1051 Commits

• Fix jitter in TUI apps/connectors picker (#10593)

  This PR fixes jitter in the TUI apps menu by making the description
  column stable during rendering and height measurement.
  Added a `stable_desc_col` option to
  `SelectionViewParams`/`ListSelectionView`, introduced stable variants of
  the shared row render/measure helpers in `selection_popup_common`, and
  enabled the stable mode for the apps/connectors picker in `chatwidget`.
  With these changes, only the apps/connectors picker uses this new
  option, though it could be used elsewhere in the future.
  
  Why: previously, the description column was computed from only currently
  visible rows, so as you scrolled or filtered, the column could shift and
  cause wrapping/height changes that looked jumpy. Computing it from all
  rows in this popup keeps alignment and layout consistent as users scroll
  through avaialble apps.
  
  
  
  **Before:**
  
  https://github.com/user-attachments/assets/3856cb72-5465-4b90-a993-65a2ffb09113
  
  
  
  
  
  **After:**
  
  https://github.com/user-attachments/assets/37b9d626-0b21-4c0f-8bb8-244c9ef971ff

  canvrno-oai · 2026-02-04 13:51:31 -08:00
  d589ee05b1
• feat: log webscocket timing into runtime metrics (#10577)
  Anton Panasenko · 2026-02-03 18:04:07 -08:00
  fcaed4cb88
• tui: make Esc clear request_user_input notes while notes are shown (#10569)

  ## Summary
  
  This PR updates the `request_user_input` TUI overlay so `Esc` is
  context-aware:
  
  - When notes are visible for an option question, `Esc` now clears notes
  and exits notes mode.
  - When notes are not visible (normal option selection UI), `Esc` still
  interrupts as before.
  
  It also updates footer guidance text to match behavior.
  
  ## Changes
  
  - Added a shared notes-clear path for option questions:
  - `Tab` and `Esc` now both clear notes and return focus to options when
  notes are visible.
  - Updated footer hint text in notes-visible state:
    - from: `tab to clear notes | ... | esc to interrupt`
    - to: `tab or esc to clear notes | ...`
  - Hid `esc to interrupt` hint while notes are visible for option
  questions.
  - Kept `esc to interrupt` visible and functional in normal
  option-selection mode.
  - Updated tests to assert the new `Esc` behavior in notes mode.
  - Updated snapshot output for the notes-visible footer row.
  - Updated docs in `docs/tui-request-user-input.md` to reflect
  mode-specific `Esc` behavior.

  Charley Cunningham · 2026-02-03 16:17:06 -08:00
  a9eb766f33
• feat(tui): pace catch-up stream chunking with hysteresis (#10461)

  ## Summary
  - preserve baseline streaming behavior (smooth mode still commits one
  line per 50ms tick)
  - extract adaptive chunking policy and commit-tick orchestration from
  ChatWidget into `streaming/chunking.rs` and `streaming/commit_tick.rs`
  - add hysteresis-based catch-up behavior with bounded batch draining to
  reduce queue lag without bursty single-frame jumps
  - document policy behavior, tuning guidance, and debug flow in rustdoc +
  docs
  
  ## Testing
  - just fmt
  - cargo test -p codex-tui

  Josh McKinney · 2026-02-03 15:01:51 -08:00
  aec58ac29b
• feat: add APIs to list and download public remote skills (#10448)

  Add API to list / download from remote public skills

  xl-openai · 2026-02-03 14:09:37 -08:00
  f38d181795
• Cleanup collaboration mode variants (#10404)

  ## Summary
  
  This PR simplifies collaboration modes to the visible set `default |
  plan`, while preserving backward compatibility for older partners that
  may still send legacy mode
  names.
  
  Specifically:
  - Renames the old Code behavior to **Default**.
  - Keeps **Plan** as-is.
  - Removes **Custom** mode behavior (fallbacks now resolve to Default).
  - Keeps `PairProgramming` and `Execute` internally for compatibility
  plumbing, while removing them from schema/API and UI visibility.
  - Adds legacy input aliasing so older clients can still send old mode
  names.
  
  ## What Changed
  
  1. Mode enum and compatibility
  - `ModeKind` now uses `Plan` + `Default` as active/public modes.
  - `ModeKind::Default` deserialization accepts legacy values:
    - `code`
    - `pair_programming`
    - `execute`
    - `custom`
  - `PairProgramming` and `Execute` variants remain in code but are hidden
  from protocol/schema generation.
  - `Custom` variant is removed; previous custom fallbacks now map to
  `Default`.
  
  2. Collaboration presets and templates
  - Built-in presets now return only:
    - `Plan`
    - `Default`
  - Template rename:
    - `core/templates/collaboration_mode/code.md` -> `default.md`
  - `execute.md` and `pair_programming.md` remain on disk but are not
  surfaced in visible preset lists.
  
  3. TUI updates
  - Updated user-facing naming and prompts from “Code” to “Default”.
  - Updated mode-cycle and indicator behavior to reflect only visible
  `Plan` and `Default`.
  - Updated corresponding tests and snapshots.
  
  4. request_user_input behavior
  - `request_user_input` remains allowed only in `Plan` mode.
  - Rejection messaging now consistently treats non-plan modes as
  `Default`.
  
  5. Schemas
  - Regenerated config and app-server schemas.
  - Public schema types now advertise mode values as:
    - `plan`
    - `default`
  
  ## Backward Compatibility Notes
  
  - Incoming legacy mode names (`code`, `pair_programming`, `execute`,
  `custom`) are accepted and coerced to `default`.
  - Outgoing/public schema surfaces intentionally expose only `plan |
  default`.
  - This allows tolerant ingestion of older partner payloads while
  standardizing new integrations on the reduced mode set.
  
