111 Commits

• TUI: split history cells into focused modules (#22704)

  ## Why
  
  `codex-rs/tui/src/history_cell.rs` had become the dumping ground for
  transcript rendering: the shared trait, common helpers, and the concrete
  cells for messages, plans, MCP/search, notices, patches, approvals,
  session chrome, and separators all lived together. That made small
  transcript changes require reopening a very large file and made
  ownership less obvious.
  
  ## What changed
  
  - Replaced the monolithic `history_cell.rs` with a `history_cell/`
  module tree organized by concern.
  - Kept the existing `crate::history_cell::*` surface stable through
  re-exports in `history_cell/mod.rs`.
  - Moved the existing render coverage into `history_cell/tests.rs`.
  
  ## Reviewer notes
  
  - This PR is intentionally mechanical in mature — existing code and
  tests moving into files that match their concern.
  - The snapshot files under `codex-rs/tui/src/history_cell/snapshots/`
  moved with the extracted test module. `insta` resolves these unnamed
  snapshots relative to the source file that declares them, so this is
  path churn only; snapshot contents were not updated.
  - The small non-mechanical seam edits are limited to split fallout:
  sibling-module visibility for shared cell containers, moving
  approval-specific exec-snippet helpers beside approvals, fixing the
  separator module path, and keeping a couple of existing test helpers
  reachable after extraction.

  Eric Traut · 2026-05-14 21:19:06 -07:00
  e6a7368810
• Prevent Esc from dismissing or rewinding /side (#22710)

  Addresses #22599
  
  ## Why
  `/side` currently lets `Esc` return to the parent thread. Multiple users
  reported that this collides with queued-steer UI that also advertises
  `Esc`, so a timing-sensitive keypress can dismiss an ephemeral side chat
  instead of sending the queued prompt.
  
  After removing that dismissal shortcut, the same `Esc` path could fall
  through to main-thread backtrack/edit-previous handling, which is not
  valid for ephemeral side conversations. This keeps `/side` out of both
  global `Esc` behaviors.
  
  ## What changed
  - Remove `Esc` from the `/side` return shortcut matcher while keeping
  the existing `Ctrl+C` and `Ctrl+D` behavior.
  - Update side-conversation hints and blocked-command copy to advertise
  `Ctrl+C` as the return shortcut.
  - Rename the reserved `Esc` keymap label to describe backtracking only.
  - Block backtrack/edit-previous handling while a side conversation is
  active and report `Editing previous prompts is unavailable in side
  conversations.` when that path would have fired.
  - Keep composer-owned `Esc` behavior, such as Vim insert-mode escape,
  routed locally.
  - Refresh focused shortcut assertions and TUI snapshots for the updated
  footer and new side-conversation error message.
  
  ## Verification
  Manually tested `/side` use cases and `Esc`, `Ctrl+C`, `Ctrl+D`.

  Eric Traut · 2026-05-14 20:51:08 -07:00
  d1235a0a78
• feat(tui): standardize picker navigation keys (#22347)

  ## Why
  
  Picker-style UI in the TUI has accumulated a mix of hardcoded navigation
  keys. Some lists supported page movement, some did not; some accepted
  Vim-like keys, while others only accepted arrows; and tabbed or
  horizontally adjustable pickers had no shared keymap action for
  left/right movement.
  
  This PR makes picker/list navigation consistent and configurable so
  users can rely on the same defaults across the TUI.
  
  ## What Changed
  
  - Adds shared list keymap actions for:
    - vertical movement: `move_up`, `move_down`
    - horizontal movement: `move_left`, `move_right`
    - paging and jumps: `page_up`, `page_down`, `jump_top`, `jump_bottom`
  - Adds defaults:
  - Up/down: arrows, `Ctrl+P/N`, `Ctrl+K/J`, and plain `k/j` where text
  input is not active
    - Page up/down: `PageUp/PageDown` and `Ctrl+B/F`
    - First/last: `Home/End`
    - Left/right: `Left/Right` and `Ctrl+H/L`
  - Wires the shared list keymap through picker and list surfaces
  including session resume, multi-select, tabbed selection lists,
  settings-style lists, app-link selection, MCP elicitation,
  request-user-input, and the OSS selection wizard.
  - Keeps search behavior intact by reserving printable characters for
  query text in searchable pickers.
  - Updates keymap setup actions, config schema, snapshots, and focused
  coverage for the new list actions.
  
  ## How to Test
  
  1. Start Codex from this branch and open the session picker, for example
  with an existing session history.
  2. In the session list, verify that `Ctrl+J/K` moves the selection
  down/up.
  3. Verify that `Ctrl+F/B` pages down/up and `Home/End` jumps to the
  first/last visible session.
  4. Type printable search text such as `j` or `k` and confirm it updates
  the query instead of navigating.
  5. Focus a picker control that changes values horizontally, such as a
  session picker toolbar control, and verify `Ctrl+H/L` changes the
  focused value like left/right arrows.
  
  Targeted tests run:
  
  - `cargo test -p codex-tui keymap::tests::`
  - `cargo test -p codex-tui keymap_setup::tests::`
  - `cargo test -p codex-tui horizontal_list_keys`
  - `cargo test -p codex-tui page_and_jump_navigation_use_list_keymap`
  - `cargo test -p codex-tui ctrl_h_l_move_provider_selection`
  - `cargo test -p codex-tui scroll_state::tests`
  - `cargo test -p codex-tui
  switching_tabs_changes_visible_items_and_clears_search`
  - `cargo test -p codex-tui toggle_sort_key_reloads_with_new_sort`
  
  Also ran `just write-config-schema`, `just fmt`, `just fix -p
  codex-tui`, `just argument-comment-lint`, and `git diff --check`.
  
  Note: `cargo test -p codex-tui` was attempted and still aborts in the
  pre-existing
  `tests::fork_last_filters_latest_session_by_cwd_unless_show_all` stack
  overflow, which is unrelated to this branch.

  Felipe Coury · 2026-05-13 15:33:27 +00:00
  3d517fbd00
• add --dangerously-bypass-hook-trust CLI flag (#21768)

  # Why
  
  Hook trust happens through the TUI in `/hooks` so it can block
  non-interactive use cases. This flag will allow users that are using
  codex headlessly to bypass hooks when they want to.
  
  # What
  
  This adds one invocation-scoped escape hatch.
  
  - the CLI flag sets a runtime-only `bypass_hook_trust` override; there
  is no durable `config.toml` setting
  - hook discovery still respects normal enablement, so explicitly
  disabled hooks remain disabled
  - we show a `--dangerously-bypass-hook-trust is enabled. Enabled hooks
  may run without review for this invocation.` message on startup so
  accidental use is visible in both interactive and exec flows
  
  This keeps “enabled” and “trusted” as separate concepts in the normal
  path, while giving CI/E2E callers a stable way to opt into the
  exceptional path when they already control the hook set.

  Abhinav · 2026-05-13 07:13:57 +00:00
  392e94e9ea
• feat(tui): render responsive Markdown tables in TUI (#22052)

  ## Why
  
  The TUI currently treats Markdown tables as ordinary wrapped text, which
  makes table-heavy responses hard to read and brittle across narrow panes
  and terminal resizes.
  
  This change teaches the TUI to render Markdown tables responsively while
  preserving the raw Markdown source needed to re-render streamed and
  finalized transcript content after width changes. The goal is to keep
  tables legible during streaming, after resize, and once a turn has
  finished, without corrupting scrollback ordering.
  
  ## What Changed
  
  - add table detection and responsive table rendering in the Markdown
  renderer
  - render standard tables with Unicode box-drawing borders when the pane
  is wide enough
  - add a vertical readability fallback for constrained or dense tables so
  narrow panes still show each row clearly
  - keep links and `<br>` content inside table cells instead of leaking
  text outside the table
  - avoid table normalization inside fenced or indented code blocks
  - preserve raw streamed Markdown source and keep the active table as a
  mutable tail until finalization
  - consolidate finalized streamed content into source-backed transcript
  cells so post-resize re-rendering stays correct
  - add snapshot and targeted streaming/resize regression coverage for the
  new table behavior
  
  ## How to Test
  
  1. Start Codex TUI from this branch.
  2. Paste this exact prompt:
  `This is a session to test codex, no need to do any thinking, just end
  different markdown tables, with columns exploring different markdown
  contents, like links, bold italic, code, etc. Make them different sizes,
  some 30+ rows, some not and intertwine them with some paragraphs with
  complex formatting as well.`
  3. Confirm the response includes several Markdown tables mixed with
  richly formatted paragraphs.
  4. Confirm wide-enough tables render with box-drawing borders instead of
  plain wrapped pipe text.
  5. Resize the terminal narrower while the answer is still streaming and
  confirm the in-progress table stays coherent instead of duplicating
  headers or leaving broken scrollback behind.
  6. Resize again after the turn finishes and confirm the finalized
  transcript re-renders cleanly at the new width.
  7. In a narrow pane, verify dense tables fall back to the vertical
  per-row layout instead of producing unreadable wrapped columns.
  8. Also verify pipe-heavy fenced code blocks still render as code, not
  as tables.
  
