840 Commits

• fix(app-server): set originator header from initialize (re-revert) (#8988)

  Reapplies https://github.com/openai/codex/pull/8873 which was reverted
  due to merge conflicts

  Owen Lin · 2026-01-09 12:09:30 -08:00
  fbe883318d
• fix: add tui.alternate_screen config and --no-alt-screen CLI flag for Zellij scrollback (#8555)

  Fixes #2558
  
  Codex uses alternate screen mode (CSI 1049) which, per xterm spec,
  doesn't support scrollback. Zellij follows this strictly, so users can't
  scroll back through output.
  
  **Changes:**
  - Add `tui.alternate_screen` config: `auto` (default), `always`, `never`
  - Add `--no-alt-screen` CLI flag
  - Auto-detect Zellij and skip alt screen (uses existing `ZELLIJ` env var
  detection)
  
  **Usage:**
  ```bash
  # CLI flag
  codex --no-alt-screen
  
  # Or in config.toml
  [tui]
  alternate_screen = "never"
  ```
  
  With default `auto` mode, Zellij users get working scrollback without
  any config changes.
  
  ---------
  
  Co-authored-by: Josh McKinney <joshka@openai.com>

  Helmut Januschka · 2026-01-09 18:38:26 +00:00
  7daaabc795
• renaming: task to turn (#8963)
  jif-oai · 2026-01-09 17:31:17 +00:00
  1aed01e99f
• nit: rename to analytics_enabled (#8978)
  jif-oai · 2026-01-09 17:18:42 +00:00
  ed64804cb5
• Revert "fix(app-server): set originator header from initialize JSON-RPC request" (#8986)

  Reverts openai/codex#8873

  jif-oai · 2026-01-09 17:00:53 +00:00
  5c380d5b1e
• Add config to disable /feedback (#8909)

  Some enterprises do not want their users to be able to `/feedback`.
  
  <img width="395" height="325" alt="image"
  src="https://github.com/user-attachments/assets/2dae9c0b-20c3-4a15-bcd3-0187857ebbd8"
  />
  
  Adds to `config.toml`:
  
  ```toml
  [feedback]
  enabled = false
  ```
  
  I've deliberately decided to:
  1. leave other references to `/feedback` (e.g. in the interrupt message,
  tips of the day) unchanged. I think we should continue to promote the
  feature even if it is not usable currently.
  2. leave the `/feedback` menu item selectable and display an error
  saying it's disabled, rather than remove the menu item (which I believe
  would raise more questions).
  
  but happy to discuss these.
  
  This will be followed by a change to requirements.toml that admins can
  use to force the value of feedback.enabled.

  gt-oai · 2026-01-09 16:33:48 +00:00
  5b5a5b92b5
• fix(app-server): set originator header from initialize JSON-RPC request (#8873)

  **Motivation**
  The `originator` header is important for codex-backend’s Responses API
  proxy because it identifies the real end client (codex cli, codex vscode
  extension, codex exec, future IDEs) and is used to categorize requests
  by client for our enterprise compliance API.
  
  Today the `originator` header is set by either:
  - the `CODEX_INTERNAL_ORIGINATOR_OVERRIDE` env var (our VSCode extension
  does this)
  - calling `set_default_originator()` which sets a global immutable
  singleton (`codex exec` does this)
  
  For `codex app-server`, we want the `initialize` JSON-RPC request to set
  that header because it is a natural place to do so. Example:
  ```json
  {
    "method": "initialize",
    "id": 0,
    "params": {
      "clientInfo": {
        "name": "codex_vscode",
        "title": "Codex VS Code Extension",
        "version": "0.1.0"
      }
    }
  }
  ```
  and when app-server receives that request, it can call
  `set_default_originator()`. This is a much more natural interface than
  asking third party developers to set an env var.
  
  One hiccup is that `originator()` reads the global singleton and locks
  in the value, preventing a later `set_default_originator()` call from
  setting it. This would be fine but is brittle, since any codepath that
  calls `originator()` before app-server can process an `initialize`
  JSON-RPC call would prevent app-server from setting it. This was
  actually the case with OTEL initialization which runs on boot, but I
  also saw this behavior in certain tests.
  
