1111 Commits

• fix(tui): rehydrate drafts and restore image placeholders (#9040)

  Fixes #9050
  
  When a draft is stashed with Ctrl+C, we now persist the full draft state
  (text elements, local image paths, and pending paste payloads) in local
  history. Up/Down recall rehydrates placeholder elements and attachments
  so styling remains correct and large pastes still expand on submit.
  Persistent (cross‑session) history remains text‑only.
  
  Backtrack prefills now reuse the selected user message’s text elements
  and local image paths, so image placeholders/attachments rehydrate when
  rolling back.
  
  External editor replacements keep only attachments whose placeholders
  remain and then normalize image placeholders to `[Image #1]..[Image #N]`
  to keep the attachment mapping consistent.
  
  Docs:
  - docs/tui-chat-composer.md
  
  Testing:
  - just fix -p codex-tui
  - cargo test -p codex-tui
  
  Co-authored-by: Eric Traut <etraut@openai.com>

  Chriss4123 · 2026-02-07 20:08:45 -08:00
  d68e9c0f19
• feat: include state of [experimental_network] in /debug-config output (#11039)

  #10958 introduced experimental support for a network config in
  `/etc/codex/requirements.toml`, so this extends `/debug-config` to
  surface this information, if set, which should make it easier to debug.

  Michael Bolin · 2026-02-07 21:38:12 +00:00
  2e89cb9117
• feat(core): add network constraints schema to requirements.toml (#10958)

  ## Summary
  
  Add `requirements.toml` schema support for admin-defined network
  constraints in the requirements layer
  
  example config:
  
  ```
  [experimental_network]
  enabled = true
  allowed_domains = ["api.openai.com"]
  denied_domains = ["example.com"]
  ```

  viyatb-oai · 2026-02-07 19:48:24 +00:00
  739908a12c
• Add resume_agent collab tool (#10903)

  Summary
  - add the new resume_agent collab tool path through core, protocol, and
  the app server API, including the resume events
  - update the schema/TypeScript definitions plus docs so resume_agent
  appears in generated artifacts and README
  - note that resumed agents rehydrate rollout history without overwriting
  their base instructions
  
  Testing
  - Not run (not requested)

  jif-oai · 2026-02-07 17:31:45 +01:00
  62605fa471
• Show left/right arrows to navigate in tui request_user_input (#10921)

  <img width="785" height="185" alt="Screenshot 2026-02-06 at 10 25 13 AM"
  src="https://github.com/user-attachments/assets/402a6e79-4626-4df9-b3da-bc2f28e64611"
  />
  
  <img width="784" height="213" alt="Screenshot 2026-02-06 at 10 26 37 AM"
  src="https://github.com/user-attachments/assets/cf9614b2-aa1e-4c61-8579-1d2c7e1c7dc1"
  />
  
  "left/right to navigate questions" in request_user_input footer

  Charley Cunningham · 2026-02-06 23:41:08 -08:00
  f3f35526a8
• Do not poll for usage when using API Key auth (#10973)

  Fixes #10869
  
  - Gate TUI rate-limit polling on ChatGPT-auth providers only.
  - `prefetch_rate_limits()` now checks `should_prefetch_rate_limits()`.
  - New gate requires:
    - `config.model_provider.requires_openai_auth`
    - cached auth is ChatGPT (`CodexAuth::is_chatgpt_auth`)
  - Prevents `/wham/usage` polling in API/custom-endpoint profiles.

  Eric Traut · 2026-02-06 23:26:44 -08:00
  3779b52e2d
• feat: add support for allowed_web_search_modes in requirements.toml (#10964)

  This PR makes it possible to disable live web search via an enterprise
  config even if the user is running in `--yolo` mode (though cached web
  search will still be available). To do this, create
  `/etc/codex/requirements.toml` as follows:
  
  ```toml
  # "live" is not allowed; "disabled" is allowed even though not listed explicitly.
  allowed_web_search_modes = ["cached"]
  ```
  
  Or set `requirements_toml_base64` MDM as explained on
  https://developers.openai.com/codex/security/#locations.
  