  Targeted tests:
  - `cargo test -p codex-tui table_readability_fallback --no-fail-fast`
  - `cargo test -p codex-tui markdown_render --no-fail-fast`
  - `cargo test -p codex-tui streaming::controller --no-fail-fast`
  - `cargo test -p codex-tui table_resize_lifecycle --no-fail-fast`
  
  ## Docs
  
  No developer docs update appears necessary.

  Felipe Coury · 2026-05-10 20:42:11 +00:00
  5248e3da2b
• Improve hooks trust flow in TUI (#21755)

  # Why
  Hooks that need trust review were easy to miss, and the existing TUI
  flow made users discover `/hooks` manually before they could decide
  whether to inspect or trust them.
  
  # What
  - add a startup review prompt for new or changed hooks before normal
  composer use
  - add a top-level `t` shortcut in `/hooks` to trust every review-needed
  hook at once
  - make pending-review rows and helper copy use warning styling
  
  ## TUI
  
  ### Startup review interstitial
  
  ```text
  Hooks need review
  2 hooks are new or changed.
  Hooks can run outside the sandbox after you trust them.
  
  › 1. Review hooks
    2. Trust all and continue
    3. Continue without trusting (hooks won't run)
  ```
  
  ### Top-level `/hooks` page when review is needed
  
  ```text
  Hooks
  Lifecycle hooks from config and enabled plugins.
  
  ⚠ 1 hook needs review before it can run.
  
  Event                 Installed   Active   Review   Description
  PreToolUse            1           0        1        Before a tool executes
  ...
  
  Press t to trust all; enter to review hooks; esc to close
  ```

  Abhinav · 2026-05-09 21:17:30 +00:00
  6d747db7d8
• fix(tui): preserve wrapped prose beside URLs (#21760)

  ## Why
  
  Mixed prose lines that contained URLs started taking the URL-preserving
  wrapping path, but that path could split ordinary words mid-token. A
  follow-up issue remained in scrollback insertion: when already-rendered
  indented rows were wrapped again, continuation rows could lose their
  margin and fall back to terminal hard wrapping. Together those bugs made
  normal Markdown output look broken around links, lists, blockquotes, and
  indented content.
  
  Separately, the local argument-comment lint wrappers failed under
  environments that set `PYTHONSAFEPATH=1`, because Python no longer adds
  the script directory to `sys.path` automatically. That prevented the
  lint from reaching Rust callsites at all.
  
  <img width="1778" height="1558" alt="CleanShot 2026-05-09 at 11 51 38"
  src="https://github.com/user-attachments/assets/9274d150-1757-4f1a-89ac-5bdc9997d8cb"
  />
  
  ## What Changed
  
  - Preserve URL tokens without turning every neighboring prose word into
  a character-level split point.
  - Add a mixed URL/prose wrapper that keeps ordinary words whole,
  preserves leading whitespace, and re-splits long non-URL tokens against
  the actual width available on continuation rows.
  - Reuse a rendered history row's leading whitespace as the continuation
  indent when scrollback insertion has to pre-wrap it again.
  - Add regression coverage for markdown wrapping, history-cell rendering,
  scrollback continuation margins, leading-indent width accounting, and
  continuation-row re-splitting.
  - Make both argument-comment lint entrypoints explicitly add their own
  directory to `sys.path`, so sibling imports still work when
  `PYTHONSAFEPATH=1`.
  
  ## How to Test
  
  1. Start Codex and render a long Markdown response that mixes prose with
  inline links, blockquotes, lists, and indented code-like text.
  2. Confirm that ordinary words next to links stay whole instead of
  breaking mid-word.
  3. Resize or replay the transcript and confirm wrapped continuation rows
  keep their expected left margin for blockquotes, lists, and indented
  content.
  4. Run the source argument-comment lint from a shell with
  `PYTHONSAFEPATH=1` and confirm it starts normally instead of failing to
  import `wrapper_common`.
  
  Targeted tests:
  - `cargo test -p codex-tui mixed_line --lib`
  - `cargo test -p codex-tui preserves_prefix_on_wrapped_rows --lib`
  - `cargo test -p codex-tui
  agent_markdown_cell_does_not_split_words_after_inline_markdown --lib`
  - `cargo test -p codex-tui
  mixed_url_markdown_wraps_prose_without_splitting_words_snapshot --lib`
  - `python3 tools/argument-comment-lint/test_wrapper_common.py`
  - `just argument-comment-lint-from-source -p codex-tui -- --lib`
  
  Notes:
  - `cargo test -p codex-tui` currently reaches the new tests
  successfully, then still aborts in the pre-existing
  `tests::fork_last_filters_latest_session_by_cwd_unless_show_all`
  stack-overflow failure.

  Felipe Coury · 2026-05-09 13:58:10 -03:00
  f27cf9db09
• feat(tui): redesign session picker (#20065)

  ## Why
  
  The resume/fork picker is becoming the main way users recover previous
  work, but the old fixed table made sessions hard to scan once thread
  names, branches, working directories, and timestamps all mattered. This
  redesign makes the picker denser by default, easier to search, and safer
  to inspect before resuming or forking.
  
  <table>
  <tr>
  <td>
  <img width="1660" height="1103" alt="CleanShot 2026-05-03 at 12 34 10"
  src="https://github.com/user-attachments/assets/313ede1d-1da4-4863-acd2-56b3e27e9703"
  />
  </td>
  <td>
  <img width="1662" height="1100" alt="CleanShot 2026-05-03 at 12 34 15"
  src="https://github.com/user-attachments/assets/cfde7d5c-bab0-4994-a807-254e53f344ea"
  />
  </td>
  </tr>
  <tr>
  <td>
  <img width="1664" height="1107" alt="CleanShot 2026-05-03 at 12 39 22"
  src="https://github.com/user-attachments/assets/e1ee58ca-4dc5-4a35-ae0f-47562da3974c"
  />
  </td>
  <td>
  <img width="1662" height="1100" alt="CleanShot 2026-05-03 at 12 35 09"
  src="https://github.com/user-attachments/assets/9c888072-eedf-4f45-985c-0c14df28bcc7"
  />
  </td>
  </tr>
  </table>
  
  ## What Changed
  
  - Replaces the old session table with responsive session rows that
  prioritize the session name or preview, then show timestamp, cwd, and
  branch metadata.
  - Makes dense view the default while keeping comfortable view available
  through `Ctrl+O`.
  - Persists the picker view preference in `[tui].session_picker_view`,
  including active profile-scoped config.
  - Adds sort/filter controls for updated time, created time, cwd, and all
  sessions.
  - Expands search matching across session name, preview, thread id,
  branch, and cwd.
  - Makes `Esc` safer in search mode: it clears an active query before
  starting a new session.
  - Adds lazy transcript inspection:
    - `Space` expands recent transcript context inline.
    - `Ctrl+T` opens a transcript overlay.
    - raw reasoning visibility follows `show_raw_agent_reasoning`.
  - Keeps remote cwd filtering server-side for remote app-server sessions
  so local path normalization does not incorrectly hide remote results.
  - Updates snapshots and config schema for the new picker states and
  config option.
  
  ## How to Test
  
  1. Start Codex in a repo with several saved sessions.
  2. Press `Ctrl+R` / resume picker entry point.
  3. Confirm the picker opens in dense mode and shows session name or
  preview, timestamp, cwd, and branch metadata.
  4. Press `Ctrl+O` and confirm it switches between dense and comfortable
  views.
  5. Restart Codex and confirm the selected view persists.
  6. Type a query that matches a branch, cwd, thread id, or session name;
  confirm matching sessions appear.
  7. Press `Esc` while the query is non-empty and confirm it clears search
  instead of starting a new session.
  8. Select a session and press `Space`; confirm recent transcript context
  expands inline.
  9. Press `Ctrl+T`; confirm the transcript overlay opens and respects
  raw-reasoning visibility settings.
  