  Instead, what we now do is:
  - [unchanged] If `CODEX_INTERNAL_ORIGINATOR_OVERRIDE` env var is set,
  `originator()` would return that value and `set_default_originator()`
  with some other value does NOT override it.
  - [new] If no env var is set, `originator()` would return the default
  value which is `codex_cli_rs` UNTIL `set_default_originator()` is called
  once, in which case it is set to the new value and becomes immutable.
  Later calls to `set_default_originator()` returns
  `SetOriginatorError::AlreadyInitialized`.
  
  **Other notes**
  - I updated `codex_core::otel_init::build_provider` to accepts a service
  name override, and app-server sends a hardcoded `codex_app_server`
  service name to distinguish it from `codex_cli_rs` used by default (e.g.
  TUI).
  
  **Next steps**
  - Update VSCE to set the proper value for `clientInfo.name` on
  `initialize` and drop the `CODEX_INTERNAL_ORIGINATOR_OVERRIDE` env var.
  - Delete support for `CODEX_INTERNAL_ORIGINATOR_OVERRIDE` in codex-rs.

  Owen Lin · 2026-01-09 08:17:13 -08:00
  ea56186c2b
• [device-auth] When headless environment is detected, show device login flow instead. (#8756)

  When headless environment is detected, show device login flow instead.

  Matthew Zeng · 2026-01-08 21:48:30 -08:00
  24d6e0114f
• Elevated sandbox NUX (#8789)

  Elevated Sandbox NUX:
  
  * prompt for elevated sandbox setup when agent mode is selected (via
  /approvals or at startup)
  * prompt for degraded sandbox if elevated setup is declined or fails
  * introduce /elevate-sandbox command to upgrade from degraded
  experience.

  iceweasel-oai · 2026-01-08 16:23:06 -08:00
  6372ba9d5f
• Immutable CodexAuth (#8857)

  Historically we started with a CodexAuth that knew how to refresh it's
  own tokens and then added AuthManager that did a different kind of
  refresh (re-reading from disk).
  
  I don't think it makes sense for both `CodexAuth` and `AuthManager` to
  be mutable and contain behaviors.
  
  Move all refresh logic into `AuthManager` and keep `CodexAuth` as a data
  object.

  pakrym-oai · 2026-01-08 11:43:56 -08:00
  634764ece9
• add tooltip hint for shell commands (!) (#8926)

  I didn't know this existed because its not listed in the hints.

  Felipe Petroski Such · 2026-01-08 19:31:20 +00:00
  5bc3e325a6
• config requirements: improve requirement error messages (#8843)

  **Before:**
  ```
  Error loading configuration: value `Never` is not in the allowed set [OnRequest]
  ```
  
  **After:**
  ```
  Error loading configuration: invalid value for `approval_policy`: `Never` is not in the
  allowed set [OnRequest] (set by MDM com.openai.codex:requirements_toml_base64)
  ```
  
  Done by introducing a new struct `ConfigRequirementsWithSources` onto
  which we `merge_unset_fields` now. Also introduces a pair of requirement
  value and its `RequirementSource` (inspired by `ConfigLayerSource`):
  
  ```rust
  pub struct Sourced<T> {
      pub value: T,
      pub source: RequirementSource,
  }
  ```

  gt-oai · 2026-01-08 16:11:14 +00:00
  932a5a446f
• fix: windows can now paste non-ascii multiline text (#8774)

  ## Summary
  This PR builds _heavily_ on the work from @occurrent in #8021 - I've
  only added a small fix, added additional tests, and propagated the
  changes to tui2.
  
  From the original PR:
  
  > On Windows, Codex relies on PasteBurst for paste detection because
  bracketed paste is not reliably available via crossterm.
  > 
  > When pasted content starts with non-ASCII characters, input is routed
  through handle_non_ascii_char, which bypasses the normal paste burst
  logic. This change extends the paste burst window for that path, which
  should ensure that Enter is correctly grouped as part of the paste.
  
