94 Commits

• fix(app-server): set originator header from initialize (re-revert) (#8988)

  Reapplies https://github.com/openai/codex/pull/8873 which was reverted
  due to merge conflicts

  Owen Lin · 2026-01-09 12:09:30 -08:00
  fbe883318d
• feat: add support for building with Bazel (#8875)

  This PR configures Codex CLI so it can be built with
  [Bazel](https://bazel.build) in addition to Cargo. The `.bazelrc`
  includes configuration so that remote builds can be done using
  [BuildBuddy](https://www.buildbuddy.io).
  
  If you are familiar with Bazel, things should work as you expect, e.g.,
  run `bazel test //... --keep-going` to run all the tests in the repo,
  but we have also added some new aliases in the `justfile` for
  convenience:
  
  - `just bazel-test` to run tests locally
  - `just bazel-remote-test` to run tests remotely (currently, the remote
  build is for x86_64 Linux regardless of your host platform). Note we are
  currently seeing the following test failures in the remote build, so we
  still need to figure out what is happening here:
  
  ```
  failures:
      suite::compact::manual_compact_twice_preserves_latest_user_messages
      suite::compact_resume_fork::compact_resume_after_second_compaction_preserves_history
      suite::compact_resume_fork::compact_resume_and_fork_preserve_model_history_view
  ```
  
  - `just build-for-release` to build release binaries for all
  platforms/architectures remotely
  
  To setup remote execution:
  - [Create a buildbuddy account](https://app.buildbuddy.io/) (OpenAI
  employees should also request org access at
  https://openai.buildbuddy.io/join/ with their `@openai.com` email
  address.)
  - [Copy your API key](https://app.buildbuddy.io/docs/setup/) to
  `~/.bazelrc` (add the line `build
  --remote_header=x-buildbuddy-api-key=YOUR_KEY`)
  - Use `--config=remote` in your `bazel` invocations (or add `common
  --config=remote` to your `~/.bazelrc`, or use the `just` commands)
  
  ## CI
  
  In terms of CI, this PR introduces `.github/workflows/bazel.yml`, which
  uses Bazel to run the tests _locally_ on Mac and Linux GitHub runners
  (we are working on supporting Windows, but that is not ready yet). Note
  that the failures we are seeing in `just bazel-remote-test` do not occur
  on these GitHub CI jobs, so everything in `.github/workflows/bazel.yml`
  is green right now.
  
  The `bazel.yml` uses extra config in `.github/workflows/ci.bazelrc` so
  that macOS CI jobs build _remotely_ on Linux hosts (using the
  `docker://docker.io/mbolin491/codex-bazel` Docker image declared in the
  root `BUILD.bazel`) using cross-compilation to build the macOS
  artifacts. Then these artifacts are downloaded locally to GitHub's macOS
  runner so the tests can be executed natively. This is the relevant
  config that enables this:
  
  ```
  common:macos --config=remote
  common:macos --strategy=remote
  common:macos --strategy=TestRunner=darwin-sandbox,local
  ```
  
  Because of the remote caching benefits we get from BuildBuddy, these new
  CI jobs can be extremely fast! For example, consider these two jobs that
  ran all the tests on Linux x86_64:
  
  - Bazel 1m37s
  https://github.com/openai/codex/actions/runs/20861063212/job/59940545209?pr=8875
  - Cargo 9m20s
  https://github.com/openai/codex/actions/runs/20861063192/job/59940559592?pr=8875
  
  For now, we will continue to run both the Bazel and Cargo jobs for PRs,
  but once we add support for Windows and running Clippy, we should be
  able to cutover to using Bazel exclusively for PRs, which should still
  speed things up considerably. We will probably continue to run the Cargo
  jobs post-merge for commits that land on `main` as a sanity check.
  
  Release builds will also continue to be done by Cargo for now.
  
  Earlier attempt at this PR: https://github.com/openai/codex/pull/8832
  Earlier attempt to add support for Buck2, now abandoned:
  https://github.com/openai/codex/pull/8504
  
  ---------
  
  Co-authored-by: David Zbarsky <dzbarsky@gmail.com>
  Co-authored-by: Michael Bolin <mbolin@openai.com>

  zbarsky-openai · 2026-01-09 11:09:43 -08:00
  2a06d64bc9
• fix: add tui.alternate_screen config and --no-alt-screen CLI flag for Zellij scrollback (#8555)

  Fixes #2558
  
  Codex uses alternate screen mode (CSI 1049) which, per xterm spec,
  doesn't support scrollback. Zellij follows this strictly, so users can't
  scroll back through output.
  
  **Changes:**
  - Add `tui.alternate_screen` config: `auto` (default), `always`, `never`
  - Add `--no-alt-screen` CLI flag
  - Auto-detect Zellij and skip alt screen (uses existing `ZELLIJ` env var
  detection)
  
  **Usage:**
  ```bash
  # CLI flag
  codex --no-alt-screen
  
  # Or in config.toml
  [tui]
  alternate_screen = "never"
  ```
  
  With default `auto` mode, Zellij users get working scrollback without
  any config changes.
  
