2513 Commits

• fix(app-server, core): defer initial context write to rollout file until first turn (#9950)

  ### Overview
  Currently calling `thread/resume` will always bump the thread's
  `updated_at` timestamp. This PR makes it the `updated_at` timestamp
  changes only if a turn is triggered.
  
  ### Additonal context
  What we typically do on resuming a thread is **always** writing “initial
  context” to the rollout file immediately. This initial context includes:
  - Developer instructions derived from sandbox/approval policy + cwd
  - Optional developer instructions (if provided)
  - Optional collaboration-mode instructions
  - Optional user instructions (if provided)
  - Environment context (cwd, shell, etc.)
  
  This PR defers writing the “initial context” to the rollout file until
  the first `turn/start`, so we don't inadvertently bump the thread's
  `updated_at` timestamp until a turn is actually triggered.
  
  This works even though both `thread/resume` and `turn/start` accept
  overrides (such as `model`, `cwd`, etc.) because the initial context is
  seeded from the effective `TurnContext` in memory, computed at
  `turn/start` time, after both sets of overrides have been applied.
  
  **NOTE**: This is a very short-lived solution until we introduce sqlite.
  Then we can remove this.

  Owen Lin · 2026-01-27 10:41:54 -08:00
  fc0fd85349
• feat(network-proxy): add a SOCKS5 proxy with policy enforcement (#9803)

  ### Summary
  - Adds an optional SOCKS5 listener via `rama-socks5`
  - SOCKS5 is disabled by default and gated by config
  - Reuses existing policy enforcement and blocked-request recording
  - Blocks SOCKS5 in limited mode to prevent method-policy bypass
  - Applies bind clamping to the SOCKS5 listener
  
