535 Commits

• Add in-process app server and wire up exec to use it (#14005)

  This is a subset of PR #13636. See that PR for a full overview of the
  architectural change.
  
  This PR implements the in-process app server and modifies the
  non-interactive "exec" entry point to use the app server.
  
  ---------
  
  Co-authored-by: Felipe Coury <felipe.coury@gmail.com>

  Eric Traut · 2026-03-08 18:43:55 -06:00
  da3689f0ef
• feat: simplify DB further (#13771)
  jif-oai · 2026-03-07 03:48:36 -08:00
  cf143bf71e
• app-server: Add streaming and tty/pty capabilities to command/exec (#13640)

  * Add an ability to stream stdin, stdout, and stderr
  * Streaming of stdout and stderr has a configurable cap for total amount
  of transmitted bytes (with an ability to disable it)
  * Add support for overriding environment variables
  * Add an ability to terminate running applications (using
  `command/exec/terminate`)
  * Add TTY/PTY support, with an ability to resize the terminal (using
  `command/exec/resize`)

  Ruslan Nigmatullin · 2026-03-06 17:30:17 -08:00
  e9bd8b20a1
• feat: add auth login diagnostics (#13797)

  ## Problem
  
  Browser login failures historically leave support with an incomplete
  picture. HARs can show that the browser completed OAuth and reached the
  localhost callback, but they do not explain why the native client failed
  on the final `/oauth/token` exchange. Direct `codex login` also relied
  mostly on terminal stderr and the browser error page, so even when the
  login crate emitted better sign-in diagnostics through TUI or app-server
  flows, the one-shot CLI path still did not leave behind an easy artifact
  to collect.
  
  ## Mental model
  
  This implementation treats the browser page, the returned `io::Error`,
  and the normal structured log as separate surfaces with different safety
  requirements. The browser page and returned error preserve the detail
  that operators need to diagnose failures. The structured log stays
  narrower: it records reviewed lifecycle events, parsed safe fields, and
  redacted transport errors without becoming a sink for secrets or
  arbitrary backend bodies.
  
  Direct `codex login` now adds a fourth support surface: a small
  file-backed log at `codex-login.log` under the configured `log_dir`.
  That artifact carries the same login-target events as the other
  entrypoints without changing the existing stderr/browser UX.
  
  ## Non-goals
  
  This does not add auth logging to normal runtime requests, and it does
  not try to infer precise transport root causes from brittle string
  matching. The scope remains the browser-login callback flow in the
  `login` crate plus a direct-CLI wrapper that persists those events to
  disk.
  
  This also does not try to reuse the TUI logging stack wholesale. The TUI
  path initializes feedback, OpenTelemetry, and other session-oriented
  layers that are useful for an interactive app but unnecessary for a
  one-shot login command.
  
  ## Tradeoffs
  
  The implementation favors fidelity for caller-visible errors and
  restraint for persistent logs. Parsed JSON token-endpoint errors are
  logged safely by field. Non-JSON token-endpoint bodies remain available
  to the returned error so CLI and browser surfaces still show backend
  detail. Transport errors keep their real `reqwest` message, but attached
  URLs are surgically redacted. Custom issuer URLs are sanitized before
  logging.
  
  On the CLI side, the code intentionally duplicates a narrow slice of the
  TUI file-logging setup instead of sharing the full initializer. That
  keeps `codex login` easy to reason about and avoids coupling it to
  interactive-session layers that the command does not need.
  
  ## Architecture
  
  The core auth behavior lives in `codex-rs/login/src/server.rs`. The
  callback path now logs callback receipt, callback validation,
  token-exchange start, token-exchange success, token-endpoint non-2xx
  responses, and transport failures. App-server consumers still use this
  same login-server path via `run_login_server(...)`, so the same
  instrumentation benefits TUI, Electron, and VS Code extension flows.
  
  The direct CLI path in `codex-rs/cli/src/login.rs` now installs a small
  file-backed tracing layer for login commands only. That writes
  `codex-login.log` under `log_dir` with login-specific targets such as
  `codex_cli::login` and `codex_login::server`.
  
  ## Observability
  
  The main signals come from the `login` crate target and are
  intentionally scoped to sign-in. Structured logs include redacted issuer
  URLs, redacted transport errors, HTTP status, and parsed token-endpoint
  fields when available. The callback-layer log intentionally avoids
  `%err` on token-endpoint failures so arbitrary backend bodies do not get
  copied into the normal log file.
  
  Direct `codex login` now leaves a durable artifact for both failure and
  success cases. Example output from the new file-backed CLI path:
  
  Failing callback:
  
  ```text
  2026-03-06T22:08:54.143612Z  INFO codex_cli::login: starting browser login flow
  2026-03-06T22:09:03.431699Z  INFO codex_login::server: received login callback path=/auth/callback has_code=false has_state=true has_error=true state_valid=true
  2026-03-06T22:09:03.431745Z  WARN codex_login::server: oauth callback returned error error_code="access_denied" has_error_description=true
  ```
  
  Succeeded callback and token exchange:
  
  ```text
  2026-03-06T22:09:14.065559Z  INFO codex_cli::login: starting browser login flow
  2026-03-06T22:09:36.431678Z  INFO codex_login::server: received login callback path=/auth/callback has_code=true has_state=true has_error=false state_valid=true
  2026-03-06T22:09:36.436977Z  INFO codex_login::server: starting oauth token exchange issuer=https://auth.openai.com/ redirect_uri=http://localhost:1455/auth/callback
  2026-03-06T22:09:36.685438Z  INFO codex_login::server: oauth token exchange succeeded status=200 OK
  ```
  
  ## Tests
  
  - `cargo test -p codex-login`
  - `cargo clippy -p codex-login --tests -- -D warnings`
  - `cargo test -p codex-cli`
  - `just bazel-lock-update`
  - `just bazel-lock-check`
  - manual direct `codex login` smoke tests for both a failing callback
  and a successful browser login
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Josh McKinney · 2026-03-06 15:00:37 -08:00
  4e68fb96e2
• [rmcp-client] Recover from streamable HTTP 404 sessions (#13514)

  ## Summary
  - add one-time session recovery in `RmcpClient` for streamable HTTP MCP
  `404` session expiry
  - rebuild the transport and retry the failed operation once after
  reinitializing the client state
  - extend the test server and integration coverage for `404`, `401`,
  single-retry, and non-session failure scenarios
  
  ## Testing
  - just fmt
  - cargo test -p codex-rmcp-client (the post-rebase run lost its final
  summary in the terminal; the suite had passed earlier before the rebase)
  - just fix -p codex-rmcp-client

  Casey Chow · 2026-03-06 10:02:42 -05:00
  b3765a07e8
• [diagnostics] show diagnostics earlier in workflow (#13604)

  <img width="591" height="243" alt="Screenshot 2026-03-05 at 10 17 06 AM"
  src="https://github.com/user-attachments/assets/84a6658b-6017-4602-b1f8-2098b9b5eff9"
  />
  
  - show feedback earlier
  - preserve raw literal env vars (no trimming, sanitizing, etc.)

  rhan-oai · 2026-03-05 11:23:47 -08:00
  9fcbbeb5ae
• feat(app-server): support mcp elicitations in v2 api (#13425)

  This adds a first-class server request for MCP server elicitations:
  `mcpServer/elicitation/request`.
  
  Until now, MCP elicitation requests only showed up as a raw
  `codex/event/elicitation_request` event from core. That made it hard for
  v2 clients to handle elicitations using the same request/response flow
  as other server-driven interactions (like shell and `apply_patch`
  tools).
  
  This also updates the underlying MCP elicitation request handling in
  core to pass through the full MCP request (including URL and form data)
  so we can expose it properly in app-server.
  
  ### Why not `item/mcpToolCall/elicitationRequest`?
  This is because MCP elicitations are related to MCP servers first, and
  only optionally to a specific MCP tool call.
  
  In the MCP protocol, elicitation is a server-to-client capability: the
  server sends `elicitation/create`, and the client replies with an
  elicitation result. RMCP models it that way as well.
  
  In practice an elicitation is often triggered by an MCP tool call, but
  not always.
  
  ### What changed
  - add `mcpServer/elicitation/request` to the v2 app-server API
  - translate core `codex/event/elicitation_request` events into the new
  v2 server request
  - map client responses back into `Op::ResolveElicitation` so the MCP
  server can continue
  - update app-server docs and generated protocol schema
  - add an end-to-end app-server test that covers the full round trip
  through a real RMCP elicitation flow
  - The new test exercises a realistic case where an MCP tool call
  triggers an elicitation, the app-server emits
  mcpServer/elicitation/request, the client accepts it, and the tool call
  resumes and completes successfully.
  
  ### app-server API flow
  - Client starts a thread with `thread/start`.
  - Client starts a turn with `turn/start`.
  - App-server sends `item/started` for the `mcpToolCall`.
  - While that tool call is in progress, app-server sends
  `mcpServer/elicitation/request`.
  - Client responds to that request with `{ action: "accept" | "decline" |
  "cancel" }`.
  - App-server sends `serverRequest/resolved`.
  - App-server sends `item/completed` for the mcpToolCall.
  - App-server sends `turn/completed`.
  - If the turn is interrupted while the elicitation is pending,
  app-server still sends `serverRequest/resolved` before the turn
  finishes.

  Owen Lin · 2026-03-05 07:20:20 -08:00
  926b2f19e8
• feat: bind package manager (#13571)
  jif-oai · 2026-03-05 11:57:13 +00:00
  f304b2ef62
• chore(deps): bump serde_with from 3.16.1 to 3.17.0 in /codex-rs (#13209)

  Bumps [serde_with](https://github.com/jonasbb/serde_with) from 3.16.1 to
  3.17.0.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/jonasbb/serde_with/releases">serde_with's
  releases</a>.</em></p>
  <blockquote>
  <h2>serde_with v3.17.0</h2>
  <h3>Added</h3>
  <ul>
  <li>Support <code>OneOrMany</code> with <code>smallvec</code> v1 (<a
  href="https://redirect.github.com/jonasbb/serde_with/issues/920">#920</a>,
  <a
  href="https://redirect.github.com/jonasbb/serde_with/issues/922">#922</a>)</li>
  </ul>
  <h3>Changed</h3>
  <ul>
  <li>Switch to <code>yaml_serde</code> for a maintained yaml dependency
  by <a href="https://github.com/kazan417"><code>@​kazan417</code></a> (<a
  href="https://redirect.github.com/jonasbb/serde_with/issues/921">#921</a>)</li>
  <li>Bump MSRV to 1.82, since that is required for
  <code>yaml_serde</code> dev-dependency.</li>
  </ul>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/jonasbb/serde_with/commit/4031878a4cfced7261105447d8683c296147864b"><code>4031878</code></a>
  Bump version to v3.17.0 (<a
  href="https://redirect.github.com/jonasbb/serde_with/issues/924">#924</a>)</li>
  <li><a
  href="https://github.com/jonasbb/serde_with/commit/204ae56f8ba08bd911ad0f122719bf07f3dcdbbb"><code>204ae56</code></a>
  Bump version to v3.17.0</li>
  <li><a
  href="https://github.com/jonasbb/serde_with/commit/7812b5a006e23e0204c687868e68a8b9dae75cd1"><code>7812b5a</code></a>
  serde_yaml 0.9 to yaml_serde 0.10 (<a
  href="https://redirect.github.com/jonasbb/serde_with/issues/921">#921</a>)</li>
  <li><a
  href="https://github.com/jonasbb/serde_with/commit/614bd8950bc179f4f23c1d9f26866ac216257fed"><code>614bd89</code></a>
  Bump MSRV to 1.82 as required by yaml_serde</li>
  <li><a
  href="https://github.com/jonasbb/serde_with/commit/518d0ed7873616a81c987d7961d78f5f26210694"><code>518d0ed</code></a>
  Suppress RUSTSEC-2026-0009 since we don't have untrusted time input in
  tests ...</li>
  <li><a
  href="https://github.com/jonasbb/serde_with/commit/a6579a89841f269c7f63912e8e808e82212c672e"><code>a6579a8</code></a>
  Suppress RUSTSEC-2026-0009 since we don't have untrusted time input in
  tests</li>
  <li><a
  href="https://github.com/jonasbb/serde_with/commit/9d4d0696e6794da4babf8204d17d11dadb79dd60"><code>9d4d069</code></a>
  Implement OneOrMany for smallvec_1::SmallVec (<a
  href="https://redirect.github.com/jonasbb/serde_with/issues/922">#922</a>)</li>
  <li><a
  href="https://github.com/jonasbb/serde_with/commit/fc78243e8c60c4fcc11a99f2c6ccc0d449a57fd9"><code>fc78243</code></a>
  Add changelog</li>
  <li><a
  href="https://github.com/jonasbb/serde_with/commit/2b8c30bf679309c27143f13070dbeef068310ab5"><code>2b8c30b</code></a>
  Implement OneOrMany for smallvec_1::SmallVec</li>
  <li><a
  href="https://github.com/jonasbb/serde_with/commit/2d9b9a1815cb6d58b17ab6403e57e7c2f62b84cc"><code>2d9b9a1</code></a>
  Carg.lock update</li>
  <li>Additional commits viewable in <a
  href="https://github.com/jonasbb/serde_with/compare/v3.16.1...v3.17.0">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=serde_with&package-manager=cargo&previous-version=3.16.1&new-version=3.17.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
  Co-authored-by: Eric Traut <etraut@openai.com>