  ---------
  
  Co-authored-by: Josh McKinney <joshka@openai.com>

  Helmut Januschka · 2026-01-09 18:38:26 +00:00
  7daaabc795
• renaming: task to turn (#8963)
  jif-oai · 2026-01-09 17:31:17 +00:00
  1aed01e99f
• nit: rename to analytics_enabled (#8978)
  jif-oai · 2026-01-09 17:18:42 +00:00
  ed64804cb5
• Revert "fix(app-server): set originator header from initialize JSON-RPC request" (#8986)

  Reverts openai/codex#8873

  jif-oai · 2026-01-09 17:00:53 +00:00
  5c380d5b1e
• Add config to disable /feedback (#8909)

  Some enterprises do not want their users to be able to `/feedback`.
  
  <img width="395" height="325" alt="image"
  src="https://github.com/user-attachments/assets/2dae9c0b-20c3-4a15-bcd3-0187857ebbd8"
  />
  
  Adds to `config.toml`:
  
  ```toml
  [feedback]
  enabled = false
  ```
  
  I've deliberately decided to:
  1. leave other references to `/feedback` (e.g. in the interrupt message,
  tips of the day) unchanged. I think we should continue to promote the
  feature even if it is not usable currently.
  2. leave the `/feedback` menu item selectable and display an error
  saying it's disabled, rather than remove the menu item (which I believe
  would raise more questions).
  
  but happy to discuss these.
  
  This will be followed by a change to requirements.toml that admins can
  use to force the value of feedback.enabled.

  gt-oai · 2026-01-09 16:33:48 +00:00
  5b5a5b92b5
• fix(app-server): set originator header from initialize JSON-RPC request (#8873)

  **Motivation**
  The `originator` header is important for codex-backend’s Responses API
  proxy because it identifies the real end client (codex cli, codex vscode
  extension, codex exec, future IDEs) and is used to categorize requests
  by client for our enterprise compliance API.
  
  Today the `originator` header is set by either:
  - the `CODEX_INTERNAL_ORIGINATOR_OVERRIDE` env var (our VSCode extension
  does this)
  - calling `set_default_originator()` which sets a global immutable
  singleton (`codex exec` does this)
  
  For `codex app-server`, we want the `initialize` JSON-RPC request to set
  that header because it is a natural place to do so. Example:
  ```json
  {
    "method": "initialize",
    "id": 0,
    "params": {
      "clientInfo": {
        "name": "codex_vscode",
        "title": "Codex VS Code Extension",
        "version": "0.1.0"
      }
    }
  }
  ```
  and when app-server receives that request, it can call
  `set_default_originator()`. This is a much more natural interface than
  asking third party developers to set an env var.
  
  One hiccup is that `originator()` reads the global singleton and locks
  in the value, preventing a later `set_default_originator()` call from
  setting it. This would be fine but is brittle, since any codepath that
  calls `originator()` before app-server can process an `initialize`
  JSON-RPC call would prevent app-server from setting it. This was
  actually the case with OTEL initialization which runs on boot, but I
  also saw this behavior in certain tests.
  
  Instead, what we now do is:
  - [unchanged] If `CODEX_INTERNAL_ORIGINATOR_OVERRIDE` env var is set,
  `originator()` would return that value and `set_default_originator()`
  with some other value does NOT override it.
  - [new] If no env var is set, `originator()` would return the default
  value which is `codex_cli_rs` UNTIL `set_default_originator()` is called
  once, in which case it is set to the new value and becomes immutable.
  Later calls to `set_default_originator()` returns
  `SetOriginatorError::AlreadyInitialized`.
  
  **Other notes**
  - I updated `codex_core::otel_init::build_provider` to accepts a service
  name override, and app-server sends a hardcoded `codex_app_server`
  service name to distinguish it from `codex_cli_rs` used by default (e.g.
  TUI).
  
  **Next steps**
  - Update VSCE to set the proper value for `clientInfo.name` on
  `initialize` and drop the `CODEX_INTERNAL_ORIGINATOR_OVERRIDE` env var.
  - Delete support for `CODEX_INTERNAL_ORIGINATOR_OVERRIDE` in codex-rs.

  Owen Lin · 2026-01-09 08:17:13 -08:00
  ea56186c2b
• [device-auth] When headless environment is detected, show device login flow instead. (#8756)

  When headless environment is detected, show device login flow instead.

  Matthew Zeng · 2026-01-08 21:48:30 -08:00
  24d6e0114f
• Elevated sandbox NUX (#8789)

  Elevated Sandbox NUX:
  
  * prompt for elevated sandbox setup when agent mode is selected (via
  /approvals or at startup)
  * prompt for degraded sandbox if elevated setup is declined or fails
  * introduce /elevate-sandbox command to upgrade from degraded
  experience.

  iceweasel-oai · 2026-01-08 16:23:06 -08:00
  6372ba9d5f
• Immutable CodexAuth (#8857)

  Historically we started with a CodexAuth that knew how to refresh it's
  own tokens and then added AuthManager that did a different kind of
  refresh (re-reading from disk).
  
  I don't think it makes sense for both `CodexAuth` and `AuthManager` to
  be mutable and contain behaviors.
  
  Move all refresh logic into `AuthManager` and keep `CodexAuth` as a data
  object.

  pakrym-oai · 2026-01-08 11:43:56 -08:00
  634764ece9
• add tooltip hint for shell commands (!) (#8926)

  I didn't know this existed because its not listed in the hints.

  Felipe Petroski Such · 2026-01-08 19:31:20 +00:00
  5bc3e325a6
• fix: windows can now paste non-ascii multiline text (#8774)

  ## Summary
  This PR builds _heavily_ on the work from @occurrent in #8021 - I've
  only added a small fix, added additional tests, and propagated the
  changes to tui2.
  