  ### Config
  New/used fields under `network_proxy`:
  - `enable_socks5`
  - `socks_url`
  - `enable_socks5_udp`
  
  ### Scope
  - Changes limited to `codex-rs/network-proxy` (+ `codex-rs/Cargo.lock`)
  
  ### Testing
  ```bash
  cd codex-rs
  just fmt
  cargo test -p codex-network-proxy --offline

  viyatb-oai · 2026-01-27 10:09:39 -08:00
  877b76bb9d
• TUI footer: right-align context and degrade shortcut summary + mode cleanly (#9944)

  ## Summary
  Refines the bottom footer layout to keep `% context left` right-aligned
  while making the left side degrade cleanly
  
  ## Behavior with empty textarea
  Full width:
  <img width="607" height="62" alt="Screenshot 2026-01-26 at 2 59 59 PM"
  src="https://github.com/user-attachments/assets/854f33b7-d714-40be-8840-a52eb3bda442"
  />
  Less:
  <img width="412" height="66" alt="Screenshot 2026-01-26 at 2 59 48 PM"
  src="https://github.com/user-attachments/assets/9c501788-c3a2-4b34-8f0b-8ec4395b44fe"
  />
  Min width:
  <img width="218" height="77" alt="Screenshot 2026-01-26 at 2 59 33 PM"
  src="https://github.com/user-attachments/assets/0bed2385-bdbf-4254-8ae4-ab3452243628"
  />
  
  ## Behavior with message in textarea and agent running (steer enabled)
  Full width:
  <img width="753" height="63" alt="Screenshot 2026-01-26 at 4 33 54 PM"
  src="https://github.com/user-attachments/assets/1856b352-914a-44cf-813d-1cb50c7f183b"
  />
  
  Less:
  <img width="353" height="61" alt="Screenshot 2026-01-26 at 4 30 12 PM"
  src="https://github.com/user-attachments/assets/d951c4d5-f3e7-4116-8fe1-6a6c712b3d48"
  />
  
  Less:
  <img width="304" height="64" alt="Screenshot 2026-01-26 at 4 30 51 PM"
  src="https://github.com/user-attachments/assets/1433e994-5cbc-4e20-a98a-79eee13c8699"
  />
  
  Less:
  <img width="235" height="61" alt="Screenshot 2026-01-26 at 4 30 56 PM"
  src="https://github.com/user-attachments/assets/e216c3c6-84cd-40fc-ae4d-83bf28947f0e"
  />
  
  Less:
  <img width="165" height="59" alt="Screenshot 2026-01-26 at 4 31 08 PM"
  src="https://github.com/user-attachments/assets/027de5de-7185-47ce-b1cc-5363ea33d9b1"
  />
  
  ## Notes / Edge Cases
  - In steer mode while typing, the queue hint no longer replaces the mode
  label; it renders as `tab to queue message · {Mode}`.
  - Collapse priorities differ by state:
  - With the queue hint active, `% context left` is hidden before
  shortening or dropping the queue hint.
  - In the empty + non-running state, `? for shortcuts` is dropped first,
  and `% context left` is only shown if `(shift+tab to
  cycle)` can also fit.
  - Transient instructional states (`?` overlay, Esc hint, Ctrl+C/D
  reminders, and flash/override hints) intentionally suppress the
  mode label (and context) to focus the next action.
  
  ## Implementation Notes
  - Renamed the base footer modes to make the state explicit:
  `ComposerEmpty` and `ComposerHasDraft`, and compute the base mode
  directly from emptiness.
  - Unified collapse behavior in `single_line_footer_layout` for both base
  modes, with:
  - Queue-hint behavior that prefers keeping the queue hint over context.
  - A cycle-hint guard that prevents context from reappearing after
  `(shift+tab to cycle)` is dropped.
  - Kept rendering responsibilities explicit:
    - `single_line_footer_layout` decides what fits.
    - `render_footer_line` renders a chosen line.
  - `render_footer_from_props` renders the canonical mode-to-text mapping.
  - Expanded snapshot coverage:
  - Added `footer_collapse_snapshots` in `chat_composer.rs` to lock the
  distinct collapse states across widths.
  - Consolidated the width-aware snapshot helper usage (e.g.,
  `snapshot_composer_state_with_width`,
  `snapshot_footer_with_mode_indicator`).

  Charley Cunningham · 2026-01-27 17:43:09 +00:00
  538e1059a3
• description in role type (#9993)
  jif-oai · 2026-01-27 17:20:07 +00:00
  067922a734
• backend-client: add get_config_requirements_file (#10001)

  Adds getting config requirement to backend-client.
  
  I made a slash command to test it (not included in this PR):
  <img width="726" height="330" alt="Screenshot 2026-01-27 at 15 20 41"
  src="https://github.com/user-attachments/assets/97222e7c-5078-485a-a5b2-a6630313901e"
  />

  gt-oai · 2026-01-27 16:59:53 +00:00
  ddc704d4c6
• chore: clean orchestrator prompt (#9994)
  jif-oai · 2026-01-27 16:32:05 +00:00
  3b726d9550
• nit: better unused prompt (#9991)
  jif-oai · 2026-01-27 13:03:12 +00:00
  74ffbbe7c1
• nit: better tool description (#9988)
  jif-oai · 2026-01-27 12:46:51 +00:00
  742f086ee6
• Fix: cap aggregated exec output consistently (#9759)

  ## WHAT?
  - Bias aggregated output toward stderr under contention (2/3 stderr, 1/3
  stdout) while keeping the 1 MiB cap.
  - Rebalance unused stderr share back to stdout when stderr is tiny to
  avoid underfilling.
  - Add tests for contention, small-stderr rebalance, and under-cap
  ordering (stdout then stderr).
  
  ## WHY?
  - Review feedback requested stderr priority under contention.
  - Avoid underfilled aggregated output when stderr is small while
  preserving a consistent cap across exec paths.
  
  ## HOW?
  - Update `aggregate_output` to compute stdout/stderr shares, then
  reassign unused capacity to the other stream.
  - Use the helper in both Windows and async exec paths.
  - Add regression tests for contention/rebalance and under-cap ordering.
  
  ## BEFORE
  ```rust
  // Best-effort aggregate: stdout then stderr (capped).
  let mut aggregated = Vec::with_capacity(
      stdout
          .text
          .len()
          .saturating_add(stderr.text.len())
          .min(EXEC_OUTPUT_MAX_BYTES),
  );
  append_capped(&mut aggregated, &stdout.text, EXEC_OUTPUT_MAX_BYTES);
  append_capped(&mut aggregated, &stderr.text, EXEC_OUTPUT_MAX_BYTES);
  let aggregated_output = StreamOutput {
      text: aggregated,
      truncated_after_lines: None,
  };
  ```
  
  ## AFTER
  ```rust
  fn aggregate_output(
      stdout: &StreamOutput<Vec<u8>>,
      stderr: &StreamOutput<Vec<u8>>,
  ) -> StreamOutput<Vec<u8>> {
      let total_len = stdout.text.len().saturating_add(stderr.text.len());
      let max_bytes = EXEC_OUTPUT_MAX_BYTES;
      let mut aggregated = Vec::with_capacity(total_len.min(max_bytes));
  
      if total_len <= max_bytes {
          aggregated.extend_from_slice(&stdout.text);
          aggregated.extend_from_slice(&stderr.text);
          return StreamOutput {
              text: aggregated,
              truncated_after_lines: None,
          };
      }
  
      // Under contention, reserve 1/3 for stdout and 2/3 for stderr; rebalance unused stderr to stdout.
      let want_stdout = stdout.text.len().min(max_bytes / 3);
      let want_stderr = stderr.text.len();
      let stderr_take = want_stderr.min(max_bytes.saturating_sub(want_stdout));
      let remaining = max_bytes.saturating_sub(want_stdout + stderr_take);
      let stdout_take = want_stdout + remaining.min(stdout.text.len().saturating_sub(want_stdout));
  
      aggregated.extend_from_slice(&stdout.text[..stdout_take]);
      aggregated.extend_from_slice(&stderr.text[..stderr_take]);
  
