1709 Commits

• Update Codex login success page UX (#20136)

  ## Summary
  
  update the local login success page to match the Codex desktop auth UX
  use theme-aware colors and an inline 20px Codex mark
  keep the actual localhost success page aligned with the browser auth UX
  PR
  
  ## Tests
  
  <img width="1728" height="1117" alt="Screenshot 2026-04-29 at 12 00
  34 PM"
  src="https://github.com/user-attachments/assets/76a40c3f-07c3-452c-97da-e7c43717cd2c"
  />

  rafael-jac · 2026-04-29 19:14:53 -04:00
  98f67b15d3
• [mcp] Fix plugin MCP approval policy. (#19537)

  Plugin MCP servers are loaded from plugin manifests rather than
  top-level `[mcp_servers]`, so their tool approval preferences need to be
  stored and applied through the owning plugin config. Without this,
  choosing "Always allow" for a plugin MCP tool could write a preference
  that was not reliably used on later tool calls.
  
  ## Summary
  - Add plugin-scoped MCP policy config under
  `plugins.<plugin>.mcp_servers`, including server enablement, tool
  allow/deny lists, server defaults, and per-tool approval modes.
  - Overlay plugin MCP policy onto manifest-provided server configs when
  plugins are loaded.
  - Route persistent "Always allow" writes for plugin MCP tools back to
  the owning `plugins.<plugin>.mcp_servers.<server>.tools.<tool>` config
  entry.
  - Reload user config after persisting an approval and make the plugin
  load cache config-aware so stale plugin MCP policy is not reused after
  `config.toml` changes.
  - Regenerate the config schema and add coverage for plugin MCP policy
  loading, approval lookup, persistence, and stale-cache prevention.
  
  ## Testing
  - `cargo test -p codex-config`
  - `cargo test -p codex-core-plugins`
  - `cargo test -p codex-core --lib plugin_mcp`

  Matthew Zeng · 2026-04-29 15:40:03 -07:00
  e20391e567
• Include auto-review rollout in feedback uploads (#20064)

  ## Summary
  
  - include the live auto-review trunk rollout when `/feedback` uploads
  logs
  - upload that attachment as
  `auto-review-rollout-<parent-thread-id>.jsonl` so it is distinguishable
  from the parent rollout
  - show the same auto-review attachment name in the TUI consent popup
  
  ## Scope
  
  - this only covers the live cached auto-review trunk for the current
  parent thread
  - it does not add durable historical parent->auto-review lookup
  - it does not add persisted rollout support for ephemeral parallel
  review forks
  
  ## UI 
  
  <img width="599" height="185" alt="Screenshot 2026-04-28 at 1 17 18 PM"
  src="https://github.com/user-attachments/assets/6a0e79c2-5d21-4702-8a89-f765778bc9e9"
  />
  
  ## Validation
  
  - `cargo test -p codex-core
  cached_guardian_subagent_exposes_its_rollout_path`
  - `cargo test -p codex-feedback`
  - `cargo test -p codex-app-server`
  - `cargo test -p codex-tui feedback_upload_consent_popup_snapshot`
  - `cargo test -p codex-tui
  feedback_good_result_consent_popup_includes_connectivity_diagnostics_filename`
  
  ## Known unrelated local failures
  
  - `cargo test -p codex-core` currently fails in the pre-existing proxy
  env snapshot test
  `tools::runtimes::tests::maybe_wrap_shell_lc_with_snapshot_keeps_user_proxy_env_when_proxy_inactive`
  - `cargo test -p codex-tui` currently hits pre-existing `status::*`
  snapshot drift unrelated to this change
  
  ## Follow-Up 
  - persist parallel auto-review fork sessions so /feedback can include
  their rollout history too
  - attach each persisted fork as its own clearly named file, for example
  auto-review-rollout-<parent-thread-id>-fork <n>.jsonl, instead of
  merging multiple Guardian sessions into one attachment
  - keep the same live-session-only scope initially; durable historical
  parent -> auto-review lookup can remain a separate decision if we later
  need feedback from resumed sessions

  Won Park · 2026-04-29 11:44:55 -07:00
  5cf0adba93
• TUI: Remove core protocol dependency [3/7] (#20174)

  ## Why
  
  This is part 3 of a 7-PR stack to remove direct
  `codex_protocol::protocol` usage from `codex-tui` while keeping each
  layer reviewable and shippable.
  
  With `AppCommand` now explicit, the internal app event bus can carry TUI
  commands directly instead of bouncing through core `Op` values.
  
  ## What changed
  
  - Changed `AppEvent::CodexOp` and `AppEvent::SubmitThreadOp` to carry
  `AppCommand`.
  - Updated app-event senders and direct emitters to submit `AppCommand`
  values.
  - Adjusted tests to match `AppCommand` or convert back through
  `into_core()` where they intentionally assert legacy payload equality.
  
  ## Verification
  
  - `cargo test -p codex-tui --no-run`

  Eric Traut · 2026-04-29 10:52:10 -07:00
  d0204c3dcc
• TUI: Remove core protocol dependency [2/7] (#20173)

  ## Why
  
  This is part 2 of a 7-PR stack to remove direct
  `codex_protocol::protocol` usage from `codex-tui` while keeping each
  layer reviewable and shippable.
  
  Before the TUI event bus can stop carrying core `Op` values,
  `AppCommand` needs to be an owned TUI command shape rather than a thin
  wrapper around `Op`.
  
  ## What changed
  
  - Replaced the opaque `AppCommand(Op)` wrapper with explicit owned
  variants for the commands the TUI submits.
  - Preserved `into_core()` so this layer does not yet change the
  app/thread submission boundary.
  - Kept existing core leaf types for now so this remains a mechanical
  command-shape refactor.
  
  ## Verification
  
  - `cargo check -p codex-tui`

  Eric Traut · 2026-04-29 10:28:04 -07:00
  445629815c
• TUI: Remove core protocol dependency [1/7] (#20172)

  ## Why
  
  This is part 1 of a 7-PR stack to remove direct
  `codex_protocol::protocol` usage from `codex-tui` while keeping each
  layer reviewable and shippable.
  
  This first layer reduces the size of the later `chatwidget` diff by
  mechanically moving MCP startup bookkeeping out of the central widget
  file without changing the event shapes or behavior.
  
  ## What changed
  
  - Extracted MCP startup status handling into
  `tui/src/chatwidget/mcp_startup.rs`.
  - Kept the existing core event types in place for this purely mechanical
  move.
  - Updated the MCP startup tests to import the moved test-only event
  types directly.
  
  ## Verification
  
  - `cargo test -p codex-tui chatwidget::tests::mcp_startup`

  Eric Traut · 2026-04-29 09:10:22 -07:00
  1c420a90cd
• Use /goal resume for paused goals (#20082)

  ## Why
  
  The paused goal statusline currently points users at `/goal` to unpause
  a goal, but bare `/goal` is the summary command and does not change the
  goal state. Instead of making `/goal` mutate state only when a goal is
  paused, this gives the action an explicit command that reads naturally
  in the UI.
  
  ## What Changed
  
  - Replace `/goal unpause` with `/goal resume` for reactivating a paused
  goal.
  - Update the paused goal statusline and `/goal` summary copy to point at
  `/goal resume`.

  Eric Traut · 2026-04-29 08:56:02 -07:00
  91ca551df8
• chore(cli) deprecate --full-auto (#20133)

  ## Summary
  Starts the process of getting rid of `--full-auto`, with some
  concessions:
  1. Fully removes the command from the tui, since it just resolves to the
  default permissions there, and encourages users to use the one-time
  trust flow if they're not in a trusted repo.
  2. Marks the command as deprecated in `codex exec`, in case users are
  actively relying on this. We'll remove in an upcoming n+X release.
  3. Cleans up some of the `codex sandbox` cli logic, to keep supporting
  legacy sandbox policies for now.
  
  This isn't the cleanest setup, but I think it is worthwhile to warn
  users for one release before hard-removing it.
  