  ## Codex author
  `codex fork 019c1fae-693b-7840-b16e-9ad38ea0bd00`

  Charley Cunningham · 2026-02-03 09:23:53 -08:00
  d509df676b
• chore: nuke chat/completions API (#10157)
  jif-oai · 2026-02-03 11:31:57 +00:00
  d2394a2494
• Restore status after preamble (#10465)
  pakrym-oai · 2026-02-02 20:35:50 -08:00
  bf87468c2b
• [Codex][CLI] Gate image inputs by model modalities (#10271)

  ###### Summary
  
  - Add input_modalities to model metadata so clients can determine
  supported input types.
  - Gate image paste/attach in TUI when the selected model does not
  support images.
  - Block submits that include images for unsupported models and show a
  clear warning.
  - Propagate modality metadata through app-server protocol/model-list
  responses.
    - Update related tests/fixtures.
  
    ###### Rationale
  
    - Models support different input modalities.
  - Clients need an explicit capability signal to prevent unsupported
  requests.
  - Backward-compatible defaults preserve existing behavior when modality
  metadata is absent.
  
    ###### Scope
  
    - codex-rs/protocol, codex-rs/core, codex-rs/tui
    - codex-rs/app-server-protocol, codex-rs/app-server
    - Generated app-server types / schema fixtures
  
    ###### Trade-offs
  
  - Default behavior assumes text + image when field is absent for
  compatibility.
    - Server-side validation remains the source of truth.
  
    ###### Follow-up
  
  - Non-TUI clients should consume input_modalities to disable unsupported
  attachments.
  - Model catalogs should explicitly set input_modalities for text-only
  models.
  
    ###### Testing
  
    - cargo fmt --all
    - cargo test -p codex-tui
    - env -u GITHUB_APP_KEY cargo test -p codex-core --lib
    - just write-app-server-schema
  - cargo run -p codex-cli --bin codex -- app-server generate-ts --out
  app-server-types
    - test against local backend
    
  <img width="695" height="199" alt="image"
  src="https://github.com/user-attachments/assets/d22dd04f-5eba-4db9-a7c5-a2506f60ec44"
  />
  
  ---------
  
  Co-authored-by: Josh McKinney <joshka@openai.com>

  Colin Young · 2026-02-02 18:56:39 -08:00
  7e07ec8f73
• app tool tip (#10454)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2026-02-03 02:37:01 +00:00
  0999fd82b9
• Hide short worked-for label in final separator (#10452)

  - Hide the "Worked for" label in the final message separator unless
  elapsed time is over one minute.\n- Update/add tests to cover both
  hidden (<60s) and shown (>=61s) behavior.

  Ahmed Ibrahim · 2026-02-03 02:29:20 +00:00
  97ff090104
• Fixed sandbox mode inconsistency if untrusted is selected (#10415)

  This PR addresses #10395
  
  When a user is asked to pick the trust level of a project, the code
  currently reloads the config if they select "trusted". It doesn't reload
  the config in the "untrusted" case but should. This causes the sandbox
  mode to be reported incorrectly in `/status` during the first run (it's
  displayed as `read-only` even though it acts as though it's
  `workspace-write`).

  Eric Traut · 2026-02-03 02:00:35 +00:00
  8dd41e229b
• feat: replace custom mcp-types crate with equivalents from rmcp (#10349)

  We started working with MCP in Codex before
  https://crates.io/crates/rmcp was mature, so we had our own crate for
  MCP types that was generated from the MCP schema:
  
  
  https://github.com/openai/codex/blob/8b95d3e082376f4cb23e92641705a22afb28a9da/codex-rs/mcp-types/README.md
  
  Now that `rmcp` is more mature, it makes more sense to use their MCP
  types in Rust, as they handle details (like the `_meta` field) that our
  custom version ignored. Though one advantage that our custom types had
  is that our generated types implemented `JsonSchema` and `ts_rs::TS`,
  whereas the types in `rmcp` do not. As such, part of the work of this PR
  is leveraging the adapters between `rmcp` types and the serializable
  types that are API for us (app server and MCP) introduced in #10356.
  
  Note this PR results in a number of changes to
  `codex-rs/app-server-protocol/schema`, which merit special attention
  during review. We must ensure that these changes are still
  backwards-compatible, which is possible because we have:
  
  ```diff
  - export type CallToolResult = { content: Array<ContentBlock>, isError?: boolean, structuredContent?: JsonValue, };
  + export type CallToolResult = { content: Array<JsonValue>, structuredContent?: JsonValue, isError?: boolean, _meta?: JsonValue, };
  ```
  
  so `ContentBlock` has been replaced with the more general `JsonValue`.
  Note that `ContentBlock` was defined as:
  
  ```typescript
  export type ContentBlock = TextContent | ImageContent | AudioContent | ResourceLink | EmbeddedResource;
  ```
  
  so the deletion of those individual variants should not be a cause of
  great concern.
  