      StreamOutput {
          text: aggregated,
          truncated_after_lines: None,
      }
  }
  ```
  
  ## TESTS
  - [x] `just fmt`
  - [x] `just fix -p codex-core`
  - [x] `cargo test -p codex-core aggregate_output_`
  - [x] `cargo test -p codex-core`
  - [x] `cargo test --all-features`
  
  ## FIXES
  Fixes #9758

  K Bediako · 2026-01-27 09:29:12 +00:00
  ab99df0694
• Fixing main and make plan mode reasoning effort medium (#9980)

  It's overthinking so much on high and going over the context window.

  Ahmed Ibrahim · 2026-01-26 22:30:24 -08:00
  509ff1c643
• make plan prompt less detailed (#9977)

  This was too much to ask for

  Ahmed Ibrahim · 2026-01-26 21:42:01 -08:00
  cabb2085cc
• tui: wrapping user input questions (#9971)
  Ahmed Ibrahim · 2026-01-26 21:30:09 -08:00
  4db6da32a3
• make cached web_search client-side default (#9974)

  [Experiment](https://console.statsig.com/50aWbk2p4R76rNX9lN5VUw/experiments/codex_web_search_rollout/summary)
  for default cached `web_search` completed; cached chosen as default.
  
  Update client to reflect that.

  sayan-oai · 2026-01-26 21:25:40 -08:00
  0adcd8aa86
• plan prompt (#9975)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2026-01-26 21:14:05 -08:00
  28bd7db14a
• prompt (#9970)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2026-01-26 20:27:57 -08:00
  0c72d8fd6e
• Fix resume --last with --json option (#9475)

  Fix resume --last prompt parsing by dropping the clap conflict on the
  codex resume subcommand so a positional prompt is accepted when --last
  is set. This aligns interactive resume behavior with exec-mode logic and
  avoids the “--last cannot be used with SESSION_ID” error.
  
  This addresses #6717

  Eric Traut · 2026-01-26 20:20:57 -08:00
  7c96f2e84c
• prompt final (#9969)

  hopefully final this time (at least tonight) >_<

  Ahmed Ibrahim · 2026-01-26 20:12:43 -08:00
  f45a8733bf
• Improve plan mode prompt (#9968)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2026-01-26 19:56:16 -08:00
  b655a092ba
• plan prompt v7 (#9966)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2026-01-26 19:34:18 -08:00
  b7bba3614e
• fix: handle all web_search actions and in progress invocations (#9960)

  ### Summary
  - Parse all `web_search` tool actions (`search`, `find_in_page`,
  `open_page`).
  - Previously we only parsed + displayed `search`, which made the TUI
  appear to pause when the other actions were being used.
  - Show in progress `web_search` calls as `Searching the web`
    - Previously we only showed completed tool calls
  
  <img width="308" height="149" alt="image"
  src="https://github.com/user-attachments/assets/90a4e8ff-b06a-48ff-a282-b57b31121845"
  />
  
  ### Tests
  Added + updated tests, tested locally
  
  ### Follow ups
  Update VSCode extension to display these as well

  sayan-oai · 2026-01-27 03:33:48 +00:00
  86adf53235
• Use test_codex more (#9961)

  Reduces boilderplate.

  pakrym-oai · 2026-01-26 18:52:10 -08:00
  998e88b12a
• Warn users on enabling underdevelopment features (#9954)

  <img width="938" height="73" alt="image"
  src="https://github.com/user-attachments/assets/a2d5ac46-92c5-4828-b35e-0965c30cdf36"
  />

  Ahmed Ibrahim · 2026-01-27 01:58:05 +00:00
  c900de271a
• feat: load interface metadata from SKILL.json (#9953)
  alexsong-oai · 2026-01-27 01:38:06 +00:00
  a641a6427c
• NIT larger buffer (#9957)
  jif-oai · 2026-01-27 01:26:55 +00:00
  5d13427ef4
• Reuse ChatComposer in request_user_input overlay (#9892)

  Reuse the shared chat composer for notes and freeform answers in
  request_user_input.
  
  - Build the overlay composer with ChatComposerConfig::plain_text.
  - Wire paste-burst flushing + menu surface sizing through the bottom
  pane.

  Ahmed Ibrahim · 2026-01-26 17:21:41 -08:00
  394b967432
• Reject request_user_input outside Plan/Pair (#9955)

  ## Context
  
  Previous work in https://github.com/openai/codex/pull/9560 only rejected
  `request_user_input` in Execute and Custom modes. Since then, additional
  modes
  (e.g., Code) were added, so the guard should be mode-agnostic.
  
  ## What changed
  
  - Switch the handler to an allowlist: only Plan and PairProgramming are
  allowed
  - Return the same error for any other mode (including Code)
  - Add a Code-mode rejection test alongside the existing Execute/Custom
  tests
  
  ## Why
  
  This prevents `request_user_input` from being used in modes where it is
  not
  intended, even as new modes are introduced.

  Charley Cunningham · 2026-01-26 17:12:17 -08:00
  47aa1f3b6a
• fix: try to fix freezes 2 (#9951)

  Fixes a TUI freeze caused by awaiting `mpsc::Sender::send()` that blocks
  the tokio thread, stopping the consumption runtime and creating a
  deadlock. This could happen if the server was producing enough chunks to
  fill the `mpsc` fast enough. To solve this we try on insert using a
  `try_send()` (not requiring an `await`) and delegate to a tokio task if
  this does not work
  
  This is a temporary solution as it can contain races for delta elements
  and a stronger design should come here

  jif-oai · 2026-01-27 01:02:22 +00:00
  73bd84dee0
• fix: use brew upgrade --cask codex to avoid warnings and ambiguity (#9823)

  Fixes #9822 
  
  ### Summary
  
  Make the Homebrew upgrade command explicit by using `brew upgrade --cask
  codex`.
  