  ### Why
  - Enforce admin/MDM/`requirements.toml` constraints on web-search
  behavior, independent of user config and per-turn sandbox defaults.
  - Ensure per-turn config resolution and review-mode overrides never
  crash when constraints are present.
  
  ### What
  - Add `allowed_web_search_modes` to requirements parsing and surface it
  in app-server v2 `ConfigRequirements` (`allowedWebSearchModes`), with
  fixtures updated.
  - Define a requirements allowlist type (`WebSearchModeRequirement`) and
  normalize semantics:
    - `disabled` is always implicitly allowed (even if not listed).
    - An empty list is treated as `["disabled"]`.
  - Make `Config.web_search_mode` a `Constrained<WebSearchMode>` and apply
  requirements via `ConstrainedWithSource<WebSearchMode>`.
  - Update per-turn resolution (`resolve_web_search_mode_for_turn`) to:
  - Prefer `Live → Cached → Disabled` when
  `SandboxPolicy::DangerFullAccess` is active (subject to requirements),
  unless the user preference is explicitly `Disabled`.
  - Otherwise, honor the user’s preferred mode, falling back to an allowed
  mode when necessary.
  - Update TUI `/debug-config` and app-server mapping to display
  normalized `allowed_web_search_modes` (including implicit `disabled`).
  - Fix web-search integration tests to assert cached behavior under
  `SandboxPolicy::ReadOnly` (since `DangerFullAccess` legitimately prefers
  `live` when allowed).

  Michael Bolin · 2026-02-07 05:55:15 +00:00
  a118494323
• fix(tui): conditionally restore status indicator using message phase (#10947)

  TLDR: use new message phase field emitted by preamble-supported models
  to determine whether an AgentMessage is mid-turn commentary. if so,
  restore the status indicator afterwards to indicate the turn has not
  completed.
  
  ### Problem
  `commit_tick` hides the status indicator while streaming assistant text.
  For preamble-capable models, that text can be commentary mid-turn, so
  hiding was correct during streaming but restore timing mattered:
  - restoring too aggressively caused jitter/flashing
  - not restoring caused indicator to stay hidden before subsequent work
  (tool calls, web search, etc.)
  
  ### Fix
  - Add optional `phase` to `AgentMessageItem` and propagate it from
  `ResponseItem::Message`
  - Keep indicator hidden during streamed commit ticks, restore only when:
    - assistant item completes as `phase=commentary`, and
    - stream queues are idle + task is still running.
  - Treat `phase=None` as final-answer behavior (no restore) to keep
  existing behavior for non-preamble models
  
  ### Tests
  Add/update tests for:
  - no idle-tick restore without commentary completion
  - commentary completion restoring status before tool begin
  - snapshot coverage for preamble/status behavior
  
  ---------
  
  Co-authored-by: Josh McKinney <joshka@openai.com>

  sayan-oai · 2026-02-07 02:39:52 +00:00
  5d2702f6b8
• TUI/Core: preserve duplicate skill/app mention selection across submit + resume (#10855)

  ## What changed
  
  - In `codex-rs/core/src/skills/injection.rs`, we now honor explicit
  `UserInput::Skill { name, path }` first, then fall back to text mentions
  only when safe.
  - In `codex-rs/tui/src/bottom_pane/chat_composer.rs`, mention selection
  is now token-bound (selected mention is tied to the specific inserted
  `$token`), and we snapshot bindings at submit time so selection is not
  lost.
  - In `codex-rs/tui/src/chatwidget.rs` and
  `codex-rs/tui/src/bottom_pane/mod.rs`, submit/queue paths now consume
  the submit-time mention snapshot (instead of rereading cleared composer
  state).
  - In `codex-rs/tui/src/mention_codec.rs` and
  `codex-rs/tui/src/bottom_pane/chat_composer_history.rs`, history now
  round-trips mention targets so resume restores the same selected
  duplicate.
  - In `codex-rs/tui/src/bottom_pane/skill_popup.rs` and
  `codex-rs/tui/src/bottom_pane/chat_composer.rs`, duplicate labels are
  normalized to `[Repo]` / `[App]`, app rows no longer show `Connected -`,
  and description space is a bit wider.
  