  Similarly, we have the following change in
  `codex-rs/app-server-protocol/schema/typescript/Tool.ts`:
  
  ```
  - export type Tool = { annotations?: ToolAnnotations, description?: string, inputSchema: ToolInputSchema, name: string, outputSchema?: ToolOutputSchema, title?: string, };
  + export type Tool = { name: string, title?: string, description?: string, inputSchema: JsonValue, outputSchema?: JsonValue, annotations?: JsonValue, icons?: Array<JsonValue>, _meta?: JsonValue, };
  ```
  
  so:
  
  - `annotations?: ToolAnnotations` ➡️ `JsonValue`
  - `inputSchema: ToolInputSchema` ➡️ `JsonValue`
  - `outputSchema?: ToolOutputSchema` ➡️ `JsonValue`
  
  and two new fields: `icons?: Array<JsonValue>, _meta?: JsonValue`
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/10349).
  * #10357
  * __->__ #10349
  * #10356

  Michael Bolin · 2026-02-02 17:41:55 -08:00
  66447d5d2c
• TUI: Render request_user_input results in history and simplify interrupt handling (#10064)

  ## Summary
  This PR improves the TUI experience for `request_user_input` by
  rendering submitted question/answer sets directly in conversation
  history with clear, structured formatting.
  
  It also intentionally simplifies interrupt behavior for now: on `Esc` /
  `Ctrl+C`, the questions overlay interrupts the turn without attempting
  to submit partial answers.
  
  <img width="1344" height="573" alt="Screenshot 2026-02-02 at 4 51 40 PM"
  src="https://github.com/user-attachments/assets/ff752131-7060-44c1-9ded-af061969a533"
  />
  
  ## Scope
  - TUI-only changes.
  - No core/protocol/app-server behavior changes in this PR.
  - Resume reconstruction of interrupted question sets is out of scope for
  this PR.
  
  ## What Changed
  - Added a new history cell: `RequestUserInputResultCell` in
  `codex-rs/tui/src/history_cell.rs`.
  - On normal `request_user_input` submission, TUI now inserts that
  history cell immediately after sending `Op::UserInputAnswer`.
  - Rendering includes a `Questions` header with `answered/total` count.
  - Rendering shows each question as a bullet item.
  - Rendering styles submitted answer lines in cyan.
  - Rendering styles notes (for option questions) as `note:` lines in
  cyan.
  - Rendering styles freeform text (for no-option questions) as `answer:`
  lines in cyan.
  - Rendering dims only the `(unanswered)` suffix.
  - Rendering can include an interrupted suffix and summary text when the
  cell is marked interrupted.
  - Rendering redacts secret questions as `••••••` instead of showing raw
  values.
  - Added `wrap_with_prefix(...)` in `history_cell.rs` for wrapped
  prefixed lines.
  - Added `split_request_user_input_answer(...)` in `history_cell.rs` for
  decoding `"user_note: ..."` entries.
  
  ## Interrupt Behavior (Intentional for this PR)
  - `Esc` / `Ctrl+C` in the questions overlay now performs `Op::Interrupt`
  and exits the overlay.
  - It does **not** submit partial/committed answers on interrupt.
  - Added TODO comments in `request_user_input` overlay interrupt paths
  indicating where interrupted partial result emission should be
  reintroduced once core support is finalized.
  - Queued `request_user_input` overlays are discarded on interrupt in the
  current behavior.
  
  ## Tests Updated
  - Updated/added overlay tests in
  `codex-rs/tui/src/bottom_pane/request_user_input/mod.rs` to reflect
  interrupt-only behavior.
  - Added helper assertion for interrupt-only event expectation.
  - Existing submission-path tests now validate history insertion behavior
  and expected answer maps.
  
  ## Behavior Notes
  - Completed question flows now produce a readable `Questions` block in
  transcript history.
  - Interrupted flows currently do not persist partial answers to
  model-visible tool output.
  
  ## Follow-ups
  - Reintroduce partial-answer-on-interrupt semantics once core can
  persist/sequence interrupted `request_user_input` outputs safely.
  - Optionally add replay/resume rendering for interrupted question sets
  as a separate PR.
  
  ## Codex author
  `codex fork 019bfb8d-2a65-7313-9be2-ea7100d19a61`

  Charley Cunningham · 2026-02-02 17:41:30 -08:00
  8f5edddf71
• Fix plan implementation prompt reappearing after /agent thread switch (#10447)

  ## Summary
  
  This fixes a UX bug (https://github.com/openai/codex/issues/10442) where
  the **"Implement this plan?"** prompt could reappear after switching
  agents with `/agent` and then switching back to the original agent
  during plan execution.
  
  ## Root Cause
  
  On thread switch, the TUI rebuilds `ChatWidget`, replays buffered thread
  events, then drains any queued live events.
  
  In this flow, a `TurnComplete` can be handled twice for the same logical
  turn:
  1. replayed (`from_replay = true`)
  2. then live (`from_replay = false`)
  
  `ChatWidget` used `saw_plan_item_this_turn` to decide whether to show
  the plan implementation prompt, but that flag was only reset on
  `TurnStarted`.
  If duplicate completion events occurred, stale `saw_plan_item_this_turn
  = true` could cause the prompt to re-trigger unexpectedly.
  
  ## Fix
  
  - Clear `saw_plan_item_this_turn` at the end of `on_task_complete`,
  after prompt gating runs.
  - This keeps the flag truly turn-scoped and prevents duplicate
  `TurnComplete` handling from reopening the prompt.

  Charley Cunningham · 2026-02-02 17:40:05 -08:00
  1096d6453c
• Add codex app macOS launcher (#10418)

  - Add `codex app <path>` to launch the Codex Desktop app.
  - On macOS, auto-downloads the DMG if missing; non-macOS prints a link
  to chatgpt.com/codex.