  
  ## Testing
  - [x] tested locally cross-platform
  - [x] added regression tests
  
  ---------
  
  Co-authored-by: occur <occurring@outlook.com>

  Dylan Hurd · 2026-01-07 23:21:49 -08:00
  0f8bb4579b
• add ability to disable input temporarily in the TUI. (#8876)

  We will disable input while the elevated sandbox setup is running.

  iceweasel-oai · 2026-01-07 20:56:48 -08:00
  ccba737d26
• add footer note to TUI (#8867)

  This will be used by the elevated sandbox NUX to give a hint on how to
  run the elevated sandbox when in the non-elevated mode.

  iceweasel-oai · 2026-01-07 16:44:28 -08:00
  357e4c902b
• Warn in /model if BASE_URL set (#8847)

  <img width="763" height="349" alt="Screenshot 2026-01-07 at 18 37 59"
  src="https://github.com/user-attachments/assets/569d01cb-ea91-4113-889b-ba74df24adaf"
  />
  
  It may not make sense to use the `/model` menu with a custom
  OPENAI_BASE_URL. But some model proxies may support it, so we shouldn't
  disable it completely. A warning is a reasonable compromise.

  gt-oai · 2026-01-07 21:24:18 +00:00
  f07b8aa591
• fix: implement 'Allow this session' for apply_patch approvals (#8451)

  **Summary**
  This PR makes “ApprovalDecision::AcceptForSession / don’t ask again this
  session” actually work for `apply_patch` approvals by caching approvals
  based on absolute file paths in codex-core, properly wiring it through
  app-server v2, and exposing the choice in both TUI and TUI2.
  - This brings `apply_patch` calls to be at feature-parity with general
  shell commands, which also have a "Yes, and don't ask again" option.
  - This also fixes VSCE's "Allow this session" button to actually work.
  
  While we're at it, also split the app-server v2 protocol's
  `ApprovalDecision` enum so execpolicy amendments are only available for
  command execution approvals.
  
  **Key changes**
  - Core: per-session patch approval allowlist keyed by absolute file
  paths
  - Handles multi-file patches and renames/moves by recording both source
  and destination paths for `Update { move_path: Some(...) }`.
  - Extend the `Approvable` trait and `ApplyPatchRuntime` to work with
  multiple keys, because an `apply_patch` tool call can modify multiple
  files. For a request to be auto-approved, we will need to check that all
  file paths have been approved previously.
  - App-server v2: honor AcceptForSession for file changes
  - File-change approval responses now map AcceptForSession to
  ReviewDecision::ApprovedForSession (no longer downgraded to plain
  Approved).
  - Replace `ApprovalDecision` with two enums:
  `CommandExecutionApprovalDecision` and `FileChangeApprovalDecision`
  - TUI / TUI2: expose “don’t ask again for these files this session”
  - Patch approval overlays now include a third option (“Yes, and don’t
  ask again for these files this session (s)”).
      - Snapshot updates for the approval modal.
  
  **Tests added/updated**
  - Core:
  - Integration test that proves ApprovedForSession on a patch skips the
  next patch prompt for the same file
  - App-server:
  - v2 integration test verifying
  FileChangeApprovalDecision::AcceptForSession works properly
  
  **User-visible behavior**
  - When the user approves a patch “for session”, future patches touching
  only those previously approved file(s) will no longer prompt gain during
  that session (both via app-server v2 and TUI/TUI2).
  
  **Manual testing**
  Tested both TUI and TUI2 - see screenshots below.
  
  TUI:
  <img width="1082" height="355" alt="image"
  src="https://github.com/user-attachments/assets/adcf45ad-d428-498d-92fc-1a0a420878d9"
  />
  
  
  TUI2:
  <img width="1089" height="438" alt="image"
  src="https://github.com/user-attachments/assets/dd768b1a-2f5f-4bd6-98fd-e52c1d3abd9e"
  />

  Owen Lin · 2026-01-07 20:11:12 +00:00
  66450f0445
• Stop using AuthManager as the source of codex_home (#8846)
  pakrym-oai · 2026-01-07 18:56:20 +00:00
  018de994b0
• remove unnecessary todos (#8842)

  > // todo(aibrahim): why are we passing model here while it can change?
  
  we update it on each turn with `.with_model`
  
  > //TODO(aibrahim): run CI in release mode.
  
  although it's good to have, release builds take double the time tests
  take.
  