  <img width="550" height="163" alt="Screenshot 2026-02-05 at 9 56 56 PM"
  src="https://github.com/user-attachments/assets/346a7eb2-a342-4a49-aec8-68dfec0c7d89"
  />
  <img width="550" height="163" alt="Screenshot 2026-02-05 at 9 57 09 PM"
  src="https://github.com/user-attachments/assets/5e04d9af-cccf-4932-98b3-c37183e445ed"
  />
  
  
  ## Before vs now
  
  - Before: selecting a duplicate could still submit the default/repo
  match, and resume could lose which duplicate was originally selected.
  - Now: the exact selected target (skill path or app id) is preserved
  through submit, queue/restore, and resume.
  
  ## Manual test
  
  1. Build and run this branch locally:
     - `cd /Users/daniels/code/codex/codex-rs`
     - `cargo build -p codex-cli --bin codex`
     - `./target/debug/codex`
  2. Open mention picker with `$` and pick a duplicate entry (not the
  first one).
  3. Confirm duplicate UI:
     - repo duplicate rows show `[Repo]`
     - app duplicate rows show `[App]`
     - app description does **not** start with `Connected -`
  4. Submit the prompt, then press Up to restore draft and submit again.  
     Expected: it keeps the same selected duplicate target.
  5. Use `/resume` to reopen the session and send again.  
  Expected: restored mention still resolves to the same duplicate target.

  daniel-oai · 2026-02-06 15:59:00 -08:00
  84bce2b8e6
• add originator to otel (#10826)
  alexsong-oai · 2026-02-06 15:13:56 -08:00
  daeef06bec
• Queue nudges while plan generating (#10457)

  ## Summary
  
  This PR fixes a UI/streaming race when nudged or steer-enabled messages
  are queued during an active Plan stream.
  
  Previously, `submit_user_message_with_mode` switched collaboration mode
  immediately (via `set_collaboration_mask`) even when the message was
  queued. If that happened mid-Plan stream, `active_mode_kind` could flip
  away from Plan before the turn finished, causing subsequent
  `on_plan_delta` updates to be ignored in the UI.
  
  Now, mode switching is deferred until the queued message is actually
  submitted.
  
  ## What changed
  
  - Added a per-message deferred mode override on `UserMessage`:
    - `collaboration_mode_override: Option<CollaborationModeMask>`
  - Updated `submit_user_message_with_mode` to:
    - create a `UserMessage` carrying the mode override
  - queue or submit that message without mutating global mode immediately
  - Updated `submit_user_message` to:
  - apply `collaboration_mode_override` just before constructing/sending
  `Op::UserTurn`
  - Kept queueing condition scoped to active Plan stream rendering:
  - queue only while plan output is actively streaming in TUI
  (`plan_stream_controller.is_some()`)
  
  ## Why
  
  This preserves Plan mode for the remainder of the in-flight Plan turn,
  so streamed plan deltas continue rendering correctly, while still
  ensuring the follow-up queued message is sent with the intended
  collaboration mode.
  
  ## Behavior after this change
  
  - If a nudged/steer submission happens while Plan output is actively
  streaming:
    - message is queued
    - UI stays in Plan mode for the running turn
  - once dequeued/submitted, mode override is applied and the message is
  sent in the intended mode
  - If no Plan stream is active:
  - submission proceeds immediately and mode override is applied as before
  
  ## Tests
  
  Added/updated coverage in `tui/src/chatwidget/tests.rs`:
  
  - `submit_user_message_with_mode_queues_while_plan_stream_is_active`
    - asserts mode remains Plan while queued
  - asserts mode switches to Code when queued message is actually
  submitted
  - `submit_user_message_with_mode_submits_when_plan_stream_is_not_active`
  - `steer_enter_queues_while_plan_stream_is_active`
  - `steer_enter_submits_when_plan_stream_is_not_active`
  
  Also updated existing `UserMessage { ... }` test fixtures to include the
  new field.
  