  Ahmed Ibrahim · 2026-02-02 17:37:04 -08:00
  d02db8b43d
• chore(tui) /personalities tip (#10377)

  ## Summary
  We have /personality now.
  
  ## Testing
  - [x] tested locally

  Dylan Hurd · 2026-02-02 15:35:37 -08:00
  98debeda8a
• emit a separate metric when the user cancels UAT during elevated setup (#10399)

  Currently this shows up as elevated setup failure, which isn't quite
  accurate.

  iceweasel-oai · 2026-02-02 15:31:08 -08:00
  a5066bef78
• Select experimental features with space (#10281)
  pakrym-oai · 2026-02-02 11:35:11 -08:00
  74327fa59c
• Add credits tooltip (#10274)
  pakrym-oai · 2026-02-02 10:06:43 -08:00
  9d976962ec
• Nicer highlighting of slash commands, /plan accepts prompt args and pasted images (#10269)

  ## Summary
  - Make typed slash commands become text elements when the user hits
  space, including paste‑burst spaces.
  - Enable `/plan` to accept inline args and submit them in plan mode,
  mirroring `/review` behavior and blocking submission while a task is
  running.
  - Preserve text elements/attachments for slash commands that take args.
  
  <img width="1510" height="500" alt="image"
  src="https://github.com/user-attachments/assets/446024df-b69a-4249-85db-1a85110e07f1"
  />
  
  ## Changes
  - Add safe helper to insert element ranges in the textarea.
  - Extend command‑with‑args pipeline to carry text elements and reuse
  submission prep.
  - Update `/plan` dispatch to switch to plan mode then submit prompt +
  elements.
  - Document new composer behavior and add tests.
  
  ## Notes
  - `/plan` is blocked during active tasks (same as `/review`).
  - Slash‑command elementization recognizes built‑ins and `/prompts:`
  custom commands only.
  
  ## Codex author
  `codex fork 019c16d3-4520-7bb0-9b9d-48720d40a8ab`

  Charley Cunningham · 2026-02-02 09:53:29 -08:00
  3392c5af24
• Session picker shows thread_name if set (#10340)

  - shows names of threads in the ResumePicker used by `/resume` and
  `codex resume` if set, default to preview (previous behaviour) if none
  - adds a `find_thread_names_by_ids` that maps names to IDs in
  `codex-rs/core/src/rollout/session_index.rs`. It reads sequentially in
  normal (instead of reverse order in `codex resume <name>`) the index
  mapping file. This function is called from a list of session (default
  page is 25, pages loaded depends of height of terminal), for which most
  of them will always have at least one session unnamed and require the
  whole file to be read therefore. Could be better and sqlite integration
  will make this better
  - those reads won't be needed when leveraging sqlite
   
  
  Opened questions:
  - We could rename the TUI "Conversation" column to "Name" or "Thread"
  that would feel more accurate. Could be a fast-follow if we implement
  auto-naming as it'll always be a name instead?

  pap-openai · 2026-02-02 08:13:17 +00:00
  1644cbfc6d
• chore(config) Rename config setting to personality (#10314)

  ## Summary
  Let's make the setting name consistent with the SlashCommand!
  
  ## Testing
  - [x] Updated tests

  Dylan Hurd · 2026-01-31 19:38:06 -08:00
  a33fa4bfe5
• Add websocket telemetry metrics and labels (#10316)

  Summary
  - expose websocket telemetry hooks through the responses client so
  request durations and event processing can be reported
  - record websocket request/event metrics and emit runtime telemetry
  events that the history UI now surfaces
  - improve tests to cover websocket telemetry reporting and guard runtime
  summary updates
  
  
  <img width="824" height="79" alt="Screenshot 2026-01-31 at 5 28 12 PM"
  src="https://github.com/user-attachments/assets/ea9a7965-d8b4-4e3c-a984-ef4fdc44c81d"
  />

  Anton Panasenko · 2026-01-31 19:16:44 -08:00
  101d359cd7
• feat(core,tui,app-server) personality migration (#10307)

  ## Summary
  Keep existing users on Pragmatic, to preserve behavior while new users
  default to Friendly
  
  ## Testing
  - [x] Tested locally
  - [x] add integration tests

  Dylan Hurd · 2026-01-31 17:25:14 -07:00
  0f9858394b
• feat: show runtime metrics in console (#10278)

  Summary of changes:
  
  - Adds a new feature flag: runtime_metrics
    - Declared in core/src/features.rs
    - Added to core/config.schema.json
    - Wired into OTEL init in core/src/otel_init.rs
  
  - Enables on-demand runtime metric snapshots in OTEL
    - Adds runtime_metrics: bool to otel/src/config.rs
    - Enables experimental custom reader features in otel/Cargo.toml
    - Adds snapshot/reset/summary APIs in:
      - otel/src/lib.rs
      - otel/src/metrics/client.rs
      - otel/src/metrics/config.rs
      - otel/src/metrics/error.rs
  
  - Defines metric names and a runtime summary builder
    - New files:
      - otel/src/metrics/names.rs
      - otel/src/metrics/runtime_metrics.rs
    - Summarizes totals for:
      - Tool calls
      - API requests
      - SSE/streaming events
  
  - Instruments metrics collection in OTEL manager
    - otel/src/traces/otel_manager.rs now records:
      - API call counts + durations
      - SSE event counts + durations (success/failure)
      - Tool call metrics now use shared constants
  
  - Surfaces runtime metrics in the TUI
    - Resets runtime metrics at turn start in tui/src/chatwidget.rs
  - Displays metrics in the final separator line in
  tui/src/history_cell.rs
  
  - Adds tests
    - New OTEL tests:
      - otel/tests/suite/snapshot.rs
      - otel/tests/suite/runtime_summary.rs
    - New TUI test:
  - final_message_separator_includes_runtime_metrics in
  tui/src/history_cell.rs
  
  Scope:
  - 19 files changed
  - ~652 insertions, 38 deletions
  
  
  <img width="922" height="169" alt="Screenshot 2026-01-30 at 4 11 34 PM"
  src="https://github.com/user-attachments/assets/1efd754d-a16d-4564-83a5-f4442fd2f998"
  />

  Anton Panasenko · 2026-01-30 22:20:02 -08:00
  8660ad6c64
• Fix minor typos in comments and documentation (#10287)

  ## Summary
  
  I have read the contribution guidelines.  
  All changes in this PR are limited to text corrections and do not modify
  any business logic, runtime behavior, or user-facing functionality.
  