  > // todo(aibrahim): make this async function
  
  we figured out another way of doing this sync

  Ahmed Ibrahim · 2026-01-07 10:43:10 -08:00
  c31960b13a
• Merge Modelfamily into modelinfo (#8763)

  - Merge ModelFamily into ModelInfo
  - Remove logic for adding instructions to apply patch
  - Add compaction limit and visible context window to `ModelInfo`

  Ahmed Ibrahim · 2026-01-07 10:35:09 -08:00
  9179c9deac
• chore: unify conversation with thread name (#8830)

  Done and verified by Codex + refactor feature of RustRover

  jif-oai · 2026-01-07 17:04:53 +00:00
  116059c3a0
• chore: rename unified exec sessions (#8822)

  Renaming done by Codex

  jif-oai · 2026-01-07 16:12:47 +00:00
  4cef89a122
• fix: handle /review arguments in TUI (#8823)

  Handle /review <instructions> in the TUI and TUI2 by routing it as a
  custom review command instead of plain text, wiring command dispatch and
  adding composer coverage so typing /review text starts a review directly
  rather than posting a message. User impact: /review with arguments now
  kicks off the review flow, previously it would just forward as a plain
  command and not actually start a review.

  Thibault Sottiaux · 2026-01-07 13:14:55 +00:00
  124a09e577
• Enable model upgrade popup even when selected model is no longer in picker (#8802)

  With `config.toml`:
  ```
  model = "gpt-5.1-codex"
  ```
  (where `gpt-5.1-codex` has `show_in_picker: false` in
  [`model_presets.rs`](https://github.com/openai/codex/blob/main/codex-rs/core/src/models_manager/model_presets.rs);
  this happens if the user hasn't used codex in a while so they didn't see
  the popup before their model was changed to `show_in_picker: false`)
  
  The upgrade picker used to not show (because `gpt-5.1-codex` was
  filtered out of the model list in code). Now, the filtering is done
  downstream in tui and app-server, so the model upgrade popup shows:
  
  <img width="1503" height="227" alt="Screenshot 2026-01-06 at 5 04 37 PM"
  src="https://github.com/user-attachments/assets/26144cc2-0b3f-4674-ac17-e476781ec548"
  />

  charley-oai · 2026-01-06 19:32:27 -08:00
  3389465c8d
• fix: truncate long approval prefixes when rendering (#8734)

  Fixes inscrutable multiline approval requests:
  <img width="686" height="844" alt="image"
  src="https://github.com/user-attachments/assets/cf9493dc-79e6-4168-8020-0ef0fe676d5e"
  />

  Thibault Sottiaux · 2026-01-06 15:17:01 -08:00
  8b4d27dfcd
• feat(app-server): thread/rollback API (#8454)

  Add `thread/rollback` to app-server to support IDEs undo-ing the last N
  turns of a thread.
  
  For context, an IDE partner will be supporting an "undo" capability
  where the IDE (the app-server client) will be responsible for reverting
  the local changes made during the last turn. To support this well, we
  also need a way to drop the last turn (or more generally, the last N
  turns) from the agent's context. This is what `thread/rollback` does.
  
  **Core idea**: A Thread rollback is represented as a persisted event
  message (EventMsg::ThreadRollback) in the rollout JSONL file, not by
  rewriting history. On resume, both the model's context (core replay) and
  the UI turn list (app-server v2's thread history builder) apply these
  markers so the pruned history is consistent across live conversations
  and `thread/resume`.
  
  Implementation notes:
  - Rollback only affects agent context and appends to the rollout file;
  clients are responsible for reverting files on disk.
  - If a thread rollback is currently in progress, subsequent
  `thread/rollback` calls are rejected.
  - Because we use `CodexConversation::submit` and codex core tracks
  active turns, returning an error on concurrent rollbacks is communicated
  via an `EventMsg::Error` with a new variant
  `CodexErrorInfo::ThreadRollbackFailed`. app-server watches for that and
  sends the BAD_REQUEST RPC response.
  