  ## Testing 
  - [x] Updated unit tests

  Dylan Hurd · 2026-04-29 04:41:30 +00:00
  3d10ba9f36
• Add environment provider snapshot (#20058)

  ## Summary
  - Change `EnvironmentProvider` to return concrete `Environment`
  instances instead of `EnvironmentConfigurations`.
  - Make `DefaultEnvironmentProvider` provide the provider-visible `local`
  environment plus optional `remote` environment from
  `CODEX_EXEC_SERVER_URL`.
  - Keep `EnvironmentManager` as the concrete cache while exposing its own
  explicit local environment for `local_environment()` fallback paths.
  
  ## Validation
  - `just fmt`
  - `git diff --check`
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  starr-openai · 2026-04-28 20:05:18 -07:00
  e1ec9e63a0
• Soften skill description budget warnings (#20112)

  Updates skill description budget messaging to be less alarming

  xl-openai · 2026-04-28 19:56:25 -07:00
  6f328d5e02
• Restore TUI working status after steer message is set (#19939)

  Fix for #19925
  
  Restore the `Working` indicator after a streamed final answer finishes
  when a user steer message is sent.
  Add regression coverage for long output plus a mid-stream steer:
  `cargo test -p codex-tui
  final_answer_completion_restores_status_indicator_for_pending_steer`
  
  Duplication/testing steps:
  1. Start a new thread and ask for a long response.
  2. While the response is streaming, submit a steer message.
  3. When the first response finishes, observe whether `Working...` is
  shown while waiting for the steer message response.

  canvrno-oai · 2026-04-28 18:10:40 -07:00
  24be9ac0a4
• Support detect and import MCP, Subagents, hooks, commands from external (#19949)

  ## Why
  This PR expands the migration path so Codex can detect and import MCP
  server config, hooks, commands, and subagents configs in a Codex-native
  shape.
  
  ## What changed
  
  - Added a `codex-external-agent-migration` crate that owns conversion
  logic for external-agent MCP servers, hooks, commands, and subagents.
  - Extended the app-server external-agent config detection/import API
  with migration item types for MCP server config, hooks, commands, and
  subagents.
  
  ## Migration strategy
  
  The migration is intentionally conservative: Codex only imports
  external-agent config that can be represented safely in Codex today.
  Unsupported or ambiguous config is skipped instead of being partially
  translated into behavior that may not match the source system.
  
  - **MCP servers**: import supported stdio and HTTP MCP server
  definitions into `mcp_servers`. Disabled servers and servers filtered
  out by source `enabledMcpjsonServers` / `disabledMcpjsonServers` are
  skipped. Project-scoped MCP entries from `.claude.json` are included
  when they match the repo path.
  - **Hooks**: import only supported command hooks into
  `.codex/hooks.json`. Unsupported hook features such as conditional
  groups, async handlers, prompt/http hooks, or unknown fields are
  skipped. Referenced hook scripts are copied into `.codex/hooks/`,
  preserving any existing target scripts.
  - **Commands**: import supported external commands as Codex skills under
  `.agents/skills/source-command-*`. Commands that rely on source runtime
  expansion such as `$ARGUMENTS`, `$1`, `@file` references, shell
  interpolation, or colliding generated names are skipped.
  - **Subagents**: import valid subagent Markdown files into
  `.codex/agents/*.toml` when they have the minimum Codex agent fields.
  Source model names are not migrated, so imported agents keep the user’s
  Codex default model; compatible reasoning effort and sandbox mode are
  migrated when present.
  - **Skills and project guidance**: copy missing skill directories into
  `.agents/skills` and migrate `CLAUDE.md` guidance into `AGENTS.md`,
  rewriting source-agent terminology to Codex terminology where
  appropriate.
  - **Detection details**: detected migration items include lightweight
  details for UI preview, such as MCP server names, hook event names,
  generated command skill names, and subagent names. Import still
  recomputes from disk instead of trusting details as the source of truth.
  
  - Adds focused coverage for the new migration behavior and app-server
  import flow.
  
  ## Verification
  
  - `cargo test -p codex-external-agent-migration`
  - `cargo test -p codex-hooks`
  - `cargo test -p codex-app-server external_agent_config`
  - `just bazel-lock-check`

  alexsong-oai · 2026-04-29 00:45:24 +00:00
  cb8b1bbcd6
• app-server: notify clients of remote-control status changes (#19919)

  ## Why
  
  Remote-control app-server enrollments have both an internal server id
  and the environment id exposed to remote-control clients. App-server
  clients need one current status snapshot that says whether remote
  control is usable and which environment id, if any, is exposed.
  
  A temporary websocket disconnect is not itself an identity change.
  Account changes, stale enrollment invalidation, successful
  re-enrollment, and missing ChatGPT auth are meaningful status changes.
  Disabled remote control remains `disabled` regardless of auth or SQLite
  state. SQLite startup failure disablement and enrollment persistence
  failures are handled in #20068; this PR reports the resulting effective
  status to clients.
  
  ## What changed
  
  - Adds v2 `remoteControl/status/changed` carrying `state` and
  `environmentId`.
  - Adds `RemoteControlConnectionState` values: `disabled`, `connecting`,
  `connected`, and `errored`.
  - Exposes remote-control status updates through `RemoteControlHandle`
  using a Tokio watch channel.
  - Always sends the current remote-control status snapshot to newly
  initialized app-server clients.
  - Broadcasts status changes to initialized app-server clients when state
  or environment id changes.
  - Treats missing ChatGPT auth as an `errored` status while leaving it
  retryable because auth can change at runtime.
  - Clears `environmentId` when enrollment is cleared for account changes,
  auth loss, stale backend invalidation, or disabled remote control.
  - Updates app-server protocol schema fixtures, generated TypeScript,
  app-server README, remote-control tests, and TUI exhaustive notification
  matches.
  
  ## Stack
  
  - Builds on #20068.
  
  ## Verification
  
  - `just write-app-server-schema`
  - `cargo test -p codex-app-server-protocol`
  - `cargo test -p codex-app-server transport::remote_control --lib`
  - `cargo check -p codex-tui`
  - `just fix -p codex-app-server-protocol`
  - `just fix -p codex-app-server`
  - `just fix -p codex-tui`

  Ruslan Nigmatullin · 2026-04-28 23:52:14 +00:00
  c6465c1ec2
• core tests: submit turns with permission profiles (#20010)

  ## Summary
  
  - Add `PermissionProfile`-based turn submission helpers to
  `core_test_support`, while keeping the legacy `SandboxPolicy` helper for
  tests that intentionally exercise legacy fallback behavior.
  - Switch the default `TestCodex::submit_turn()` path to send a real
  `PermissionProfile` plus the required legacy compatibility projection in
  `Op::UserTurn`.
  - Migrate straightforward app/search/shell/truncation tests from
  `SandboxPolicy::{DangerFullAccess, ReadOnly}` to
  `PermissionProfile::{Disabled, read_only}`.
  - Add a TUI compatibility projection helper for legacy app-server fields
  so non-legacy writable roots are preserved instead of being downgraded
  to read-only.
  - Fix remote start/resume/fork sandbox-mode projection to classify any
  managed profile with writable roots as workspace-write, not only
  profiles that can write `cwd`.
  - Reduce `SandboxPolicy` references in `codex-rs/core/tests` from 47
  files to 41 files without changing production behavior.
  
  ## Testing
  
  - `cargo check -p codex-core --tests`
  - `cargo test -p codex-tui
  compatibility_profile_preserves_unbridgeable_write_roots`
  - `cargo test -p codex-tui
  sandbox_mode_preserves_non_cwd_write_roots_for_remote_sessions`
  - `just fmt`
  - `just fix -p core_test_support`
  - `just fix -p codex-core`

  Michael Bolin · 2026-04-28 23:01:40 +00:00
  891722849d
• /plugins: add marketplace install flow (#18704)

  This PR adds a new feature to the `/plugins` menu that gives users the
  ability to add new plugin marketplaces. It introduces an Add Marketplace
  tab to the right of installed marketplaces, a source prompt, loading and
  error states, and the app-server request flow needed to perform the
  install. After a successful `marketplace/add`, the popup refreshes back
  into the newly added marketplace tab so the new plugins are immediately
  visible.
  