  ## Details
  
  This PR fixes several minor typos, including:
  
  - `create` -> `crate`
  - `analagous` -> `analogous`
  - `apply-patch` -> `apply_patch`
  - `codecs` -> `codex`
  - ` '/" ` -> ` '/' `
  - `Respesent` -> `Represent`

  Ruyut · 2026-01-30 22:11:02 -08:00
  9327e99b28
• add missing fields to WebSearchAction and update app-server types (#10276)

  - add `WebSearchAction` to app-server v2 types
  - add `queries` to `WebSearchAction::Search` type
  
  Updated tests.

  sayan-oai · 2026-01-30 16:37:56 -08:00
  eb86663dcb
• Add enforce_residency to requirements (#10263)

  Add `enforce_residency` to requirements.toml and thread it through to a
  header on `default_client`.

  gt-oai · 2026-01-31 00:26:25 +00:00
  149f3aa27a
• fix: update file search directory when session CWD changes (#9279)

  ## Summary
  
  Fixes #9041
  
  - Adds update_search_dir() method to FileSearchManager to allow updating
  the search directory after initialization
  - Calls this method when the session CWD changes: new session, resume,
  or fork
  
  ## Problem
  
  The FileSearchManager was created once with the initial search_dir and
  never updated. When a user:
  
  1. Starts Codex in a non-git directory (e.g., /tmp/random)
  2. Resumes or forks a session from a different workspace
  3. The @filename lookup still searched the original directory
  
  This caused no matches to be returned even when files existed in the
  current workspace.
  
  ## Solution
  
  Update FileSearchManager.search_dir whenever the session working
  directory changes:
  - AppEvent::NewSession: Use current config CWD
  - SessionSelection::Resume: Use resumed session CWD
  - SessionSelection::Fork: Use forked session CWD
  
  ## Test plan
  
  - [ ] Start Codex in /tmp/test-dir (non-git)
  - [ ] Resume a session from a project with actual files
  - [ ] Verify @filename returns matches from the resumed session
  directory
  
  ---------
  
  Co-authored-by: Eric Traut <etraut@openai.com>

  Yuvraj Angad Singh · 2026-01-30 14:59:20 -08:00
  13e85b1549
• file-search: multi-root walk (#10240)

  Instead of a separate walker for each root in a multi-root walk, use a
  single walker.

  Jeremy Rose · 2026-01-30 22:20:23 +00:00
  d59685f6d4
• Hide /approvals from the slash-command list (#10265)

  `/permissions` is the replacement. `/approvals` still available when
  typing.

  pakrym-oai · 2026-01-30 22:12:50 +00:00
  0fac2744f7
• Update copy (#10256)

  <img width="839" height="62" alt="image"
  src="https://github.com/user-attachments/assets/ca987cdb-9e8c-403e-8856-a9b37baa7673"
  />

  pakrym-oai · 2026-01-30 12:57:19 -08:00
  aacd530a41
• Make plan highlight use popup grey background (#10253)

  ## Summary
  - align proposed plan background with popup surface color by reusing
  `user_message_bg`
  - remove the custom blue-tinted plan background
  
  <img width="1572" height="1568" alt="image"
  src="https://github.com/user-attachments/assets/63a5341e-4342-4c07-b6b0-c4350c3b2639"
  />

  Charley Cunningham · 2026-01-30 12:39:15 -08:00
  83317ed4bf
• Fix deploy (#10251)

  Fix
  https://github.com/openai/codex/actions/runs/21527697445/job/62035898666

  Charley Cunningham · 2026-01-30 11:57:13 -08:00
  2457bb3c40
• chore: rename ChatGpt -> Chatgpt in type names (#10244)

  When using ChatGPT in names of types, we should be consistent, so this
  renames some types with `ChatGpt` in the name to `Chatgpt`. From
  https://rust-lang.github.io/api-guidelines/naming.html:
  
  > In `UpperCamelCase`, acronyms and contractions of compound words count
  as one word: use `Uuid` rather than `UUID`, `Usize` rather than `USize`
  or `Stdin` rather than `StdIn`. In `snake_case`, acronyms and
  contractions are lower-cased: `is_xid_start`.
  
  This PR updates existing uses of `ChatGpt` and changes them to
  `Chatgpt`. Though in all cases where it could affect the wire format, I
  visually inspected that we don't change anything there. That said, this
  _will_ change the codegen because it will affect the spelling of type
  names.
  
  For example, this renames `AuthMode::ChatGPT` to `AuthMode::Chatgpt` in
  `app-server-protocol`, but the wire format is still `"chatgpt"`.
  
  This PR also updates a number of types in `codex-rs/core/src/auth.rs`.