  Targeted tests:
  - `cargo test -p codex-tui resume_picker --no-fail-fast`
  - `cargo test -p codex-core
  runtime_config_resolves_session_picker_view_default_and_override`
  - `cargo test -p codex-core profile_tui_rejects_unsupported_settings`
  - `cargo check -p codex-thread-manager-sample`
  - `cargo insta pending-snapshots`

  Felipe Coury · 2026-05-05 13:32:54 -07:00
  3b2ebb368e
• hook trust metadata and enforcement (#20321)

  # Why
  
  We want shared hook trust that both the app and the TUI can build on,
  but the metadata is only useful if runtime behavior agrees with it. This
  PR adds a single backend trust model for hooks so unmanaged hooks cannot
  run until the current definition has been reviewed, while managed hooks
  remain runnable and non-configurable.
  
  # What
  
  - persist `trusted_hash` alongside hook state in `config.toml`
  - expose `currentHash` and derived `trustStatus` through `hooks/list`
  - derive trust from normalized hook definitions so equivalent hooks from
  `config.toml` and `hooks.json` share the same trust identity
  - gate unmanaged hooks on trust before they enter the runnable handler
  set
  
  # Reviewer Notes
  
  - key file to review is `codex-rs/hooks/src/engine/discovery.rs`
  - the only **core** change is schema related

  Abhinav · 2026-05-05 19:13:55 +00:00
  0452dca986
• feat(tui): add raw scrollback mode (#20819)

  ## Why
  
  Granular copy is particularly difficult with the current output. Part of
  it was solved with the introduction of the `/copy` command but when you
  only need to copy parts of a response, you still encounter some issues:
  
  - When you copy a paragraph, the result is a sequence of separate lines
  instead of one correctly joined paragraph.
  - When a word wraps, part of it stays on the original line and the rest
  appears at the start of the next line.
  - When you copy a long command, extra line breaks are often inserted,
  and command arguments can be split across multiple lines.
  
  
  https://github.com/user-attachments/assets/0ef85c84-9363-4aad-b43a-15fce062a443
  
  ## Solution
  
  Now that we own the scrollback and we re-create it when we resize, we
  have the opportunity of toggling between the raw text and the rich text
  we see today.
  
  - Add TUI raw scrollback mode with `tui.raw_output_mode`, `/raw
  [on|off]`, and the configurable `tui.keymap.global.toggle_raw_output`
  action.
  - Render transcript cells through rich/raw-aware paths so raw mode
  preserves source text and lets the terminal soft-wrap selection-friendly
  output.
  - Bind raw-mode toggle to `alt-r` by default, with the keybinding path
  toggling silently while `/raw` continues to emit confirmation messages.
  
  ## Related Issues
  
  Likely addressed by raw mode:
  
  - #12200: clean copy for multiline and soft-wrapped output. Raw mode
  removes Codex-inserted wrapping/indentation and lets the terminal
  soft-wrap logical lines.
  - #9252: command suggestions gain unwanted leading spaces when copied.
  Raw mode renders transcript text without the rich-mode left
  padding/gutter.
  - #8258: prompt output is hard to copy because of leading indentation.
  Raw mode renders user/source-backed transcript text without that
  decorative indentation.
  
  Partially or conditionally addressed:
  
  - #2880: copy/export message as Markdown. Raw mode exposes raw Markdown
  for terminal selection, but this PR does not add a dedicated
  export/copy-message command.
  - #19820: mouse drag selection + copy in the TUI. Raw mode improves
  terminal-native selection of output/history text, but this PR does not
  implement in-TUI mouse selection, highlighting, auto-copy, or composer
  selection.
  - #18979: copied content is divided into two parts. This should improve
  cases caused by Codex-inserted wraps/padding in rendered output; if the
  report is about pasting into the composer/input path, that remains
  outside this PR.
  
  ## Validation
  
  - `just write-config-schema`
  - `just fmt`
  - `cargo test -p codex-config`
  - `cargo test -p codex-tui`
  - `just fix -p codex-tui`
  - `just argument-comment-lint`
  - `cargo test -p codex-tui
  raw_output_mode_can_change_without_inserting_notice -- --nocapture`
  - `cargo test -p codex-tui
  raw_slash_command_toggles_and_accepts_on_off_args -- --nocapture`
  - `cargo test -p codex-tui raw_output_toggle -- --nocapture`
  - `git diff --check`
  - `cargo insta pending-snapshots`

  Felipe Coury · 2026-05-05 11:17:47 -07:00
  5e0a4adbe5
• feat(tui): improve TUI keymap coverage (#20798)

  ## Summary
  - normalize terminal-emitted C0 control characters through configurable
  editor keymaps, covering raw control-key fallbacks like
  Shift+Enter-as-LF in terminals from #20555 and #20898, plus part of the
  modified-Enter behavior in #20580
  - add default-unbound keymap actions for toggling Fast mode and killing
  the current composer line, giving #20698 users a configurable zsh-style
  Ctrl+U option without changing the existing default Ctrl+U behavior
  - wire the new actions through gated /keymap picker entries, schema
  generation, and snapshot coverage
  
  Fixes #20555.
  Fixes #20898.
  
  ## Testing
  - just write-config-schema
  - just fmt
  - cargo test -p codex-config
  - cargo test -p codex-tui keymap::tests
  - cargo test -p codex-tui bottom_pane::textarea::tests
  - cargo test -p codex-tui keymap_setup::tests
  - cargo insta pending-snapshots
  - just fix -p codex-tui
  - git diff --check
  - just argument-comment-lint

  Felipe Coury · 2026-05-04 19:18:56 +00:00
  48402be6fa
• feat(tui): add keymap debug inspector (#20794)

  ## Why
  
  We constantly get bug reports about keys not being recognized by Codex
  when the terminal is not handling the key press. Running `/keymap debug`
  or `/keymap` and going to the Debug tab, we can allow the user to either
  understand that the key being pressed is not being recognized or to
  check what it's being recognized as and report or reassign that key.
  
  | Menu | Inspector | Hint |
  |---|---|---|
  | <img width="1369" height="796" alt="CleanShot 2026-05-02 at 12 57 12"
  src="https://github.com/user-attachments/assets/512b6faa-344e-4aee-9c00-b4bdc633a662"
  /> | <img width="1261" height="754" alt="CleanShot 2026-05-02 at 12 56
  36"
  src="https://github.com/user-attachments/assets/a6ddae7d-e174-4ee4-893f-e6bec4fff4ab"
  /> | <img width="1369" height="796" alt="CleanShot 2026-05-02 at 12 57
  30"
  src="https://github.com/user-attachments/assets/db507784-f40a-4cff-ac23-a61d9703769b"
  /> |
  ## Summary
  - add a Debug tab to `/keymap` and support `/keymap debug` for direct
  access
  - show what key Codex receives, the config key representation, raw event
  details, and matching actions
  - add a progressive missing-key hint that escalates after a few seconds
  with no detected keypress
  
  ## Validation
  - `just fmt`
  - `cargo test -p codex-tui keymap_setup::tests::debug_view`
  - `cargo test -p codex-tui keymap_setup::tests`
  - `cargo test -p codex-tui slash_keymap`
  - `cargo test -p codex-tui` (unit tests passed; integration test
  `suite::model_availability_nux::resume_startup_does_not_consume_model_availability_nux_count`
  failed locally by itself with `codex resume` exiting 1 and terminal
  probe escape output)
  - `just fix -p codex-tui`
  - `just argument-comment-lint`
  - `cargo insta pending-snapshots`
  - `git diff --check`

  Felipe Coury · 2026-05-04 14:40:50 -03:00
  94800ecbbf
• fix(tui): restore alt-enter newline alias (#20535)

  Fixes https://github.com/openai/codex/issues/20501
  
  ## Summary
  - add Alt+Enter to the built-in editor newline aliases
  - update keymap tests that used Alt+Enter as a custom submit binding now
  that it conflicts with newline
  - refresh the keymap action-menu snapshot fixture
  
  ## Test Plan
  - `just fmt`
  - `cargo test -p codex-tui keymap::tests`
  - `cargo test -p codex-tui bottom_pane::textarea::tests`
  - `cargo test -p codex-tui keymap_setup::tests`
  - `cargo test -p codex-tui`
  - `cargo insta pending-snapshots`
  - `git diff --check`
  - `just argument-comment-lint`

  Felipe Coury · 2026-05-01 15:22:02 -03:00
  ff66b3c7eb
• Enforce animations = false for screen readers (#20564)

  ## Why
  
  Issue #20489 calls out that animated TUI affordances can be noisy for
  screen-reader users. Codex already has `tui.animations = false` as a
  reduced-motion setting, but some live activity rows render spinner-style
  prefixes in that mode. These were relatively recent regressions.
  
  We have also regressed this pattern more than once by adding new
  spinner/shimmer callsites that do not think through the reduced-motion
  path, so this PR adds a small guardrail while fixing the current
  surfaces.
  
