
  | ------------------------- | -------------------------- | ------- |
  -----------------------------------------------------------------------------------------------------------------------------------------------
  |
  | `inherit` | string | `core` | Starting template for the
  environment:<br>`core` (`HOME`, `PATH`, `USER`, …), `all` (clone full
  parent env), or `none` (start empty). |
  | `ignore_default_excludes` | boolean | `false` | When `false`, Codex
  removes any var whose **name** contains `KEY`, `SECRET`, or `TOKEN`
  (case-insensitive) before other rules run. |
  | `exclude` | array&lt;string&gt; | `[]` | Case-insensitive glob
  patterns to drop after the default filter.<br>Examples: `"AWS_*"`,
  `"AZURE_*"`. |
  | `set` | table&lt;string,string&gt; | `{}` | Explicit key/value
  overrides or additions – always win over inherited values. |
  | `include_only` | array&lt;string&gt; | `[]` | If non-empty, a
  whitelist of patterns; only variables that match _one_ pattern survive
  the final step. (Generally used with `inherit = "all"`.) |
  
  
  In particular, note that the default is `inherit = "core"`, so:
  
  * if you have extra env variables that you want to inherit from the
  parent process, use `inherit = "all"` and then specify `include_only`
  * if you have extra env variables where you want to hardcode the values,
  the default `inherit = "core"` will work fine, but then you need to
  specify `set`
  
  This configuration is not battle-tested, so we will probably still have
  to play with it a bit. `core/src/exec_env.rs` has the critical business
  logic as well as unit tests.
  
  Though if nothing else, previous to this change:
  
  ```
  $ cargo run --bin codex -- debug seatbelt -- printenv OPENAI_API_KEY
  # ...prints OPENAI_API_KEY...
  ```
  
  But after this change it does not print anything (as desired).
  
  One final thing to call out about this PR is that the
  `configure_command!` macro we use in `core/src/exec.rs` has to do some
  complex logic with respect to how it builds up the `env` for the process
  being spawned under Landlock/seccomp. Specifically, doing
  `cmd.env_clear()` followed by `cmd.envs(&$env_map)` (which is arguably
  the most intuitive way to do it) caused the Landlock unit tests to fail
  because the processes spawned by the unit tests started failing in
  unexpected ways! If we forgo `env_clear()` in favor of updating env vars
  one at a time, the tests still pass. The comment in the code talks about
  this a bit, and while I would like to investigate this more, I need to
  move on for the moment, but I do plan to come back to it to fully
  understand what is going on. For example, this suggests that we might
  not be able to spawn a C program that calls `env_clear()`, which would
  be...weird. We may still have to fiddle with our Landlock config if that
  is the case.

  Michael Bolin · 2025-05-22 09:51:19 -07:00
  cb379d7797