  Michael Bolin · 2026-01-30 11:18:39 -08:00
  e6d913af2d
• Tui: hide Code mode footer label (#10063)

  Title
  Hide Code mode footer label/cycle hint; add Plan footer-collapse
  snapshots
  
  Summary
  - Keep Code mode internal naming but suppress the footer mode label +
  cycle hint when Code is active.
  - Only show the cycle hint when a non‑Code mode indicator is present.
  - Add Plan-mode footer collapse snapshot coverage (empty + queued,
  across widths) and update existing footer collapse snapshots for the new
  Code behavior.
  
  Notes
  - The test run currently fails in codex-cloud-requirements on
  origin/main due to a stale auth.mode field; no fix is included in this
  PR to keep the diff minimal.
  
  Codex author
  `codex resume 019c0296-cfd4-7193-9b0a-6949048e4546`

  Charley Cunningham · 2026-01-30 11:15:21 -08:00
  2d10aa6859
• Plan mode: stream proposed plans, emit plan items, and render in TUI (#9786)

  ## Summary
  - Stream proposed plans in Plan Mode using `<proposed_plan>` tags parsed
  in core, emitting plan deltas plus a plan `ThreadItem`, while stripping
  tags from normal assistant output.
  - Persist plan items and rebuild them on resume so proposed plans show
  in thread history.
  - Wire plan items/deltas through app-server protocol v2 and render a
  dedicated proposed-plan view in the TUI, including the “Implement this
  plan?” prompt only when a plan item is present.
  
  ## Changes
  
  ### Core (`codex-rs/core`)
  - Added a generic, line-based tag parser that buffers each line until it
  can disprove a tag prefix; implements auto-close on `finish()` for
  unterminated tags. `codex-rs/core/src/tagged_block_parser.rs`
  - Refactored proposed plan parsing to wrap the generic parser.
  `codex-rs/core/src/proposed_plan_parser.rs`
  - In plan mode, stream assistant deltas as:
    - **Normal text** → `AgentMessageContentDelta`
    - **Plan text** → `PlanDelta` + `TurnItem::Plan` start/completion  
    (`codex-rs/core/src/codex.rs`)
  - Final plan item content is derived from the completed assistant
  message (authoritative), not necessarily the concatenated deltas.
  - Strips `<proposed_plan>` blocks from assistant text in plan mode so
  tags don’t appear in normal messages.
  (`codex-rs/core/src/stream_events_utils.rs`)
  - Persist `ItemCompleted` events only for plan items for rollout replay.
  (`codex-rs/core/src/rollout/policy.rs`)
  - Guard `update_plan` tool in Plan Mode with a clear error message.
  (`codex-rs/core/src/tools/handlers/plan.rs`)
  - Updated Plan Mode prompt to:  
    - keep `<proposed_plan>` out of non-final reasoning/preambles  
    - require exact tag formatting  
    - allow only one `<proposed_plan>` block per turn  
    (`codex-rs/core/templates/collaboration_mode/plan.md`)
  
  ### Protocol / App-server protocol
  - Added `TurnItem::Plan` and `PlanDeltaEvent` to core protocol items.
  (`codex-rs/protocol/src/items.rs`, `codex-rs/protocol/src/protocol.rs`)
  - Added v2 `ThreadItem::Plan` and `PlanDeltaNotification` with
  EXPERIMENTAL markers and note that deltas may not match the final plan
  item. (`codex-rs/app-server-protocol/src/protocol/v2.rs`)
  - Added plan delta route in app-server protocol common mapping.
  (`codex-rs/app-server-protocol/src/protocol/common.rs`)
  - Rebuild plan items from persisted `ItemCompleted` events on resume.
  (`codex-rs/app-server-protocol/src/protocol/thread_history.rs`)
  
  ### App-server
  - Forward plan deltas to v2 clients and map core plan items to v2 plan
  items. (`codex-rs/app-server/src/bespoke_event_handling.rs`,
  `codex-rs/app-server/src/codex_message_processor.rs`)
  - Added v2 plan item tests.
  (`codex-rs/app-server/tests/suite/v2/plan_item.rs`)
  
  ### TUI
  - Added a dedicated proposed plan history cell with special background
  and padding, and moved “• Proposed Plan” outside the highlighted block.
  (`codex-rs/tui/src/history_cell.rs`, `codex-rs/tui/src/style.rs`)
  - Only show “Implement this plan?” when a plan item exists.
  (`codex-rs/tui/src/chatwidget.rs`,
  `codex-rs/tui/src/chatwidget/tests.rs`)
  
  <img width="831" height="847" alt="Screenshot 2026-01-29 at 7 06 24 PM"
  src="https://github.com/user-attachments/assets/69794c8c-f96b-4d36-92ef-c1f5c3a8f286"
  />
  
  ### Docs / Misc
  - Updated protocol docs to mention plan deltas.
  (`codex-rs/docs/protocol_v1.md`)
  - Minor plumbing updates in exec/debug clients to tolerate plan deltas.
  (`codex-rs/debug-client/src/reader.rs`, `codex-rs/exec/...`)
  
  ## Tests
  - Added core integration tests:
    - Plan mode strips plan from agent messages.
    - Missing `</proposed_plan>` closes at end-of-message.  
    (`codex-rs/core/tests/suite/items.rs`)
  - Added unit tests for generic tag parser (prefix buffering, non-tag
  lines, auto-close). (`codex-rs/core/src/tagged_block_parser.rs`)
  - Existing app-server plan item tests in v2.
  (`codex-rs/app-server/tests/suite/v2/plan_item.rs`)
  
  ## Notes / Behavior
  - Plan output no longer appears in standard assistant text in Plan Mode;
  it streams via `PlanDelta` and completes as a `TurnItem::Plan`.
  - The final plan item content is authoritative and may diverge from
  streamed deltas (documented as experimental).
  - Reasoning summaries are not filtered; prompt instructs the model not
  to include `<proposed_plan>` outside the final plan message.
  