  - Add an Add Marketplace tab to the `/plugins` menu
  - Prompt for marketplace source input from git repo, URL, or local path
  - Show loading and error states during `marketplace/add`
  - Refresh plugin data after success and switch into the newly added
  marketplace tab
  - Add tests and snapshot updates

  canvrno-oai · 2026-04-28 14:22:39 -07:00
  66b0781502
• tui: use permission profiles for sandbox state (#20008)

  ## Summary
  - Move TUI permission state from legacy `SandboxPolicy` values to
  canonical `PermissionProfile` values across presets, app events, chat
  widget state, app commands, thread routing, and cached thread session
  state.
  - Keep app-server compatibility boundaries explicit: embedded sessions
  send `permissionProfile`, while remote sessions send only a legacy
  `sandbox` projection and fall back to read-only when a custom profile
  cannot be projected.
  - Update status/add-dir UI summaries and snapshots to render the active
  permission profile, including workspace profiles selected by the new
  built-in defaults.
  
  ## Verification
  - `rg '\bSandboxPolicy\b' codex-rs/tui -n` returns no matches.
  - `cargo test -p codex-tui`
  - `cargo check -p codex-tui --tests`
  - `cargo test -p codex-tui additional_dirs`
  - `just fmt`
  - `just fix -p codex-tui`
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/20008).
  * #20041
  * #20040
  * #20037
  * #20035
  * #20034
  * #20033
  * #20032
  * #20030
  * #20028
  * #20027
  * #20026
  * #20024
  * #20021
  * #20018
  * #20016
  * #20015
  * #20013
  * #20011
  * #20010
  * __->__ #20008

  Michael Bolin · 2026-04-28 20:36:48 +00:00
  3b74a4d3b1
• Fix plan mode nudge test after task completion signature change (#20045)

  Updates the plan mode nudge test to pass the new `duration_ms` argument
  to task completion.
  
  Co-authored-by: Codex <noreply@openai.com>

  canvrno-oai · 2026-04-28 11:24:22 -07:00
  640a1b23ea
• External agent session support (#19895)

  ## Summary
  
  This extends external agent detection/import beyond config artifacts so
  Codex can detect recent sessions files from the external agent home and
  import them into Codex rollout history.
  
  ## What changed
  
  - Added a focused `external_agent_sessions` module for:
    - session discovery
    - source-record parsing
    - rollout construction
    - import ledger tracking
  - Wired session detection/import into the app-server external agent
  config API.
  - Added compaction handling so large imported sessions can be resumed
  safely before the first follow-up turn.
  
  ## Testing
  
  Added coverage for:
  - recent-session detection
  - custom-title handling
  - recency filtering
  - dedupe and re-detect-after-source-change behavior
  - visible imported turn construction
  - backward-compatible import payload deserialization
  - end-to-end RPC import flow
  - rejection of undetected session paths
  - repeat-import behavior
  - large-session compaction before first follow-up
  
  Ran:
  - `cargo test -p codex-app-server external_agent_config_import_ --test
  all`

  stefanstokic-oai · 2026-04-28 17:42:36 +00:00
  4c68bd728f
• fix(tui): let esc exit empty shell mode (#19986)

  ## Summary
  
  - exit shell mode when `Esc` is pressed while the absorbed `!` is the
  only input
  - add direct regression coverage plus a composer snapshot for the
  restored normal prompt state
  
  ## Root cause
  
  Shell mode stores the leading `!` outside the editable textarea. After
  typing only `!`, the textarea is empty but the composer is still in bash
  mode, so the existing empty-composer `Esc` handling never runs.
  
  ## Validation
  
  - `just fmt`
  - `cargo test -p codex-tui
  bottom_pane::chat_composer::tests::esc_exits_empty_shell_mode`
  - `cargo test -p codex-tui
  bottom_pane::chat_composer::tests::footer_mode_snapshots`
  - `cargo insta pending-snapshots`
  
  `cargo test -p codex-tui` still reports unrelated existing `/status`
  snapshot drift in this local environment because the rendered
  permissions text is `workspace-write with network access` instead of the
  older `read-only` fixture text.

  Felipe Coury · 2026-04-28 14:35:24 -03:00
  a036584104
• Move local /resume cwd filtering into thread/list (#19931)

  Move local resume and fork cwd filtering to `thread/list` instead of
  filtering in the TUI. This makes the `/resume` menu feel slightly faster
  to load when working in repos with many historical threads, and
  centralizes the cwd filtering in app-server.
  
  **Affected:**
  - /resume from inside the TUI.
  - codex resume with no session ID and without --last
  - codex resume --all
  - codex fork with no session ID and without --last
  - codex fork --all
  
  **Not affected:**
  - codex resume <id>
  - codex fork <id>
  - codex resume --last
  - codex fork --last
  
  Steps to test performance improvement in a real Codex environment:
  - Launch `codex resume` using compiled binary in a directory that has
  seen many threads.
  - Launch `codex resume` using release binary in same directory.
  - Observe difference in time-to-full-page as threads load.

  canvrno-oai · 2026-04-28 10:35:10 -07:00
  bc5a1b961e
• feat(tui): suggest plan mode from composer drafts (#19901)

  ## Summary
  
  - suggest Plan mode when the current composer draft contains the
  standalone word `plan`
  - shares the Codex App heuristics for detection
  - excludes things line `/plan` and the word plan in shell mode
  - reuse the existing `Shift+Tab` mode cycle and add thread-scoped
  dismissal with `Esc`
  - replace the normal footer hint while the reminder is visible so the
  statusline stays anchored
  
  
  https://github.com/user-attachments/assets/01123ae8-cee6-4e95-b563-44655c071cde
  
  ## Why
  
  The desktop app already nudges users toward Plan mode when their draft
  clearly signals planning intent. The TUI had the underlying `/plan` and
  `Shift+Tab` flows, but no equivalent reminder at the moment the user was
  most likely to benefit from them.
  
  ## Details
  
  The reminder is shown only when Plan mode is available, the draft
  contains standalone `plan`, the user is not already in Plan mode, the
  composer is actionable, and the current thread has not dismissed the
  reminder. Slash-command and shell-command drafts are excluded.
  
  The first implementation used an extra composer row, but that moved the
  statusline whenever the heuristic fired. This version keeps the layout
  stable by rendering the reminder in the existing footer row instead.
  
  ## Validation
  
  - `INSTA_UPDATE=always cargo test -p codex-tui
  chatwidget::tests::plan_mode::plan_mode_nudge -- --nocapture`
  - `just fmt`
  - `just fix -p codex-tui`
  - `./tools/argument-comment-lint/run.py -p codex-tui`
  - `cargo insta pending-snapshots`
  - `git diff --check`

  Felipe Coury · 2026-04-28 14:34:10 -03:00
  c6bcd27832
• feat: verify agent identity JWTs with JWKS (#19764)
  efrazer-oai · 2026-04-28 09:56:20 -07:00
  f6797c3ac6
• TUI: use cumulative turn duration for worked-for separator (#19929)

  ## Why
  
  Fixes #19814.
  
  The TUI's current `Worked for ...` timing behavior is a leftover from
  #9599. At that point, models could emit multiple assistant messages in
  one turn for preambles/commentary, but the TUI did not yet have a
  reliable signal that an assistant message was the final answer when it
  started streaming. To avoid showing an ever-growing elapsed time on each
  preamble separator, #9599 made the separator timer incremental by
  tracking elapsed time since the previous separator.
  
  That workaround is no longer the right model for the final
  completed-turn display. Since then, #16638 added protocol-native turn
  timing, including `duration_ms` on turn completion. With that cumulative
  duration available at the point where the TUI renders the completed-turn
  separator, the UI can show the actual turn duration directly instead of
  carrying per-separator timing state.
  
  ## What Changed
  
  - Thread `duration_ms` into `ChatWidget::on_task_complete` from both
  legacy `TurnCompleteEvent` handling and app-server `TurnCompleted`
  notifications.
  - Use `duration_ms` for the final `Worked for ...` separator, falling
  back to the status indicator timer only when the protocol duration is
  unavailable.
  - Keep mid-turn separators before later assistant text as plain visual
  dividers instead of clocked `Worked for ...` separators.
  - Remove the old incremental separator timer state and helper
  (`last_separator_elapsed_secs` / `worked_elapsed_from`).
  - Add a snapshot regression test for a turn that runs a command and then
  completes with a final answer, verifying the final separator uses the
  cumulative turn duration.
  