  From the original PR:
  
  > On Windows, Codex relies on PasteBurst for paste detection because
  bracketed paste is not reliably available via crossterm.
  > 
  > When pasted content starts with non-ASCII characters, input is routed
  through handle_non_ascii_char, which bypasses the normal paste burst
  logic. This change extends the paste burst window for that path, which
  should ensure that Enter is correctly grouped as part of the paste.
  
  
  ## Testing
  - [x] tested locally cross-platform
  - [x] added regression tests
  
  ---------
  
  Co-authored-by: occur <occurring@outlook.com>

  Dylan Hurd · 2026-01-07 23:21:49 -08:00
  0f8bb4579b
• add ability to disable input temporarily in the TUI. (#8876)

  We will disable input while the elevated sandbox setup is running.

  iceweasel-oai · 2026-01-07 20:56:48 -08:00
  ccba737d26
• add footer note to TUI (#8867)

  This will be used by the elevated sandbox NUX to give a hint on how to
  run the elevated sandbox when in the non-elevated mode.

  iceweasel-oai · 2026-01-07 16:44:28 -08:00
  357e4c902b
• fix: implement 'Allow this session' for apply_patch approvals (#8451)

  **Summary**
  This PR makes “ApprovalDecision::AcceptForSession / don’t ask again this
  session” actually work for `apply_patch` approvals by caching approvals
  based on absolute file paths in codex-core, properly wiring it through
  app-server v2, and exposing the choice in both TUI and TUI2.
  - This brings `apply_patch` calls to be at feature-parity with general
  shell commands, which also have a "Yes, and don't ask again" option.
  - This also fixes VSCE's "Allow this session" button to actually work.
  
  While we're at it, also split the app-server v2 protocol's
  `ApprovalDecision` enum so execpolicy amendments are only available for
  command execution approvals.
  
  **Key changes**
  - Core: per-session patch approval allowlist keyed by absolute file
  paths
  - Handles multi-file patches and renames/moves by recording both source
  and destination paths for `Update { move_path: Some(...) }`.
  - Extend the `Approvable` trait and `ApplyPatchRuntime` to work with
  multiple keys, because an `apply_patch` tool call can modify multiple
  files. For a request to be auto-approved, we will need to check that all
  file paths have been approved previously.
  - App-server v2: honor AcceptForSession for file changes
  - File-change approval responses now map AcceptForSession to
  ReviewDecision::ApprovedForSession (no longer downgraded to plain
  Approved).
  - Replace `ApprovalDecision` with two enums:
  `CommandExecutionApprovalDecision` and `FileChangeApprovalDecision`
  - TUI / TUI2: expose “don’t ask again for these files this session”
  - Patch approval overlays now include a third option (“Yes, and don’t
  ask again for these files this session (s)”).
      - Snapshot updates for the approval modal.
  
  **Tests added/updated**
  - Core:
  - Integration test that proves ApprovedForSession on a patch skips the
  next patch prompt for the same file
  - App-server:
  - v2 integration test verifying
  FileChangeApprovalDecision::AcceptForSession works properly
  
  **User-visible behavior**
  - When the user approves a patch “for session”, future patches touching
  only those previously approved file(s) will no longer prompt gain during
  that session (both via app-server v2 and TUI/TUI2).
  
  **Manual testing**
  Tested both TUI and TUI2 - see screenshots below.
  
  TUI:
  <img width="1082" height="355" alt="image"
  src="https://github.com/user-attachments/assets/adcf45ad-d428-498d-92fc-1a0a420878d9"
  />
  
  
  TUI2:
  <img width="1089" height="438" alt="image"
  src="https://github.com/user-attachments/assets/dd768b1a-2f5f-4bd6-98fd-e52c1d3abd9e"
  />

  Owen Lin · 2026-01-07 20:11:12 +00:00
  66450f0445
• Stop using AuthManager as the source of codex_home (#8846)
  pakrym-oai · 2026-01-07 18:56:20 +00:00
  018de994b0
• remove unnecessary todos (#8842)

  > // todo(aibrahim): why are we passing model here while it can change?
  
  we update it on each turn with `.with_model`
  
  > //TODO(aibrahim): run CI in release mode.
  
  although it's good to have, release builds take double the time tests
  take.
  
  > // todo(aibrahim): make this async function
  
  we figured out another way of doing this sync

  Ahmed Ibrahim · 2026-01-07 10:43:10 -08:00
  c31960b13a
• Merge Modelfamily into modelinfo (#8763)

  - Merge ModelFamily into ModelInfo
  - Remove logic for adding instructions to apply patch
  - Add compaction limit and visible context window to `ModelInfo`

  Ahmed Ibrahim · 2026-01-07 10:35:09 -08:00
  9179c9deac
• chore: unify conversation with thread name (#8830)

  Done and verified by Codex + refactor feature of RustRover

  jif-oai · 2026-01-07 17:04:53 +00:00
  116059c3a0
• fix: handle /review arguments in TUI (#8823)

  Handle /review <instructions> in the TUI and TUI2 by routing it as a
  custom review command instead of plain text, wiring command dispatch and
  adding composer coverage so typing /review text starts a review directly
  rather than posting a message. User impact: /review with arguments now
  kicks off the review flow, previously it would just forward as a plain
  command and not actually start a review.