  ### Motivation
  
  During the Codex self-update, Homebrew can emit an avoidable warning
  because the
  name `codex` resolves to a cask:
  
  ```
  Warning: Formula codex was renamed to homebrew/cask/codex.
  ````
  
  While the upgrade succeeds, this relies on implicit name resolution and
  produces
  unnecessary output during the update flow.
  
  ### Why `--cask`
  
  * Eliminates warning/noise for users
  * Explicitly matches how Codex is distributed via Homebrew
  * Avoids reliance on name resolution behavior
  * Makes the command more robust if a `codex` formula is ever introduced
  
  ### Context
  
  This restores the `--cask` flag that was removed in #6238 after being
  considered
  “not necessary” during review:
  [https://github.com/openai/codex/pull/6238#discussion_r2505947880](https://github.com/openai/codex/pull/6238#discussion_r2505947880).
  
  Co-authored-by: Eric Traut <etraut@openai.com>

  JBallin · 2026-01-26 16:21:09 -08:00
  32b062d0e1
• fix: remove cli tooltip references to custom prompts (#9901)

  Custom prompts are now deprecated, however are still references in
  tooltips. Remove the relevant tips from the repository.
  
  Closes #9900

  Matt Ridley · 2026-01-26 15:55:44 -08:00
  f29a0defa2
• chore(deps): bump globset from 0.4.16 to 0.4.18 in /codex-rs (#9884)

  Bumps [globset](https://github.com/BurntSushi/ripgrep) from 0.4.16 to
  0.4.18.
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/0b0e013f5ac6ae1dbfdf97f6f6aaa27d7c9bc317"><code>0b0e013</code></a>
  globset-0.4.18</li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/cac9870a0264014ab7015bf07e154c06a668a72c"><code>cac9870</code></a>
  doc: update date in man page template</li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/24e88dc15b58b6fcc16d217158994871e756a6ca"><code>24e88dc</code></a>
  ignore/types: add <code>ssa</code> type</li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/5748f81bb107ce65f32cff330fe90dc639af262c"><code>5748f81</code></a>
  printer: use <code>doc_cfg</code> instead of
  <code>doc_auto_cfg</code></li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/d47663b1b4548e4fa02d6e4b575718d0f5f5e7d6"><code>d47663b</code></a>
  searcher: fix regression with <code>--line-buffered</code> flag</li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/38d630261aded3a8e535fe85761e68af35bc462d"><code>38d6302</code></a>
  printer: add Cursor hyperlink alias</li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/b3dc4b09988b4fe7d8ff69ad576623d57f7c3b75"><code>b3dc4b0</code></a>
  globset: improve debug log</li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/ca2e34f37c5fa3021d0c14a67a7f0590166ade4f"><code>ca2e34f</code></a>
  grep-0.4.0</li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/a0d61a063f5ff7c1d1b131882d92999c923c3420"><code>a0d61a0</code></a>
  grep-printer-0.3.0</li>
  <li><a
  href="https://github.com/BurntSushi/ripgrep/commit/c22fc0f13ce1cbe3bd40b659628aea21874938a2"><code>c22fc0f</code></a>
  deps: bump to grep-searcher 0.1.15</li>
  <li>Additional commits viewable in <a
  href="https://github.com/BurntSushi/ripgrep/compare/globset-0.4.16...globset-0.4.18">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=globset&package-manager=cargo&previous-version=0.4.16&new-version=0.4.18)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2026-01-26 15:55:19 -08:00
  2e5aa809f4
• chore(deps): bump axum from 0.8.4 to 0.8.8 in /codex-rs (#9883)

  Bumps [axum](https://github.com/tokio-rs/axum) from 0.8.4 to 0.8.8.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/tokio-rs/axum/releases">axum's
  releases</a>.</em></p>
  <blockquote>
  <h2>axum v0.8.8</h2>
  <ul>
  <li>Clarify documentation for <code>Router::route_layer</code> (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3567">#3567</a>)</li>
  </ul>
  <p><a
  href="https://redirect.github.com/tokio-rs/axum/issues/3567">#3567</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3567">tokio-rs/axum#3567</a></p>
  <h2>axum v0.8.7</h2>
  <ul>
  <li>Relax implicit <code>Send</code> / <code>Sync</code> bounds on
  <code>RouterAsService</code>, <code>RouterIntoService</code> (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3555">#3555</a>)</li>
  <li>Make it easier to visually scan for default features (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3550">#3550</a>)</li>
  <li>Fix some documentation typos</li>
  </ul>
  <p><a
  href="https://redirect.github.com/tokio-rs/axum/issues/3550">#3550</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3550">tokio-rs/axum#3550</a>
  <a
  href="https://redirect.github.com/tokio-rs/axum/issues/3555">#3555</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3555">tokio-rs/axum#3555</a></p>
  <h2>axum v0.8.5</h2>
  <ul>
  <li><strong>fixed:</strong> Reject JSON request bodies with trailing
  characters after the JSON document (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3453">#3453</a>)</li>
  <li><strong>added:</strong> Implement <code>OptionalFromRequest</code>
  for <code>Multipart</code> (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3220">#3220</a>)</li>
  <li><strong>added:</strong> Getter methods <code>Location::{status_code,
  location}</code></li>
  <li><strong>added:</strong> Support for writing arbitrary binary data
  into server-sent events (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3425">#3425</a>)]</li>
  <li><strong>added:</strong>