  dependabot[bot] · 2026-03-04 18:08:26 -07:00
  95aad8719f
• chore(deps): bump strum_macros from 0.27.2 to 0.28.0 in /codex-rs (#13210)

  Bumps [strum_macros](https://github.com/Peternator7/strum) from 0.27.2
  to 0.28.0.
  <details>
  <summary>Changelog</summary>
  <p><em>Sourced from <a
  href="https://github.com/Peternator7/strum/blob/master/CHANGELOG.md">strum_macros's
  changelog</a>.</em></p>
  <blockquote>
  <h2>0.28.0</h2>
  <ul>
  <li>
  <p><a
  href="https://redirect.github.com/Peternator7/strum/pull/461">#461</a>:
  Allow any kind of passthrough attributes on
  <code>EnumDiscriminants</code>.</p>
  <ul>
  <li>Previously only list-style attributes (e.g.
  <code>#[strum_discriminants(derive(...))]</code>) were supported. Now
  path-only
  (e.g. <code>#[strum_discriminants(non_exhaustive)]</code>) and
  name/value (e.g. <code>#[strum_discriminants(doc =
  &quot;foo&quot;)]</code>)
  attributes are also supported.</li>
  </ul>
  </li>
  <li>
  <p><a
  href="https://redirect.github.com/Peternator7/strum/pull/462">#462</a>:
  Add missing <code>#[automatically_derived]</code> to generated impls not
  covered by <a
  href="https://redirect.github.com/Peternator7/strum/pull/444">#444</a>.</p>
  </li>
  <li>
  <p><a
  href="https://redirect.github.com/Peternator7/strum/pull/466">#466</a>:
  Bump MSRV to 1.71, required to keep up with updated <code>syn</code> and
  <code>windows-sys</code> dependencies. This is a breaking change if
  you're on an old version of rust.</p>
  </li>
  <li>
  <p><a
  href="https://redirect.github.com/Peternator7/strum/pull/469">#469</a>:
  Use absolute paths in generated proc macro code to avoid
  potential name conflicts.</p>
  </li>
  <li>
  <p><a
  href="https://redirect.github.com/Peternator7/strum/pull/465">#465</a>:
  Upgrade <code>phf</code> dependency to v0.13.</p>
  </li>
  <li>
  <p><a
  href="https://redirect.github.com/Peternator7/strum/pull/473">#473</a>:
  Fix <code>cargo fmt</code> / <code>clippy</code> issues and add GitHub
  Actions CI.</p>
  </li>
  <li>
  <p><a
  href="https://redirect.github.com/Peternator7/strum/pull/477">#477</a>:
  <code>strum::ParseError</code> now implements
  <code>core::fmt::Display</code> instead
  <code>std::fmt::Display</code> to make it <code>#[no_std]</code>
  compatible. Note the <code>Error</code> trait wasn't available in core
  until <code>1.81</code>
  so <code>strum::ParseError</code> still only implements that in std.</p>
  </li>
  <li>
  <p><a
  href="https://redirect.github.com/Peternator7/strum/pull/476">#476</a>:
  <strong>Breaking Change</strong> - <code>EnumString</code> now
  implements <code>From&lt;&amp;str&gt;</code>
  (infallible) instead of <code>TryFrom&lt;&amp;str&gt;</code> when the
  enum has a <code>#[strum(default)]</code> variant. This more accurately
  reflects that parsing cannot fail in that case. If you need the old
  <code>TryFrom</code> behavior, you can opt back in using
  <code>parse_error_ty</code> and <code>parse_error_fn</code>:</p>
  <pre lang="rust"><code>#[derive(EnumString)]
  #[strum(parse_error_ty = strum::ParseError, parse_error_fn =
  make_error)]
  pub enum Color {
      Red,
      #[strum(default)]
      Other(String),
  }
  <p>fn make_error(x: &amp;str) -&gt; strum::ParseError {
  strum::ParseError::VariantNotFound
  }
  </code></pre></p>
  </li>
  <li>
  <p><a
  href="https://redirect.github.com/Peternator7/strum/pull/431">#431</a>:
  Fix bug where <code>EnumString</code> ignored the
  <code>parse_err_ty</code>
  attribute when the enum had a <code>#[strum(default)]</code>
  variant.</p>
  </li>
  <li>
  <p><a
  href="https://redirect.github.com/Peternator7/strum/pull/474">#474</a>:
  EnumDiscriminants will now copy <code>default</code> over from the
  original enum to the Discriminant enum.</p>
  <pre lang="rust"><code>#[derive(Debug, Default, EnumDiscriminants)]
  #[strum_discriminants(derive(Default))] // &lt;- Remove this in 0.28.
  enum MyEnum {
      #[default] // &lt;- Will be the #[default] on the MyEnumDiscriminant
      #[strum_discriminants(default)] // &lt;- Remove this in 0.28
      Variant0,
      Variant1 { a: NonDefault },
  }
  </code></pre>
  </li>
  </ul>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/Peternator7/strum/commit/7376771128834d28bb9beba5c39846cba62e71ec"><code>7376771</code></a>
  Peternator7/0.28 (<a
  href="https://redirect.github.com/Peternator7/strum/issues/475">#475</a>)</li>
  <li><a
  href="https://github.com/Peternator7/strum/commit/26e63cd964a2e364331a5dd977d589bb9f649d8c"><code>26e63cd</code></a>
  Display exists in core (<a
  href="https://redirect.github.com/Peternator7/strum/issues/477">#477</a>)</li>
  <li><a
  href="https://github.com/Peternator7/strum/commit/9334c728eedaa8a992d1388a8f4564bbccad1934"><code>9334c72</code></a>
  Make TryFrom and FromStr infallible if there's a default (<a
  href="https://redirect.github.com/Peternator7/strum/issues/476">#476</a>)</li>
  <li><a
  href="https://github.com/Peternator7/strum/commit/0ccbbf823c16e827afc263182cd55e99e3b2a52e"><code>0ccbbf8</code></a>
  Honor parse_err_ty attribute when the enum has a default variant (<a
  href="https://redirect.github.com/Peternator7/strum/issues/431">#431</a>)</li>
  <li><a
  href="https://github.com/Peternator7/strum/commit/2c9e5a9259189ce8397f2f4967060240c6bafd74"><code>2c9e5a9</code></a>
  Automatically add Default implementation to EnumDiscriminant if it
  exists on ...</li>
  <li><a
  href="https://github.com/Peternator7/strum/commit/e241243e48359b8b811b8eaccdcfa1ae87138e0d"><code>e241243</code></a>
  Fix existing cargo fmt + clippy issues and add GH actions (<a
  href="https://redirect.github.com/Peternator7/strum/issues/473">#473</a>)</li>
  <li><a
  href="https://github.com/Peternator7/strum/commit/639b67fefd20eaead1c5d2ea794e9afe70a00312"><code>639b67f</code></a>
  feat: allow any kind of passthrough attributes on
  <code>EnumDiscriminants</code> (<a
  href="https://redirect.github.com/Peternator7/strum/issues/461">#461</a>)</li>
  <li><a
  href="https://github.com/Peternator7/strum/commit/0ea1e2d0fd1460e7492ea32e6b460394d9199ff8"><code>0ea1e2d</code></a>
  docs: Fix typo (<a
  href="https://redirect.github.com/Peternator7/strum/issues/463">#463</a>)</li>
  <li><a
  href="https://github.com/Peternator7/strum/commit/36c051b91086b37d531c63ccf5a49266832a846d"><code>36c051b</code></a>
  Upgrade <code>phf</code> to v0.13 (<a
  href="https://redirect.github.com/Peternator7/strum/issues/465">#465</a>)</li>
  <li><a
  href="https://github.com/Peternator7/strum/commit/9328b38617dc6f4a3bc5fdac03883d3fc766cf34"><code>9328b38</code></a>
  Use absolute paths in proc macro (<a
  href="https://redirect.github.com/Peternator7/strum/issues/469">#469</a>)</li>
  <li>Additional commits viewable in <a
  href="https://github.com/Peternator7/strum/compare/v0.27.2...v0.28.0">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=strum_macros&package-manager=cargo&previous-version=0.27.2&new-version=0.28.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
  Co-authored-by: Eric Traut <etraut@openai.com>

  dependabot[bot] · 2026-03-04 17:58:58 -07:00
  14ac823aef
• feat(app-server-test-client): OTEL setup for tracing (#13493)

  ### Overview
  This PR:
  - Updates `app-server-test-client` to load OTEL settings from
  `$CODEX_HOME/config.toml` and initializes its own OTEL provider.
  - Add real client root spans to app-server test client traces.
  
  This updates `codex-app-server-test-client` so its Datadog traces
  reflect the full client-driven flow instead of a set of server spans
  stitched together under a synthetic parent.
  
  Before this change, the test client generated a fake `traceparent` once
  and reused it for every JSON-RPC request. That kept the requests in one
  trace, but there was no real client span at the top, so Datadog ended up
  showing the sequence in a slightly misleading way, where all RPCs were
  anchored under `initialize`.
  
  Now the test client:
  - loads OTEL settings from the normal Codex config path, including
  `$CODEX_HOME/config.toml` and existing --config overrides
  - initializes tracing the same way other Codex binaries do when trace
  export is enabled
  - creates a real client root span for each scripted command
  - creates per-request client spans for JSON-RPC methods like
  `initialize`, `thread/start`, and `turn/start`
  - injects W3C trace context from the current client span into
  request.trace instead of reusing a fabricated carrier
  
  This gives us a cleaner trace shape in Datadog:
  - one trace URL for the whole scripted flow
  - a visible client root span
  - proper client/server parent-child relationships for each app-server
  request

  Owen Lin · 2026-03-04 13:30:09 -08:00
  8dfd654196
• feat: external artifacts builder (#13485)

  This PR reverts the built-in artifact render while a decision is being
  reached. No impact expected on any features

  jif-oai · 2026-03-04 20:22:34 +00:00
  2322e49549
• feat(app-server): propagate app-server trace context into core (#13368)

  ### Summary
  Propagate trace context originating at app-server RPC method handlers ->
  codex core submission loop (so this includes spans such as `run_turn`!).
  This implements PR 2 of the app-server tracing rollout.
  