  Thibault Sottiaux · 2026-01-07 13:14:55 +00:00
  124a09e577
• Enable model upgrade popup even when selected model is no longer in picker (#8802)

  With `config.toml`:
  ```
  model = "gpt-5.1-codex"
  ```
  (where `gpt-5.1-codex` has `show_in_picker: false` in
  [`model_presets.rs`](https://github.com/openai/codex/blob/main/codex-rs/core/src/models_manager/model_presets.rs);
  this happens if the user hasn't used codex in a while so they didn't see
  the popup before their model was changed to `show_in_picker: false`)
  
  The upgrade picker used to not show (because `gpt-5.1-codex` was
  filtered out of the model list in code). Now, the filtering is done
  downstream in tui and app-server, so the model upgrade popup shows:
  
  <img width="1503" height="227" alt="Screenshot 2026-01-06 at 5 04 37 PM"
  src="https://github.com/user-attachments/assets/26144cc2-0b3f-4674-ac17-e476781ec548"
  />

  charley-oai · 2026-01-06 19:32:27 -08:00
  3389465c8d
• fix: truncate long approval prefixes when rendering (#8734)

  Fixes inscrutable multiline approval requests:
  <img width="686" height="844" alt="image"
  src="https://github.com/user-attachments/assets/cf9493dc-79e6-4168-8020-0ef0fe676d5e"
  />

  Thibault Sottiaux · 2026-01-06 15:17:01 -08:00
  8b4d27dfcd
• feat(app-server): thread/rollback API (#8454)

  Add `thread/rollback` to app-server to support IDEs undo-ing the last N
  turns of a thread.
  
  For context, an IDE partner will be supporting an "undo" capability
  where the IDE (the app-server client) will be responsible for reverting
  the local changes made during the last turn. To support this well, we
  also need a way to drop the last turn (or more generally, the last N
  turns) from the agent's context. This is what `thread/rollback` does.
  
  **Core idea**: A Thread rollback is represented as a persisted event
  message (EventMsg::ThreadRollback) in the rollout JSONL file, not by
  rewriting history. On resume, both the model's context (core replay) and
  the UI turn list (app-server v2's thread history builder) apply these
  markers so the pruned history is consistent across live conversations
  and `thread/resume`.
  
  Implementation notes:
  - Rollback only affects agent context and appends to the rollout file;
  clients are responsible for reverting files on disk.
  - If a thread rollback is currently in progress, subsequent
  `thread/rollback` calls are rejected.
  - Because we use `CodexConversation::submit` and codex core tracks
  active turns, returning an error on concurrent rollbacks is communicated
  via an `EventMsg::Error` with a new variant
  `CodexErrorInfo::ThreadRollbackFailed`. app-server watches for that and
  sends the BAD_REQUEST RPC response.
  
  Tests cover thread rollbacks in both core and app-server, including when
  `num_turns` > existing turns (which clears all turns).
  
  **Note**: this explicitly does **not** behave like `/undo` which we just
  removed from the CLI, which does the opposite of what `thread/rollback`
  does. `/undo` reverts local changes via ghost commits/snapshots and does
  not modify the agent's context / conversation history.

  Owen Lin · 2026-01-06 21:23:48 +00:00
  8b7ec31ba7
• Clear copy pill background and add snapshot test (#8777)

  ### Motivation
  - Fix a visual bug where transcript text could bleed through the
  on-screen copy "pill" overlay.
  - Ensure the copy affordance fully covers the underlying buffer so the
  pill background is solid and consistent with styling.
  - Document the approach in-code to make the background-clearing
  rationale explicit.
  
  ### Description
  - Clear the pill area before drawing by iterating `Rect::positions()`
  and calling `cell.set_symbol(" ")` and `cell.set_style(base_style)` in
  `render_copy_pill` in `transcript_copy_ui.rs`.
  - Added an explanatory comment for why the pill background is explicitly
  cleared.
  - Added a unit test `copy_pill_clears_background` and committed the
  corresponding snapshot file to validate the rendering behavior.
  
  ### Testing
  - Ran `just fmt` (formatting completed; non-blocking environment warning
  may appear).
  - Ran `just fix -p codex-tui2` to apply lints/fixes (completed). 
  - Ran `cargo test -p codex-tui2` and all tests passed (snapshot updated
  and tests succeeded).
  
  ------
  [Codex
  Task](https://chatgpt.com/codex/tasks/task_i_695c9b23e9b8832997d5a457c4d83410)

  Josh McKinney · 2026-01-06 11:21:26 -08:00
  a0b2d03302
• feat: forced tool tips (#8752)

  Force an announcement tooltip in the CLI. This query the gh repo on this
  [file](https://raw.githubusercontent.com/openai/codex/main/announcement_tip.toml)
  which contains announcements in TOML looking like this:
  ```
  # Example announcement tips for Codex TUI.
  # Each [[announcements]] entry is evaluated in order; the last matching one is shown.
  # Dates are UTC, formatted as YYYY-MM-DD. The from_date is inclusive and the to_date is exclusive.
  # version_regex matches against the CLI version (env!("CARGO_PKG_VERSION")); omit to apply to all versions.
  # target_app specify which app should display the announcement (cli, vsce, ...).
  
  [[announcements]]
  content = "Welcome to Codex! Check out the new onboarding flow."
  from_date = "2024-10-01"
  to_date = "2024-10-15"
  version_regex = "^0\\.0\\.0$"
  target_app = "cli"
  ``` 
  
  To make this efficient, the announcement is queried on a best effort
  basis at the launch of the CLI (no refresh made after this).
  This is done in an async way and we display the announcement (with 100%
  probability) iff the announcement is available, the cache is correctly
  warmed and there is a matching announcement (matching is recomputed for
  each new session).

  jif-oai · 2026-01-06 18:02:05 +00:00
  d1c6329c32
• fix: render cwd-relative paths in tui (#8771)

  Display paths relative to the cwd before checking git roots so view
  image tool calls keep project-local names in jj/no-.git workspaces.