  <code>middleware::ResponseAxumBodyLayer</code> for mapping response body
  to <code>axum::body::Body</code> (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3469">#3469</a>)</li>
  <li><strong>added:</strong> <code>impl FusedStream for WebSocket</code>
  (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3443">#3443</a>)</li>
  <li><strong>changed:</strong> The <code>sse</code> module and
  <code>Sse</code> type no longer depend on the <code>tokio</code> feature
  (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3154">#3154</a>)</li>
  <li><strong>changed:</strong> If the location given to one of
  <code>Redirect</code>s constructors is not a valid header value, instead
  of panicking on construction, the <code>IntoResponse</code> impl now
  returns an HTTP 500, just like <code>Json</code> does when serialization
  fails (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3377">#3377</a>)</li>
  <li><strong>changed:</strong> Update minimum rust version to 1.78 (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3412">#3412</a>)</li>
  </ul>
  <p><a
  href="https://redirect.github.com/tokio-rs/axum/issues/3154">#3154</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3154">tokio-rs/axum#3154</a>
  <a
  href="https://redirect.github.com/tokio-rs/axum/issues/3220">#3220</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3220">tokio-rs/axum#3220</a>
  <a
  href="https://redirect.github.com/tokio-rs/axum/issues/3377">#3377</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3377">tokio-rs/axum#3377</a>
  <a
  href="https://redirect.github.com/tokio-rs/axum/issues/3412">#3412</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3412">tokio-rs/axum#3412</a>
  <a
  href="https://redirect.github.com/tokio-rs/axum/issues/3425">#3425</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3425">tokio-rs/axum#3425</a>
  <a
  href="https://redirect.github.com/tokio-rs/axum/issues/3443">#3443</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3443">tokio-rs/axum#3443</a>
  <a
  href="https://redirect.github.com/tokio-rs/axum/issues/3453">#3453</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3453">tokio-rs/axum#3453</a>
  <a
  href="https://redirect.github.com/tokio-rs/axum/issues/3469">#3469</a>:
  <a
  href="https://redirect.github.com/tokio-rs/axum/pull/3469">tokio-rs/axum#3469</a></p>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/d07863f97d2649c414d2cdd162d1a10750e29a25"><code>d07863f</code></a>
  Release axum v0.8.8 and axum-extra v0.12.3</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/287c674b65fa363fa8e60a5b2de7502dfda0decc"><code>287c674</code></a>
  axum-extra: Make typed-routing feature enable routing feature (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3514">#3514</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/f5804aa6a13f8af1ae1a8998b872b300b0859d81"><code>f5804aa</code></a>
  SecondElementIs: Correct a small inconsistency (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3559">#3559</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/f51f3ba4366e1060206efc41fde1227055164c45"><code>f51f3ba</code></a>
  axum-extra: Add trailing newline to pretty JSON response (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3526">#3526</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/816407a8166491217168890ee96856469c3b424c"><code>816407a</code></a>
  Fix integer underflow in <code>try_range_response</code> for empty files
  (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3566">#3566</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/78656ebb4a925329dc19c17a4dbef31d7551d4f5"><code>78656eb</code></a>
  docs: Clarify <code>route_layer</code> does not apply middleware to the
  fallback handler...</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/4404f27cea206b0dca63637b1c76dff23772a5cc"><code>4404f27</code></a>
  Release axum v0.8.7 and axum-extra v0.12.2</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/8f1545adecc86036ed9c8f252edcc099f7016103"><code>8f1545a</code></a>
  Fix typo in extractors guide (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3554">#3554</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/4fc3faa0b4d82db870d8daaf49978da960bcfc42"><code>4fc3faa</code></a>
  Relax implicit Send / Sync bounds (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3555">#3555</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/axum/commit/a05920c906fb5fe3c5b734f80465a3a6f06948f1"><code>a05920c</code></a>
  Make it easier to visually scan for default features (<a
  href="https://redirect.github.com/tokio-rs/axum/issues/3550">#3550</a>)</li>
  <li>Additional commits viewable in <a
  href="https://github.com/tokio-rs/axum/compare/axum-v0.8.4...axum-v0.8.8">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=axum&package-manager=cargo&previous-version=0.8.4&new-version=0.8.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2026-01-26 15:54:58 -08:00
  6418e65356
• chore(deps): bump tokio-test from 0.4.4 to 0.4.5 in /codex-rs (#9882)

  Bumps [tokio-test](https://github.com/tokio-rs/tokio) from 0.4.4 to
  0.4.5.
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/41d1877689f8669902b003a6affce60bdfeb3025"><code>41d1877</code></a>
  chore: prepare tokio-test 0.4.5 (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7831">#7831</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/60b083b630ed279d579368e513406d735d739511"><code>60b083b</code></a>