  ## Verification
  
  - `cargo test -p codex-tui
  final_worked_for_uses_cumulative_turn_duration_snapshot`
  - `just fix -p codex-tui`
  
  Manual repro prompt:
  
  ```text
  Manual timing repro. First send a short preamble/commentary sentence before using tools. Then run exactly this shell command: sleep 75; echo MANUAL_TIMING_DONE. After the command finishes, give a final answer that says "done". Do not skip the preamble.
  ```
  
  After this change, the mid-turn break before the final answer should be
  a plain divider, and the final completed-turn separator should show
  `Worked for ...` using the cumulative turn duration.
  
  Before:
  <img width="414" height="102" alt="Screenshot 2026-04-27 at 10 09 01 PM"
  src="https://github.com/user-attachments/assets/b9e2ce01-2460-40e4-a5c4-c9ba8add2557"
  />
  
  
  After:
  <img width="485" height="149" alt="Screenshot 2026-04-27 at 10 09 07 PM"
  src="https://github.com/user-attachments/assets/d24089ae-d4e2-41b6-b966-07c98706ead4"
  />

  Eric Traut · 2026-04-28 09:24:29 -07:00
  087c9c1f1f
• feat(tui): add configurable keymap support (#18593)

  ## Why
  
  The TUI currently handles keyboard shortcuts as hard-coded event matches
  spread across app, composer, pager, list, approval, and navigation code.
  That makes shortcuts hard to customize, makes displayed hints easy to
  drift from actual behavior, and makes future keymap work riskier because
  there is no central action inventory.
  
  This PR adds the foundation for configurable, action-based keymaps
  without adding the interactive remapping UI yet. Onboarding
  intentionally stays on fixed startup shortcuts because users cannot
  reasonably configure keymaps before completing onboarding.
  
  This is PR1 in the keymap stack:
  
  - PR1: #18593: configurable keymap foundation
  - PR2: #18594: `/keymap` picker and guided remapping UI
  - PR3: #18595: Vim composer mode and the remap option
  
  ## Design Notes
  
  The new model resolves named actions into concrete runtime bindings once
  from config, then passes those bindings to the UI surfaces that handle
  input or render shortcut hints.
  
  The main concepts are:
  
  - **Context**: a scope where an action is active, such as `global`,
  `chat`, `composer`, `editor`, `pager`, `list`, or `approval`.
  - **Action**: a named operation inside a context, such as
  `global.open_transcript`, `composer.submit`, or `pager.close`.
  - **Binding**: one or more single-key shortcuts assigned to an action,
  written as config strings such as `ctrl-t`, `alt-backspace`, or
  `page-down`. Multi-step sequences such as `ctrl-x ctrl-s`, `g g`, or
  leader-key flows are not part of this PR.
  - **Resolution order**: context-specific config wins first, supported
  global fallbacks come next, and built-in defaults fill in anything
  unset.
  - **Explicit unbinding**: an empty array removes an action binding in
  that scope and does not fall through to a fallback binding.
  - **Conflict validation**: a resolved keymap rejects duplicate active
  bindings inside the same scope so one keypress cannot dispatch two
  actions.
  
  ## What Changed
  
  - Added `TuiKeymap` config support under `[tui.keymap]`, including typed
  contexts/actions, key alias normalization, generated schema coverage,
  and user-facing config errors.
  - Added `RuntimeKeymap` resolution in `codex-rs/tui/src/keymap.rs`,
  including fallback precedence, built-in defaults, explicit unbinding,
  and per-context conflict validation.
  - Rewired existing TUI handlers to consume resolved keymap actions
  instead of directly matching hard-coded keys in each component.
  - Updated key hint rendering and footer/pager/list surfaces so displayed
  shortcuts follow the resolved keymap.
  - Kept onboarding shortcuts fixed in
  `codex-rs/tui/src/onboarding/keys.rs` instead of exposing them through
  `[tui.keymap]`.
  
  ## Validation
  
  The branch includes focused coverage for config parsing, key
  normalization, runtime fallback resolution, explicit unbinding,
  duplicate-key conflict validation, default keymap consistency,
  onboarding startup key behavior, and UI hint snapshots affected by
  resolved key bindings.

  Felipe Coury · 2026-04-28 12:52:25 -03:00
  5e737372ee
• Reset TUI keyboard reporting on exit (#19625)

  ## Why
  
  Codex enables enhanced keyboard reporting while the TUI owns the
  terminal. In iTerm2, exiting the TUI with Ctrl+C can intermittently
  leave the parent shell receiving raw CSI-u / `modifyOtherKeys` fragments
  instead of normal key input.
  
  Final terminal cleanup should put the parent shell back into normal
  keyboard reporting even if the terminal misses the usual stack pop.
  
  Fixes #19553.
  
  ## What Changed
  
  - Move TUI keyboard enhancement setup and detection into
  `tui/src/tui/keyboard_modes.rs`.
  - Add an exit-only `restore_after_exit()` path that performs the normal
  keyboard enhancement pop plus unconditional keyboard enhancement and
  `modifyOtherKeys` resets.
  - Keep temporary restore paths, such as external-editor handoff, using
  the balanced stack pop behavior.
  
  ## Confidence
  
  Medium. This is a speculative fix: I was not able to reproduce the
  reported iTerm2 behavior manually, but the symptoms line up with
  terminal keyboard reporting state surviving Codex exit. The added reset
  sequences are scoped to final TUI shutdown and should be harmless when
  the terminal is already clean.

  Eric Traut · 2026-04-28 08:51:44 -07:00
  a61c785040
• Add codex update command (#19933)

  ## Why
  
  Addresses #9274
  
  Running `codex update` currently starts an interactive Codex session
  with `update` as the prompt. That is a rough edge for users who expect a
  direct self-update command after seeing the existing update notice, and
  it forces them to copy the suggested package-manager command manually.
  
  ## What changed
  
  - Added a top-level `codex update` subcommand.
  - Reused the existing install-channel detection and update command
  runner that the TUI already uses for update prompts.
  - Exposed the update-action lookup from `codex-tui` so the CLI can
  invoke the same behavior.
  - Added CLI coverage to ensure `codex update` is parsed as a subcommand
  instead of becoming an interactive prompt.
  
  ## Verification
  
  - `cargo test -p codex-cli`
  - `cargo test -p codex-tui update_action::tests`

  Eric Traut · 2026-04-27 23:33:59 -07:00
  b985768dc1
• permissions: store thread sessions as profiles (#19776)

  ## Why
  
  After thread sessions have a required `PermissionProfile`, the TUI no
  longer needs to cache a separate legacy `SandboxPolicy` in
  `ThreadSessionState`. Keeping the legacy field would reintroduce two
  permission authorities in the session cache and make later
  replay/switching logic easier to get wrong.
  
  This PR keeps legacy app-server compatibility at the ingestion boundary:
  old `sandbox` response values are still accepted, but they are
  immediately converted to a cwd-anchored profile.
  
  ## What Changed
  
  - Removes `ThreadSessionState.sandbox_policy`.
  - Updates active-session permission syncing to write only the current
  `PermissionProfile`.
  - Updates thread-read/replay/test fixtures to use profiles as the cached
  session permission source.
  - Leaves legacy `sandbox` fields in app-server request/response protocol
  paths unchanged; those are compatibility boundaries and are converted
  before entering cached TUI state.
  
  ## Verification
  
  - `cargo test -p codex-tui thread_session_state::tests --lib`
  - `cargo test -p codex-tui
  inactive_thread_started_notification_initializes_replay_session --lib`
  - `cargo test -p codex-tui thread_events --lib`
  - `just fix -p codex-tui`
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/19776).
  * #19900
  * #19899
  * __->__ #19776

  Michael Bolin · 2026-04-28 05:49:58 +00:00
  341550c275
• permissions: make SessionConfigured profile-only (#19774)

  ## Why
  
  `SessionConfiguredEvent` is the internal event that tells clients what
  permissions are active for a session. Emitting both `sandbox_policy` and
  `permission_profile` leaves two possible authorities and forces every
  consumer to decide which one to honor. At this point in the migration,
  the profile is expressive enough to represent managed, disabled, and
  external sandbox enforcement, so the internal event can be profile-only.
  