  Josh McKinney · 2026-01-06 03:17:40 +00:00
  4c3d2a5bbe
• tui2: stop baking streaming wraps; reflow agent markdown (#8761)

  Background
  Streaming assistant prose in tui2 was being rendered with viewport-width
  wrapping during streaming, then stored in history cells as already split
  `Line`s. Those width-derived breaks became indistinguishable from hard
  newlines, so the transcript could not "un-split" on resize. This also
  degraded copy/paste, since soft wraps looked like hard breaks.
  
  What changed
  - Introduce width-agnostic `MarkdownLogicalLine` output in
  `tui2/src/markdown_render.rs`, preserving markdown wrap semantics:
  initial/subsequent indents, per-line style, and a preformatted flag.
  - Update the streaming collector (`tui2/src/markdown_stream.rs`) to emit
  logical lines (newline-gated) and remove any captured viewport width.
  - Update streaming orchestration (`tui2/src/streaming/*`) to queue and
  emit logical lines, producing `AgentMessageCell::new_logical(...)`.
  - Make `AgentMessageCell` store logical lines and wrap at render time in
  `HistoryCell::transcript_lines_with_joiners(width)`, emitting joiners so
  copy/paste can join soft-wrap continuations correctly.
  
  Overlay deferral
  When an overlay is active, defer *cells* (not rendered `Vec<Line>`) and
  render them at overlay close time. This avoids baking width-derived
  wraps based on a stale width.
  
  Tests + docs
  - Add resize/reflow regression tests + snapshots for streamed agent
  output.
  - Expand module/API docs for the new logical-line streaming pipeline and
  clarify joiner semantics.
  - Align scrollback-related docs/comments with current tui2 behavior
  (main draw loop does not flush queued "history lines" to the terminal).
  
  More details
  See `codex-rs/tui2/docs/streaming_wrapping_design.md` for the full
  problem statement and solution approach, and
  `codex-rs/tui2/docs/tui_viewport_and_history.md` for viewport vs printed
  output behavior.

  Josh McKinney · 2026-01-05 18:37:58 -08:00
  c92dbea7c1
• [device-auth] Update login instruction for headless environments. (#8753)

  We've seen reports that people who try to login on a remote/headless
  machine will open the login link on their own machine and got errors.
  Update the instructions to ask those users to use `codex login
  --device-auth` instead.
  
  <img width="1434" height="938" alt="CleanShot 2026-01-05 at 11 35 02@2x"
  src="https://github.com/user-attachments/assets/2b209953-6a42-4eb0-8b55-bb0733f2e373"
  />

  Matthew Zeng · 2026-01-05 13:46:42 -08:00
  c29afc0cf3
• feat: expose outputSchema to user_turn/turn_start app_server API (#8377)

  What changed
  - Added `outputSchema` support to the app-server APIs, mirroring `codex
  exec --output-schema` behavior.
  - V1 `sendUserTurn` now accepts `outputSchema` and constrains the final
  assistant message for that turn.
  - V2 `turn/start` now accepts `outputSchema` and constrains the final
  assistant message for that turn (explicitly per-turn only).
  
  Core behavior
  - `Op::UserTurn` already supported `final_output_json_schema`; now V1
  `sendUserTurn` forwards `outputSchema` into that field.
  - `Op::UserInput` now carries `final_output_json_schema` for per-turn
  settings updates; core maps it into
  `SessionSettingsUpdate.final_output_json_schema` so it applies to the
  created turn context.
  - V2 `turn/start` does NOT persist the schema via `OverrideTurnContext`
  (it’s applied only for the current turn). Other overrides
  (cwd/model/etc) keep their existing persistent behavior.
  
  API / docs
  - `codex-rs/app-server-protocol/src/protocol/v1.rs`: add `output_schema:
  Option<serde_json::Value>` to `SendUserTurnParams` (serialized as
  `outputSchema`).
  - `codex-rs/app-server-protocol/src/protocol/v2.rs`: add `output_schema:
  Option<JsonValue>` to `TurnStartParams` (serialized as `outputSchema`).
  - `codex-rs/app-server/README.md`: document `outputSchema` for
  `turn/start` and clarify it applies only to the current turn.
  - `codex-rs/docs/codex_mcp_interface.md`: document `outputSchema` for v1
  `sendUserTurn` and v2 `turn/start`.
  
  Tests added/updated
  - New app-server integration tests asserting `outputSchema` is forwarded
  into outbound `/responses` requests as `text.format`:
    - `codex-rs/app-server/tests/suite/output_schema.rs`
    - `codex-rs/app-server/tests/suite/v2/output_schema.rs`
  - Added per-turn semantics tests (schema does not leak to the next
  turn):
    - `send_user_turn_output_schema_is_per_turn_v1`
    - `turn_start_output_schema_is_per_turn_v2`
  - Added protocol wire-compat tests for the merged op:
    - serialize omits `final_output_json_schema` when `None`
    - deserialize works when field is missing
    - serialize includes `final_output_json_schema` when `Some(schema)`
  
  Call site updates (high level)
  - Updated all `Op::UserInput { .. }` constructions to include
  `final_output_json_schema`:
    - `codex-rs/app-server/src/codex_message_processor.rs`
    - `codex-rs/core/src/codex_delegate.rs`
    - `codex-rs/mcp-server/src/codex_tool_runner.rs`
    - `codex-rs/tui/src/chatwidget.rs`
    - `codex-rs/tui2/src/chatwidget.rs`
    - plus impacted core tests.
  