  This also removes the old lower-level env-based reparenting in core so
  explicit request/submission ancestry wins instead of being overridden by
  ambient `TRACEPARENT` state.
  
  ### What changed
  - Added `trace: Option<W3cTraceContext>` to codex_protocol::Submission
  - Taught `Codex::submit()` / `submit_with_id()` to automatically capture
  the current span context when constructing or forwarding a submission
  - Wrapped the core submission loop in a submission_dispatch span
  parented from Submission.trace
  - Warn on invalid submission trace carriers and ignore them cleanly
  - Removed the old env-based downstream reparenting path in core task
  execution
  - Stopped OTEL provider init from implicitly attaching env trace context
  process-wide
  - Updated mcp-server Submission call sites for the new field
  
  Added focused unit tests for:
  - capturing trace context into Submission
  - preferring `Submission.trace` when building the core dispatch span
  
  ### Why
  PR 1 gave us consistent inbound request spans in app-server, but that
  only covered the transport boundary. For long-running work like turns
  and reviews, the important missing piece was preserving ancestry after
  the request handler returns and core continues work on a different async
  path.
  
  This change makes that handoff explicit and keeps the parentage rules
  simple:
  - app-server request span sets the current context
  - `Submission.trace` snapshots that context
  - core restores it once, at the submission boundary
  - deeper core spans inherit naturally
  
  That also lets us stop relying on env-based reparenting for this path,
  which was too ambient and could override explicit ancestry.

  Owen Lin · 2026-03-04 01:03:45 +00:00
  52521a5e40
• [feedback] diagnostics (#13292)

  - added header logic to display diagnostics on cli
  - added logic for collecting env vars
  
  <img width="606" height="327" alt="Screenshot 2026-03-03 at 3 49 31 PM"
  src="https://github.com/user-attachments/assets/05e78c56-8cb3-47fa-abaf-3e57f1fdd8e2"
  />
  
  <img width="690" height="353" alt="Screenshot 2026-03-02 at 6 47 54 PM"
  src="https://github.com/user-attachments/assets/e470b559-13f4-44d9-897f-bc398943c6d1"
  />

  rhan-oai · 2026-03-03 16:34:11 -08:00
  e951ef4374
• Add under-development original-resolution view_image support (#13050)

  ## Summary
  
  Add original-resolution support for `view_image` behind the
  under-development `view_image_original_resolution` feature flag.
  
  When the flag is enabled and the target model is `gpt-5.3-codex` or
  newer, `view_image` now preserves original PNG/JPEG/WebP bytes and sends
  `detail: "original"` to the Responses API instead of using the legacy
  resize/compress path.
  
  ## What changed
  
  - Added `view_image_original_resolution` as an under-development feature
  flag.
  - Added `ImageDetail` to the protocol models and support for serializing
  `detail: "original"` on tool-returned images.
  - Added `PromptImageMode::Original` to `codex-utils-image`.
    - Preserves original PNG/JPEG/WebP bytes.
    - Keeps legacy behavior for the resize path.
  - Updated `view_image` to:
  - use the shared `local_image_content_items_with_label_number(...)`
  helper in both code paths
    - select original-resolution mode only when:
      - the feature flag is enabled, and
      - the model slug parses as `gpt-5.3-codex` or newer
  - Kept local user image attachments on the existing resize path; this
  change is specific to `view_image`.
  - Updated history/image accounting so only `detail: "original"` images
  use the docs-based GPT-5 image cost calculation; legacy images still use
  the old fixed estimate.
  - Added JS REPL guidance, gated on the same feature flag, to prefer JPEG
  at 85% quality unless lossless is required, while still allowing other
  formats when explicitly requested.
  - Updated tests and helper code that construct
  `FunctionCallOutputContentItem::InputImage` to carry the new `detail`
  field.
  
  ## Behavior
  
  ### Feature off
  - `view_image` keeps the existing resize/re-encode behavior.
  - History estimation keeps the existing fixed-cost heuristic.
  
  ### Feature on + `gpt-5.3-codex+`
  - `view_image` sends original-resolution images with `detail:
  "original"`.
  - PNG/JPEG/WebP source bytes are preserved when possible.
  - History estimation uses the GPT-5 docs-based image-cost calculation
  for those `detail: "original"` images.
  
  
  #### [git stack](https://github.com/magus/git-stack-cli)
  - 👉 `1` https://github.com/openai/codex/pull/13050
  - ⏳ `2` https://github.com/openai/codex/pull/13331
  - ⏳ `3` https://github.com/openai/codex/pull/13049

  Curtis 'Fjord' Hawthorne · 2026-03-03 15:56:54 -08:00
  b92146d48b
• chore(app-server): delete v1 RPC methods and notifications (#13375)

  ## Summary
  This removes the old app-server v1 methods and notifications we no
  longer need, while keeping the small set the main codex app client still
  depends on for now.
  
  The remaining legacy surface is:
  - `initialize`
  - `getConversationSummary`
  - `getAuthStatus`
  - `gitDiffToRemote`
  - `fuzzyFileSearch`
  - `fuzzyFileSearch/sessionStart`
  - `fuzzyFileSearch/sessionUpdate`
  - `fuzzyFileSearch/sessionStop`
  
  And the raw `codex/event/*` notifications emitted from core. These
  notifications will be removed in a followup PR.
  
  ## What changed
  - removed deprecated v1 request variants from the protocol and
  app-server dispatcher
  - removed deprecated typed notifications: `authStatusChange`,
  `loginChatGptComplete`, and `sessionConfigured`
  - updated the app-server test client to use v2 flows instead of deleted
  v1 flows
  - deleted legacy-only app-server test suites and added focused coverage
  for `getConversationSummary`
  - regenerated app-server schema fixtures and updated the MCP interface
  docs to match the remaining compatibility surface
  
  ## Testing
  - `just write-app-server-schema`
  - `cargo test -p codex-app-server-protocol`
  - `cargo test -p codex-app-server`

  Owen Lin · 2026-03-03 13:18:25 -08:00
  167158f93c
• feat: wire spreadsheet artifact (#13362)
  jif-oai · 2026-03-03 15:27:37 +00:00
  8159f05dfd
• feat: spreadsheet artifact (#13345)
  jif-oai · 2026-03-03 12:25:40 +00:00
  8c5e50ef39
• feat: pres artifact 2 (#13344)
  jif-oai · 2026-03-03 12:00:34 +00:00
  72dc444b2c
• feat: presentation artifact p1 (#13341)

  Part 1 of presentation tool artifact

  jif-oai · 2026-03-03 11:38:03 +00:00
  4874b9291a
• app-server service tier plumbing (plus some cleanup) (#13334)

  followup to https://github.com/openai/codex/pull/13212 to expose fast
  tier controls to app server
  (majority of this PR is generated schema jsons - actual code is +69 /
  -35 and +24 tests )
  
  - add service tier fields to the app-server protocol surfaces used by
  thread lifecycle, turn start, config, and session configured events
  - thread service tier through the app-server message processor and core
  thread config snapshots
  - allow runtime config overrides to carry service tier for app-server
  callers
  
  cleanup:
  - Removing useless "legacy" code supporting "standard" - we moved to
  None | "fast", so "standard" is not needed.

  pash-openai · 2026-03-03 02:35:09 -08:00
  07e532dcb9
• feat(app-server): add tracing to all app-server APIs (#13285)

  ### Overview
  This PR adds the first piece of tracing for app-server JSON-RPC
  requests.
  
  There are two main changes:
  - JSON-RPC requests can now take an optional W3C trace context at the
  top level via a `trace` field (`traceparent` / `tracestate`).
  - app-server now creates a dedicated request span for every inbound
  JSON-RPC request in `MessageProcessor`, and uses the request-level trace
  context as the parent when present.
  
  For compatibility with existing flows, app-server still falls back to
  the TRACEPARENT env var when there is no request-level traceparent.
  
  This PR is intentionally scoped to the app-server boundary. In a
  followup, we'll actually propagate trace context through the async
  handoff into core execution spans like run_turn, which will make
  app-server traces much more useful.
  
  ### Spans
  A few details on the app-server span shape:
  - each inbound request gets its own server span
  - span/resource names are based on the JSON-RPC method (`initialize`,
  `thread/start`, `turn/start`, etc.)
  - spans record transport (stdio vs websocket), request id, connection
  id, and client name/version when available
  - `initialize` stores client metadata in session state so later requests
  on the same connection can reuse it

  Owen Lin · 2026-03-02 16:01:41 -08:00
  d473e8d56d
• feat: add debug clear-memories command to hard-wipe memories state (#13085)

  #### what
  adds a `codex debug clear-memories` command to help with clearing all
  memories state from disk, sqlite db, and marking threads as
  `memory_mode=disabled` so they don't get resummarized when the
  `memories` feature is re-enabled.
  
  #### tests
  add tests

  sayan-oai · 2026-02-27 17:45:55 -08:00
  033ef9cb9d
• execpolicy: add host_executable() path mappings (#12964)

  ## Why
  
  `execpolicy` currently keys `prefix_rule()` matching off the literal
  first token. That works for rules like `["/usr/bin/git"]`, but it means
  shared basename rules such as `["git"]` do not help when a caller passes
  an absolute executable path like `/usr/bin/git`.
  
  This PR lays the groundwork for basename-aware matching without changing
  existing callers yet. It adds typed host-executable metadata and an
  opt-in resolution path in `codex-execpolicy`, so a follow-up PR can
  adopt the new behavior in `unix_escalation.rs` and other call sites
  without having to redesign the policy layer first.
  
  ## What Changed
  
  - added `host_executable(name = ..., paths = [...])` to the execpolicy
  parser and validated it with `AbsolutePathBuf`
  - stored host executable mappings separately from prefix rules inside
  `Policy`
  - added `MatchOptions` and opt-in `*_with_options()` APIs that preserve
  existing behavior by default
  - implemented exact-first matching with optional basename fallback,
  gated by `host_executable()` allowlists when present
  - normalized executable names for cross-platform matching so Windows
  paths like `git.exe` can satisfy `host_executable(name = "git", ...)`
  - updated `match` / `not_match` example validation to exercise the
  host-executable resolution path instead of only raw prefix-rule matching
  - preserved source locations for deferred example-validation errors so
  policy load failures still point at the right file and line
  - surfaced `resolvedProgram` on `RuleMatch` so callers can tell when a
  basename rule matched an absolute executable path
  - preserved host executable metadata when requirements policies overlay
  file-based policies in `core/src/exec_policy.rs`
  - documented the new rule shape and CLI behavior in
  `execpolicy/README.md`
  
  ## Verification
  
  - `cargo test -p codex-execpolicy`
  - added coverage in `execpolicy/tests/basic.rs` for parsing, precedence,
  empty allowlists, basename fallback, exact-match precedence, and
  host-executable-backed `match` / `not_match` examples
  - added a regression test in `core/src/exec_policy.rs` to verify
  requirements overlays preserve `host_executable()` metadata
  - verified `cargo test -p codex-core --lib`, including source-rendering
  coverage for deferred validation errors

  Michael Bolin · 2026-02-27 12:59:24 -08:00
  b148d98e0e
• feat: add local date/timezone to turn environment context (#12947)

  ## Summary
  
  This PR includes the session's local date and timezone in the
  model-visible environment context and persists that data in
  `TurnContextItem`.
  