  ## Codex author
  `codex fork 019c1047-d5d5-7c92-a357-6009604dc7e8`

  Charley Cunningham · 2026-02-06 09:43:00 -08:00
  b7ecd166a6
• Removed "exec_policy" feature flag (#10851)

  This is no longer needed because it's on by default

  Eric Traut · 2026-02-06 08:59:47 -08:00
  4521a6e852
• Handle required MCP startup failures across components (#10902)

  Summary
  - add a `required` flag for MCP servers everywhere config/CLI data is
  touched so mandatory helpers can be round-tripped
  - have `codex exec` and `codex app-server` thread start/resume fail fast
  when required MCPs fail to initialize

  jif-oai · 2026-02-06 17:14:37 +01:00
  aab61934af
• Personality setting is no longer available in experimental menu (#10852)

  This PR removes the inaccurate "Disable in /experimental." statement now
  that the "personality" feature flag is no longer experimental.
  
  This addresses #10850

  Eric Traut · 2026-02-05 22:19:09 -08:00
  f61226d32a
• Gate app tooltips to macOS (#10784)

  - Gate app promo tips to macOS and use non-app copy elsewhere.

  Ahmed Ibrahim · 2026-02-05 19:18:08 -08:00
  048e0f3888
• feat: expose detailed metrics to runtime metrics (#10699)
  Anton Panasenko · 2026-02-05 18:22:30 -08:00
  4ee039744e
• updates: use brew api for version check (#10809)

  ## Problem
  
  `codex` currently prompts you to update via `brew upgrade --cask codex`
  but the brew api does not return the new version
  
  > <img width="1500" height="822" alt="Screenshot 2026-02-05 at 12 36
  09 PM"
  src="https://github.com/user-attachments/assets/9e12929d-95e8-43f4-8fba-ab93f5f76e73"
  />
  
  ## Solution
  
  `codex-rs/tui/src/updates.rs` was using the [latest cask in
  github](https://github.com/Homebrew/homebrew-cask/blob/HEAD/Casks/c/codex.rb)
  but this does not agree with the brew api, which leads to the issue
  above. Instead we use the [brew api json
  endpoint](https://github.com/Homebrew/homebrew-cask/blob/HEAD/Casks/c/codex.rb)
  to ensure our version check agrees with the upgrade command.

  Noah Jorgensen · 2026-02-05 15:12:27 -08:00
  dcea972db8
• Add analytics for /rename and /fork (#10655)
  pap-openai · 2026-02-05 20:18:29 +00:00
  529b539564
• fix: announcement in prio (#10783)
  jif-oai · 2026-02-05 19:57:57 +00:00
  ddd09a9368
• fix(auth): isolate chatgptAuthTokens concept to auth manager and app-server (#10423)

  So that the rest of the codebase (like TUI) don't need to be concerned
  whether ChatGPT auth was handled by Codex itself or passed in via
  app-server's external auth mode.

  Owen Lin · 2026-02-05 10:46:06 -08:00
  3582b74d01
• fix(tui): fix resume_picker_orders_by_updated_at test (#10769)

  I think this was due to https://github.com/openai/codex/issues/10752
  landing and not rebased on top of
  9ee746afd6

  Owen Lin · 2026-02-05 18:03:10 +00:00
  5c0fd62ff1
• feat(tui): add sortable resume picker with created/updated timestamp toggle (#10752)

  ## Summary
  
  - Add sorting support to the resume session picker with Tab key toggle
  - Sessions can now be sorted by either creation time or last updated
  time
  - Display the current sort mode in the picker header
  - Default to sorting by creation time (most recent first)
  