  ## Codex Author
  `codex fork 019bec2d-b09d-7450-b292-d7bcdddcdbfb`

  Charley Cunningham · 2026-01-30 18:59:30 +00:00
  ec4a2d07e4
• feat: refactor CodexAuth so invalid state cannot be represented (#10208)

  Previously, `CodexAuth` was defined as follows:
  
  
  https://github.com/openai/codex/blob/d550fbf41afc09d7d7b5ac813aea38de07b2a73f/codex-rs/core/src/auth.rs#L39-L46
  
  But if you looked at its constructors, we had creation for
  `AuthMode::ApiKey` where `storage` was built using a nonsensical path
  (`PathBuf::new()`) and `auth_dot_json` was `None`:
  
  
  https://github.com/openai/codex/blob/d550fbf41afc09d7d7b5ac813aea38de07b2a73f/codex-rs/core/src/auth.rs#L212-L220
  
  By comparison, when `AuthMode::ChatGPT` was used, `api_key` was always
  `None`:
  
  
  https://github.com/openai/codex/blob/d550fbf41afc09d7d7b5ac813aea38de07b2a73f/codex-rs/core/src/auth.rs#L665-L671
  
  https://github.com/openai/codex/pull/10012 took things further because
  it introduced a new `ChatgptAuthTokens` variant to `AuthMode`, which is
  important in when invoking `account/login/start` via the app server, but
  most logic _internal_ to the app server should just reason about two
  `AuthMode` variants: `ApiKey` and `ChatGPT`.
  
  This PR tries to clean things up as follows:
  
  - `LoginAccountParams` and `AuthMode` in `codex-rs/app-server-protocol/`
  both continue to have the `ChatgptAuthTokens` variant, though it is used
  exclusively for the on-the-wire messaging.
  - `codex-rs/core/src/auth.rs` now has its own `AuthMode` enum, which
  only has two variants: `ApiKey` and `ChatGPT`.
  - `CodexAuth` has been changed from a struct to an enum. It is a
  disjoint union where each variant (`ApiKey`, `ChatGpt`, and
  `ChatGptAuthTokens`) have only the associated fields that make sense for
  that variant.
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/10208).
  * #10224
  * __->__ #10208

  Michael Bolin · 2026-01-30 09:33:23 -08:00
  377ab0c77c
• Fetch Requirements from cloud (#10167)

  Load requirements from Codex Backend. It only does this for enterprise
  customers signed in with ChatGPT.
  
  Todo in follow-up PRs:
  * Add to app-server and exec too
  * Switch from fail-open to fail-closed on failure

  gt-oai · 2026-01-30 12:03:29 +00:00
  e85d019daa
• Conversation naming (#8991)

  Session renaming:
  - `/rename my_session`
  - `/rename` without arg and passing an argument in `customViewPrompt`
  - AppExitInfo shows resume hint using the session name if set instead of
  uuid, defaults to uuid if not set
  - Names are stored in `CODEX_HOME/sessions.jsonl`
  
  Session resuming:
  - codex resume <name> lookup for `CODEX_HOME/sessions.jsonl` first entry
  matching the name and resumes the session
  
  ---------
  
  Co-authored-by: jif-oai <jif@openai.com>

  pap-openai · 2026-01-30 10:40:09 +00:00
  1ef5455eb6
• Add community links to startup tooltips (#10177)

  ## Summary
  - add startup tooltip for OpenAI community Discord
  - add startup tooltip for Codex community forum
  
  ## Testing
  - not run (text-only tooltip change)

  Josh McKinney · 2026-01-30 10:14:15 +01:00
  c0cad80668
• feat: add output to /ps (#10154)

  <img width="599" height="238" alt="Screenshot 2026-01-29 at 13 24 57"
  src="https://github.com/user-attachments/assets/1e9a5af2-f649-476c-b310-ae4938814538"
  />

  jif-oai · 2026-01-30 09:00:44 +01:00
  a270a28a06
• feat(tui): route employee feedback follow-ups to internal link (#10198)

  ## Problem
  OpenAI employees were sent to the public GitHub issue flow after
  `/feedback`, which is the wrong follow-up path internally.
  
  ## Mental model
  After feedback upload completes, we render a follow-up link/message.
  That link should be audience-aware but must not change the upload
  pipeline itself.
  
  ## Non-goals
  - Changing how feedback is captured or uploaded
  - Changing external user behavior
  
  ## Tradeoffs
  We detect employees via the authenticated account email suffix
  (`@openai.com`). If the email is unavailable (e.g., API key auth), we
  default to the external behavior.
  
  ## Architecture
  - Introduce `FeedbackAudience` and thread it from `App` -> `ChatWidget`
  -> `FeedbackNoteView`
  - Gate internal messaging/links on `FeedbackAudience::OpenAiEmployee`
  - Internal follow-up link is now `http://go/codex-feedback-internal`
  - External GitHub URL remains byte-for-byte identical
  
  ## Observability
  No new telemetry; this only changes rendered follow-up instructions.
  
  ## Tests
  - `just fmt`
  - `cargo test -p codex-tui --lib`

  Josh McKinney · 2026-01-30 02:12:46 +00:00
  36f2fe8af9
• tui: add feature-gated /plan slash command to switch to Plan mode (#10103)

  ## Summary
  Adds a simple `/plan` slash command in the TUI that switches the active
  collaboration mode to Plan mode. The command is only available when the
  `collaboration_modes` feature is enabled.
  