    ## What changed
  - captures the current local date and IANA timezone when building a turn
  context, with a UTC fallback if the timezone lookup fails
  - includes current_date and timezone in the serialized
  <environment_context> payload
  - stores those fields on TurnContextItem so they survive rollout/history
  handling, subagent review threads, and resume flows
  - treats date/timezone changes as environment updates, so prompt caching
  and context refresh logic do not silently reuse stale time context
  - updates tests to validate the new environment fields without depending
  on a single hardcoded environment-context string
  
  ## test
  
  built a local build and saw it in the rollout file:
  ```
  {"timestamp":"2026-02-26T21:39:50.737Z","type":"response_item","payload":{"type":"message","role":"user","content":[{"type":"input_text","text":"<environment_context>\n  <shell>zsh</shell>\n  <current_date>2026-02-26</current_date>\n  <timezone>America/Los_Angeles</timezone>\n</environment_context>"}]}}
  ```

  Celia Chen · 2026-02-26 23:17:35 +00:00
  90cc4e79a2
• feat: include sandbox config with escalation request (#12839)

  ## Why
  
  Before this change, an escalation approval could say that a command
  should be rerun, but it could not carry the sandbox configuration that
  should still apply when the escalated command is actually spawned.
  
  That left an unsafe gap in the `zsh-fork` skill path: skill scripts
  under `scripts/` that did not declare permissions could be escalated
  without a sandbox, and scripts that did declare permissions could lose
  their bounded sandbox on rerun or cached session approval.
  
  This PR extends the escalation protocol so approvals can optionally
  carry sandbox configuration all the way through execution. That lets the
  shell runtime preserve the intended sandbox instead of silently widening
  access.
  
  We likely want a single permissions type for this codepath eventually,
  probably centered on `Permissions`. For now, the protocol needs to
  represent both the existing `PermissionProfile` form and the fuller
  `Permissions` form, so this introduces a temporary disjoint union,
  `EscalationPermissions`, to carry either one.
  
  Further, this means that today, a skill either:
  
  - does not declare any permissions, in which case it is run using the
  default sandbox for the turn
  - specifies permissions, in which case the skill is run using that exact
  sandbox, which might be more restrictive than the default sandbox for
  the turn
  
  We will likely change the skill's permissions to be additive to the
  existing permissions for the turn.
  
  ## What Changed
  
  - Added `EscalationPermissions` to `codex-protocol` so escalation
  requests can carry either a `PermissionProfile` or a full `Permissions`
  payload.
  - Added an explicit `EscalationExecution` mode to the shell escalation
  protocol so reruns distinguish between `Unsandboxed`, `TurnDefault`, and
  `Permissions(...)` instead of overloading `None`.
  - Updated `zsh-fork` shell reruns to resolve `TurnDefault` at execution
  time, which keeps ordinary `UseDefault` commands on the turn sandbox and
  preserves turn-level macOS seatbelt profile extensions.
  - Updated the `zsh-fork` skill path so a skill with no declared
  permissions inherits the conversation's effective sandbox instead of
  escalating unsandboxed.
  - Updated the `zsh-fork` skill path so a skill with declared permissions
  reruns with exactly those permissions, including when a cached session
  approval is reused.
  
  ## Testing
  
  - Added unit coverage in
  `core/src/tools/runtimes/shell/unix_escalation.rs` for the explicit
  `UseDefault` / `RequireEscalated` / `WithAdditionalPermissions`
  execution mapping.
  - Added unit coverage in
  `core/src/tools/runtimes/shell/unix_escalation.rs` for macOS seatbelt
  extension preservation in both the `TurnDefault` and
  explicit-permissions rerun paths.
  - Added integration coverage in `core/tests/suite/skill_approval.rs` for
  permissionless skills inheriting the turn sandbox and explicit skill
  permissions remaining bounded across cached approval reuse.

  Michael Bolin · 2026-02-26 12:00:18 -08:00
  7fa9d9ae35
• tui: restore visible line numbers for hidden file links (#12870)

  we recently changed file linking so the model uses markdown links when
  it wants something to be clickable.
  
  This works well across the GUI surfaces because they can render markdown
  cleanly and use the full absolute path in the anchor target.
  
  A previous pass hid the absolute path in the TUI (and only showed the
  label), but that also meant we could lose useful location info when the
  model put the line number or range in the anchor target instead of the
  label.
  
  This follow-up keeps the TUI behavior simple while making local file
  links feel closer to the old TUI file reference style.
  
  key changes:
  - Local markdown file links in the TUI keep the old file-ref feel: code
  styling, no underline, no visible absolute path.
  - If the hidden local anchor target includes a location suffix and the
  label does not already include one, we append that suffix to the visible
  label.
  - This works for single lines, line/column references, and ranges.
  - If the label already includes the location, we leave it alone.
  - normal web links keep the old TUI markdown-link behavior
  
  some examples:
  - `[foo.rs](/abs/path/foo.rs)` renders as `foo.rs`
  - `[foo.rs](/abs/path/foo.rs:45)` renders as `foo.rs:45`
  - `[foo.rs](/abs/path/foo.rs:45:3-48:9)` renders as `foo.rs:45:3-48:9`
  - `[foo.rs:45](/abs/path/foo.rs:45)` stays `foo.rs:45`
  - `[docs](https://example.com/docs)` still renders like a normal web
  link
  
  how it looks:
  <img width="732" height="813" alt="Screenshot 2026-02-26 at 9 27 55 AM"
  src="https://github.com/user-attachments/assets/d51bf236-653a-4e83-96e4-9427f0804471"
  />

  pash-openai · 2026-02-26 10:29:54 +00:00
  6acede5a28
• Revert "fix(bazel): replace askama templates with include_str! in memories" (#12795)

  Reverts openai/codex#11778

  jif-oai · 2026-02-25 18:06:17 +00:00
  7b39e76a66
• feat(network-proxy): add embedded OTEL policy audit logging (#12046)

  **PR Summary**
  
  This PR adds embedded-only OTEL policy audit logging for
  `codex-network-proxy` and threads audit metadata from `codex-core` into
  managed proxy startup.
  
  ### What changed
  - Added structured audit event emission in `network_policy.rs` with
  target `codex_otel.network_proxy`.
  - Emitted:
  - `codex.network_proxy.domain_policy_decision` once per domain-policy
  evaluation.
    - `codex.network_proxy.block_decision` for non-domain denies.
  - Added required policy/network fields, RFC3339 UTC millisecond
  `event.timestamp`, and fallback defaults (`http.request.method="none"`,
  `client.address="unknown"`).
  - Added non-domain deny audit emission in HTTP/SOCKS handlers for
  mode-guard and proxy-state denies, including unix-socket deny paths.
  - Added `REASON_UNIX_SOCKET_UNSUPPORTED` and used it for unsupported
  unix-socket auditing.
  - Added `NetworkProxyAuditMetadata` to runtime/state, re-exported from
  `lib.rs` and `state.rs`.
  - Added `start_proxy_with_audit_metadata(...)` in core config, with
  `start_proxy()` delegating to default metadata.
  - Wired metadata construction in `codex.rs` from session/auth context,
  including originator sanitization for OTEL-safe tagging.
  - Updated `network-proxy/README.md` with embedded-mode audit schema and
  behavior notes.
  - Refactored HTTP block-audit emission to a small local helper to reduce
  duplication.
  - Preserved existing unix-socket proxy-disabled host/path behavior for
  responses and blocked history while using an audit-only endpoint
  override (`server.address="unix-socket"`, `server.port=0`).
  
  ### Explicit exclusions
  - No standalone proxy OTEL startup work.
  - No `main.rs` binary wiring.
  - No `standalone_otel.rs`.
  - No standalone docs/tests.
  
  ### Tests
  - Extended `network_policy.rs` tests for event mapping, metadata
  propagation, fallbacks, timestamp format, and target prefix.
  - Extended HTTP tests to assert unix-socket deny block audit events.
  - Extended SOCKS tests to cover deny emission from handler deny
  branches.
  - Added/updated core tests to verify audit metadata threading into
  managed proxy state.
  
  ### Validation run
  - `just fmt`
  - `cargo test -p codex-network-proxy` ✅
  - `cargo test -p codex-core` ran with one unrelated flaky timeout
  (`shell_snapshot::tests::snapshot_shell_does_not_inherit_stdin`), and
  the test passed when rerun directly ✅
  
  ---------
  
  Co-authored-by: viyatb-oai <viyatb@openai.com>

  mcgrew-oai · 2026-02-25 11:46:37 -05:00
  9a393c9b6f
• otel: add host.name resource attribute to logs/traces via gethostname (#12352)

  **PR Summary**
  
  This PR adds the OpenTelemetry `host.name` resource attribute to Codex
  OTEL exports so every OTEL log (and trace, via the shared resource)
  carries the machine hostname.
  
  **What changed**
  
  - Added `host.name` to the shared OTEL `Resource` in
  `/Users/michael.mcgrew/code/codex/codex-rs/otel/src/otel_provider.rs`
    - This applies to both:
      - OTEL logs (`SdkLoggerProvider`)
      - OTEL traces (`SdkTracerProvider`)
  - Hostname is now resolved via `gethostname::gethostname()`
  (best-effort)
    - Value is trimmed
    - Empty values are omitted (non-fatal)
  - Added focused unit tests for:
    - including `host.name` when present
    - omitting `host.name` when missing/empty
  
  **Why**
  
  - `host.name` is host/process metadata and belongs on the OTEL
  `resource`, not per-event attributes.
  - Attaching it in the shared resource is the smallest change that
  guarantees coverage across all exported OTEL logs/traces.
  
  **Scope / Non-goals**
  
  - No public API changes
  - No changes to metrics behavior (this PR only updates log/trace
  resource metadata)
  
  **Dependency updates**
  
  - Added `gethostname` as a workspace dependency and `codex-otel`
  dependency
  - `Cargo.lock` updated accordingly
  - `MODULE.bazel.lock` unchanged after refresh/check
  
  **Validation**
  
  - `just fmt`
  - `cargo test -p codex-otel`
  - `just bazel-lock-update`
  - `just bazel-lock-check`

  mcgrew-oai · 2026-02-25 09:54:45 -05:00
  bccce0d75f
• feat: adding stream parser (#12666)

  Add a stream parser to extract citations (and others) from a stream.
  This support cases where markers are split in differen tokens.
  
  Codex never manage to make this code work so everything was done
  manually. Please review correctly and do not touch this part of the code
  without a very clear understanding of it

  jif-oai · 2026-02-25 13:27:58 +00:00
  5441130e0a
• feat: add large stack test macro (#12768)

  This PR adds the macro `#[large_stack_test]`
  
  This spawns the tests in a dedicated tokio runtime with a larger stack.
  It is useful for tests that needs the full recursion on the harness
  (which is now too deep for windows for example)

  jif-oai · 2026-02-25 13:19:21 +00:00
  5a9a5b51b2
• feat: add search term to thread list (#12578)

  Add `searchTerm` to `thread/list` that will search for a match in the
  titles (the condition being `searchTerm` $$\in$$ `title`)

  jif-oai · 2026-02-25 09:59:41 +00:00
  f46b767b7e
• fix: keep shell escalation exec paths absolute (#12750)

  ## Why
  
  In the `shell_zsh_fork` flow, `codex-shell-escalation` receives the
  executable path exactly as the shell passed it to `execve()`. That path
  is not guaranteed to be absolute.
  
  For commands such as `./scripts/hello-mbolin.sh`, if the shell was
  launched with a different `workdir`, resolving the intercepted `file`
  against the server process working directory makes policy checks and
  skill matching inspect the wrong executable. This change pushes that fix
  a step further by keeping the normalized path typed as `AbsolutePathBuf`
  throughout the rest of the escalation pipeline.
  
  That makes the absolute-path invariant explicit, so later code cannot
  accidentally treat the resolved executable path as an arbitrary
  `PathBuf`.
  