  ## Changes
  
  - Add `sort_key` field to `PickerState` to track current sort order
  - Pass sort key to `RolloutRecorder::list_threads()` for proper backend
  sorting
  - Add Tab key handler to toggle between `CreatedAt` and `UpdatedAt`
  sorting
  - Show current sort mode ("Created at" / "Updated at") in header
  - Add "Tab to toggle sort" keyboard hint
  - Intelligently hide secondary date column when terminal is narrow
  - Reload session list when sort order changes
  
  ## Test plan
  
  - [x] Unit tests for sort key toggle functionality
  - [x] Snapshot tests updated for new header format
  - [x] Test that Tab key triggers reload with new sort key
  - [x] Test column visibility adapts to narrow terminals

  Felipe Coury · 2026-02-05 09:08:31 -08:00
  22545bf206
• feat(tui): add /statusline command for interactive status line configuration (#10546)

  ## Summary
  - Adds a new `/statusline` command to configure TUI footer status line
  - Introduces reusable `MultiSelectPicker` component with keyboard
  navigation, optional ordering and toggle support
  - Implement status line setup modal that persist configuration to
  config.toml
  
    ## Status Line Items
    The following items can be displayed in the status line:
    - **Model**: Current model name (with optional reasoning level)
    - **Context**: Remaining/used context window percentage
    - **Rate Limits**: 5-day and weekly usage limits
    - **Git**: Current branch (with optimized lookups)
    - **Tokens**: Used tokens, input/output token counts
    - **Session**: Session ID (full or shortened prefix)
    - **Paths**: Current directory, project root
    - **Version**: Codex version
  
    ## Features
    - Live preview while configuring status line items
    - Fuzzy search filtering in the picker
    - Intelligent truncation when items don't fit
    - Items gracefully omit when data is unavailable
    - Configuration persists to `config.toml`
    - Validates and warns about invalid status line items
  
    ## Test plan
    - [x] Run `/statusline` and verify picker UI appears
    - [x] Toggle items on/off and verify live preview updates
    - [x] Confirm selection persists after restart
    - [x] Verify truncation behavior with many items selected
    - [x] Test git branch detection in and out of git repos
  
  ---------
  
  Co-authored-by: Josh McKinney <joshka@openai.com>

  Felipe Coury · 2026-02-05 08:50:21 -08:00
  b0e5a6305b
• Leverage state DB metadata for thread summaries (#10621)

  Summary:
  - read conversation summaries and cwd info from the state DB when
  possible so we no longer rely on rollout files for metadata and avoid
  extra I/O
  - persist CLI version in thread metadata, surface it through summary
  builders, and add the necessary DB migration hooks
  - simplify thread listing by using enriched state DB data directly
  rather than reading rollout heads
  
  Testing:
  - Not run (not requested)

  jif-oai · 2026-02-05 16:39:11 +00:00
  9ee746afd6
• chore: handle shutdown correctly in tui (#10756)
  jif-oai · 2026-02-05 16:07:50 +00:00
  fe1cbd0f38
• adding fork information (UI) when forking (#10246)

  - shows `/fork` command that ran in prev session
  - shows `session forked from name (uuid) || uuid (if name is not set)` as an event in new session

  pap-openai · 2026-02-05 13:24:55 +00:00
  b2424cb635
• fix(tui): flush input buffer on init to prevent early exit on Windows (#10729)

  Fixes #10661.
  
  ### Problem
  On Windows, the sign-in menu can exit immediately if the OS-level input
  buffer contains trailing characters (like the Enter key from running the
  command).
  
  ### Solution
  **Flush Input Buffer on Init**: Use FlushConsoleInputBuffer on Windows
  (and cflush on Unix) in ui::init() to discard any input captured before
  the TUI was ready.
  
  Verified by @CodebyAmbrose in #10661.