  The wire compatibility concern is older serialized events or rollout
  data that only contain `sandbox_policy`; those still need to
  deserialize.
  
  ## What Changed
  
  - Removes `sandbox_policy` from `SessionConfiguredEvent` and makes
  `permission_profile` required.
  - Adds custom deserialization so old payloads with only `sandbox_policy`
  are upgraded to a cwd-anchored `PermissionProfile`.
  - Updates core event emission and TUI session handling to sync
  permissions from the profile directly.
  - Updates app-server response construction to derive the legacy
  `sandbox` response field from the active thread snapshot instead of from
  `SessionConfiguredEvent`.
  - Updates yolo-mode display logic to treat both
  `PermissionProfile::Disabled` and managed unrestricted filesystem plus
  enabled network as full-access, while still preserving the distinction
  between no sandbox and external sandboxing.
  
  ## Verification
  
  - `cargo test -p codex-protocol session_configured_event --lib`
  - `cargo test -p codex-protocol serialize_event --lib`
  - `cargo test -p codex-exec session_configured --lib`
  - `cargo test -p codex-app-server
  thread_response_permission_profile_preserves_enforcement --lib`
  - `cargo test -p codex-core
  session_configured_reports_permission_profile_for_external_sandbox
  --lib`
  - `cargo test -p codex-tui session_configured --lib`
  - `cargo test -p codex-tui
  yolo_mode_includes_managed_full_access_profiles --lib`
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/19774).
  * #19900
  * #19899
  * #19776
  * #19775
  * __->__ #19774

  Michael Bolin · 2026-04-27 22:06:47 -07:00
  bf38def44e
• Allow /statusline and /title slash commands during active turns (#19917)

  - Marks `/title` and `/statusline` as available during active tasks.
  - Extends the existing slash-command availability test coverage to
  include these commands alongside `/goal`.

  canvrno-oai · 2026-04-27 20:57:20 -07:00
  2307aa8d98
• permissions: require profiles in TUI thread state (#19773)

  ## Why
  
  `ThreadSessionState` is the TUI's cached view of an app-server session.
  To make `PermissionProfile` the canonical runtime permissions model,
  cached thread sessions need to always have a profile instead of treating
  the profile as an optional supplement to a legacy `sandbox` response
  field.
  
  The main compatibility concern is older app-server v2 lifecycle
  responses that only include `sandbox` and omit `permissionProfile`:
  
  - `thread/start` -> `ThreadStartResponse.sandbox`
  - `thread/resume` -> `ThreadResumeResponse.sandbox`
  - `thread/fork` -> `ThreadForkResponse.sandbox`
  
  Those responses must still hydrate correctly when the TUI is pointed at
  an older app-server. This PR converts the legacy `sandbox` value into a
  `PermissionProfile` immediately at response ingestion time, using the
  response `cwd`, so cached sessions do not carry an optional profile that
  can later reinterpret cwd-bound grants against a different thread cwd.
  
  This fallback is intentionally boundary compatibility. The follow-up PRs
  in this stack continue the cleanup by making `SessionConfiguredEvent`
  profile-only, deriving sandbox projections from snapshots only when an
  API still needs them, and then removing `sandbox_policy` from
  `ThreadSessionState`.
  
  ## What Changed
  
  - Makes `ThreadSessionState.permission_profile` required.
  - Converts legacy app-server response `sandbox` values into a
  `PermissionProfile` at ingestion time using the response cwd.
  - Ensures `thread/read` hydration does not reuse a primary session
  profile that may be anchored to a different cwd; it uses the active
  widget permission settings for the read thread fallback instead of
  reusing cached primary-session permissions.
  - Keeps the app-server request path unchanged: embedded sessions send
  profiles, while remote sessions continue using legacy sandbox overrides
  for compatibility.
  
  ## Verification
  
  - `cargo test -p codex-tui thread_read --lib`
  - `cargo test -p codex-tui
  permission_settings_sync_preserves_active_profile_only_rules --lib`
  - `cargo test -p codex-tui
  resume_response_restores_turns_from_thread_items --lib`
  - `cargo test -p codex-tui thread_session_state::tests --lib`
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/19773).
  * #19900
  * #19899
  * #19776
  * #19775
  * #19774
  * __->__ #19773

  Michael Bolin · 2026-04-27 20:39:06 -07:00
  af95662a70
• Remove ghost snapshots (#19481)

  ## Summary
  - Remove `ghost_snapshot` / `GhostCommit` from the Responses API surface
  and generated SDK/schema artifacts.
  - Keep legacy config loading compatible, but make undo a no-op that
  reports the feature is unavailable.
  - Clean up core history, compaction, telemetry, rollout, and tests to
  stop carrying ghost snapshot items.
  
  ## Testing
  - Unit tests passed for `codex-protocol`, `codex-core` targeted undo and
  compaction flows, `codex-rollout`, and `codex-app-server-protocol`.
  - Regenerated config and app-server schemas plus Python SDK artifacts
  and verified they match the checked-in outputs.

  pakrym-oai · 2026-04-27 18:48:57 -07:00
  4e05f3053c
• Show action required in terminal title (#18372)

  Implements #18162
  
  This updates the TUI terminal title to show an explicit action-required
  state when Codex is blocked on user approval or input. The terminal
  title now uses the activity title item to cover both active work and
  blocked-on-user states, while still accepting the legacy spinner config
  value.
  
  Changes
  - Rename the terminal title item from `spinner` to `activity` while
  preserving legacy config compatibility
  - Show `[ ! ] Action Required `while approval or input overlays are
  active, with a blinking `[ . ]` alternate state
  - Suppress the normal working spinner while Codex is blocked on user
  action
  - Add targeted coverage for action-required title behavior and legacy
  title-item parsing
  
  Testing
  - Trigger an approval or input modal and confirm the tab title
  alternates between `[ ! ] Action Required` and `[ . ] Action Required`
  - Disable the activity title item and confirm the action-required title
  does not appear
  - Resolve the prompt and confirm the title returns to the normal
  spinning/idel state
  
  
  https://github.com/user-attachments/assets/e9ecc530-a6be-4fd7-b9a6-d550a790eb2c

  canvrno-oai · 2026-04-27 15:27:11 -07:00
  e64c765673
• permissions: remove cwd special path (#19841)

  ## Why
  
  The experimental `PermissionProfile` API had both `:cwd` and
  `:project_roots` special filesystem paths, which made the permission
  root ambiguous. This PR removes the unstable `current_working_directory`
  special path before the permissions API is stabilized, so callers use
  `:project_roots` for symbolic project-root access.
  
  ## What changed
  
  - Removes `FileSystemSpecialPath::CurrentWorkingDirectory` from protocol
  and app-server protocol models, plus regenerated app-server
  JSON/TypeScript schemas.
  - Replaces internal `:cwd` permission entries with `:project_roots`
  entries.
  - Keeps the existing cwd-update behavior for legacy-shaped
  workspace-write profiles, while removing the deleted
  `CurrentWorkingDirectory` case from that compatibility path.
  - Keeps `PermissionProfile::workspace_write()` as the reusable symbolic
  workspace-write helper, with docs noting that `:project_roots` entries
  resolve at enforcement time.
  - Updates app-server docs/examples and approval UI labeling to stop
  advertising `:cwd` as a permission token.
  
  ## Compatibility
  
  Persisted rollout items may contain the old
  `{"kind":"current_working_directory"}` tag from earlier experimental
  `permissionProfile` snapshots. This PR keeps that tag as a
  deserialize-only alias for `ProjectRoots { subpath: None }`, while
  continuing to serialize only the new `project_roots` tag.
  
  ## Follow-up
  
  This PR intentionally does not introduce an explicit project-root set on
  `SessionConfiguration` or runtime sandbox resolution. Today, the
  resolver still uses the active cwd as the single implicit project root.
  A follow-up should model project roots separately from tool cwd so
  `:project_roots` entries can resolve against the configured project
  roots, and resolve to no entries when there are no project roots.
  