  ## What Changed
  
  - record the wrapper process working directory as an `AbsolutePathBuf`
  - update the escalation protocol so `workdir` is explicitly absolute
  while `file` remains the raw intercepted exec path
  - resolve a relative intercepted `file` against the request `workdir` as
  soon as the server receives the request
  - thread `AbsolutePathBuf` through `EscalationPolicy`,
  `CoreShellActionProvider`, and command normalization helpers so the
  resolved executable path stays type-checked as absolute
  - replace the `path-absolutize` dependency in `codex-shell-escalation`
  with `codex-utils-absolute-path`
  - add a regression test that covers a relative `file` with a distinct
  `workdir`
  
  ## Verification
  
  - `cargo test -p codex-shell-escalation`

  Michael Bolin · 2026-02-24 23:52:36 -08:00
  c4ec6be4ab
• fix: make EscalateServer public and remove shell escalation wrappers (#12724)

  ## Why
  
  `codex-shell-escalation` exposed a `codex-core`-specific adapter layer
  (`ShellActionProvider`, `ShellPolicyFactory`, and `run_escalate_server`)
  that existed only to bridge `codex-core` to `EscalateServer`. That
  indirection increased API surface and obscured crate ownership without
  adding behavior.
  
  This change moves orchestration into `codex-core` so boundaries are
  clearer: `codex-shell-escalation` provides reusable escalation
  primitives, and `codex-core` provides shell-tool policy decisions.
  
  Admittedly, @pakrym rightfully requested this sort of cleanup as part of
  https://github.com/openai/codex/pull/12649, though this avoids moving
  all of `codex-shell-escalation` into `codex-core`.
  
  ## What changed
  
  - Made `EscalateServer` public and exported it from `shell-escalation`.
  - Removed the adapter layer from `shell-escalation`:
    - deleted `shell-escalation/src/unix/core_shell_escalation.rs`
  - removed exports for `ShellActionProvider`, `ShellPolicyFactory`,
  `EscalationPolicyFactory`, and `run_escalate_server`
  - Updated `core/src/tools/runtimes/shell/unix_escalation.rs` to:
    - create `Stopwatch`/cancellation in `codex-core`
    - instantiate `EscalateServer` directly
    - implement `EscalationPolicy` directly on `CoreShellActionProvider`
  
  Net effect: same escalation flow with fewer wrappers and a smaller
  public API.
  
  ## Verification
  
  - Manually reviewed the old vs. new escalation call flow to confirm
  timeout/cancellation behavior and approval policy decisions are
  preserved while removing wrapper types.

  Michael Bolin · 2026-02-24 16:20:08 -08:00
  3d356723c4
• Agent jobs (spawn_agents_on_csv) + progress UI (#10935)

  ## Summary
  - Add agent job support: spawn a batch of sub-agents from CSV, auto-run,
  auto-export, and store results in SQLite.
  - Simplify workflow: remove run/resume/get-status/export tools; spawn is
  deterministic and completes in one call.
  - Improve exec UX: stable, single-line progress bar with ETA; suppress
  sub-agent chatter in exec.
  
  ## Why
  Enables map-reduce style workflows over arbitrarily large repos using
  the existing Codex orchestrator. This addresses review feedback about
  overly complex job controls and non-deterministic monitoring.
  
  ## Demo (progress bar)
  ```
  ./codex-rs/target/debug/codex exec \
    --enable collab \
    --enable sqlite \
    --full-auto \
    --progress-cursor \
    -c agents.max_threads=16 \
    -C /Users/daveaitel/code/codex \
    - <<'PROMPT'
  Create /tmp/agent_job_progress_demo.csv with columns: path,area and 30 rows:
  path = item-01..item-30, area = test.
  
  Then call spawn_agents_on_csv with:
  - csv_path: /tmp/agent_job_progress_demo.csv
  - instruction: "Run `python - <<'PY'` to sleep a random 0.3–1.2s, then output JSON with keys: path, score (int). Set score = 1."
  - output_csv_path: /tmp/agent_job_progress_demo_out.csv
  PROMPT
  ```
  
  ## Review feedback addressed
  - Auto-start jobs on spawn; removed run/resume/status/export tools.
  - Auto-export on success.
  - More descriptive tool spec + clearer prompts.
  - Avoid deadlocks on spawn failure; pending/running handled safely.
  - Progress bar no longer scrolls; stable single-line redraw.
  
  ## Tests
  - `cd codex-rs && cargo test -p codex-exec`
  - `cd codex-rs && cargo build -p codex-cli`

  daveaitel-openai · 2026-02-24 21:00:19 +00:00
  dcab40123f
• feat(sleep-inhibitor): add Linux and Windows idle-sleep prevention (#11766)

  ## Background
  - follow-up to previous macOS-only PR:
  https://github.com/openai/codex/pull/11711
  - follow-up macOS refactor PR (current structural approach used here):
  https://github.com/openai/codex/pull/12340
  
  ## Summary
  - extend `codex-utils-sleep-inhibitor` with Linux and Windows backends
  while preserving existing macOS behavior
  - Linux backend:
    - use `systemd-inhibit` (`--what=idle --mode=block`) when available
  - fall back to `gnome-session-inhibit` (`--inhibit idle`) when available
    - keep no-op behavior if neither backend exists on host
  - Windows backend:
  - use Win32 power request handles (`PowerCreateRequest` +
  `PowerSetRequest` / `PowerClearRequest`) with
  `PowerRequestSystemRequired`
  - make `prevent_idle_sleep` Experimental on macOS/Linux/Windows; keep
  under development on other targets
  
  ## Testing
  - `just fmt`
  - `cargo test -p codex-utils-sleep-inhibitor`
  - `cargo test -p codex-core features::tests::`
  - `cargo test -p codex-tui chatwidget::tests::`
  - `just fix -p codex-utils-sleep-inhibitor`
  - `just fix -p codex-core`
  
  ## Semantics and API references
  - Goal remains: prevent idle system sleep while a turn is running.
  - Linux:
    - `systemd-inhibit` / login1 inhibitor model:
  -
  https://www.freedesktop.org/software/systemd/man/latest/systemd-inhibit.html
  -
  https://www.freedesktop.org/software/systemd/man/org.freedesktop.login1.html
      - https://systemd.io/INHIBITOR_LOCKS/
    - xdg-desktop-portal Inhibit (relevant for sandboxed apps):
  -
  https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.freedesktop.portal.Inhibit.html
  - Windows:
    - `PowerCreateRequest`:
  -
  https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-powercreaterequest
    - `PowerSetRequest`:
  -
  https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-powersetrequest
    - `PowerClearRequest`:
  -
  https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-powerclearrequest
    - `SetThreadExecutionState` (alternative baseline API):
  -
  https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-setthreadexecutionstate
  
  ## Chromium vs this PR
  - Chromium Linux backend:
  -
  https://github.com/chromium/chromium/blob/main/services/device/wake_lock/power_save_blocker/power_save_blocker_linux.cc
  - Chromium Windows backend:
  -
  https://github.com/chromium/chromium/blob/main/services/device/wake_lock/power_save_blocker/power_save_blocker_win.cc
  - Electron powerSaveBlocker entry point:
  -
  https://github.com/electron/electron/blob/main/shell/browser/api/electron_api_power_save_blocker.cc
  
  ## Why we differ from Chromium
  - Linux implementation mechanism:
  - Chromium uses in-process D-Bus APIs plus UI-integrated screen-saver
  suspension.
  - This PR uses command-based inhibitor backends (`systemd-inhibit`,
  `gnome-session-inhibit`) instead of linking a Linux D-Bus client in this
  crate.
  - Reason: keep `codex-utils-sleep-inhibitor` dependency-light and avoid
  Linux CI/toolchain fragility from new native D-Bus linkage, while
  preserving the same runtime intent (hold an inhibitor while a turn
  runs).
  - Linux UI integration scope:
  - Chromium also uses `display::Screen::SuspendScreenSaver()` in its UI
  stack.
  - Codex `codex-rs` does not have that display abstraction in this crate,
  so this PR scopes Linux behavior to process-level sleep inhibition only.
  - Windows wake-lock type breadth:
  - Chromium supports both display/system wake-lock types and extra
  display-specific handling for some pre-Win11 scenarios.
  - Codex’s feature is scoped to turn execution continuity (not forcing
  display on), so this PR uses `PowerRequestSystemRequired` only.

  Yaroslav Volovich · 2026-02-24 11:51:44 -08:00
  67d9261e2c
• feat: run zsh fork shell tool via shell-escalation (#12649)

  ## Why
  
  This PR switches the `shell_command` zsh-fork path over to
  `codex-shell-escalation` so the new shell tool can use the shared
  exec-wrapper/escalation protocol instead of the `zsh_exec_bridge`
  implementation that was introduced in
  https://github.com/openai/codex/pull/12052. `zsh_exec_bridge` relied on
  UNIX domain sockets, which is not as tamper-proof as the FD-based
  approach in `codex-shell-escalation`.
  
  ## What Changed
  
  - Added a Unix zsh-fork runtime adapter in `core`
  (`core/src/tools/runtimes/shell/unix_escalation.rs`) that:
  - runs zsh-fork commands through
  `codex_shell_escalation::run_escalate_server`
    - bridges exec-policy / approval decisions into `ShellActionProvider`
  - executes escalated commands via a `ShellCommandExecutor` that calls
  `process_exec_tool_call`
  - Updated `ShellRuntime` / `ShellCommandHandler` / tool spec wiring to
  select a `shell_command` backend (`classic` vs `zsh-fork`) while leaving
  the generic `shell` tool path unchanged.
  - Removed the `zsh_exec_bridge`-based session service and deleted
  `core/src/zsh_exec_bridge/mod.rs`.
  - Moved exec-wrapper entrypoint dispatch to `arg0` by handling the
  `codex-execve-wrapper` arg0 alias there, and removed the old
  `codex_core::maybe_run_zsh_exec_wrapper_mode()` hooks from `cli` and
  `app-server` mains.
  - Added the needed `codex-shell-escalation` dependencies for `core` and
  `arg0`.
  
  ## Tests
  
  - `cargo test -p codex-core
  shell_zsh_fork_prefers_shell_command_over_unified_exec`
  - `cargo test -p codex-app-server turn_start_shell_zsh_fork --
  --nocapture`
  - verifies zsh-fork command execution and approval flows through the new
  backend
  - includes subcommand approve/decline coverage using the shared zsh
  DotSlash fixture in `app-server/tests/suite/zsh`
  - To test manually, I added the following to `~/.codex/config.toml`:
  
  ```toml
  zsh_path = "/Users/mbolin/code/codex3/codex-rs/app-server/tests/suite/zsh"
  
  [features]
  shell_zsh_fork = true
  ```
  
  Then I ran `just c` to run the dev build of Codex with these changes and
  sent it the message:
  
  ```
  run `echo $0`
  ```
  
  And it replied with:
  
  ```
    echo $0 printed:
  
    /Users/mbolin/code/codex3/codex-rs/app-server/tests/suite/zsh
  
    In this tool context, $0 reflects the script path used to invoke the shell, not just zsh.
  ```
  
  so the tool appears to be wired up correctly.
  
  ## Notes
  
  - The zsh subcommand-decline integration test now uses `rm` under a
  `WorkspaceWrite` sandbox. The previous `/usr/bin/true` scenario is
  auto-allowed by the new `shell-escalation` policy path, which no longer
  produces subcommand approval prompts.