  Ashutosh Kumar Singh · 2026-02-05 00:59:32 -08:00
  7b28b350e1
• Reload cloud requirements after user login (#10725)

  Reload cloud requirements after user login so it could take effect
  immediately.

  xl-openai · 2026-02-05 00:27:16 -08:00
  1e1146cd29
• Sync collaboration mode naming across Default prompt, tools, and TUI (#10666)

  ## Summary
  - add shared `ModeKind` helpers for display names, TUI visibility, and
  `request_user_input` availability
  - derive TUI mode filtering/labels from shared `ModeKind` metadata
  instead of local hardcoded matches
  - derive `request_user_input` availability text and unavailable error
  mode names from shared mode metadata
  - replace hardcoded known mode names in the Default collaboration-mode
  template with `{{KNOWN_MODE_NAMES}}` and fill it from
  `TUI_VISIBLE_COLLABORATION_MODES`
  - add regression tests for mode metadata sync and placeholder
  replacement
  
  ## Notes
  - `cargo test -p codex-core` integration target (`tests/all`) still
  shows pre-existing env-specific failures in this environment due missing
  `test_stdio_server` binary resolution; core unit tests are green.
  
  ## Codex author
  `codex resume 019c26ff-dfe7-7173-bc04-c9e1fff1e447`

  Charley Cunningham · 2026-02-04 23:03:28 -08:00
  41b4962b0a
• chore(config) Default Personality Pragmatic (#10705)

  ## Summary
  Switch back to Pragmatic personality
  
  ## Testing
  - [x] Updated unit tests

  Dylan Hurd · 2026-02-04 21:22:47 -08:00
  a05aadfa1b
• fix: ensure status indicator present earlier in exec path (#10700)

  ensure status indicator present in all classifications of exec tool.
  fixes indicator disappearing after preambles, will look into using
  `phase` to avoid this class of error in a few hours.
  
  commands parsed as unknown faced this issue
  
  tested locally, added test for specific failure flow

  sayan-oai · 2026-02-05 03:56:50 +00:00
  4ed8d74aab
• fix(tui): restore working shimmer after preamble output (#10701)

  ## Problem
  When a turn streamed a preamble line before any tool activity,
  `ChatWidget` hid the status row while committing streamed lines and did
  not restore it until a later event (commonly `ExecCommandBegin`). During
  that idle gap, the UI looked finished even though the turn was still
  active.
  
  ## Mental model
  The bottom status row and transcript stream are separate progress
  affordances:
  - transcript stream shows committed output
  - status row (spinner/shimmer + header) shows liveness of an active turn
  
  While stream output is actively committing, hiding the status row is
  acceptable to avoid redundant visual noise. Once stream controllers go
  idle, an active turn must restore the status row immediately so liveness
  remains visible across preamble-to-tool gaps.
  
  ## Non-goals
  - No changes to streaming chunking policy or pacing.
  - No changes to final completion behavior (status still hides when task
  actually ends).
  - No refactor of status lifecycle ownership between `ChatWidget` and
  `BottomPane`.
  
  ## Tradeoffs
  - We keep the existing behavior of hiding the status row during active
  stream commits.
  - We add explicit restoration on the idle boundary when the task is
  still running.
  - This introduces one extra status update on idle transitions, which is
  small overhead but makes liveness semantics consistent.
  
  ## Architecture
  `run_commit_tick_with_scope` in `chatwidget.rs` now documents and
  enforces a two-phase contract:
  1. For each committed streamed cell, hide status and append transcript
  output.
  2. If controllers are present and all idle, restore status iff task is
  still running, preserving the current header.
  
  This keeps status ownership in `ChatWidget` while relying on
  `BottomPane` helpers:
  - `hide_status_indicator()` during active stream commits
  - `ensure_status_indicator()` +
  `set_status_header(current_status_header)` at stream-idle boundary
  
  Documentation pass additions:
  - Clarified the function-level contract and lifecycle intent in
  `run_commit_tick_with_scope`.
  - Added an explicit regression snapshot test comment describing the
  failing sequence.
  
  ## Observability
  Signal that the fix is present:
  - In the preamble-idle state, rendered output still includes `• Working
  (… esc to interrupt)`.
  - New snapshot:
  `codex_tui__chatwidget__tests__preamble_keeps_working_status.snap`.
  