  Validation
  - `just fmt`
  - `cargo test -p codex-core`
  - `cargo test -p codex-app-server`
  - `cargo test -p codex-mcp-server`
  - `cargo test -p codex-tui`
  - `cargo test -p codex-tui2`
  - `cargo test -p codex-protocol`
  - `cargo clippy --all-features --tests --profile dev --fix -- -D
  warnings`

  Anton Panasenko · 2026-01-05 10:27:00 -08:00
  807f8a43c2
• feat(tui2): transcript scrollbar (auto-hide + drag) (#8728)

  ## Summary
  - Add a transcript scrollbar in `tui2` using `tui-scrollbar`.
  - Reserve 2 columns on the right (1 empty gap + 1 scrollbar track) and
  plumb the reduced width through wrapping/selection/copy so rendering and
  interactions match.
  - Auto-hide the scrollbar when the transcript is pinned to the bottom
  (columns remain reserved).
  - Add mouse click/drag support for the scrollbar, with pointer-capture
  so drags don’t fall through into transcript selection.
  - Skip scrollbar hit-testing when auto-hidden to avoid an invisible
  interactive region.
  
  ## Notes
  - Styling is theme-aware: in light themes the thumb is darker than the
  track; in dark themes it reads as an “indented” element without going
  full-white.
  - Pre-Ratatui 0.30 (ratatui-core split) requires a small scratch-buffer
  bridge; this should simplify once we move to Ratatui 0.30.
  
  ## Testing
  - `just fmt`
  - `just fix -p codex-tui2 --allow-no-vcs`
  - `cargo test -p codex-tui2`

  Josh McKinney · 2026-01-05 09:05:14 -08:00
  8f10d3bf05
• tui2: copy selection dismisses highlight (#8718)

  Clicking the transcript copy pill or pressing the copy shortcut now
  copies the selected transcript text and clears the highlight.
  
  Show transient footer feedback ("Copied"/"Copy failed") after a copy
  attempt, with logic in transcript_copy_action to keep app.rs smaller and
  closer to tui for long-term diffs.
  
  Update footer snapshots and add tiny unit tests for feedback expiry.
  
  
  https://github.com/user-attachments/assets/c36c8163-11c5-476b-b388-e6fbe0ff6034

  Josh McKinney · 2026-01-04 22:05:18 -08:00
  181ff89cbd
• fix(tui2): render copy pill at viewport bottom (#8716)

  When the selection ends on the last visible row, the copy affordance had
  no space below and never rendered. Fall back to placing it above (or on
  the same row for 1-row viewports) and add a regression test.

  Josh McKinney · 2026-01-04 22:05:08 -08:00
  5678213058
• fix(tui2): avoid scroll stickiness at cell boundaries (#8695)

  Mouse/trackpad scrolling in tui2 applies deltas in visual lines, but the
  transcript scroll state was anchored only to CellLine entries.
  
  When a 1-line scroll landed on the synthetic inter-cell Spacer row
  (inserted between non-continuation cells),
  `TranscriptScroll::anchor_for` would skip that row and snap back to the
  adjacent cell line. That makes the resolved top offset unchanged for
  small/coalesced scroll deltas, so scrolling appears to get stuck right
  before certain cells (commonly user prompts and command output cells).
  
  Fix this by making spacer rows a first-class scroll anchor:
  - Add `TranscriptScroll::ScrolledSpacerBeforeCell` and resolve it back
  to the spacer row index when present.
  - Update `anchor_for`/`scrolled_by` to preserve spacers instead of
  skipping them.
  - Treat the new variant as "already anchored" in
  `lock_transcript_scroll_to_current_view`.
  
  Tests:
  - cargo test -p codex-tui2

  Josh McKinney · 2026-01-03 20:26:40 +00:00
  279283fe02
• fix: brighten transcript copy affordance (#8697)

  - set the pill text to white so it stays legible on light themes
  - render the icon in bold light cyan so it stands out
  - reran `just fmt`, `just fix -p codex-tui2`, and `cargo test -p
  codex-tui2` after the tweak
  
  
  https://github.com/user-attachments/assets/6c296b8d-84fb-45b9-bce7-57982e0d531b

  Josh McKinney · 2026-01-03 11:45:50 -08:00
  19525efb22
• perf(tui2): cache transcript view rendering (#8693)

  The transcript viewport draws every frame. Ratatui's Line::render_ref
  does grapheme segmentation and span layout, so repeated redraws can burn
  CPU during streaming even when the visible transcript hasn't changed.
  
  Introduce TranscriptViewCache to reduce per-frame work:
  - WrappedTranscriptCache memoizes flattened+wrapped transcript lines per
  width, appends incrementally as new cells arrive, and rebuilds on width
  change, truncation (backtrack), or transcript replacement.
  - TranscriptRasterCache caches rasterized rows (Vec<Cell>) per line
  index and user-row styling; redraws copy cells instead of rerendering
  spans.
  
  The caches are width-scoped and store base transcript content only;
  selection highlighting and copy affordances are applied after drawing.
  User rows include the row-wide base style in the cached raster.
  