  Tests cover thread rollbacks in both core and app-server, including when
  `num_turns` > existing turns (which clears all turns).
  
  **Note**: this explicitly does **not** behave like `/undo` which we just
  removed from the CLI, which does the opposite of what `thread/rollback`
  does. `/undo` reverts local changes via ghost commits/snapshots and does
  not modify the agent's context / conversation history.

  Owen Lin · 2026-01-06 21:23:48 +00:00
  8b7ec31ba7
• suppress popups while browsing input history (#8772)
  xl-openai · 2026-01-06 11:13:21 -08:00
  4ce9d0aa7b
• chore: clear background terminals on interrupt (#8786)
  jif-oai · 2026-01-06 19:01:07 +00:00
  740bf0e755
• feat: forced tool tips (#8752)

  Force an announcement tooltip in the CLI. This query the gh repo on this
  [file](https://raw.githubusercontent.com/openai/codex/main/announcement_tip.toml)
  which contains announcements in TOML looking like this:
  ```
  # Example announcement tips for Codex TUI.
  # Each [[announcements]] entry is evaluated in order; the last matching one is shown.
  # Dates are UTC, formatted as YYYY-MM-DD. The from_date is inclusive and the to_date is exclusive.
  # version_regex matches against the CLI version (env!("CARGO_PKG_VERSION")); omit to apply to all versions.
  # target_app specify which app should display the announcement (cli, vsce, ...).
  
  [[announcements]]
  content = "Welcome to Codex! Check out the new onboarding flow."
  from_date = "2024-10-01"
  to_date = "2024-10-15"
  version_regex = "^0\\.0\\.0$"
  target_app = "cli"
  ``` 
  
  To make this efficient, the announcement is queried on a best effort
  basis at the launch of the CLI (no refresh made after this).
  This is done in an async way and we display the announcement (with 100%
  probability) iff the announcement is available, the cache is correctly
  warmed and there is a matching announcement (matching is recomputed for
  each new session).

  jif-oai · 2026-01-06 18:02:05 +00:00
  d1c6329c32
• fix: render cwd-relative paths in tui (#8771)

  Display paths relative to the cwd before checking git roots so view
  image tool calls keep project-local names in jj/no-.git workspaces.

  Josh McKinney · 2026-01-06 03:17:40 +00:00
  4c3d2a5bbe
• [device-auth] Update login instruction for headless environments. (#8753)

  We've seen reports that people who try to login on a remote/headless
  machine will open the login link on their own machine and got errors.
  Update the instructions to ask those users to use `codex login
  --device-auth` instead.
  
  <img width="1434" height="938" alt="CleanShot 2026-01-05 at 11 35 02@2x"
  src="https://github.com/user-attachments/assets/2b209953-6a42-4eb0-8b55-bb0733f2e373"
  />

  Matthew Zeng · 2026-01-05 13:46:42 -08:00
  c29afc0cf3
• feat: expose outputSchema to user_turn/turn_start app_server API (#8377)

  What changed
  - Added `outputSchema` support to the app-server APIs, mirroring `codex
  exec --output-schema` behavior.
  - V1 `sendUserTurn` now accepts `outputSchema` and constrains the final
  assistant message for that turn.
  - V2 `turn/start` now accepts `outputSchema` and constrains the final
  assistant message for that turn (explicitly per-turn only).
  
  Core behavior
  - `Op::UserTurn` already supported `final_output_json_schema`; now V1
  `sendUserTurn` forwards `outputSchema` into that field.
  - `Op::UserInput` now carries `final_output_json_schema` for per-turn
  settings updates; core maps it into
  `SessionSettingsUpdate.final_output_json_schema` so it applies to the
  created turn context.
  - V2 `turn/start` does NOT persist the schema via `OverrideTurnContext`
  (it’s applied only for the current turn). Other overrides
  (cwd/model/etc) keep their existing persistent behavior.
  