  chore: prepare tokio-stream 0.1.18 (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7830">#7830</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/9cc02cc88d083113cd9889a74b382e39e430e180"><code>9cc02cc</code></a>
  chore: prepare tokio-util 0.7.18 (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7829">#7829</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/d2799d791b10388e60a2a5fe5e4a33b3336e1465"><code>d2799d7</code></a>
  task: improve the docs of <code>Builder::spawn_local</code> (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7828">#7828</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/4d4870f291b69e2426232440e03c9e66fe77b525"><code>4d4870f</code></a>
  task: doc that task drops before JoinHandle completion (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7825">#7825</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/fdb150901afb0456037c6232eab8ce80116ccd02"><code>fdb1509</code></a>
  fs: check for io-uring opcode support (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7815">#7815</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/426a56278017c30e7da7b4c9365a2610f4695f76"><code>426a562</code></a>
  rt: remove <code>allow(dead_code)</code> after <code>JoinSet</code>
  stabilization (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7826">#7826</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/e3b89bbefa7564e2eba2fb9f849ef7bf87d60fad"><code>e3b89bb</code></a>
  chore: prepare Tokio v1.49.0 (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7824">#7824</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/4f577b84e939c8d427d79fdc73919842d8735de2"><code>4f577b8</code></a>
  Merge 'tokio-1.47.3' into 'master'</li>
  <li><a
  href="https://github.com/tokio-rs/tokio/commit/f320197693ee09e28f1fca0e55418081adcdfc25"><code>f320197</code></a>
  chore: prepare Tokio v1.47.3 (<a
  href="https://redirect.github.com/tokio-rs/tokio/issues/7823">#7823</a>)</li>
  <li>Additional commits viewable in <a
  href="https://github.com/tokio-rs/tokio/compare/tokio-test-0.4.4...tokio-test-0.4.5">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tokio-test&package-manager=cargo&previous-version=0.4.4&new-version=0.4.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2026-01-26 15:51:21 -08:00
  764712c116
• chore(deps): bump tracing from 0.1.43 to 0.1.44 in /codex-rs (#9880)

  Bumps [tracing](https://github.com/tokio-rs/tracing) from 0.1.43 to
  0.1.44.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/tokio-rs/tracing/releases">tracing's
  releases</a>.</em></p>
  <blockquote>
  <h2>tracing 0.1.44</h2>
  <h3>Fixed</h3>
  <ul>
  <li>Fix <code>record_all</code> panic (<a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3432">#3432</a>)</li>
  </ul>
  <h3>Changed</h3>
  <ul>
  <li><code>tracing-core</code>: updated to 0.1.36 (<a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3440">#3440</a>)</li>
  </ul>
  <p><a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3432">#3432</a>:
  <a
  href="https://redirect.github.com/tokio-rs/tracing/pull/3432">tokio-rs/tracing#3432</a>
  <a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3440">#3440</a>:
  <a
  href="https://redirect.github.com/tokio-rs/tracing/pull/3440">tokio-rs/tracing#3440</a></p>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/tokio-rs/tracing/commit/2d55f6faf9be83e7e4634129fb96813241aac2b8"><code>2d55f6f</code></a>
  chore: prepare tracing 0.1.44 (<a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3439">#3439</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tracing/commit/10a9e838a35e6ded79d66af246be2ee05417136d"><code>10a9e83</code></a>
  chore: prepare tracing-core 0.1.36 (<a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3440">#3440</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tracing/commit/ee82cf92a8c750f98cfb7a417cc8defb37e26a00"><code>ee82cf9</code></a>
  tracing: fix record_all panic (<a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3432">#3432</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tracing/commit/9978c3663bcd58de14b3cf089ad24cb63d00a922"><code>9978c36</code></a>
  chore: prepare tracing-mock 0.1.0-beta.3 (<a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3429">#3429</a>)</li>
  <li><a
  href="https://github.com/tokio-rs/tracing/commit/cc44064b3a41cb586bd633f8a024354928e25819"><code>cc44064</code></a>
  chore: prepare tracing-subscriber 0.3.22 (<a
  href="https://redirect.github.com/tokio-rs/tracing/issues/3428">#3428</a>)</li>
  <li>See full diff in <a
  href="https://github.com/tokio-rs/tracing/compare/tracing-0.1.43...tracing-0.1.44">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tracing&package-manager=cargo&previous-version=0.1.43&new-version=0.1.44)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2026-01-26 15:48:45 -08:00
  5ace350186
• Add composer config and shared menu surface helpers (#9891)

  Centralize built-in slash-command gating and extract shared menu-surface
  helpers.
  
  - Add bottom_pane::slash_commands and reuse it from composer + command
  popup.
  - Introduce ChatComposerConfig + shared menu surface rendering without
  changing default behavior.

  Ahmed Ibrahim · 2026-01-26 23:16:29 +00:00
  a8f195828b
• fix: handle utf-8 in windows sandbox logs (#8647)

  Currently `apply_patch` will fail on Windows if the file contents happen