  ## What changed
  
  - Omit the live status-row spinner when animations are disabled, so the
  row starts with stable text like `Working (...)`.
  - Render running hook headers without the spinner prefix when animations
  are disabled, while preserving shimmer/spinner behavior when animations
  are enabled.
  - Centralize TUI activity indicators in `tui/src/motion.rs`, with
  explicit reduced-motion choices for hidden prefixes, static bullets, and
  plain shimmer-text fallbacks.
  - Route existing spinner/shimmer callsites through the central motion
  helper, including exec rows, MCP/web-search/loading rows, hook rows,
  plugin loading, and onboarding loading text.
  - Add a source-scan regression test that rejects direct `spinner(...)`
  or `shimmer_spans(...)` usage outside the central module and primitive
  definition.
  - Add focused coverage that reduced-motion active exec rows are stable,
  status rows start without a spinner, running hooks omit the spinner, and
  MCP inventory loading stays stable.
  - Update the one affected status-indicator snapshot; the existing detail
  tree prefix remains unchanged.
  
  ## Verification
  
  - `cargo test -p codex-tui`

  Eric Traut · 2026-05-01 09:07:56 -07:00
  227bee0445
• feat(tui): add vim composer mode (#18595)

  ## Why
  
  Codex now has configurable TUI keymaps, but the composer still behaves
  like a plain text field. Users who prefer modal editing need a way to
  keep Vim muscle memory while drafting prompts, and the keymap picker
  needs to expose Vim-specific actions if those bindings are configurable
  instead of hardcoded.
  
  ## What Changed
  
  - Adds composer Vim mode with insert/normal state, common normal-mode
  movement and editing commands, `d`/`y` operator-pending flows, and
  mode-aware footer and cursor indicators.
  - Adds `/vim`, an optional global `toggle_vim_mode` binding, and
  `tui.vim_mode_default` so Vim mode can be toggled per session or enabled
  as the default composer state.
  - Extends runtime and config keymaps with `vim_normal` and
  `vim_operator` contexts, exposes those contexts in `/keymap`, refreshes
  the config schema, and validates Vim bindings separately.
  - Integrates Vim normal mode with existing composer behavior: `/` opens
  slash command entry, `!` enters shell mode, `j`/`k` navigate history at
  history boundaries, successful submissions reset back to normal mode,
  and paste burst handling remains insert-mode only.
  - Teaches the TUI render path to apply and restore cursor style so Vim
  insert mode can use a bar cursor without leaving the terminal in that
  state after exit.
  
  ## Validation
  
  - `cargo test -p codex-tui keymap -- --nocapture` on the keymap/Vim
  coverage
  - `cargo insta pending-snapshots`
  
  ## Docs
  
  This introduces user-facing `/vim`, `tui.vim_mode_default`, and Vim
  keymap contexts under `tui.keymap`, so the public CLI configuration and
  slash-command docs should be updated before the feature ships.

  Felipe Coury · 2026-04-30 17:20:51 -07:00
  b6f81257f8
• feat(tui): add configurable keymap support (#18593)

  ## Why
  
  The TUI currently handles keyboard shortcuts as hard-coded event matches
  spread across app, composer, pager, list, approval, and navigation code.
  That makes shortcuts hard to customize, makes displayed hints easy to
  drift from actual behavior, and makes future keymap work riskier because
  there is no central action inventory.
  
  This PR adds the foundation for configurable, action-based keymaps
  without adding the interactive remapping UI yet. Onboarding
  intentionally stays on fixed startup shortcuts because users cannot
  reasonably configure keymaps before completing onboarding.
  
  This is PR1 in the keymap stack:
  
  - PR1: #18593: configurable keymap foundation
  - PR2: #18594: `/keymap` picker and guided remapping UI
  - PR3: #18595: Vim composer mode and the remap option
  
  ## Design Notes
  
  The new model resolves named actions into concrete runtime bindings once
  from config, then passes those bindings to the UI surfaces that handle
  input or render shortcut hints.
  
  The main concepts are:
  
  - **Context**: a scope where an action is active, such as `global`,
  `chat`, `composer`, `editor`, `pager`, `list`, or `approval`.
  - **Action**: a named operation inside a context, such as
  `global.open_transcript`, `composer.submit`, or `pager.close`.
  - **Binding**: one or more single-key shortcuts assigned to an action,
  written as config strings such as `ctrl-t`, `alt-backspace`, or
  `page-down`. Multi-step sequences such as `ctrl-x ctrl-s`, `g g`, or
  leader-key flows are not part of this PR.
  - **Resolution order**: context-specific config wins first, supported
  global fallbacks come next, and built-in defaults fill in anything
  unset.
  - **Explicit unbinding**: an empty array removes an action binding in
  that scope and does not fall through to a fallback binding.
  - **Conflict validation**: a resolved keymap rejects duplicate active
  bindings inside the same scope so one keypress cannot dispatch two
  actions.
  
  ## What Changed
  
  - Added `TuiKeymap` config support under `[tui.keymap]`, including typed
  contexts/actions, key alias normalization, generated schema coverage,
  and user-facing config errors.
  - Added `RuntimeKeymap` resolution in `codex-rs/tui/src/keymap.rs`,
  including fallback precedence, built-in defaults, explicit unbinding,
  and per-context conflict validation.
  - Rewired existing TUI handlers to consume resolved keymap actions
  instead of directly matching hard-coded keys in each component.
  - Updated key hint rendering and footer/pager/list surfaces so displayed
  shortcuts follow the resolved keymap.
  - Kept onboarding shortcuts fixed in
  `codex-rs/tui/src/onboarding/keys.rs` instead of exposing them through
  `[tui.keymap]`.
  
  ## Validation
  
  The branch includes focused coverage for config parsing, key
  normalization, runtime fallback resolution, explicit unbinding,
  duplicate-key conflict validation, default keymap consistency,
  onboarding startup key behavior, and UI hint snapshots affected by
  resolved key bindings.

  Felipe Coury · 2026-04-28 12:52:25 -03:00
  5e737372ee
• Preserve TUI markdown list spacing after code blocks (#19706)

  ## Why
  
  Fixes #19702.
  
  The TUI markdown renderer could visually attach the next list marker to
  a fenced code block inside the previous list item, even when the source
  markdown included a blank line before the next item. That made
  block-heavy loose lists harder to read, while the desired behavior is
  still to keep simple lists compact.
  
  ## What changed
  
  - Track whether the current rendered list item contains a code block.
  - Preserve one blank separator before the following list marker only
  when the previous item contained a code block.
  - Add regression coverage for both paths: code-block list items keep the
  separator, and simple loose list items stay compact.
  
  ## Verification
  
  - `cargo test -p codex-tui markdown_render`
  
  I also manually verified that the bug exists before and is fixed after.
  
  ## Before
  <img width="437" height="240" alt="Screenshot 2026-04-26 at 1 19 01 PM"
  src="https://github.com/user-attachments/assets/3bc9d64d-2dba-40d9-9d6b-a1d0b3c0f728"
  />
  
  ## After
  <img width="410" height="269" alt="Screenshot 2026-04-26 at 1 18 54 PM"
  src="https://github.com/user-attachments/assets/19c15bee-da32-455e-a7cb-e05eb85f4ea0"
  />

  Eric Traut · 2026-04-27 13:40:46 -07:00
  52c06b8759
• Hide rewind preview when no user message exists (#19510)

  ## Why
  
  Fixes #19508.
  
  In a fresh TUI session, pressing `Esc` twice entered the rewind
  transcript overlay even though there was no user message to rewind to.
  That produced an empty header-only transcript view and exposed a rewind
  flow that could not select a valid target.
  
  ## What changed
  
  The backtrack flow now checks whether a user-message rewind target
  exists before opening the transcript preview. If no target exists, Codex
  stays in the main TUI and shows `No previous message to edit.` instead
  of opening an empty overlay.
  
  The same guard applies when starting rewind preview from the transcript
  overlay, and the first `Esc` no longer advertises the “edit previous
  message” hint when there is no previous message available.
  
  Snapshot coverage was added for the unavailable rewind info message,
  along with a small target-detection test.

  Eric Traut · 2026-04-27 09:51:12 -07:00
  6c51bf0c7c
• Add safety check notification and error handling (#19055)

  Adds a new app-server notification that fires when a user account has
  been flagged for potential safety reasons.

  Eric Traut · 2026-04-22 22:24:12 -07:00
  bbff4ee61a
• fix: windows snapshot for external_agent_config_migration::tests::prompt_snapshot did not match windows output (#18915)

  Fix a snapshot test that is failing on Windows, but is currently missed
  by Bazel due to https://github.com/openai/codex/pull/18913. We see this
  failing on Cargo builds on Windows, though.
  