  Michael Bolin · 2026-02-24 10:31:08 -08:00
  3ca0e7673b
• feat(network-proxy): add MITM support and gate limited-mode CONNECT (#9859)

  ## Description
  - Adds MITM support (CA load/issue, TLS termination, optional body
  inspection).
  - Adds `codex-network-proxy init` to create
  `CODEX_HOME/network_proxy/mitm`.
  - Enforces limited-mode HTTPS correctly: `CONNECT` requires MITM,
  otherwise blocked with `mitm_required`.
  - Keeps `origin/main` layering/reload semantics (managed layers included
  in reload checks).
  - Centralizes block reasons (`REASON_MITM_REQUIRED`) and removes
  `println!`.
  - Scope is MITM-only (no SOCKS changes).
  
  gated by `mitm=false` (default)

  viyatb-oai · 2026-02-24 18:15:15 +00:00
  8d3d58f992
• chore: rm hardcoded PRESETS list (#12650)

  rm `PRESETS` list harcoded in `model_presets` as we now have bundled
  `models.json` with equivalent info.
  
  update logic to rely on bundled models instead, update tests.

  sayan-oai · 2026-02-23 22:35:51 -08:00
  7e46e5b9c2
• refactor: decouple shell-escalation from codex-core (#12638)

  ## Why
  
  After removing `exec-server`, the next step is to wire a new shell tool
  to `codex-rs/shell-escalation` directly.
  
  That is blocked while `codex-shell-escalation` depends on `codex-core`,
  because the new integration would require `codex-core` to depend on
  `codex-shell-escalation` and create a dependency cycle.
  
  This change ports the reusable pieces from the earlier prep work, but
  drops the old compatibility shim because `exec-server`/MCP support is
  already gone.
  
  ## What Changed
  
  ### Decouple `shell-escalation` from `codex-core`
  
  - Introduce a crate-local `SandboxState` in `shell-escalation`
  - Introduce a `ShellCommandExecutor` trait so callers provide process
  execution/sandbox integration
  - Update `EscalateServer::exec(...)` and `run_escalate_server(...)` to
  use the injected executor
  - Remove the direct `codex_core::exec::process_exec_tool_call(...)` call
  from `shell-escalation`
  - Remove the `codex-core` dependency from `codex-shell-escalation`
  
  ### Restore reusable policy adapter exports
  
  - Re-enable `unix::core_shell_escalation`
  - Export `ShellActionProvider` and `ShellPolicyFactory` from
  `shell-escalation`
  - Keep the crate root API simple (no `legacy_api` compatibility layer)
  
  ### Port socket fixes from the earlier prep commit
  
  - Use `socket2::Socket::pair_raw(...)` for AF_UNIX socketpairs and
  restore `CLOEXEC` explicitly on both endpoints
  - Keep `CLOEXEC` cleared only on the single datagram client FD that is
  intentionally passed across `exec`
  - Clean up `tokio::AsyncFd::try_io(...)` error handling in the socket
  helpers
  
  ## Verification
  
  - `cargo shear`
  - `cargo clippy -p codex-shell-escalation --tests`
  - `cargo test -p codex-shell-escalation`

  Michael Bolin · 2026-02-23 20:58:24 -08:00
  af215eb390
• refactor: delete exec-server and move execve wrapper into shell-escalation (#12632)

  ## Why
  
  We already plan to remove the shell-tool MCP path, and doing that
  cleanup first makes the follow-on `shell-escalation` work much simpler.
  
  This change removes the last remaining reason to keep
  `codex-rs/exec-server` around by moving the `codex-execve-wrapper`
  binary and shared shell test fixtures to the crates/tests that now own
  that functionality.
  
  ## What Changed
  
  ### Delete `codex-rs/exec-server`
  
  - Remove the `exec-server` crate, including the MCP server binary,
  MCP-specific modules, and its test support/test suite
  - Remove `exec-server` from the `codex-rs` workspace and update
  `Cargo.lock`
  
  ### Move `codex-execve-wrapper` into `codex-rs/shell-escalation`
  
  - Move the wrapper implementation into `shell-escalation`
  (`src/unix/execve_wrapper.rs`)
  - Add the `codex-execve-wrapper` binary entrypoint under
  `shell-escalation/src/bin/`
  - Update `shell-escalation` exports/module layout so the wrapper
  entrypoint is hosted there
  - Move the wrapper README content from `exec-server` to
  `shell-escalation/README.md`
  
  ### Move shared shell test fixtures to `app-server`
  
  - Move the DotSlash `bash`/`zsh` test fixtures from
  `exec-server/tests/suite/` to `app-server/tests/suite/`
  - Update `app-server` zsh-fork tests to reference the new fixture paths
  
  ### Keep `shell-tool-mcp` as a shell-assets package
  
  - Update `.github/workflows/shell-tool-mcp.yml` packaging so the npm
  artifact contains only patched Bash/Zsh payloads (no Rust binaries)
  - Update `shell-tool-mcp/package.json`, `shell-tool-mcp/src/index.ts`,
  and docs to reflect the shell-assets-only package shape
  - `shell-tool-mcp-ci.yml` does not need changes because it is already
  JS-only
  
  ## Verification
  
  - `cargo shear`
  - `cargo clippy -p codex-shell-escalation --tests`
  - `just clippy`

  Michael Bolin · 2026-02-23 20:10:22 -08:00
  38f84b6b29
• voice transcription (#3381)

  Adds voice transcription on press-and-hold of spacebar.
  
  
  https://github.com/user-attachments/assets/85039314-26f3-46d1-a83b-8c4a4a1ecc21
  
  ---------
  
  Co-authored-by: Codex <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>
  Co-authored-by: David Zbarsky <zbarsky@openai.com>

  Jeremy Rose · 2026-02-23 22:15:18 +00:00
  855e275591
• chore(deps): bump owo-colors from 4.2.3 to 4.3.0 in /codex-rs (#12530)

  Bumps [owo-colors](https://github.com/owo-colors/owo-colors) from 4.2.3
  to 4.3.0.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/owo-colors/owo-colors/releases">owo-colors's
  releases</a>.</em></p>
  <blockquote>
  <h2>owo-colors 4.3.0</h2>
  <h3>Fixed</h3>
  <ul>
  <li>Scripts in the <code>scripts/</code> directory are no longer
  published in the crate package. Thanks <a
  href="https://redirect.github.com/owo-colors/owo-colors/pull/152">weiznich</a>
  for your first contribution!</li>
  </ul>
  <h3>Changed</h3>
  <ul>
  <li>
  <p>Mark methods with
  <code>#[rust_analyzer::completions(ignore_flyimport)]</code> and the
  <code>OwoColorize</code> trait with
  <code>#[rust_analyzer::completions(ignore_flyimport_methods)]</code>.
  This prevents owo-colors methods from being completed with rust-analyzer
  unless the <code>OwoColorize</code> trait is included.</p>
  <p>Unfortunately, this also breaks explicit autocomplete commands such
  as Ctrl-Space in many editors. (The language server protocol doesn't
  appear to have a way to differentiate between implicit and explicit
  autocomplete commands.) On balance we believe this is the right
  approach, but please do provide feedback on [PR <a
  href="https://redirect.github.com/owo-colors/owo-colors/issues/141">#141</a>](<a
  href="https://redirect.github.com/owo-colors/owo-colors/pull/141">owo-colors/owo-colors#141</a>)
  if it negatively affects you.</p>
  </li>
  <li>
  <p>Updated MSRV to Rust 1.81.</p>
  </li>
  </ul>
  </blockquote>
  </details>
  <details>
  <summary>Changelog</summary>
  <p><em>Sourced from <a
  href="https://github.com/owo-colors/owo-colors/blob/main/CHANGELOG.md">owo-colors's
  changelog</a>.</em></p>
  <blockquote>
  <h2>[4.3.0] - 2026-02-22</h2>
  <h3>Fixed</h3>
  <ul>
  <li>Scripts in the <code>scripts/</code> directory are no longer
  published in the crate package. Thanks <a
  href="https://redirect.github.com/owo-colors/owo-colors/pull/152">weiznich</a>
  for your first contribution!</li>
  </ul>
  <h3>Changed</h3>
  <ul>
  <li>
  <p>Mark methods with
  <code>#[rust_analyzer::completions(ignore_flyimport)]</code> and the
  <code>OwoColorize</code> trait with
  <code>#[rust_analyzer::completions(ignore_flyimport_methods)]</code>.
  This prevents owo-colors methods from being completed with rust-analyzer
  unless the <code>OwoColorize</code> trait is included.</p>
  <p>Unfortunately, this also breaks explicit autocomplete commands such
  as Ctrl-Space in many editors. (The language server protocol doesn't
  appear to have a way to differentiate between implicit and explicit
  autocomplete commands.) On balance we believe this is the right
  approach, but please do provide feedback on [PR <a
  href="https://redirect.github.com/owo-colors/owo-colors/issues/141">#141</a>](<a
  href="https://redirect.github.com/owo-colors/owo-colors/pull/141">owo-colors/owo-colors#141</a>)
  if it negatively affects you.</p>
  </li>
  <li>
  <p>Updated MSRV to Rust 1.81.</p>
  </li>
  </ul>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/owo-colors/owo-colors/commit/baf10f9a74007501379afdc002394a15a787dc59"><code>baf10f9</code></a>
  [owo-colors] version 4.3.0</li>
  <li><a
  href="https://github.com/owo-colors/owo-colors/commit/6abe2026c56ef6eefda30d417462f28f9ea8854d"><code>6abe202</code></a>
  [meta] prepare changelog</li>
  <li><a
  href="https://github.com/owo-colors/owo-colors/commit/ca814470410c819568b381b9b2b3f7a184e7de28"><code>ca81447</code></a>
  [RFC] add ignore_flyimport and ignore_flyimport_methods (<a
  href="https://redirect.github.com/owo-colors/owo-colors/issues/141">#141</a>)</li>
  <li><a
  href="https://github.com/owo-colors/owo-colors/commit/61de72e7f9487a945e8ea59afb9aa1b2046a2bd7"><code>61de72e</code></a>
  Exclude development script from published package (<a
  href="https://redirect.github.com/owo-colors/owo-colors/issues/152">#152</a>)</li>
  <li><a
  href="https://github.com/owo-colors/owo-colors/commit/b2ad6bcd4156207bcbc4c756c0c926e02667a872"><code>b2ad6bc</code></a>
  update MSRV to Rust 1.81 (<a
  href="https://redirect.github.com/owo-colors/owo-colors/issues/156">#156</a>)</li>
  <li>See full diff in <a
  href="https://github.com/owo-colors/owo-colors/compare/v4.2.3...v4.3.0">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=owo-colors&package-manager=cargo&previous-version=4.2.3&new-version=4.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2026-02-23 13:01:15 -08:00
  cd5acf6af7
• chore(deps): bump syn from 2.0.114 to 2.0.117 in /codex-rs (#12529)