  to have a multi-byte character at the point where the `preview` function
  truncates.
  
  I've used the existing `take_bytes_at_char_boundary` helper and added a
  regression test (that fails without the fix).
  
  This is related to #4013 but doesn't fix it.

  David Gilbertson · 2026-01-26 15:11:27 -08:00
  313ee3003b
• plan prompt (#9943)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2026-01-26 14:48:54 -08:00
  159ff06281
• Add MCP server scopes config and use it as fallback for OAuth login (#9647)

  ### Motivation
  - Allow MCP OAuth flows to request scopes defined in `config.toml`
  instead of requiring users to always pass `--scopes` on the CLI.
  CLI/remote parameters should still override config values.
  
  ### Description
  - Add optional `scopes: Option<Vec<String>>` to `McpServerConfig` and
  `RawMcpServerConfig`, and propagate it through deserialization and the
  built config types.
  - Serialize `scopes` into the MCP server TOML via
  `serialize_mcp_server_table` in `core/src/config/edit.rs` and include
  `scopes` in the generated config schema (`core/config.schema.json`).
  - CLI: update `codex-rs/cli/src/mcp_cmd.rs` `run_login` to fall back to
  `server.scopes` when the `--scopes` flag is empty, with explicit CLI
  scopes still taking precedence.
  - App server: update
  `codex-rs/app-server/src/codex_message_processor.rs`
  `mcp_server_oauth_login` to use `params.scopes.or_else(||
  server.scopes.clone())` so the RPC path also respects configured scopes.
  - Update many test fixtures to initialize the new `scopes` field (set to
  `None`) so test code builds with the new struct field.
  
  ### Testing
  - Ran config tooling and formatters: `just write-config-schema`
  (succeeded), `just fmt` (succeeded), and `just fix -p codex-core`, `just
  fix -p codex-cli`, `just fix -p codex-app-server` (succeeded where
  applicable).
  - Ran unit tests for the CLI: `cargo test -p codex-cli` (passed).
  - Ran unit tests for core: `cargo test -p codex-core` (ran; many tests
  passed but several failed, including model refresh/403-related tests,
  shell snapshot/timeouts, and several `unified_exec` expectations).
  - Ran app-server tests: `cargo test -p codex-app-server` (ran; many
  integration-suite tests failed due to mocked/remote HTTP 401/403
  responses and wiremock expectations).
  
  If you want, I can split the tests into smaller focused runs or help
  debug the failing integration tests (they appear to be unrelated to the
  config change and stem from external HTTP/mocking behaviors encountered
  during the test runs).
  
  ------
  [Codex
  Task](https://chatgpt.com/codex/tasks/task_i_69718f505914832ea1f334b3ba064553)

  blevy-oai · 2026-01-26 14:13:04 -08:00
  bdc4742bfc
• [app-server] feat: add filtering on thread list (#9897)
  jif-oai · 2026-01-26 21:54:19 +00:00
  247fb2de64
• Aligned feature stage names with public feature maturity stages (#9929)

  We've recently standardized a [feature maturity
  model](https://developers.openai.com/codex/feature-maturity) that we're
  using in our docs and support forums to communicate expectations to
  users. This PR updates the internal stage names and descriptions to
  match.
  
  This change involves a simple internal rename and updates to a few
  user-visible strings. No functional change.

  Eric Traut · 2026-01-26 11:43:36 -08:00
  b77bf4d36d
• Add thread/unarchive to restore archived rollouts (#9843)

  ## Summary
  - Adds a new `thread/unarchive` RPC to move archived thread rollouts
  back into the active `sessions/` tree.
  
  ## What changed
  - **Protocol**
    - Adds `thread/unarchive` request/response types and wiring.
  - **Server**
    - Implements `thread_unarchive` in the app server.
    - Validates the archived rollout path and thread ID.
  - Restores the rollout to `sessions/YYYY/MM/DD/...` based on the rollout
  filename timestamp.
  - **Core**
  - Adds `find_archived_thread_path_by_id_str` helper for archived
  rollouts.
  - **Docs**
    - Documents the new RPC and usage example.
  - **Tests**
    - Adds an end-to-end server test that:
      1) starts a thread,
      2) archives it,
      3) unarchives it,
      4) asserts the file is restored to `sessions/`.
  
  ## How to use
  ```json
  { "method": "thread/unarchive", "id": 24, "params": { "threadId": "<thread-id>" } }
  ```
  
  ## Author Codex Session
  
  `codex resume 019bf158-54b6-7960-a696-9d85df7e1bc1` (soon I'll make this
  kind of session UUID forkable by anyone with the right
  `session_object_storage_url` line in their config, but for now just
  pasting it here for my reference)

  Charley Cunningham · 2026-01-26 11:24:36 -08:00
  62266b13f8
• chore: update interrupt message (#9925)
  jif-oai · 2026-01-26 19:07:54 +00:00
  09251387e0
• prompt (#9928)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2026-01-26 10:27:18 -08:00
  e471ebc5d2
• fix: attempt to reduce high cpu usage when using collab (#9776)

  Reproduce with a prompt like this with collab enabled:
  ```
  Examine the code at <some subdirectory with a deeply nested project>.  Find the most urgent issue to resolve and describe it to me.
  ```
  
  Existing behavior causes the top-level agent to busy wait on subagents.

  Gene Oden · 2026-01-26 10:07:25 -08:00
  375a5ef051
• Fix flakey shell snapshot test (#9919)

  Sometimes fails with:
  
  ```
  failures:
  