  This Bazel vs. Cargo inconsistency explains why
  https://github.com/openai/codex/pull/18768 did not fix the Cargo Windows
  build.

  Michael Bolin · 2026-04-22 00:32:46 +00:00
  6368f506b7
• [codex] Tighten external migration prompt tests (#18768)

  ## Summary
  - tighten the external migration prompt snapshot around stable synthetic
  fixture text
  - add focused display_description tests for relative path rewriting and
  plugin summaries
  - split the path-format assertions into smaller, easier-to-read unit
  tests
  
  ## Why
  The previous prompt snapshot was coupled to path text that came from
  detected migration items, which made it noisier and more brittle than
  necessary. This change keeps the snapshot focused on stable UI structure
  and moves dynamic path formatting checks into targeted unit tests.
  
  ## Validation
  - cargo test -p codex-tui external_agent_config_migration::tests::
  - cargo test -p codex-tui
  external_agent_config_migration::tests::display_description_
  - just fmt
  
  ## Notes
  Per the repo instructions, I did not rerun tests after the final `just
  fmt` pass.

  alexsong-oai · 2026-04-21 16:20:15 -07:00
  6bbd710496
• Fix stale model test fixtures (#18719)

  Fixes stale test fixtures left after the active bundled model catalog
  updates in #18586 and #18388. Those changes made `gpt-5.4` the current
  default and removed several older hardcoded slugs, which left Windows
  Bazel shards failing TUI and config tests.
  
  What changed:
  - Refresh TUI model migration, availability NUX, plan-mode, status, and
  snapshot fixtures to use active bundled model slugs.
  - Update the config edit test expectation for the TOML-quoted
  `"gpt-5.2"` migration key.
  - Move the model catalog tests into
  `codex-rs/tui/src/app/tests/model_catalog.rs` so touching them does not
  trip the blob-size policy for `app.rs`.
  
  Verification:
  - CI Bazel/lint checks are expected to cover the affected test shards.

  Ahmed Ibrahim · 2026-04-20 21:52:30 +00:00
  cc96a03f10
• Add verbose diagnostics for /mcp (#18610)

  Fixes #18539.
  
  ## Summary
  The recent `/mcp` performance work kept the default command fast by
  avoiding resource and resource-template inventory probes, but it also
  removed useful diagnostics for users trying to confirm MCP server state.
  
  This keeps bare `/mcp` on the fast tools/auth path and adds `/mcp
  verbose` for the slower diagnostic view. Verbose mode requests full MCP
  server status from the app-server and restores status, resources, and
  resource templates in the TUI output.
  
  ## Testing
  In addition to running automation, I manually tested the feature to
  confirm that it works.

  Eric Traut · 2026-04-20 08:13:44 -07:00
  5a8700abcc
• Add /side conversations (#18190)

  The TUI supports long-running turns and agent threads, but quick side
  questions have required interrupting the main flow or manually
  forking/navigating threads. This PR adds a guarded `/side` flow so users
  can ask brief side-conversation questions in an ephemeral fork while
  keeping the primary thread focused. This also helps address the feature
  request in #18125.
  
  The implementation creates one side conversation at a time, lets `/side`
  open either an empty side thread or immediately submit `/side
  <question>`, and returns to the parent with Esc or Ctrl+C. Side
  conversations get hidden developer guardrails that treat inherited
  history as reference-only and steer the model away from workspace
  mutations unless explicitly requested in the side conversation.
  
  The TUI hides most slash commands while side mode is active, leaving
  only `/copy`, `/diff`, `/mention`, and `/status` available there.

  Eric Traut · 2026-04-19 11:59:41 -07:00
  95dafbc7b5
• [TUI] add external config migration prompt when start TUI (#17891)

  - add a TUI startup migration prompt for external agent config
  - support migrating external configs including config, skills, AGENTS.md
  and plugins
  - gate the prompt behind features.external_migrate (default false)
  
  <img width="1037" height="480" alt="Screenshot 2026-04-14 at 9 29 14 PM"
  src="https://github.com/user-attachments/assets/6060849b-03cb-429a-9c13-c7bb46ad2e65"
  />
  <img width="713" height="183" alt="Screenshot 2026-04-14 at 9 29 26 PM"
  src="https://github.com/user-attachments/assets/d13f177e-d4c4-479c-8736-ef29636081e1"
  />
  
  ---------
  
  Co-authored-by: Eric Traut <etraut@openai.com>

  alexsong-oai · 2026-04-17 17:58:32 -07:00
  93ff798e5b
• Display YOLO mode permissions if set when launching TUI (#17877)

  - When launching the TUI client, if YOLO mode is enabled, display this
  in the header.
  - Eligibility is determined by `approval_policy = "never"` and
  `sandbox_mode = "danger-full-access"`
  
  <img width="886" height="230" alt="image"
  src="https://github.com/user-attachments/assets/d7064778-e32c-4123-8e44-ca0c9016ab09"
  />

  canvrno-oai · 2026-04-15 18:28:11 -07:00
  d97bad1272
• [codex] Show ctrl + t hint on truncated exec output in TUI (#17076)

  ## What
  
  Show an inline `ctrl + t to view transcript` hint when exec output is
  truncated in the main TUI chat view.
  
  ## Why
  
  Today, truncated exec output shows `… +N lines`, but it does not tell
  users that the full content is already available through the existing
  transcript overlay. That makes hidden output feel lost instead of
  discoverable.
  
  This change closes that discoverability gap without introducing a new
  interaction model.
  
  Fixes: CLI-5740
  
  ## How
  
  - added an output-specific truncation hint in `ExecCell` rendering
  - applied that hint in both exec-output truncation paths:
    - logical head/tail truncation before wrapping
    - row-budget truncation after wrapping
  - preserved the existing row-budget behavior on narrow terminals by
  reserving space for the longer hint line
  - updated the relevant snapshot and added targeted regression coverage
  
  ## Intentional design decisions
  
  - **Aligned shortcut styling with the visible footer UI**  
  The inline hint uses `ctrl + t`, not `Ctrl+T`, to match the TUI’s
  rendered key-hint style.
  
  - **Kept the noun `transcript`**  
  The product already exposes this flow as the transcript overlay, so the
  hint points at the existing concept instead of inventing a new label.
  
  - **Preserved narrow-terminal behavior**  
  The longer hint text is accounted for in the row-budget truncation path
  so the visible output still respects the existing viewport cap.
  
  - **Did not add the hint to long command truncation**  
  This PR only changes hidden **output** truncation. Long command
  truncation still uses the plain ellipsis form because `ctrl + t` is not
  the same kind of “show hidden output” escape hatch there.
  
  - **Did not widen scope to other truncation surfaces**  
  This does not change MCP/tool-call truncation in `history_cell.rs`, and
  it does not change transcript-overlay behavior itself.
  
  ## Validation
  
  ### Automated
  - `just fmt`
  - `cargo test -p codex-tui`
  
  ### Manual
  - ran `just tui-with-exec-server`
  - executed `!seq 1 200`
  - confirmed the main view showed the new `ctrl + t to view transcript`
  truncation hint
  - pressed `ctrl + t` and confirmed the transcript overlay still exposed
  the full output
  - closed the overlay and returned to the main view
  
  ## Visual proof
  
  Screenshot/video attached in the PR UI showing:
  - the truncated exec output row with the new hint
  - the transcript overlay after `ctrl + t`

  mom-oai · 2026-04-09 11:01:30 -07:00
  25a0f6784d
• Use model metadata for Fast Mode status (#16949)

  Fast Mode status was still tied to one model name in the TUI and
  model-list plumbing. This changes the model metadata shape so a model
  can advertise additional speed tiers, carries that field through the
  app-server model list, and uses it to decide when to show Fast Mode
  status.
  
  For people using Codex, the behavior is intended to stay the same for
  existing models. Fast Mode still requires the existing signed-in /
  feature-gated path; the difference is that the UI can now recognize any
  model the model list marks as Fast-capable, instead of requiring a new
  client-side slug check.

  pash-openai · 2026-04-07 17:55:40 -07:00
  80ebc80be5
• Speed up /mcp inventory listing (#16831)

  Addresses #16244
  
  This was a performance regression introduced when we moved the TUI on
  top of the app server API.
  
  Problem: `/mcp` rebuilt a full MCP inventory through
  `mcpServerStatus/list`, including resources and resource templates that
  made the TUI wait on slow inventory probes.
  