  Refactor transcript_render to expose append_wrapped_transcript_cell for
  incremental building and add a test that incremental append matches the
  full build.
  
  Add docs/tui2/performance-testing.md as a playbook for macOS sample
  profiles and hotspot greps.
  
  Expand transcript_view_cache tests to cover rebuild conditions, raster
  equivalence vs direct rendering, user-row caching, and eviction.
  
  Test: cargo test -p codex-tui2

  Josh McKinney · 2026-01-03 11:44:27 -08:00
  90f37e8549
• Attach more tags to feedback submissions (#8688)

  Attach more tags to sentry feedback so it's easier to classify and debug
  without having to scan through logs.
  
  Formatting isn't amazing but it's a start.
  <img width="1234" height="276" alt="image"
  src="https://github.com/user-attachments/assets/521a349d-f627-4051-b511-9811cd5cd933"
  />

  pakrym-oai · 2026-01-02 16:51:03 -08:00
  1b5095b5d1
• perf(tui2): reduce unnecessary redraws (#8681)

  This reduces unnecessary frame scheduling in codex-tui2.
  
  Changes:
  - Gate redraw scheduling for streaming deltas when nothing visible
  changes.
  - Avoid a redraw feedback loop from footer transcript UI state updates.
  
  Why:
  - Streaming deltas can arrive at very high frequency; redrawing on every
  delta can drive a near-constant render loop.
  - BottomPane was requesting another frame after every Draw even when the
  derived transcript UI state was unchanged.
  
  Testing:
  - cargo test -p codex-tui2
  
  Manual sampling:
  - sample "$(pgrep -n codex-tui2)" 3 -file
  /tmp/tui2.idle.after.sample.txt
  - sample "$(pgrep -n codex-tui2)" 3 -file
  /tmp/tui2.streaming.after.sample.txt

  Josh McKinney · 2026-01-02 20:15:58 +00:00
  3cfa4bc8be
• Remove model family from tui (#8488)

  - Remove model family from tui

  Ahmed Ibrahim · 2026-01-02 11:30:04 -08:00
  2de731490e
• [chore] add additional_details to StreamErrorEvent + wire through (#8307)

  ### What
  
  Builds on #8293.
  
  Add `additional_details`, which contains the upstream error message, to
  relevant structures used to pass along retryable `StreamError`s.
  
  Uses the new TUI status indicator's `details` field (shows under the
  status header) to display the `additional_details` error to the user on
  retryable `Reconnecting...` errors. This adds clarity for users for
  retryable errors.
  
  Will make corresponding change to VSCode extension to show
  `additional_details` as expandable from the `Reconnecting...` cell.
  
  Examples:
  <img width="1012" height="326" alt="image"
  src="https://github.com/user-attachments/assets/f35e7e6a-8f5e-4a2f-a764-358101776996"
  />
  
  <img width="1526" height="358" alt="image"
  src="https://github.com/user-attachments/assets/0029cbc0-f062-4233-8650-cc216c7808f0"
  />

  sayan-oai · 2025-12-24 10:07:38 -08:00
  bf732600ea
• perf(tui): cap redraw scheduling to 60fps (#8499)

  Clamp frame draw notifications in the `FrameRequester` scheduler so we
  don't redraw more frequently than a user can perceive.
  
  This applies to both `codex-tui` and `codex-tui2`, and keeps the
  draw/dispatch loops simple by centralizing the rate limiting in a small
  helper module.
  
  - Add `FrameRateLimiter` (pure, unit-tested) to clamp draw deadlines
  - Apply the limiter in the scheduler before emitting `TuiEvent::Draw`
  - Use immediate redraw requests for scroll paths (scheduler now
  coalesces + clamps)
  - Add scheduler tests covering immediate/delayed interactions

  Josh McKinney · 2025-12-23 19:10:15 -08:00
  96a65ff0ed
• Remove reasoning format (#8484)

  This isn't very useful parameter. 
  
  logic:
  ```
  if model puts `**` in their reasoning, trim it and visualize the header.
  if couldn't trim: don't render
  if model doesn't support: don't render
  ```
  
  We can simplify to:
  ```
  if could trim, visualize header.
  if not, don't render
  ```

  Ahmed Ibrahim · 2025-12-23 16:01:46 -08:00
  40de81e7af
• fix: fix test that was writing temp file to cwd instead of TMPDIR (#8493)

  I am trying to support building with [Buck2](https://buck2.build), which
  reports which files have changed between invocations of `buck2 test` and
  `tmp_delete_example.txt` came up. This turned out to be the reason.

  Michael Bolin · 2025-12-23 15:48:06 -08:00
  972b5853a0
• feat(tui2): add multi-click transcript selection (#8471)

  Support multi-click transcript selection using transcript/viewport
  coordinates
  (wrapped visual line index + content column), not terminal buffer
  positions.
  
  Gestures:
  - double click: select word-ish token under cursor
  - triple click: select entire wrapped line
  - quad click: select paragraph (contiguous non-empty wrapped lines)
  - quint+ click: select the entire history cell (all wrapped lines
  belonging to a
    single `HistoryCell`, including blank lines inside the cell)
  
  Selection expansion rebuilds the wrapped transcript view from
  `HistoryCell::display_lines(width)` so boundaries match on-screen
  wrapping during
  scroll/resize/streaming reflow. Click grouping is resilient to minor
  drag jitter
  (some terminals emit tiny Drag events during clicks) and becomes more
  tolerant as
  the sequence progresses so quad/quint clicks are practical.
  