    ---- shell_snapshot::tests::timed_out_snapshot_shell_is_terminated stdout ----
  
    thread 'shell_snapshot::tests::timed_out_snapshot_shell_is_terminated' panicked at codex-rs/core/src/shell_snapshot.rs:588:9:
    expected timeout error, got Failed to execute sh
  
    Caused by:
        Text file busy (os error 26)
  
  
    failures:
        shell_snapshot::tests::timed_out_snapshot_shell_is_terminated
  
    test result: FAILED. 815 passed; 1 failed; 4 ignored; 0 measured; 0 filtered out; finished in 18.00s
  ```

  gt-oai · 2026-01-26 18:05:30 +00:00
  fdc69df454
• feat: codex exec mapping of collab tools (#9817)

  THIS IS NOT THE FINAL UX

  jif-oai · 2026-01-26 18:01:35 +00:00
  01d7f8095b
• Feat: add isOther to question returned by request user input tool (#9890)

  ### Summary
  Add `isOther` to question object from request_user_input tool input and
  remove `other` option from the tool prompt to better handle tool input.

  Shijie Rao · 2026-01-26 09:52:38 -08:00
  3ba702c5b6
• Fix up config disabled err msg (#9916)

  **Before:**
  <img width="745" height="375" alt="image"
  src="https://github.com/user-attachments/assets/d6c23562-b87f-4af9-8642-329aab8e594d"
  />
  
  **After:**
  <img width="1042" height="354" alt="image"
  src="https://github.com/user-attachments/assets/c9a2413c-c945-4c34-8b7e-c6c9b8fbf762"
  />
  
  Two changes:
  1. only display if there is a `config.toml` that is skipped (i.e. if
  there is just `.codex/skills` but no `.codex/config.toml` we do not
  display the error)
  2. clarify the implications and the fix in the error message.

  gt-oai · 2026-01-26 17:49:31 +00:00
  6316e57497
• feat: disable collab at max depth (#9899)
  jif-oai · 2026-01-26 17:05:36 +00:00
  70d5959398
• feat: explorer collab (#9918)
  jif-oai · 2026-01-26 16:21:42 +00:00
  3f338e4a6a
• Fix flakey conversation flow test (#9784)

  I've seen this test fail with:
  
  ```
   - Mock #1.
          	Expected range of matching incoming requests: == 2
          	Number of matched incoming requests: 1
  ```
  
  This is because we pop the wrong task_complete events and then the test
  exits. I think this is because the MCP events are now buffered after
  https://github.com/openai/codex/pull/8874.
  
  So:
  1. clear the buffer before we do any user message sending
  2. additionally listen for task start before task complete
  3. use the ID from task start to find the correct task complete event.

  gt-oai · 2026-01-26 15:58:14 +00:00
  48aeb67f7a