  Solution: add a lightweight `detail` mode to `mcpServerStatus/list`,
  have `/mcp` request tools-and-auth only, and cover the fast path with
  app-server and TUI tests.
  
  Testing: Confirmed slow (multi-second) response prior to change and
  immediate response after change.
  
  I considered two options:
  1. Change the existing `mcpServerStatus/list` API to accept an optional
  "details" parameter so callers can request only a subset of the
  information.
  2. Add a separate `mcpServer/list` API that returns only the servers,
  tools, and auth but omits the resources.
  
  I chose option 1, but option 2 is also a reasonable approach.

  Eric Traut · 2026-04-06 16:27:02 -07:00
  9f737c28dd
• Fix resume picker timestamp labels and stability (#16822)

  Problem: The resume picker used awkward "Created at" and "Updated at"
  headers, and its relative timestamps changed while navigating because
  they were recomputed on each redraw.
  
  Solution: Rename the headers to "Created" and "Updated", and anchor
  relative timestamp formatting to the picker load time so the displayed
  ages stay stable while browsing.

  Eric Traut · 2026-04-06 08:51:13 -07:00
  4294031a93
• ci: stop running rust CI with --all-features (#16473)

  ## Why
  
  Now that workspace crate features have been removed and
  `.github/scripts/verify_cargo_workspace_manifests.py` hard-bans new
  ones, Rust CI should stop building and testing with `--all-features`.
  
  Keeping `--all-features` in CI no longer buys us meaningful coverage for
  `codex-rs`, but it still makes the workflow look like we rely on Cargo
  feature permutations that we are explicitly trying to eliminate. It also
  leaves stale examples in the repo that suggest `--all-features` is a
  normal or recommended way to run the workspace.
  
  ## What changed
  
  - removed `--all-features` from the Rust CI `cargo chef cook`, `cargo
  clippy`, and `cargo nextest` invocations in
  `.github/workflows/rust-ci-full.yml`
  - updated the `just test` guidance in `justfile` to reflect that
  workspace crate features are banned and there should be no need to add
  `--all-features`
  - updated the multiline command example and snapshot in
  `codex-rs/tui/src/history_cell.rs` to stop rendering `cargo test
  --all-features --quiet`
  - tightened the verifier docstring in
  `.github/scripts/verify_cargo_workspace_manifests.py` so it no longer
  talks about temporary remaining exceptions
  
  ## How tested
  
  - `python3 .github/scripts/verify_cargo_workspace_manifests.py`
  - `cargo test -p codex-tui`

  Michael Bolin · 2026-04-01 14:06:20 -07:00
  148dbb25f0
• Rename tui_app_server to tui (#16104)

  This is a follow-up to https://github.com/openai/codex/pull/15922. That
  previous PR deleted the old `tui` directory and left the new
  `tui_app_server` directory in place. This PR renames `tui_app_server` to
  `tui` and fixes up all references.

  Eric Traut · 2026-03-28 11:23:07 -06:00
  61429a6c10
• fix(tui): refresh footer on collaboration mode changes (#16026)

  ## Summary
  - Moves status surface refresh (`refresh_status_surfaces` /
  `refresh_status_line`) from `App` event handlers into `ChatWidget`
  setters via a new `refresh_model_dependent_surfaces()` method
  - Ensures model-dependent UI stays in sync whenever collaboration mode,
  model, or reasoning effort changes, including the footer and terminal
  title in both `tui` and `tui_app_server`
  - Applies the fix to both `tui` and `tui_app_server` widgets
  
  #15961
  
  ## Test plan
  - [x] Added snapshot test
  `status_line_model_with_reasoning_plan_mode_footer` verifying footer
  renders correctly in plan mode
  - [x] Added
  `terminal_title_model_updates_on_model_change_without_manual_refresh` in
  `tui_app_server`
  - [ ] Verify switching collaboration modes updates the footer in real
  TUI
  - [ ] Verify model/reasoning effort changes reflect in the status bar
  and terminal title
  
  ---------
  
  Co-authored-by: Eric Traut <etraut@openai.com>

  Felipe Coury · 2026-03-28 08:55:32 -06:00
  bede1d9e23
• Remove the legacy TUI split (#15922)

  This is the part 1 of 2 PRs that will delete the `tui` /
  `tui_app_server` split. This part simply deletes the existing `tui`
  directory and marks the `tui_app_server` feature flag as removed. I left
  the `tui_app_server` feature flag in place for now so its presence
  doesn't result in an error. It is simply ignored.
  
  Part 2 will rename the `tui_app_server` directory `tui`. I did this as
  two parts to reduce visible code churn.

  Eric Traut · 2026-03-27 22:56:44 +00:00
  d65deec617
• Normalize /mcp tool grouping for hyphenated server names (#15946)

  Fix display for servers with special characters.

  pakrym-oai · 2026-03-27 14:58:29 -06:00
  8002594ee3
• Add a startup deprecation warning for custom prompts (#15076)

  ## Summary
  - detect custom prompts in `$CODEX_HOME/prompts` during TUI startup
  - show a deprecation notice only when prompts are present, with guidance
  to use `$skill-creator`
  - add TUI tests and snapshot coverage for present, missing, and empty
  prompts directories
  
  ## Testing
  - Manually tested

  Eric Traut · 2026-03-18 15:21:30 -06:00
  e5de13644d
• feat: make interrupt state not final for multi-agents (#13850)

  Make `interrupted` an agent state and make it not final. As a result, a
  `wait` won't return on an interrupted agent and no notification will be
  send to the parent agent.
  
  The rationals are:
  * If a user interrupt a sub-agent for any reason, you don't want the
  parent agent to instantaneously ask the sub-agent to restart
  * If a parent agent interrupt a sub-agent, no need to add a noisy
  notification in the parent agen

  jif-oai · 2026-03-16 16:39:40 +00:00
  3f266bcd68
• render local file links from target paths (#13857)

  Co-authored-by: Josh McKinney <joshka@openai.com>

  pash-openai · 2026-03-11 12:33:09 -07:00
  da74da6684
• Show spawned agent model and effort in TUI (#14273)

  - include the requested sub-agent model and reasoning effort in the
  spawn begin event\n- render that metadata next to the spawned agent name
  and role in the TUI transcript
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-03-11 12:33:09 -07:00
  285b3a5143
• tui: only show fast status for gpt-5.4 (#14135)
  pash-openai · 2026-03-09 21:12:05 -07:00
  63597d1b2d
• [tui] Show speed in session header (#13446)

  - add a speed row to the startup/session header under the model row
  - render the speed row with the same styling pattern as the model row,
  using /fast to change
  - show only Fast or Standard to users and update the affected snapshots
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  pash-openai · 2026-03-05 00:00:16 -08:00
  1ce1712aeb
• Add model availability NUX tooltips (#13021)

  - override startup tooltips with model availability NUX and persist
  per-model show counts in config
  - stop showing each model after four exposures and fall back to normal
  tooltips

  Ahmed Ibrahim · 2026-02-27 17:14:06 -08:00
  ec6f6aacbf
• fix(tui): theme-aware diff backgrounds with fallback behavior (#13037)

  ## Problem
  
  The TUI diff renderer uses hardcoded background palettes for
  insert/delete lines that don't respect the user's chosen syntax theme.
  When a theme defines `markup.inserted` / `markup.deleted` scope
  backgrounds (the convention used by GitHub, Solarized, Monokai, and most
  VS Code themes), those colors are ignored — the diff always renders with
  the same green/red tints regardless of theme selection.
  
  Separately, ANSI-16 terminals (and Windows Terminal sessions misreported
  as ANSI-16) rendered diff backgrounds as full-saturation blocks that
  obliterated syntax token colors, making highlighted diffs unreadable.
  
  ## Mental model
  
  Diff backgrounds are resolved in three layers:
  
  1. **Color level detection** — `diff_color_level_for_terminal()` maps
  the raw `supports-color` probe + Windows Terminal heuristics to a
  `DiffColorLevel` (TrueColor / Ansi256 / Ansi16). Windows Terminal gets
  promoted from Ansi16 to TrueColor when `WT_SESSION` is present.
  
  2. **Background resolution** — `resolve_diff_backgrounds()` queries the
  active syntax theme for `markup.inserted`/`markup.deleted` (falling back
  to `diff.inserted`/`diff.deleted`), then overlays those on top of the
  hardcoded palette. For ANSI-256, theme RGB values are quantized to the
  nearest xterm-256 index. For ANSI-16, backgrounds are `None`
  (foreground-only).
  
  3. **Style composition** — The resolved `ResolvedDiffBackgrounds` is
  threaded through every call to `style_add`, `style_del`, `style_sign_*`,
  and `style_line_bg_for`, which decide how to compose
  foreground+background for each line kind and theme variant.
  