  Tests cover expansion (word/line/paragraph/cell), sequence resets
  (timing, motion,
  line changes, real drags), drag jitter, and behavior on spacer lines
  between
  history cells (paragraph/cell selection prefers the cell above).

  Josh McKinney · 2025-12-23 21:05:06 +00:00
  0130a2fa40
• [tui] add optional details to TUI status header (#8293)

  ### What
  
  Add optional `details` field to TUI's status indicator header. `details`
  is shown under the header with text wrapping and a max height of 3
  lines.
  
  Duplicated changes to `tui2`.
  
  ### Why
  
  Groundwork for displaying error details under `Reconnecting...` for
  clarity with retryable errors.
  
  Basic examples
  <img width="1012" height="326" alt="image"
  src="https://github.com/user-attachments/assets/dd751ceb-b179-4fb2-8fd1-e4784d6366fb"
  />
  
  <img width="1526" height="358" alt="image"
  src="https://github.com/user-attachments/assets/bbe466fc-faff-4a78-af7f-3073ccdd8e34"
  />
  
  Truncation example
  <img width="936" height="189" alt="image"
  src="https://github.com/user-attachments/assets/f3f1b5dd-9050-438b-bb07-bd833c03e889"
  />
  
  ### Tests
  Tested locally, added tests for truncation.

  sayan-oai · 2025-12-23 12:40:40 -08:00
  53eb2e9f27
• fix(tui2): start transcript selection on drag (#8466)

  Avoid distracting 1-cell highlights on simple click by tracking an
  anchor on mouse down and only creating a visible selection once the
  mouse is dragged (selection head set).
  
  When dragging while following the bottom during streaming, request a
  scroll lock so the viewport stops moving under the active selection.
  
  Move selection state transitions into transcript_selection helpers
  (returning change/lock outcomes for the caller) and add unit tests for
  the state machine.

  Josh McKinney · 2025-12-22 21:15:57 -08:00
  2828549323
• fix(tui2): fix screen corruption (#8463)

  Summary
  
  Fixes intermittent screen corruption in tui2 (random stale characters)
  by
  addressing two terminal state desyncs: nested alt-screen transitions and
  the
  first-draw viewport clear.
  
  - Make alt-screen enter/leave re-entrant via a small nesting guard so
  closing
  - Ensure the first viewport draw clears after the viewport is sized,
  preventing
  old terminal contents from leaking through when diff-based rendering
  skips
    space cells.
  - Add docs + a small unit test for the alt-screen nesting behavior.
  
  Testing
  
  - cargo test -p codex-tui2
  - cargo clippy -p codex-tui2 --all-features --tests
  - Manual:
  - Opened the transcript overlay and dismissed it repeatedly; verified
  the
        normal view redraws cleanly with no leftover characters.
  - Ran tui2 in a new folder with no trust settings (and also cleared the
  trust setting from config to re-trigger the prompt); verified the
  initial
        trust/onboarding screen renders without artifacts.

  Josh McKinney · 2025-12-22 19:15:23 -08:00
  310f2114ae
• feat(tui2): add copy selection shortcut + UI affordance (#8462)

  - Detect Ctrl+Shift+C vs VS Code Ctrl+Y and surface in footer hints
  - Render clickable “⧉ copy” pill near transcript selection (hidden while
  dragging)
  - Handle copy hotkey + click to copy selection
  - Document updated copy UX
  
  VSCode:
  <img width="1095" height="413" alt="image"
  src="https://github.com/user-attachments/assets/84be0c82-4762-4c3e-80a4-c751c078bdaa"
  />
  
  Ghosty:
  <img width="505" height="68" alt="image"
  src="https://github.com/user-attachments/assets/109cc1a1-f029-4f7e-a141-4c6ed2da7338"
  />

  Josh McKinney · 2025-12-22 18:54:58 -08:00
  414fbe0da9
• chore(tui): include tracing targets in file logs (#8418)

  with_target(true) is the default for tracing-subscriber, but we
  previously disabled it for file output.
  
  Keep it enabled so we can selectively enable specific targets/events at
  runtime via RUST_LOG=..., and then grep by target/module in the log file
  during troubleshooting.
  
  before and after:
  
  <img width="629" height="194" alt="image"
  src="https://github.com/user-attachments/assets/33f7df3f-0c5d-4d3f-b7b7-80b03d4acd21"
  />

  Josh McKinney · 2025-12-22 15:59:30 -08:00
  f6275a5142
• fix(tui2): copy transcript selection outside viewport (#8449)

  Copy now operates on the full logical selection range (anchor..head),
  not just the visible viewport, so selections that include offscreen
  lines copy the expected text.
  
  Selection extraction is factored into `transcript_selection` to make the
  logic easier to test and reason about. It reconstructs the wrapped
  visual transcript, renders each wrapped line into a 1-row offscreen
  Buffer, and reads the selected cells. This keeps clipboard text aligned
  with what is rendered (gutter, indentation, wrapping).
  
  Additional behavior:
  - Skip continuation cells for wide glyphs (e.g. CJK) so copied text does
  not include spurious spaces like "コ X".
  - Avoid copying right-margin padding spaces.
  
  Manual tested performed:
  - "tell me a story" a few times
  - scroll up, select text, scroll down, copy text
  - confirm copied text is what you expect

  Josh McKinney · 2025-12-22 15:24:52 -08:00
  7d0c5c7bd5