  Bumps [syn](https://github.com/dtolnay/syn) from 2.0.114 to 2.0.117.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/dtolnay/syn/releases">syn's
  releases</a>.</em></p>
  <blockquote>
  <h2>2.0.117</h2>
  <ul>
  <li>Fix parsing of <code>self::</code> pattern in first function
  argument (<a
  href="https://redirect.github.com/dtolnay/syn/issues/1970">#1970</a>)</li>
  </ul>
  <h2>2.0.116</h2>
  <ul>
  <li>Optimize parse_fn_arg_or_variadic for less lookahead on erroneous
  receiver (<a
  href="https://redirect.github.com/dtolnay/syn/issues/1968">#1968</a>)</li>
  </ul>
  <h2>2.0.115</h2>
  <ul>
  <li>Enable GenericArgument::Constraint parsing in non-full mode (<a
  href="https://redirect.github.com/dtolnay/syn/issues/1966">#1966</a>)</li>
  </ul>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/dtolnay/syn/commit/7bcb37cdb3399977658c8b52d2441d37e42e48f2"><code>7bcb37c</code></a>
  Release 2.0.117</li>
  <li><a
  href="https://github.com/dtolnay/syn/commit/9c6e7d3b8df7b30909d60395f88a6ca07688e1c1"><code>9c6e7d3</code></a>
  Merge pull request <a
  href="https://redirect.github.com/dtolnay/syn/issues/1970">#1970</a>
  from dtolnay/receiver</li>
  <li><a
  href="https://github.com/dtolnay/syn/commit/019a84847eded0cdb1f7856e0752ba618155cfc9"><code>019a848</code></a>
  Fix self:: pattern in first function argument</li>
  <li><a
  href="https://github.com/dtolnay/syn/commit/23f54f3cf61ddedd5daea4f347eca2d4b84c8abb"><code>23f54f3</code></a>
  Update test suite to nightly-2026-02-18</li>
  <li><a
  href="https://github.com/dtolnay/syn/commit/b99b9a627c46580343398472e7b08a131357a994"><code>b99b9a6</code></a>
  Unpin CI miri toolchain</li>
  <li><a
  href="https://github.com/dtolnay/syn/commit/a62e54a48b3b05add5df0e80fe93906509ad72ae"><code>a62e54a</code></a>
  Release 2.0.116</li>
  <li><a
  href="https://github.com/dtolnay/syn/commit/5a8ed9f32e572f35a952c05f25beb3bd976300a4"><code>5a8ed9f</code></a>
  Merge pull request <a
  href="https://redirect.github.com/dtolnay/syn/issues/1968">#1968</a>
  from dtolnay/receiver</li>
  <li><a
  href="https://github.com/dtolnay/syn/commit/813afcc7733b02a8ad0a829eef431e593a906379"><code>813afcc</code></a>
  Optimize parse_fn_arg_or_variadic for less lookahead on erroneous
  receiver</li>
  <li><a
  href="https://github.com/dtolnay/syn/commit/c17215011363b8e936b98a9053726abfbc2bdcc4"><code>c172150</code></a>
  Add regression test for issue 1718</li>
  <li><a
  href="https://github.com/dtolnay/syn/commit/0071ab367ca6c42f94209f8187de3e540231427f"><code>0071ab3</code></a>
  Ignore type_complexity clippy lint</li>
  <li>Additional commits viewable in <a
  href="https://github.com/dtolnay/syn/compare/2.0.114...2.0.117">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=syn&package-manager=cargo&previous-version=2.0.114&new-version=2.0.117)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2026-02-23 10:25:05 -08:00
  fec517cd38
• chore(deps): bump libc from 0.2.180 to 0.2.182 in /codex-rs (#12528)

  Bumps [libc](https://github.com/rust-lang/libc) from 0.2.180 to 0.2.182.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/rust-lang/libc/releases">libc's
  releases</a>.</em></p>
  <blockquote>
  <h2>0.2.182</h2>
  <h3>Added</h3>
  <ul>
  <li>Android, Linux: Add <code>tgkill</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4970">#4970</a>)</li>
  <li>Redox: Add <code>RENAME_NOREPLACE</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4968">#4968</a>)</li>
  <li>Redox: Add <code>renameat2</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4968">#4968</a>)</li>
  </ul>
  <h2>0.2.181</h2>
  <h3>Added</h3>
  <ul>
  <li>Apple: Add <code>MADV_ZERO</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4924">#4924</a>)</li>
  <li>Redox: Add <code>makedev</code>, <code>major</code>, and
  <code>minor</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4928">#4928</a>)</li>
  <li>GLibc: Add <code>PTRACE_SET_SYSCALL_INFO</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4933">#4933</a>)</li>
  <li>OpenBSD: Add more kqueue related constants for (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4945">#4945</a>)</li>
  <li>Linux: add CAN error types (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4944">#4944</a>)</li>
  <li>OpenBSD: Add siginfo_t::si_status (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4946">#4946</a>)</li>
  <li>QNX NTO: Add <code>max_align_t</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4927">#4927</a>)</li>
  <li>Illumos: Add <code>_CS_PATH</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4956">#4956</a>)</li>
  <li>OpenBSD: add <code>ppoll</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4957">#4957</a>)</li>
  </ul>
  <h3>Fixed</h3>
  <ul>
  <li><strong>Breaking</strong>: Redox: Fix the type of <code>dev_t</code>
  (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4928">#4928</a>)</li>
  <li>AIX: Change 'tv_nsec' of 'struct timespec' to type 'c_long' (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4931">#4931</a>)</li>
  <li>AIX: Use 'struct st_timespec' in 'struct stat{,64}' (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4931">#4931</a>)</li>
  <li>Glibc: Link old version of <code>tc{g,s}etattr</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4938">#4938</a>)</li>
  <li>Glibc: Link the correct version of <code>cf{g,s}et{i,o}speed</code>
  on mips{32,64}r6 (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4938">#4938</a>)</li>
  <li>OpenBSD: Fix constness of tm.tm_zone (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4948">#4948</a>)</li>
  <li>OpenBSD: Fix the definition of <code>ptrace_thread_state</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4947">#4947</a>)</li>
  <li>QuRT: Fix type visibility and defs (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4932">#4932</a>)</li>
  <li>Redox: Fix values for <code>PTHREAD_MUTEX_{NORMAL, RECURSIVE}</code>
  (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4943">#4943</a>)</li>
  <li>Various: Mark additional fields as private padding (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4922">#4922</a>)</li>
  </ul>
  <h3>Changed</h3>
  <ul>
  <li>Fuchsia: Update <code>SO_*</code> constants (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4937">#4937</a>)</li>
  <li>Revert &quot;musl: convert inline timespecs to timespec&quot;
  (resolves build issues on targets only supported by Musl 1.2.3+ ) (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4958">#4958</a>)</li>
  </ul>
  </blockquote>
  </details>
  <details>
  <summary>Changelog</summary>
  <p><em>Sourced from <a
  href="https://github.com/rust-lang/libc/blob/0.2.182/CHANGELOG.md">libc's
  changelog</a>.</em></p>
  <blockquote>
  <h2><a
  href="https://github.com/rust-lang/libc/compare/0.2.181...0.2.182">0.2.182</a>
  - 2026-02-13</h2>
  <h3>Added</h3>
  <ul>
  <li>Android, Linux: Add <code>tgkill</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4970">#4970</a>)</li>
  <li>Redox: Add <code>RENAME_NOREPLACE</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4968">#4968</a>)</li>
  <li>Redox: Add <code>renameat2</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4968">#4968</a>)</li>
  </ul>
  <h2><a
  href="https://github.com/rust-lang/libc/compare/0.2.180...0.2.181">0.2.181</a>
  - 2026-02-09</h2>
  <h3>Added</h3>
  <ul>
  <li>Apple: Add <code>MADV_ZERO</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4924">#4924</a>)</li>
  <li>Redox: Add <code>makedev</code>, <code>major</code>, and
  <code>minor</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4928">#4928</a>)</li>
  <li>GLibc: Add <code>PTRACE_SET_SYSCALL_INFO</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4933">#4933</a>)</li>
  <li>OpenBSD: Add more kqueue related constants for (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4945">#4945</a>)</li>
  <li>Linux: add CAN error types (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4944">#4944</a>)</li>
  <li>OpenBSD: Add siginfo_t::si_status (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4946">#4946</a>)</li>
  <li>QNX NTO: Add <code>max_align_t</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4927">#4927</a>)</li>
  <li>Illumos: Add <code>_CS_PATH</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4956">#4956</a>)</li>
  <li>OpenBSD: add <code>ppoll</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4957">#4957</a>)</li>
  </ul>
  <h3>Fixed</h3>
  <ul>
  <li><strong>breaking</strong>: Redox: Fix the type of dev_t (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4928">#4928</a>)</li>
  <li>AIX: Change 'tv_nsec' of 'struct timespec' to type 'c_long' (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4931">#4931</a>)</li>
  <li>AIX: Use 'struct st_timespec' in 'struct stat{,64}' (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4931">#4931</a>)</li>
  <li>Glibc: Link old version of <code>tc{g,s}etattr</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4938">#4938</a>)</li>
  <li>Glibc: Link the correct version of <code>cf{g,s}et{i,o}speed</code>
  on mips{32,64}r6 (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4938">#4938</a>)</li>
  <li>OpenBSD: Fix constness of tm.tm_zone (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4948">#4948</a>)</li>
  <li>OpenBSD: Fix the definition of <code>ptrace_thread_state</code> (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4947">#4947</a>)</li>
  <li>QuRT: Fix type visibility and defs (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4932">#4932</a>)</li>
  <li>Redox: Fix values for <code>PTHREAD_MUTEX_{NORMAL, RECURSIVE}</code>
  (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4943">#4943</a>)</li>
  <li>Various: Mark additional fields as private padding (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4922">#4922</a>)</li>
  </ul>
  <h3>Changed</h3>
  <ul>
  <li>Fuchsia: Update <code>SO_*</code> constants (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4937">#4937</a>)</li>
  <li>Revert &quot;musl: convert inline timespecs to timespec&quot;
  (resolves build issues on targets only supported by Musl 1.2.3+ ) (<a
  href="https://redirect.github.com/rust-lang/libc/pull/4958">#4958</a>)</li>
  </ul>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/rust-lang/libc/commit/e879ee90b6cd8f79b352d4d4d1f8ca05f94f2f53"><code>e879ee9</code></a>
  chore: Release libc 0.2.182</li>
  <li><a
  href="https://github.com/rust-lang/libc/commit/2efe72f4dae6feebacaf5ec8a4ec5fdc79569e7b"><code>2efe72f</code></a>
  remove copyright year in LICENSE-MIT</li>
  <li><a
  href="https://github.com/rust-lang/libc/commit/634bc4e66e944d54ebc3d1610175c8c6d390bd29"><code>634bc4e</code></a>
  ci: Update the list of tested and documented targets</li>
  <li><a
  href="https://github.com/rust-lang/libc/commit/d7aa109ab5074dbbd35fb52cc72620e29961e76d"><code>d7aa109</code></a>
  Revert &quot;Disable hexagon-unknown-linux-musl testing for
  now&quot;</li>
  <li><a
  href="https://github.com/rust-lang/libc/commit/14e2f5641e2d4356953b0c95959ccfc86af5dcc3"><code>14e2f56</code></a>
  Revert &quot;ci: Skip hexagon-unknown-linux-musl&quot;</li>
  <li><a
  href="https://github.com/rust-lang/libc/commit/b7807c369b468c369661e81ea6f9f649f3b3ddf3"><code>b7807c3</code></a>
  Revert &quot;aix: Temporarily skip checking powerpc64-ibm-aix
  builds&quot;</li>
  <li><a
  href="https://github.com/rust-lang/libc/commit/abe93a0bfedfe6159252d43e5c4273d0b0833ca4"><code>abe93a0</code></a>
  feat(linux): add <code>tgkill</code> for Linux and Android</li>
  <li><a
  href="https://github.com/rust-lang/libc/commit/25f7dde943988c81871d95aaea1afd49cf11425d"><code>25f7dde</code></a>
  feat(redox): add <code>RENAME_NOREPLACE</code></li>
  <li><a
  href="https://github.com/rust-lang/libc/commit/4b4ce4f2205d22121c5e913b118f8fc776d39897"><code>4b4ce4f</code></a>
  feat(redox): add <code>renameat2</code></li>
  <li><a
  href="https://github.com/rust-lang/libc/commit/ab8c36c49327eeee2b5c3818d6706b499dd890a4"><code>ab8c36c</code></a>
  build(deps): bump vmactions/solaris-vm from 1.2.8 to 1.3.0</li>
  <li>Additional commits viewable in <a
  href="https://github.com/rust-lang/libc/compare/0.2.180...0.2.182">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=libc&package-manager=cargo&previous-version=0.2.180&new-version=0.2.182)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2026-02-23 10:24:35 -08:00
  5c52ef8e60
• refactor: normalize unix module layout for exec-server and shell-escalation (#12556)

  ## Why
  Shell execution refactoring in `exec-server` had become split between
  duplicated code paths, which blocked a clean introduction of the new
  reusable shell escalation flow. This commit creates a dedicated
  foundation crate so later shell tooling changes can share one
  implementation.
  