  ## Verification
  
  - `cargo test -p codex-protocol permissions:: --lib`
  - `cargo test -p codex-app-server-protocol`
  - `cargo test -p codex-sandboxing -p codex-exec-server --lib`
  - `cargo test -p codex-core session_configuration_apply_ --lib`
  - `cargo test -p codex-app-server
  command_exec_permission_profile_project_roots_use_command_cwd --test
  all`
  - `cargo test -p codex-tui
  thread_read_session_state_does_not_reuse_primary_permission_profile
  --lib`
  - `cargo test -p codex-tui
  preset_matching_accepts_workspace_write_with_extra_roots --lib`
  - `cargo test -p codex-config --lib`

  Michael Bolin · 2026-04-27 13:41:27 -07:00
  4b55979755
• Preserve TUI markdown list spacing after code blocks (#19706)

  ## Why
  
  Fixes #19702.
  
  The TUI markdown renderer could visually attach the next list marker to
  a fenced code block inside the previous list item, even when the source
  markdown included a blank line before the next item. That made
  block-heavy loose lists harder to read, while the desired behavior is
  still to keep simple lists compact.
  
  ## What changed
  
  - Track whether the current rendered list item contains a code block.
  - Preserve one blank separator before the following list marker only
  when the previous item contained a code block.
  - Add regression coverage for both paths: code-block list items keep the
  separator, and simple loose list items stay compact.
  
  ## Verification
  
  - `cargo test -p codex-tui markdown_render`
  
  I also manually verified that the bug exists before and is fixed after.
  
  ## Before
  <img width="437" height="240" alt="Screenshot 2026-04-26 at 1 19 01 PM"
  src="https://github.com/user-attachments/assets/3bc9d64d-2dba-40d9-9d6b-a1d0b3c0f728"
  />
  
  ## After
  <img width="410" height="269" alt="Screenshot 2026-04-26 at 1 18 54 PM"
  src="https://github.com/user-attachments/assets/19c15bee-da32-455e-a7cb-e05eb85f4ea0"
  />

  Eric Traut · 2026-04-27 13:40:46 -07:00
  52c06b8759
• Delay approval prompts while typing (#19513)

  ## Why
  
  Fixes #7744. Approval modals can currently appear while the user is
  typing ahead in the TUI composer, which lets plain letters like `y` or
  `a` get consumed as approval shortcuts instead of staying in the draft
  input.
  
  ## What changed
  
  - Track recent composer typing activity in `bottom_pane/mod.rs`.
  - Delay new approval overlays for 1 second while the composer is active,
  keeping delayed requests queued until the user is idle.
  - Preserve the existing active-overlay behavior so approvals that arrive
  while an approval modal is already open are still queued into that
  overlay.
  - Prune delayed approvals when app-server resolution says the request
  has already been handled.
  
  ## Verification
  
  Added unit coverage for immediate approvals, delayed approvals, idle
  deadline reset, typed shortcut letters staying in the composer, shortcut
  handling after the delay, and resolved delayed-request pruning.
  
  Focused `codex-tui` test groups pass locally. The full `cargo test -p
  codex-tui` run currently aborts in
  `app::tests::attach_live_thread_for_selection_rejects_unmaterialized_fallback_threads`;
  that same test also fails when run alone with the same stack overflow.
  
  Manual reviewer check:
  
  1. Start the TUI from the repo root:
  
     ```bash
     RUST_LOG=trace just codex \
       -c log_dir=<temp-log-dir> \
       --ask-for-approval untrusted \
       --sandbox workspace-write
     ```
  
  2. Submit this prompt:
  
     ```text
     create a file text.txt on my desktop
     ```
  
  3. While the agent is preparing the approval request, immediately type
  text such as `ya this should stay in the composer`.
  4. Confirm the typed-ahead `y`/`a` remains in the composer instead of
  approving the request.
  5. Stop typing for about 1 second; the approval modal should then
  appear.
  6. Once the modal is visible, press `y` and confirm the approval
  shortcut works normally.

  Eric Traut · 2026-04-27 13:20:55 -07:00
  0bd25ab374
• refactor: make auth loading async (#19762)

  ## Summary
  
  Auth loading used to expose synchronous construction helpers in several
  places even though some auth sources now need async work. This PR makes
  the auth-loading surface async and updates the callers to await it.
  
  This is intentionally only plumbing. It does not change how
  AgentIdentity tokens are decoded, how task runtime ids are allocated, or
  how JWT signatures are verified.
  
  ## Stack
  
  1. **This PR:** [refactor: make auth loading
  async](https://github.com/openai/codex/pull/19762)
  2. [refactor: load AgentIdentity runtime
  eagerly](https://github.com/openai/codex/pull/19763)
  3. [feat: verify AgentIdentity JWTs with
  JWKS](https://github.com/openai/codex/pull/19764)
  
  ## Important call sites
  
  | Area | Change |
  | --- | --- |
  | `codex-login` auth loading | `CodexAuth` and `AuthManager`
  construction paths now await auth loading. |
  | app-server startup | Auth manager construction is awaited during
  initialization. |
  | CLI/TUI/exec/MCP/chatgpt callers | Existing auth-loading calls now
  await the same behavior. |
  | cloud requirements storage loader | The loader becomes async so it can
  share the same auth construction path. |
  | auth tests | Tests that load auth now run in async contexts. |
  
  ## Testing
  
  Tests: targeted Rust auth test compilation, formatter, scoped Clippy
  fix, and Bazel lock check.

  efrazer-oai · 2026-04-27 11:00:27 -07:00
  2009f6e894
• Render delegated patch approval details (#19709)

  ## Why
  
  Fixes #19632.
  
  When a delegated agent requests approval for an in-progress file change,
  the parent TUI handles that request from an inactive thread. The app
  server already sent the `FileChange` item with the proposed diff, but
  the inactive-thread approval path was not recovering and rendering it
  the same way as the active-thread path.
  
  The result was an inconsistent approval prompt: main-thread edits show a
  normal patch preview history item before the approval modal, while
  delegated edits did not show that preview in the transcript flow.
  
  ## What Changed
  
  - Recover buffered or historical `FileChange` item changes when building
  inactive-thread file-change approval requests.
  - Reuse the app-server file-change conversion helper for both live
  transcript rendering and inactive-thread approvals.
  - Render recovered delegated patches as a normal patch preview history
  cell before the approval modal.
  - Keep apply-patch approval modals focused on the decision prompt and
  optional metadata; they do not render a synthetic command line or embed
  the diff body.
  
  ## Manual Repro And Verification
  
  I manually reproduced the issue using a file under `~/Desktop` so the
  write would require approval.
  
  Before the fix:
  
  1. Ask the main thread: `Use apply_patch, not shell redirection or
  Python, to create ~/Desktop/bug1.txt with three short lines.`
  2. Observe the expected TUI shape: the transcript shows a normal patch
  preview such as `• Added ~/Desktop/bug1.txt (+N -0)` above the approval
  modal, and the modal contains only the approval prompt/options without a
  synthetic command line.
  3. Ask for the delegated path: `Spawn a worker. Have it use apply_patch,
  not shell redirection or Python, to create ~/Desktop/bug1.txt with four
  short lines.`
  4. Observe the delegated approval is inconsistent: the parent view does
  not render the proposed patch as the normal transcript preview before
  the modal, so the diff context is missing from the stream or appears
  inside the modal instead of in the history flow.
  
  After the fix:
  
  1. Repeat the delegated worker prompt with `apply_patch`.
  2. Confirm the parent view renders the same normal patch preview history
  cell (`• Added ~/Desktop/bug1.txt (+N -0)` plus the diff) immediately
  before the approval modal.
  3. Confirm the approval modal remains focused on the decision prompt.
  For delegated approvals it may show the worker thread label, but it
  should not show a `$ apply_patch` command line or embed the diff body in
  the modal.