  API / docs
  - `codex-rs/app-server-protocol/src/protocol/v1.rs`: add `output_schema:
  Option<serde_json::Value>` to `SendUserTurnParams` (serialized as
  `outputSchema`).
  - `codex-rs/app-server-protocol/src/protocol/v2.rs`: add `output_schema:
  Option<JsonValue>` to `TurnStartParams` (serialized as `outputSchema`).
  - `codex-rs/app-server/README.md`: document `outputSchema` for
  `turn/start` and clarify it applies only to the current turn.
  - `codex-rs/docs/codex_mcp_interface.md`: document `outputSchema` for v1
  `sendUserTurn` and v2 `turn/start`.
  
  Tests added/updated
  - New app-server integration tests asserting `outputSchema` is forwarded
  into outbound `/responses` requests as `text.format`:
    - `codex-rs/app-server/tests/suite/output_schema.rs`
    - `codex-rs/app-server/tests/suite/v2/output_schema.rs`
  - Added per-turn semantics tests (schema does not leak to the next
  turn):
    - `send_user_turn_output_schema_is_per_turn_v1`
    - `turn_start_output_schema_is_per_turn_v2`
  - Added protocol wire-compat tests for the merged op:
    - serialize omits `final_output_json_schema` when `None`
    - deserialize works when field is missing
    - serialize includes `final_output_json_schema` when `Some(schema)`
  
  Call site updates (high level)
  - Updated all `Op::UserInput { .. }` constructions to include
  `final_output_json_schema`:
    - `codex-rs/app-server/src/codex_message_processor.rs`
    - `codex-rs/core/src/codex_delegate.rs`
    - `codex-rs/mcp-server/src/codex_tool_runner.rs`
    - `codex-rs/tui/src/chatwidget.rs`
    - `codex-rs/tui2/src/chatwidget.rs`
    - plus impacted core tests.
  
  Validation
  - `just fmt`
  - `cargo test -p codex-core`
  - `cargo test -p codex-app-server`
  - `cargo test -p codex-mcp-server`
  - `cargo test -p codex-tui`
  - `cargo test -p codex-tui2`
  - `cargo test -p codex-protocol`
  - `cargo clippy --all-features --tests --profile dev --fix -- -D
  warnings`

  Anton Panasenko · 2026-01-05 10:27:00 -08:00
  807f8a43c2
• perf(tui2): cache transcript view rendering (#8693)

  The transcript viewport draws every frame. Ratatui's Line::render_ref
  does grapheme segmentation and span layout, so repeated redraws can burn
  CPU during streaming even when the visible transcript hasn't changed.
  
  Introduce TranscriptViewCache to reduce per-frame work:
  - WrappedTranscriptCache memoizes flattened+wrapped transcript lines per
  width, appends incrementally as new cells arrive, and rebuilds on width
  change, truncation (backtrack), or transcript replacement.
  - TranscriptRasterCache caches rasterized rows (Vec<Cell>) per line
  index and user-row styling; redraws copy cells instead of rerendering
  spans.
  
  The caches are width-scoped and store base transcript content only;
  selection highlighting and copy affordances are applied after drawing.
  User rows include the row-wide base style in the cached raster.
  
  Refactor transcript_render to expose append_wrapped_transcript_cell for
  incremental building and add a test that incremental append matches the
  full build.
  
  Add docs/tui2/performance-testing.md as a playbook for macOS sample
  profiles and hotspot greps.
  
  Expand transcript_view_cache tests to cover rebuild conditions, raster
  equivalence vs direct rendering, user-row caching, and eviction.
  
  Test: cargo test -p codex-tui2

  Josh McKinney · 2026-01-03 11:44:27 -08:00
  90f37e8549
• Attach more tags to feedback submissions (#8688)

  Attach more tags to sentry feedback so it's easier to classify and debug
  without having to scan through logs.
  
  Formatting isn't amazing but it's a start.
  <img width="1234" height="276" alt="image"
  src="https://github.com/user-attachments/assets/521a349d-f627-4051-b511-9811cd5cd933"
  />

  pakrym-oai · 2026-01-02 16:51:03 -08:00
  1b5095b5d1
• Remove model family from tui (#8488)

  - Remove model family from tui

  Ahmed Ibrahim · 2026-01-02 11:30:04 -08:00
  2de731490e
• [chore] add additional_details to StreamErrorEvent + wire through (#8307)

  ### What
  
  Builds on #8293.
  