  A new `RichDiffColorLevel` type (a subset of `DiffColorLevel` without
  Ansi16) encodes the invariant "we have enough depth for tinted
  backgrounds" at the type level, so background-producing functions have
  exhaustive matches without unreachable arms.
  
  ## Non-goals
  
  - No change to gutter (line number column) styling — gutter backgrounds
  still use the hardcoded palette.
  - No per-token scope background resolution — this is line-level
  background only; syntax token colors come from the existing
  `highlight_code_to_styled_spans` path.
  - No dark/light theme auto-switching from scope backgrounds —
  `DiffTheme` is still determined by querying the terminal's background
  color.
  
  ## Tradeoffs
  
  - **Theme trust vs. visual safety:** When a theme defines scope
  backgrounds, we trust them unconditionally for rich color levels. A
  badly authored theme could produce illegible combinations. The fallback
  for `None` backgrounds (foreground-only) is intentionally conservative.
  - **Quantization quality:** ANSI-256 quantization uses perceptual
  distance across indices 16–255, skipping system colors. The result is
  approximate — a subtle theme tint may land on a noticeably different
  xterm index.
  - **Single-query caching:** `resolve_diff_backgrounds` is called once
  per `render_change` invocation (i.e., once per file in a diff). If the
  theme changes mid-render (live preview), the next file picks up the new
  backgrounds.
  
  ## Architecture
  
  Files changed:
  
  | File | Role |
  |---|---|
  | `tui/src/render/highlight.rs` | New: `DiffScopeBackgroundRgbs`,
  `diff_scope_background_rgbs()`, scope extraction helpers |
  | `tui/src/diff_render.rs` | New: `RichDiffColorLevel`,
  `ResolvedDiffBackgrounds`, `resolve_diff_backgrounds*`,
  `quantize_rgb_to_ansi256`, Windows Terminal promotion; modified: all
  style helpers to accept/thread `ResolvedDiffBackgrounds` |
  
  The scope-extraction code lives in `highlight.rs` because it uses
  `syntect::highlighting::Highlighter` and the theme singleton. The
  resolution and quantization logic lives in `diff_render.rs` because it
  depends on diff-specific types (`DiffTheme`, `DiffColorLevel`, ratatui
  `Color`).
  
  ## Observability
  
  No runtime logging was added. The most useful debugging aid is the
  `diff_color_level_for_terminal` function, which is pure and fully
  unit-tested — to diagnose a color-depth mismatch, log its four inputs
  (`StdoutColorLevel`, `TerminalName`, `WT_SESSION` presence,
  `FORCE_COLOR` presence).
  
  Scope resolution can be tested by loading a custom `.tmTheme` with known
  `markup.inserted` / `markup.deleted` backgrounds and checking the diff
  output in a truecolor terminal.
  
  ## Tests
  
  - **Windows Terminal promotion:** 7 unit tests cover every branch of
  `diff_color_level_for_terminal` (ANSI-16 promotion, `WT_SESSION`
  unconditional promotion, `FORCE_COLOR` suppression, conservative
  `Unknown` level).
  - **ANSI-16 foreground-only:** Tests verify that `style_add`,
  `style_del`, `style_sign_*`, `style_line_bg_for`, and `style_gutter_for`
  all return `None` backgrounds on ANSI-16.
  - **Scope resolution:** Tests verify `markup.*` preference over
  `diff.*`, `None` when no scope matches, bundled theme resolution, and
  custom `.tmTheme` round-trip.
  - **Quantization:** Test verifies ANSI-256 quantization of a known RGB
  triple.
  - **Insta snapshots:** 2 new snapshot tests
  (`ansi16_insert_delete_no_background`,
  `theme_scope_background_resolution`) lock visual output.

  Felipe Coury · 2026-02-27 16:44:56 -07:00
  c3c75878e8
• fix(tui): promote windows terminal diff ansi16 to truecolor (#13016)

  ## Summary
  
  - Promote ANSI-16 to truecolor for diff rendering when running inside
  Windows Terminal
  - Respect explicit `FORCE_COLOR` override, skipping promotion when set
  - Extract a pure `diff_color_level_for_terminal` function for
  testability
  - Strip background tints from ANSI-16 diff output, rendering add/delete
  lines with foreground color only
  - Introduce `RichDiffColorLevel` to type-safely restrict background
  fills to truecolor and ansi256
  
  ## Problem
  
  Windows Terminal fully supports 24-bit (truecolor) rendering but often
  does not provide the usual TERM metadata (`TERM`, `TERM_PROGRAM`,
  `COLORTERM`) in `cmd.exe`/PowerShell sessions. In those environments,
  `supports-color` can report only ANSI-16 support. The diff renderer
  therefore falls back to a 16-color palette, producing washed-out,
  hard-to-read diffs.
  
  The screenshots below demonstrate that both PowerShell and cmd.exe don't
  set any `*TERM*` environment variables.
  
  | PowerShell | cmd.exe |
  |---|---|
  | <img width="2032" height="1162" alt="SCR-20260226-nfvy"
  src="https://github.com/user-attachments/assets/59e968cc-4add-4c7b-a415-07163297e86a"
  /> | <img width="2032" height="1162" alt="SCR-20260226-nfyc"
  src="https://github.com/user-attachments/assets/d06b3e39-bf91-4ce3-9705-82bf9563a01b"
  /> |
  
  
  ## Mental model
  
  `StdoutColorLevel` (from `supports-color`) is the _detected_ capability.
  `DiffColorLevel` is the _intended_ capability for diff rendering. A new
  intermediary — `diff_color_level_for_terminal` — maps one to the other
  and is the single place where terminal-specific overrides live.
  
  Windows Terminal is detected two independent ways: the `TerminalName`
  parsed by `terminal_info()` and the raw presence of `WT_SESSION`. When
  `WT_SESSION` is present and `FORCE_COLOR` is not set, we promote
  unconditionally to truecolor. When `WT_SESSION` is absent but
  `TerminalName::WindowsTerminal` is detected, we promote only the ANSI-16
  level (not `Unknown`).
  
  A single override helper — `has_force_color_override()` — checks whether
  `FORCE_COLOR` is set. When it is, both the `WT_SESSION` fast-path and
  the `TerminalName`-based promotion are suppressed, preserving explicit
  user intent.
  
  | PowerShell | cmd.exe | WSL | Bash for Windows |
  |---|---|---|---|
  |
  ![SCR-20260226-msrh](https://github.com/user-attachments/assets/0f6297a6-4241-4dbf-b7ff-cf02da8941b0)
  |
  ![SCR-20260226-nbao](https://github.com/user-attachments/assets/bb5ff8a9-903c-4677-a2de-1f6e1f34b18e)
  |
  ![SCR-20260226-nbej](https://github.com/user-attachments/assets/26ecec2c-a7e9-410a-8702-f73995b490a6)
  |
  ![SCR-20260226-nbkz](https://github.com/user-attachments/assets/80c4bf9a-3b41-40e1-bc87-f5c565f96075)
  |
  
  ## Non-goals
  
  - This does not change color detection for anything outside the diff
  renderer (e.g. the chat widget, markdown rendering).
  - This does not add a user-facing config knob; `FORCE_COLOR` already
  serves that role.
  
  ## Tradeoffs
  
  - The `has_wt_session` signal is intentionally kept separate from
  `TerminalName::WindowsTerminal`. `terminal_info()` is derived with
  `TERM_PROGRAM` precedence, so it can differ from raw `WT_SESSION`.
  - Real-world validation in this issue: in both `cmd.exe` and PowerShell,
  `TERM`/`TERM_PROGRAM`/`COLORTERM` were absent, so TERM-based capability
  hints were unavailable in those sessions.
  - Checking `FORCE_COLOR` for presence rather than parsing its value is a
  simplification. In practice `supports-color` has already parsed it, so
  our check is a coarse "did the user set _anything_?" gate. The effective
  color level still comes from `supports-color`.
  - When `WT_SESSION` is present without `FORCE_COLOR`, we promote to
  truecolor regardless of `stdout_level` (including `Unknown`). This is
  aggressive but correct: `WT_SESSION` is a strong signal that we're in
  Windows Terminal.
  - ANSI-16 add/delete backgrounds (bright green/red) overpower
  syntax-highlighted token colors, making diffs harder to read.
  Foreground-only cues (colored text, gutter signs) preserve readability
  on low-color terminals.
  