  Eric Traut · 2026-04-27 10:07:15 -07:00
  48dd7b58f0
• Persist shell mode commands in prompt history (#19618)

  ## Why
  
  `!` shell commands are currently surfaced as "Bash mode", which is
  misleading for users running shells such as PowerShell or zsh. Those
  commands also bypass the persistent prompt history path, so they cannot
  be recalled after starting a new session.
  
  Fixes #19613.
  
  ## What changed
  
  - Rename the TUI footer label and related test wording from "Bash mode"
  to "Shell mode".
  - Persist accepted `!` shell commands to prompt history with the leading
  `!`, so recall restores the composer into shell mode across sessions.
  - Add coverage for immediate and queued shell-command submissions
  emitting the prompt-history update.
  
  ## Verification
  
  - `cargo test -p codex-tui bang_shell`
  - `cargo test -p codex-tui shell_command_uses_shell_accent_style`
  - `cargo test -p codex-tui footer_mode_snapshots`
  - `cargo insta pending-snapshots --manifest-path tui/Cargo.toml`
  
  Manually verified fix after confirming presence of bug prior to fix.

  Eric Traut · 2026-04-27 09:54:25 -07:00
  0e2300c02c
• Hide rewind preview when no user message exists (#19510)

  ## Why
  
  Fixes #19508.
  
  In a fresh TUI session, pressing `Esc` twice entered the rewind
  transcript overlay even though there was no user message to rewind to.
  That produced an empty header-only transcript view and exposed a rewind
  flow that could not select a valid target.
  
  ## What changed
  
  The backtrack flow now checks whether a user-message rewind target
  exists before opening the transcript preview. If no target exists, Codex
  stays in the main TUI and shows `No previous message to edit.` instead
  of opening an empty overlay.
  
  The same guard applies when starting rewind preview from the transcript
  overlay, and the first `Esc` no longer advertises the “edit previous
  message” hint when there is no previous message available.
  
  Snapshot coverage was added for the unavailable rewind info message,
  along with a small target-detection test.

  Eric Traut · 2026-04-27 09:51:12 -07:00
  6c51bf0c7c
• feat: use git-backed workspace diffs for memory consolidation (#18982)

  ## Why
  
  This PR make the `morpheus` agent (memory phase 2) use a git diff to
  start it's consolidation. The workflow is the following:
  1. The agent acquire a lock
  2. If `.codex/memories` does not exist or is not a git root, initialize
  everything (and make a first empty commit)
  3. Update `raw_memories.md` and `rollout_summaries/` as before.
  Basically we select max N phase 1 memories based on a given policy
  4. We use git (`gix`) to get a diff between the current state of
  `.codex/memories` and the last commit.
  5. Dump the diff in `phase2_workspace_diff.md`
  6. Spawn `morpheus` and point it to `phase2_workspace_diff.md`
  7. Wait for `morpheus` to be done
  8. Re-create a new `.git` and make one single commit on it. We do this
  because we don't want to preserve history through `.git` and this is
  cheap anyway
  9. We release the lock
  On top of this, we keep the retry policies etc etc
  
  The goals of this new workflow are:
  * Better support of any memory extensions such as `chronicle`
  * Allow the user to manually edit memories and this will be considered
  by the phase 2 agent
   
  As a follow-up we will need to add support for user's edition while
  `morpheus` is running
  
  ## What Changed
  
  - Added memory workspace helpers that prepare the git baseline, compute
  the diff, write `phase2_workspace_diff.md`, and reset the baseline after
  successful consolidation.
  - Updated Phase 2 to sync current inputs into `raw_memories.md` and
  `rollout_summaries/`, prune old extension resources, skip clean
  workspaces, and run the consolidation subagent only when the workspace
  has changes.
  - Tightened Phase 2 job ownership around long-running consolidation with
  heartbeats and an ownership check before resetting the baseline.
  - Simplified the prompt and state APIs so DB watermarks are bookkeeping,
  while workspace dirtiness decides whether consolidation work exists.
  - Updated the memory pipeline README and tests for workspace diffs,
  extension-resource cleanup, pollution-driven forgetting, selection
  ranking, and baseline persistence.
  
  ## Verification
  
  - Added/updated coverage in `core/src/memories/tests.rs`,
  `core/src/memories/workspace_tests.rs`, `state/src/runtime/memories.rs`,
  and `core/tests/suite/memories.rs`.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  jif-oai · 2026-04-27 14:32:44 +02:00
  01ab25dbb5
• permissions: constrain requirements as profiles (#19736)
  Michael Bolin · 2026-04-26 21:49:30 -07:00
  523e4aa8e3
• permissions: store only constrained permission profiles (#19735)
  Michael Bolin · 2026-04-26 20:59:58 -07:00
  0ccd659b4b
• Add /auto-review-denials retry approval flow (#19058)

  ## Why
  
  Auto-review can deny an action that the user later decides they want to
  retry. Today there is no TUI surface for selecting a recent denial and
  sending explicit approval context back into the session, so users have
  to restate intent manually and the retry can be reviewed without the
  original denied action context.
  
  This adds a narrow TUI-driven path for approving a recent denied action
  while still keeping the retry inside the normal auto-review flow.
  
  ## What Changed
  
  - Added `/auto-review-denials` to open a picker of recent denied
  auto-review actions.
  - Added a small in-memory TUI store for the 10 most recent denied
  auto-review events.
  - Selecting a denial sends the structured denied event back through the
  existing core/app-server op path.
  - Core now injects a developer message containing the approved action
  JSON rather than the full assessment event.
  - Auto-review transcript collection now preserves this specific approval
  developer message so follow-up review sessions can see the user approval
  context.
  - Added TUI snapshot/unit coverage for the picker and approval dispatch
  path.
  - Added core coverage for retaining the approval developer message in
  the auto-review transcript.
  
  ## Verification
  
  - `cargo test -p codex-core
  collect_guardian_transcript_entries_keeps_manual_approval_developer_message`
  - `cargo test -p codex-tui auto_review_denials`
  - `cargo test -p codex-tui
  approving_recent_denial_emits_structured_core_op_once`
  
  ## Notes
  
  This intentionally keeps retries going through auto-review. The approval
  signal is context for the exact previously denied action, not a blanket
  bypass for similar future actions.

  Won Park · 2026-04-27 03:43:53 +00:00
  8033b6a449
• permissions: centralize legacy sandbox projection (#19734)

  ## Why
  
  The remaining migration work still needs `SandboxPolicy` at a few
  compatibility boundaries, but those projections should come from one
  canonical path. Keeping ad hoc legacy projections scattered through
  app-server, CLI, and config code makes it easy for behavior to drift as
  `PermissionProfile` gains fidelity that the legacy enum cannot
  represent.
  
  ## What Changed
  
  - Adds `Permissions::legacy_sandbox_policy(cwd)` and
  `Config::legacy_sandbox_policy()` as the compatibility projection from
  the canonical `PermissionProfile`.
  - Adds `Permissions::can_set_legacy_sandbox_policy()` so legacy inputs
  are checked after they are converted into profile semantics.
  - Updates app-server command handling, Windows sandbox setup, session
  configuration, and sandbox summaries to use the centralized projection
  helper.
  - Leaves `SandboxPolicy` in place only for boundary inputs/outputs that
  still speak the legacy abstraction.
  
  ## Verification
  
  - `cargo check -p codex-config -p codex-core -p codex-sandboxing -p
  codex-app-server -p codex-cli -p codex-tui`
  - `cargo test -p codex-tui
  permissions_selection_history_snapshot_full_access_to_default --
  --nocapture`
  - `cargo test -p codex-tui
  permissions_selection_sends_approvals_reviewer_in_override_turn_context
  -- --nocapture`
  - `bazel test //codex-rs/tui:tui-unit-tests-bin
  --test_arg=permissions_selection_history_snapshot_full_access_to_default
  --test_output=errors`
  - `bazel test //codex-rs/tui:tui-unit-tests-bin
  --test_arg=permissions_selection_sends_approvals_reviewer_in_override_turn_context
  --test_output=errors`
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/19734).
  * #19737
  * #19736
  * #19735
  * __->__ #19734

  Michael Bolin · 2026-04-26 20:31:23 -07:00
  0d8cdc0510
• permissions: finish profile-backed app surfaces (#19395)
  Michael Bolin · 2026-04-26 19:42:39 -07:00
  ad57a3fee2
• Delete unused ResponseItem::Message.end_turn (#19605)

  This field is unused. Delete it.