  ## Changes
  - Add `plan_mask` helper in `codex-rs/tui/src/collaboration_modes.rs`
  - Add `SlashCommand::Plan` metadata in
  `codex-rs/tui/src/slash_command.rs`
  - Implement and hard-gate `/plan` dispatch in
  `codex-rs/tui/src/chatwidget.rs`
  - Hide `/plan` when collaboration modes are disabled in
  `codex-rs/tui/src/bottom_pane/slash_commands.rs`
  - Update command popup tests in
  `codex-rs/tui/src/bottom_pane/command_popup.rs`
  - Add a focused unit test for `/plan` in
  `codex-rs/tui/src/chatwidget/tests.rs`
  
  ## Behavior notes
  - `/plan` is now a no-op if `Feature::CollaborationModes` is disabled.
  - When enabled, `/plan` switches directly to Plan mode without opening
  the picker.
  
  ## Codex author
  `codex resume 019c05da-d7c3-7322-ae2c-3ca38d0ef702`

  Charley Cunningham · 2026-01-29 16:40:43 -08:00
  11958221a3
• feat(app-server): support external auth mode (#10012)

  This enables a new use case where `codex app-server` is embedded into a
  parent application that will directly own the user's ChatGPT auth
  lifecycle, which means it owns the user’s auth tokens and refreshes it
  when necessary. The parent application would just want a way to pass in
  the auth tokens for codex to use directly.
  
  The idea is that we are introducing a new "auth mode" currently only
  exposed via app server: **`chatgptAuthTokens`** which consist of the
  `id_token` (stores account metadata) and `access_token` (the bearer
  token used directly for backend API calls). These auth tokens are only
  stored in-memory. This new mode is in addition to the existing `apiKey`
  and `chatgpt` auth modes.
  
  This PR reuses the shape of our existing app-server account APIs as much
  as possible:
  - Update `account/login/start` with a new `chatgptAuthTokens` variant,
  which will allow the client to pass in the tokens and have codex
  app-server use them directly. Upon success, the server emits
  `account/login/completed` and `account/updated` notifications.
  - A new server->client request called
  `account/chatgptAuthTokens/refresh` which the server can use whenever
  the access token previously passed in has expired and it needs a new one
  from the parent application.
  
  I leveraged the core 401 retry loop which typically triggers auth token
  refreshes automatically, but made it pluggable:
  - **chatgpt** mode refreshes internally, as usual.
  - **chatgptAuthTokens** mode calls the client via
  `account/chatgptAuthTokens/refresh`, the client responds with updated
  tokens, codex updates its in-memory auth, then retries. This RPC has a
  10s timeout and handles JSON-RPC errors from the client.
  
  Also some additional things:
  - chatgpt logins are blocked while external auth is active (have to log
  out first. typically clients will pick one OR the other, not support
  both)
  - `account/logout` clears external auth in memory
  - Ensures that if `forced_chatgpt_workspace_id` is set via the user's
  config, we respect it in both:
  - `account/login/start` with `chatgptAuthTokens` (returns a JSON-RPC
  error back to the client)
  - `account/chatgptAuthTokens/refresh` (fails the turn, and on next
  request app-server will send another `account/chatgptAuthTokens/refresh`
  request to the client).

  Owen Lin · 2026-01-29 23:46:04 +00:00
  81a17bb2c1
• [Codex][CLI] Show model-capacity guidance on 429 (#10118)

  ###### Problem
  Users get generic 429s with no guidance when a model is at capacity.
  ###### Solution
  Detect model-cap headers, surface a clear “try a different model”
  message, and keep behavior non‑intrusive (no auto‑switch).
  ###### Scope
  CLI/TUI only; protocol + error mapping updated to carry model‑cap info.
  ###### Tests
        - just fmt
        - cargo test -p codex-tui
  - cargo test -p codex-core --lib
  shell_snapshot::tests::try_new_creates_and_deletes_snapshot_file --
  --nocapture (ran in isolated env)
        - validate local build with backend
       
  <img width="719" height="845" alt="image"
  src="https://github.com/user-attachments/assets/1470b33d-0974-4b1f-b8e6-d11f892f4b54"
  />

  Colin Young · 2026-01-29 14:59:07 -08:00
  b79bf69af6
• updating comment to better indicate intent of skipping quit in the main slash command menu (#10186)

  Updates comment indicating intent for skipping `quit` in the main slash
  command dropdown.

  natea-oai · 2026-01-29 14:41:42 -08:00
  ca9d417633
• fix: /approvals -> /permissions (#10184)

  I believe we should be recommending `/permissions` in light of
  https://github.com/openai/codex/pull/9561.

  Michael Bolin · 2026-01-29 20:36:53 +00:00
  2d9ac8227a
• Better handling skill depdenencies on ENV VAR. (#9017)

  An experimental flow for env var skill dependencies. Skills can now
  declare required env vars in SKILL.md; if missing, the CLI prompts the
  user to get the value, and Core will store it in memory (eventually to a
  local persistent store)
  <img width="790" height="169" alt="image"
  src="https://github.com/user-attachments/assets/cd928918-9403-43cb-a7e7-b8d59bcccd9a"
  />

  xl-openai · 2026-01-29 14:13:30 -05:00
  bdd8a7d58b