  Add `additional_details`, which contains the upstream error message, to
  relevant structures used to pass along retryable `StreamError`s.
  
  Uses the new TUI status indicator's `details` field (shows under the
  status header) to display the `additional_details` error to the user on
  retryable `Reconnecting...` errors. This adds clarity for users for
  retryable errors.
  
  Will make corresponding change to VSCode extension to show
  `additional_details` as expandable from the `Reconnecting...` cell.
  
  Examples:
  <img width="1012" height="326" alt="image"
  src="https://github.com/user-attachments/assets/f35e7e6a-8f5e-4a2f-a764-358101776996"
  />
  
  <img width="1526" height="358" alt="image"
  src="https://github.com/user-attachments/assets/0029cbc0-f062-4233-8650-cc216c7808f0"
  />

  sayan-oai · 2025-12-24 10:07:38 -08:00
  bf732600ea
• perf(tui): cap redraw scheduling to 60fps (#8499)

  Clamp frame draw notifications in the `FrameRequester` scheduler so we
  don't redraw more frequently than a user can perceive.
  
  This applies to both `codex-tui` and `codex-tui2`, and keeps the
  draw/dispatch loops simple by centralizing the rate limiting in a small
  helper module.
  
  - Add `FrameRateLimiter` (pure, unit-tested) to clamp draw deadlines
  - Apply the limiter in the scheduler before emitting `TuiEvent::Draw`
  - Use immediate redraw requests for scroll paths (scheduler now
  coalesces + clamps)
  - Add scheduler tests covering immediate/delayed interactions

  Josh McKinney · 2025-12-23 19:10:15 -08:00
  96a65ff0ed
• Remove reasoning format (#8484)

  This isn't very useful parameter. 
  
  logic:
  ```
  if model puts `**` in their reasoning, trim it and visualize the header.
  if couldn't trim: don't render
  if model doesn't support: don't render
  ```
  
  We can simplify to:
  ```
  if could trim, visualize header.
  if not, don't render
  ```

  Ahmed Ibrahim · 2025-12-23 16:01:46 -08:00
  40de81e7af
• fix: fix test that was writing temp file to cwd instead of TMPDIR (#8493)

  I am trying to support building with [Buck2](https://buck2.build), which
  reports which files have changed between invocations of `buck2 test` and
  `tmp_delete_example.txt` came up. This turned out to be the reason.

  Michael Bolin · 2025-12-23 15:48:06 -08:00
  972b5853a0
• [tui] add optional details to TUI status header (#8293)

  ### What
  
  Add optional `details` field to TUI's status indicator header. `details`
  is shown under the header with text wrapping and a max height of 3
  lines.
  
  Duplicated changes to `tui2`.
  
  ### Why
  
  Groundwork for displaying error details under `Reconnecting...` for
  clarity with retryable errors.
  
  Basic examples
  <img width="1012" height="326" alt="image"
  src="https://github.com/user-attachments/assets/dd751ceb-b179-4fb2-8fd1-e4784d6366fb"
  />
  
  <img width="1526" height="358" alt="image"
  src="https://github.com/user-attachments/assets/bbe466fc-faff-4a78-af7f-3073ccdd8e34"
  />
  
  Truncation example
  <img width="936" height="189" alt="image"
  src="https://github.com/user-attachments/assets/f3f1b5dd-9050-438b-bb07-bd833c03e889"
  />
  
  ### Tests
  Tested locally, added tests for truncation.

  sayan-oai · 2025-12-23 12:40:40 -08:00
  53eb2e9f27
• chore(tui): include tracing targets in file logs (#8418)

  with_target(true) is the default for tracing-subscriber, but we
  previously disabled it for file output.
  