  ## What changed
  - Added the `codex-shell-escalation` crate and moved the core escalation
  pieces (`mcp` protocol/socket/session flow, policy glue) that were
  previously in `exec-server` into it.
  - Normalized `exec-server` Unix structure under a dedicated `unix`
  module layout and kept non-Unix builds narrow.
  - Wired crate/build metadata so `shell-escalation` is a first-class
  workspace dependency for follow-on integration work.
  
  ## Verification
  - Built and linted the stack at this commit point with `just clippy`.
  
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/12556).
  * #12584
  * #12583
  * __->__ #12556

  Michael Bolin · 2026-02-23 09:28:17 -08:00
  5221575f23
• feat: add uuid helper (#12500)
  jif-oai · 2026-02-23 14:14:36 +00:00
  764ac9449f
• test: vendor zsh fork via DotSlash and stabilize zsh-fork tests (#12518)

  ## Why
  
  The zsh integration tests were still brittle in two ways:
  
  - they relied on `CODEX_TEST_ZSH_PATH` / environment-specific setup, so
  they often did not exercise the patched zsh fork that `shell-tool-mcp`
  ships
  - once the tests consistently used the vendored zsh fork, they exposed
  real Linux-specific zsh-fork issues in CI
  
  In particular, the Linux failures were not just test noise:
  
  - the zsh-fork launch path was dropping `ExecRequest.arg0`, so Linux
  `codex-linux-sandbox` arg0 dispatch did not run and zsh wrapper-mode
  could receive malformed arguments
  - the
  `turn_start_shell_zsh_fork_subcommand_decline_marks_parent_declined_v2`
  test uses the zsh exec bridge (which talks to the parent over a Unix
  socket), but Linux restricted sandbox seccomp denies `connect(2)`,
  causing timeouts on `ubuntu-24.04` x86/arm
  
  This PR makes the zsh tests consistently run against the intended
  vendored zsh fork and fixes/hardens the zsh-fork path so the Linux CI
  signal is meaningful.
  
  ## What Changed
  
  - Added a single shared test-only DotSlash file for the patched zsh fork
  at `codex-rs/exec-server/tests/suite/zsh` (analogous to the existing
  `bash` test resource).
  - Updated both app-server and exec-server zsh tests to use that shared
  DotSlash zsh (no duplicate zsh DotSlash file, no `CODEX_TEST_ZSH_PATH`
  dependency).
  - Updated the app-server zsh-fork test helper to resolve the shared
  DotSlash zsh and avoid silently falling back to host zsh.
  - Kept the app-server zsh-fork tests configured via `config.toml`, using
  a test wrapper path where needed to force `zsh -df` (and rewrite `-lc`
  to `-c`) for the subcommand-decline test.
  - Hardened the app-server subcommand-decline zsh-fork test for CI
  variability:
    - tolerate an extra `/responses` POST with a no-op mock response
  - tolerate non-target approval ordering while remaining strict on the
  two `/usr/bin/true` approvals and decline behavior
  - use `DangerFullAccess` on Linux for this one test because it validates
  zsh approval flow, not Linux sandbox socket restrictions
  - Fixed zsh-fork process launching on Linux by preserving `req.arg0` in
  `ZshExecBridge::execute_shell_request(...)` so `codex-linux-sandbox`
  arg0 dispatch continues to work.
  - Moved `maybe_run_zsh_exec_wrapper_mode()` under
  `arg0_dispatch_or_else(...)` in `app-server` and `cli` so wrapper-mode
  handling coexists correctly with arg0-dispatched helper modes.
  - Consolidated duplicated `dotslash -- fetch` resolution logic into
  shared test support (`core/tests/common/lib.rs`).
  - Updated `codex-rs/exec-server/tests/suite/accept_elicitation.rs` to
  use DotSlash zsh and hardened the zsh elicitation test for Bazel/zsh
  differences by:
    - resolving an absolute `git` path
    - running `git init --quiet .`
  - asserting success / `.git` creation instead of relying on banner text
  
  ## Verification
  
  - `cargo test -p codex-app-server turn_start_zsh_fork -- --nocapture`
  - `cargo test -p codex-exec-server accept_elicitation -- --nocapture`
  - `bazel test //codex-rs/exec-server:exec-server-all-test
  --test_output=streamed --test_arg=--nocapture
  --test_arg=accept_elicitation_for_prompt_rule_with_zsh`
  - CI (`rust-ci`) on the final cleaned commit: `Tests — ubuntu-24.04 -
  x86_64-unknown-linux-gnu` and `Tests — ubuntu-24.04-arm -
  aarch64-unknown-linux-gnu` passed in [run
  22291424358](https://github.com/openai/codex/actions/runs/22291424358)

  Michael Bolin · 2026-02-22 19:39:56 -08:00
  e8949f4507
• feat(tui): syntax highlighting via syntect with theme picker (#11447)

  ## Summary
  
  Adds syntax highlighting to the TUI for fenced code blocks in markdown
  responses and file diffs, plus a `/theme` command with live preview and
  persistent theme selection. Uses syntect (~250 grammars, 32 bundled
  themes, ~1 MB binary cost) — the same engine behind `bat`, `delta`, and
  `xi-editor`. Includes guardrails for large inputs, graceful fallback to
  plain text, and SSH-aware clipboard integration for the `/copy` command.
  
  <img width="1554" height="1014" alt="image"
  src="https://github.com/user-attachments/assets/38737a79-8717-4715-b857-94cf1ba59b85"
  />
  
  <img width="2354" height="1374" alt="image"
  src="https://github.com/user-attachments/assets/25d30a00-c487-4af8-9cb6-63b0695a4be7"
  />
  
  ## Problem
  
  Code blocks in the TUI (markdown responses and file diffs) render
  without syntax highlighting, making it hard to scan code at a glance.
  Users also have no way to pick a color theme that matches their terminal
  aesthetic.
  
  ## Mental model
  
  The highlighting system has three layers:
  
  1. **Syntax engine** (`render::highlight`) -- a thin wrapper around
  syntect + two-face. It owns a process-global `SyntaxSet` (~250 grammars)
  and a `RwLock<Theme>` that can be swapped at runtime. All public entry
  points accept `(code, lang)` and return ratatui `Span`/`Line` vectors or
  `None` when the language is unrecognized or the input exceeds safety
  guardrails.
  
  2. **Rendering consumers** -- `markdown_render` feeds fenced code blocks
  through the engine; `diff_render` highlights Add/Delete content as a
  whole file and Update hunks per-hunk (preserving parser state across
  hunk lines). Both callers fall back to plain unstyled text when the
  engine returns `None`.
  
  3. **Theme lifecycle** -- at startup the config's `tui.theme` is
  resolved to a syntect `Theme` via `set_theme_override`. At runtime the
  `/theme` picker calls `set_syntax_theme` to swap themes live; on cancel
  it restores the snapshot taken at open. On confirm it persists `[tui]
  theme = "..."` to config.toml.
  
  ## Non-goals
  
  - Inline diff highlighting (word-level change detection within a line).
  - Semantic / LSP-backed highlighting.
  - Theme authoring tooling; users supply standard `.tmTheme` files.
  
  ## Tradeoffs
  
  | Decision | Upside | Downside |
  | ------------------------------------------------ |
  ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
  |
  -----------------------------------------------------------------------------------------------------------------------
  |
  | syntect over tree-sitter / arborium | ~1 MB binary increase for ~250
  grammars + 32 themes; battle-tested crate powering widely-used tools
  (`bat`, `delta`, `xi-editor`). tree-sitter would add ~12 MB for 20-30
  languages or ~35 MB for full coverage. | Regex-based; less structurally
  accurate than tree-sitter for some languages (e.g. language injections
  like JS-in-HTML). |
  | Global `RwLock<Theme>` | Enables live `/theme` preview without
  threading Theme through every call site | Lock contention risk
  (mitigated: reads vastly outnumber writes, single UI thread) |
  | Skip background / italic / underline from themes | Terminal BG
  preserved, avoids ugly rendering on some themes | Themes that rely on
  these properties lose fidelity |
  | Guardrails: 512 KB / 10k lines | Prevents pathological stalls on huge
  diffs or pastes | Very large files render without color |
  
  ## Architecture
  
  ```
  config.toml  ─[tui.theme]─>  set_theme_override()  ─>  THEME (RwLock)
                                                                │
                    ┌───────────────────────────────────────────┘
                    │
    markdown_render ─── highlight_code_to_lines(code, lang) ─> Vec<Line>
    diff_render     ─── highlight_code_to_styled_spans(code, lang) ─> Option<Vec<Vec<Span>>>
                    │
                    │   (None ⇒ plain text fallback)
                    │
    /theme picker   ─── set_syntax_theme(theme)    // live preview swap
                    ─── current_syntax_theme()      // snapshot for cancel
                    ─── resolve_theme_by_name(name) // lookup by kebab-case
  ```
  
  Key files:
  
  - `tui/src/render/highlight.rs` -- engine, theme management, guardrails
  - `tui/src/diff_render.rs` -- syntax-aware diff line wrapping
  - `tui/src/theme_picker.rs` -- `/theme` command builder
  - `tui/src/bottom_pane/list_selection_view.rs` -- side content panel,
  callbacks
  - `core/src/config/types.rs` -- `Tui::theme` field
  - `core/src/config/edit.rs` -- `syntax_theme_edit()` helper
  
  ## Observability
  
  - `tracing::warn` when a configured theme name cannot be resolved.
  - `Config::startup_warnings` surfaces the same message as a TUI banner.
  - `tracing::error` when persisting theme selection fails.
  
  ## Tests
  
  - Unit tests in `highlight.rs`: language coverage, fallback behavior,
  CRLF stripping, style conversion, guardrail enforcement, theme name
  mapping exhaustiveness.
  - Unit tests in `diff_render.rs`: snapshot gallery at multiple terminal
  sizes (80x24, 94x35, 120x40), syntax-highlighted wrapping, large-diff
  guardrail, rename-to-different-extension highlighting, parser state
  preservation across hunk lines.
  - Unit tests in `theme_picker.rs`: preview rendering (wide + narrow),
  dim overlay on deletions, subtitle truncation, cancel-restore, fallback
  for unavailable configured theme.
  - Unit tests in `list_selection_view.rs`: side layout geometry, stacked
  fallback, buffer clearing, cancel/selection-changed callbacks.
  - Integration test in `lib.rs`: theme warning uses the final
  (post-resume) config.
  
  ## Cargo Deny: Unmaintained Dependency Exceptions
  
  This PR adds two `cargo deny` advisory exceptions for transitive
  dependencies pulled in by `syntect v5.3.0`:
  
  | Advisory | Crate | Status |
  |----------|-------|--------|
  | RUSTSEC-2024-0320 | `yaml-rust` | Unmaintained (maintainer
  unreachable) |
  | RUSTSEC-2025-0141 | `bincode` | Unmaintained (development ceased;
  v1.3.3 considered complete) |
  
  **Why this is safe in our usage:**
  
  - Neither advisory describes a known security vulnerability. Both are
  "unmaintained" notices only.
  - `bincode` is used by syntect to deserialize pre-compiled syntax sets.
  Again, these are **static vendored artifacts** baked into the binary at
  build time. No user-supplied bincode data is ever deserialized. - Attack
  surface is zero for both crates; exploitation would require a
  supply-chain compromise of our own build artifacts.
  - These exceptions can be removed when syntect migrates to `yaml-rust2`
  and drops `bincode`, or when alternative crates are available upstream.

  Felipe Coury · 2026-02-21 20:26:58 -08:00
  c4f1af7a86