  Andrey Mishchenko · 2026-04-26 17:18:09 -07:00
  35bc6e3d01
• permissions: derive compatibility policies from profiles (#19392)

  ## Why
  
  After #19391, `PermissionProfile` and the split filesystem/network
  policies could still be stored in parallel. That creates drift risk: a
  profile can preserve deny globs, external enforcement, or split
  filesystem entries while a cached projection silently loses those
  details. This PR makes the profile the runtime source and derives
  compatibility views from it.
  
  ## What Changed
  
  - Removes stored filesystem/network sandbox projections from
  `Permissions` and `SessionConfiguration`; their accessors now derive
  from the canonical `PermissionProfile`.
  - Derives legacy `SandboxPolicy` snapshots from profiles only where an
  older API still needs that field.
  - Updates MCP connection and elicitation state to track
  `PermissionProfile` instead of `SandboxPolicy` for auto-approval
  decisions.
  - Adds semantic filesystem-policy comparison so cwd changes can preserve
  richer profiles while still recognizing equivalent legacy projections
  independent of entry ordering.
  - Updates config/session tests to assert profile-derived projections
  instead of parallel stored fields.
  
  ## Verification
  
  - `cargo test -p codex-core direct_write_roots`
  - `cargo test -p codex-core runtime_roots_to_legacy_projection`
  - `cargo test -p codex-app-server
  requested_permissions_trust_project_uses_permission_profile_intent`
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/19392).
  * #19395
  * #19394
  * #19393
  * __->__ #19392

  Michael Bolin · 2026-04-26 15:06:42 -07:00
  deaa307fb2
• permissions: make runtime config profile-backed (#19606)

  ## Why
  
  This supersedes #19391. During stack repair, GitHub marked #19391 as
  merged into a temporary stack branch rather than into `main`, so the
  runtime-config change needed a fresh PR.
  
  `PermissionProfile` is now the canonical permissions shape after #19231
  because it can distinguish `Managed`, `Disabled`, and `External`
  enforcement while also carrying filesystem rules that legacy
  `SandboxPolicy` cannot represent cleanly. Core config and session state
  still needed to accept profile-backed permissions without forcing every
  profile through the strict legacy bridge, which rejected valid runtime
  profiles such as direct write roots.
  
  The unrelated CI/test hardening that previously rode along with this PR
  has been split into #19683 so this PR stays focused on the permissions
  model migration.
  
  ## What Changed
  
  - Adds `Permissions.permission_profile` and
  `SessionConfiguration.permission_profile` as constrained runtime state,
  while keeping `sandbox_policy` as a legacy compatibility projection.
  - Introduces profile setters that keep `PermissionProfile`, split
  filesystem/network policies, and legacy `SandboxPolicy` projections
  synchronized.
  - Uses a compatibility projection for requirement checks and legacy
  consumers instead of rejecting profiles that cannot round-trip through
  `SandboxPolicy` exactly.
  - Updates config loading, config overrides, session updates, turn
  context plumbing, prompt permission text, sandbox tags, and exec request
  construction to carry profile-backed runtime permissions.
  - Preserves configured deny-read entries and `glob_scan_max_depth` when
  command/session profiles are narrowed.
  - Adds `PermissionProfile::read_only()` and
  `PermissionProfile::workspace_write()` presets that match legacy
  defaults.
  
  ## Verification
  
  - `cargo test -p codex-core direct_write_roots`
  - `cargo test -p codex-core runtime_roots_to_legacy_projection`
  - `cargo test -p codex-app-server
  requested_permissions_trust_project_uses_permission_profile_intent`
  
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/19606).
  * #19395
  * #19394
  * #19393
  * #19392
  * __->__ #19606

  Michael Bolin · 2026-04-26 13:29:54 -07:00
  4d7ce3447d
• fix(tui): reflow scrollback on terminal resize (#18575)

  Fixes multiple scrollback and terminal resize issues: #5538, #5576,
  #8352, #12223, #16165, and #15380.
  
  ## Why
  
  Codex writes finalized transcript output into terminal scrollback after
  wrapping it for the current viewport width. A later terminal resize
  could leave that scrollback shaped for the old width, so wider windows
  kept narrow output and narrower windows could show stale wrapping
  artifacts until enough new output replaced the visible area.
  
  This is also the foundation PR for responsive markdown tables. Table
  rendering needs finalized transcript content to be width-sensitive after
  insertion, not only while content is first streaming. Markdown table
  rendering itself stays in #18576.
  
  ## Stack
  
  - PR1: resize backlog reflow and interrupt cleanup
  - #18576: markdown table support
  
  ## What Changed
  
  - Rebuild source-backed transcript history when the terminal width
  changes. `terminal_resize_reflow` is introduced through the experimental
  feature system, but is enabled by default for this rollout so we can
  validate behavior across real terminals.
  - Preserve assistant and plan stream source so finalized streaming
  output can participate in resize reflow after consolidation.
  - Debounce resize work, but force a final source-backed reflow when a
  resize happened during active or unconsolidated streaming output.
  - Clear stale pending history lines on resize so old-width wrapped
  output is not emitted just before rebuilt scrollback.
  - Bound replay work with `[tui.terminal_resize_reflow].max_rows`:
  omitted uses terminal-specific defaults, `0` keeps all rendered rows,
  and a positive value sets an explicit cap. The cap applies both while
  initially replaying a resumed transcript into scrollback and when
  rebuilding scrollback after terminal resize.
  - Consolidate interrupted assistant streams before cleanup, then clear
  pending stream output and active-tail state consistently.
  - Move resize reflow and thread event buffering helpers out of `app.rs`
  into dedicated TUI modules.
  - Add focused coverage for resize reflow, feature-gated behavior,
  streaming source preservation, interrupted output cleanup,
  unicode-neutral text, terminal-specific row caps, and composer/layout
  stability.
  
  ## Runtime Bounds
  
  Resize reflow keeps only the most recent rendered rows when a row cap is
  active. The default is `auto`, which maps to the detected terminal's
  default scrollback size where Codex can identify it: VS Code `1000`,
  Windows Terminal `9001`, WezTerm `3500`, and Alacritty `10000`.
  Terminals without a dedicated mapping use the conservative fallback of
  `1000` rows. Users can override this with `[tui.terminal_resize_reflow]
  max_rows = N`, or set `max_rows = 0` to disable row limiting.
  
  ## Validation
  
  - `just fmt`
  - `git diff --check`
  - `cargo test --manifest-path codex-rs/Cargo.toml -p codex-tui reflow`
  - `cargo test --manifest-path codex-rs/Cargo.toml -p codex-tui
  transcript_reflow`
  - `just fix -p codex-tui`
  - PR CI in progress on the squashed branch

  Felipe Coury · 2026-04-25 22:00:32 -03:00
  5591912f0b
• Guard npm update readiness (#19389)

  ## Why
  For npm/Bun-managed installs, the update prompt was treating the latest
  GitHub release as ready to install. During the `0.124.0` release, GitHub
  and npm visibility were not atomic: the root npm wrapper could become
  visible before the npm registry marked that version as the package
  `latest`. That left a window where users could be prompted to upgrade
  before npm was ready for the release.
  
  ## What changed
  - Keep GitHub Releases as the candidate latest-version source for
  npm/Bun installs, but only write the existing `version.json` cache after
  npm registry metadata proves that same root version is ready.
  - Add `codex-rs/tui/src/npm_registry.rs` to validate npm readiness by
  checking `dist-tags.latest` and root package `dist` metadata for the
  GitHub candidate version.
  - Move version parsing helpers into
  `codex-rs/tui/src/update_versions.rs` so that logic can be tested
  without compiling the release-only `updates.rs` module under tests.
  - Update `.github/workflows/rust-release.yml` so the six known platform
  tarballs publish before the root `@openai/codex` wrapper. Other npm
  tarballs publish before the root wrapper, and the SDK publishes after
  the root package it depends on.

  Shijie Rao · 2026-04-25 17:09:29 -07:00
  4e30281a13