  Keep it enabled so we can selectively enable specific targets/events at
  runtime via RUST_LOG=..., and then grep by target/module in the log file
  during troubleshooting.
  
  before and after:
  
  <img width="629" height="194" alt="image"
  src="https://github.com/user-attachments/assets/33f7df3f-0c5d-4d3f-b7b7-80b03d4acd21"
  />

  Josh McKinney · 2025-12-22 15:59:30 -08:00
  f6275a5142
• feat: open prompt in configured external editor (#7606)

  Add `ctrl+g` shortcut to enable opening current prompt in configured
  editor (`$VISUAL` or `$EDITOR`).
  
  
  - Prompt is updated with editor's content upon editor close.
  - Paste placeholders are automatically expanded when opening the
  external editor, and are not "recompressed" on close
  - They could be preserved in the editor, but it would be hard to prevent
  the user from modifying the placeholder text directly, which would drop
  the mapping to the `pending_paste` value
  - Image placeholders stay as-is
  - `ctrl+g` explanation added to shortcuts menu, snapshot tests updated
  
  
  
  https://github.com/user-attachments/assets/4ee05c81-fa49-4e99-8b07-fc9eef0bbfce

  sayan-oai · 2025-12-22 15:12:23 -08:00
  4673090f73
• chore: un-ship undo (#8424)
  jif-oai · 2025-12-22 09:53:03 +01:00
  7a8407bbb6
• chore: enusre the logic that creates ConfigLayerStack has access to cwd (#8353)

  `load_config_layers_state()` should load config from a
  `.codex/config.toml` in any folder between the `cwd` for a thread and
  the project root. Though in order to do that,
  `load_config_layers_state()` needs to know what the `cwd` is, so this PR
  does the work to thread the `cwd` through for existing callsites.
  
  A notable exception is the `/config` endpoint in app server for which a
  `cwd` is not guaranteed to be associated with the query, so the `cwd`
  param is `Option<AbsolutePathBuf>` to account for this case.
  
  The logic to make use of the `cwd` will be done in a follow-up PR.

  Michael Bolin · 2025-12-19 20:11:27 -08:00
  a6974087e5
• Rename OpenAI models to models manager (#8346)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2025-12-19 16:20:05 -08:00
  f0dc6fd3c7
• feat: support allowed_sandbox_modes in requirements.toml (#8298)

  This adds support for `allowed_sandbox_modes` in `requirements.toml` and
  provides legacy support for constraining sandbox modes in
  `managed_config.toml`. This is converted to `Constrained<SandboxPolicy>`
  in `ConfigRequirements` and applied to `Config` such that constraints
  are enforced throughout the harness.
  
  Note that, because `managed_config.toml` is deprecated, we do not add
  support for the new `external-sandbox` variant recently introduced in
  https://github.com/openai/codex/pull/8290. As noted, that variant is not
  supported in `config.toml` today, but can be configured programmatically
  via app server.

  Michael Bolin · 2025-12-19 21:09:20 +00:00
  dc61fc5f50
• feat: make ConstraintError an enum (#8330)

  This will make it easier to test for expected errors in unit tests since
  we can compare based on the field values rather than the message (which
  might change over time). See https://github.com/openai/codex/pull/8298
  for an example.
  
  It also ensures more consistency in the way a `ConstraintError` is
  constructed.

  Michael Bolin · 2025-12-19 19:03:50 +00:00
  7e5c343ef5
• Fix tests (#8299)

  Fix broken tests.

  xl-openai · 2025-12-19 02:07:23 +00:00
  ba835c3c36
• UI tweaks on skills popup. (#8250)

  Only display the skill name (not the folder), and truncate the skill
  description to a maximum of two lines.

  xl-openai · 2025-12-19 01:16:51 +00:00
  dcc01198e2
• feat: collapse "waiting" of unified_exec (#8257)

  Screenshots here but check the snapshot files to see it better
  <img width="712" height="408" alt="Screenshot 2025-12-18 at 11 58 02"
  src="https://github.com/user-attachments/assets/84a2c410-0767-4870-84d1-ae1c0d4c445e"
  />
  <img width="523" height="352" alt="Screenshot 2025-12-18 at 11 17 41"
  src="https://github.com/user-attachments/assets/d029c7ea-0feb-4493-9dca-af43a0c70c52"
  />

  jif-oai · 2025-12-18 17:03:43 -08:00
  6c76d17713