  ## Architecture
  
  ```
  stdout_color_level()  ──┐
  terminal_info().name  ──┤
  WT_SESSION presence   ──┼──▶ diff_color_level_for_terminal() ──▶ DiffColorLevel
  FORCE_COLOR presence  ──┘                                            │
                                                                       ▼
                                                            RichDiffColorLevel::from_diff_color_level()
                                                                       │
                                                            ┌──────────┴──────────┐
                                                            │ Some(TrueColor|256) │ → bg tints
                                                            │ None (Ansi16)       │ → fg only
                                                            └─────────────────────┘
  ```
  
  `diff_color_level()` is the environment-reading entry point; it gathers
  the four runtime signals and delegates to the pure, testable
  `diff_color_level_for_terminal()`.
  
  ## Observability
  
  No new logs or metrics. Incorrect color selection is immediately visible
  as broken diff rendering; the test suite covers the decision matrix
  exhaustively.
  
  ## Tests
  
  Six new unit tests exercise every branch of
  `diff_color_level_for_terminal`:
  
  | Test | Inputs | Expected |
  |------|--------|----------|
  | `windows_terminal_promotes_ansi16_to_truecolor_for_diffs` | Ansi16 +
  WindowsTerminal name | TrueColor |
  | `wt_session_promotes_ansi16_to_truecolor_for_diffs` | Ansi16 +
  WT_SESSION only | TrueColor |
  | `non_windows_terminal_keeps_ansi16_diff_palette` | Ansi16 + WezTerm |
  Ansi16 |
  | `wt_session_promotes_unknown_color_level_to_truecolor` | Unknown +
  WT_SESSION | TrueColor |
  | `explicit_force_override_keeps_ansi16_on_windows_terminal` | Ansi16 +
  WindowsTerminal + FORCE_COLOR | Ansi16 |
  | `explicit_force_override_keeps_ansi256_on_windows_terminal` | Ansi256
  + WT_SESSION + FORCE_COLOR | Ansi256 |
  | `ansi16_add_style_uses_foreground_only` | Dark + Ansi16 | fg=Green,
  bg=None |
  | (and any other new snapshot/assertion tests from commits d757fee and
  d7c78b3) | | |
  
  ## Test plan
  
  - [x] Verify all new unit tests pass (`cargo test -p codex-tui --lib`)
  - [x] On Windows Terminal: confirm diffs render with truecolor
  backgrounds
  - [x] On Windows Terminal with `FORCE_COLOR` set: confirm promotion is
  disabled and output follows the forced `supports-color` level
  - [x] On macOS/Linux terminals: confirm no behavior change
  
  Fixes https://github.com/openai/codex/issues/12904 
  Fixes https://github.com/openai/codex/issues/12890
  Fixes https://github.com/openai/codex/issues/12912
  Fixes https://github.com/openai/codex/issues/12840

  Felipe Coury · 2026-02-27 10:45:59 -07:00
  3b5996f988
• tui: use thread_id for resume/fork cwd resolution (#12727)

  ## Summary
  - make resume/fork targets explicit and typed as `SessionTarget { path,
  thread_id }` (non-optional `thread_id`)
  - resolve `thread_id` centrally via `resolve_session_thread_id(...)`:
  - use CLI input directly when it is a UUID (`--resume <uuid>` / `--fork
  <uuid>`)
  - otherwise read `thread_id` from rollout `SessionMeta` for path-based
  selections (picker, `--resume-last`, name-based resume/fork)
  - use `thread_id` to read cwd from SQLite first during resume/fork cwd
  resolution
  - keep rollout fallback for cwd resolution when SQLite is unavailable or
  does not return thread metadata (`TurnContext` tail, then `SessionMeta`)
  - keep the resume picker open when a selected row has unreadable session
  metadata, and show an inline recoverable error instead of aborting the
  TUI
  
  ## Why
  This removes ad-hoc rollout filename parsing and makes resume/fork
  target identity explicit. The resume/fork cwd check can use indexed
  SQLite lookup by `thread_id` in the common path, while preserving
  rollout-based fallback behavior. It also keeps malformed legacy rows
  recoverable in the picker instead of letting a selection failure unwind
  the app.
  
  ## Notes
  - minimal TUI-only change; no schema/protocol changes
  - includes TUI test coverage for SQLite cwd precedence when `thread_id`
  is available
  - includes TUI regression coverage for picker inline error rendering /
  non-fatal unreadable session rows
  
  ## Codex author
  `codex resume 019c9205-7f8b-7173-a2a2-f082d4df3de3`

  Charley Cunningham · 2026-02-26 12:52:31 -08:00
  c1afb8815a
• tui: restore visible line numbers for hidden file links (#12870)

  we recently changed file linking so the model uses markdown links when
  it wants something to be clickable.
  
  This works well across the GUI surfaces because they can render markdown
  cleanly and use the full absolute path in the anchor target.
  
  A previous pass hid the absolute path in the TUI (and only showed the
  label), but that also meant we could lose useful location info when the
  model put the line number or range in the anchor target instead of the
  label.
  
  This follow-up keeps the TUI behavior simple while making local file
  links feel closer to the old TUI file reference style.
  
  key changes:
  - Local markdown file links in the TUI keep the old file-ref feel: code
  styling, no underline, no visible absolute path.
  - If the hidden local anchor target includes a location suffix and the
  label does not already include one, we append that suffix to the visible
  label.
  - This works for single lines, line/column references, and ranges.
  - If the label already includes the location, we leave it alone.
  - normal web links keep the old TUI markdown-link behavior
  
  some examples:
  - `[foo.rs](/abs/path/foo.rs)` renders as `foo.rs`
  - `[foo.rs](/abs/path/foo.rs:45)` renders as `foo.rs:45`
  - `[foo.rs](/abs/path/foo.rs:45:3-48:9)` renders as `foo.rs:45:3-48:9`
  - `[foo.rs:45](/abs/path/foo.rs:45)` stays `foo.rs:45`
  - `[docs](https://example.com/docs)` still renders like a normal web
  link
  
  how it looks:
  <img width="732" height="813" alt="Screenshot 2026-02-26 at 9 27 55 AM"
  src="https://github.com/user-attachments/assets/d51bf236-653a-4e83-96e4-9427f0804471"
  />

  pash-openai · 2026-02-26 10:29:54 +00:00
  6acede5a28
• Enforce user input length cap (#12823)

  Currently there is no bound on the length of a user message submitted in
  the TUI or through the app server interface. That means users can paste
  many megabytes of text, which can lead to bad performance, hangs, and
  crashes. In extreme cases, it can lead to a [kernel
  panic](https://github.com/openai/codex/issues/12323).
  
  This PR limits the length of a user input to 2**20 (about 1M)
  characters. This value was chosen because it fills the entire context
  window on the latest models, so accepting longer inputs wouldn't make
  sense anyway.
  
  Summary
  - add a shared `MAX_USER_INPUT_TEXT_CHARS` constant in codex-protocol
  and surface it in TUI and app server code
  - block oversized submissions in the TUI submit flow and emit error
  history cells when validation fails
  - reject heavy app-server requests with JSON-RPC `-32602` and structured
  `input_too_large` data, plus document the behavior
  
  Testing
  - ran the IDE extension with this change and verified that when I
  attempt to paste a user message that's several MB long, it correctly
  reports an error instead of crashing or making my computer hot.

  Eric Traut · 2026-02-25 22:23:51 -08:00
  28bfbb8f2b
• Hide local file link destinations in TUI markdown (#12705)

  ## Summary
  - hide appended destinations for local path-style markdown links in the
  TUI renderer
  - keep web links rendering with their visible destination and style link
  labels consistently
  - add markdown renderer tests and a snapshot for the new file-link
  output
  
  ## Testing
  - just fmt
  - cargo test -p codex-tui
  <img width="1120" height="968" alt="image"
  src="https://github.com/user-attachments/assets/490e8eda-ae47-4231-89fa-b254a1f83eed"
  />

  pash-openai · 2026-02-26 05:28:37 +00:00
  9a96b6f509
• chore: rm hardcoded PRESETS list (#12650)

  rm `PRESETS` list harcoded in `model_presets` as we now have bundled
  `models.json` with equivalent info.
  
  update logic to rely on bundled models instead, update tests.

  sayan-oai · 2026-02-23 22:35:51 -08:00
  7e46e5b9c2
• fix: add ellipsis for truncated status indicator (#12540)

  #### What
  
  - Add ellipsis truncation of the status indicator, similar to equivalent
  truncation done in the footer.
  - Extract truncation helpers into separate file
  
  
  
  https://github.com/user-attachments/assets/a2d5f22f-8adc-456e-8059-97359194c25c
  
  
  #### Tests
  Updated relevant snapshot tests

  sayan-oai · 2026-02-23 11:45:46 -08:00
  bfe622f495