  Debug path for future regressions:
  - Start at `run_commit_tick_with_scope` for hide/restore transitions.
  - Verify `bottom_pane.is_task_running()` at idle transition.
  - Confirm `current_status_header` continuity when status is recreated.
  - Use the new snapshot and targeted test sequence to reproduce
  deterministic preamble-idle behavior.
  
  ## Tests
  - Updated regression assertion:
  - `streaming_final_answer_keeps_task_running_state` now expects status
  widget to remain present while turn is running.
  - Renamed/updated behavioral regression:
    - `preamble_keeps_status_indicator_visible_until_exec_begin`.
  - Added snapshot regression coverage:
    - `preamble_keeps_working_status_snapshot`.
  - Snapshot file:
  `tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__preamble_keeps_working_status.snap`.
  
  Commands run:
  - `just fmt`
  - `cargo test -p codex-tui
  preamble_keeps_status_indicator_visible_until_exec_begin`
  - `cargo test -p codex-tui preamble_keeps_working_status_snapshot`
  
  ## Risks / Inconsistencies
  - Status visibility policy is still split across multiple event paths
  (`commit tick`, `turn complete`, `exec begin`), so future regressions
  can reintroduce ordering gaps.
  - Restoration depends on `is_task_running()` correctness; if task
  lifecycle flags drift, status behavior will drift too.
  - Snapshot proves rendered state, not animation cadence; cadence still
  relies on frame scheduling behavior elsewhere.

  Josh McKinney · 2026-02-04 19:28:13 -08:00
  d876f3b94f
• add none personality option (#10688)

  - add none personality enum value and empty placeholder behavior\n- add
  docs/schema updates and e2e coverage

  Ahmed Ibrahim · 2026-02-04 15:40:33 -08:00
  f9c38f531c
• Add /debug-config slash command (#10642)

  <img width="409" height="175" alt="image"
  src="https://github.com/user-attachments/assets/76efe9c5-8375-4af3-b6af-bd9e162c1bc3"
  />

  gt-oai · 2026-02-04 22:26:17 +00:00
  d452bb3ae5
• Fix jitter in TUI apps/connectors picker (#10593)

  This PR fixes jitter in the TUI apps menu by making the description
  column stable during rendering and height measurement.
  Added a `stable_desc_col` option to
  `SelectionViewParams`/`ListSelectionView`, introduced stable variants of
  the shared row render/measure helpers in `selection_popup_common`, and
  enabled the stable mode for the apps/connectors picker in `chatwidget`.
  With these changes, only the apps/connectors picker uses this new
  option, though it could be used elsewhere in the future.
  
  Why: previously, the description column was computed from only currently
  visible rows, so as you scrolled or filtered, the column could shift and
  cause wrapping/height changes that looked jumpy. Computing it from all
  rows in this popup keeps alignment and layout consistent as users scroll
  through avaialble apps.
  
  
  
  **Before:**
  
  https://github.com/user-attachments/assets/3856cb72-5465-4b90-a993-65a2ffb09113
  
  
  
  
  
  **After:**
  
  https://github.com/user-attachments/assets/37b9d626-0b21-4c0f-8bb8-244c9ef971ff

  canvrno-oai · 2026-02-04 13:51:31 -08:00
  d589ee05b1
• feat: log webscocket timing into runtime metrics (#10577)
  Anton Panasenko · 2026-02-03 18:04:07 -08:00
  fcaed4cb88
• tui: make Esc clear request_user_input notes while notes are shown (#10569)

  ## Summary
  
  This PR updates the `request_user_input` TUI overlay so `Esc` is
  context-aware:
  
  - When notes are visible for an option question, `Esc` now clears notes
  and exits notes mode.
  - When notes are not visible (normal option selection UI), `Esc` still
  interrupts as before.
  
  It also updates footer guidance text to match behavior.
  
  ## Changes
  
  - Added a shared notes-clear path for option questions:
  - `Tab` and `Esc` now both clear notes and return focus to options when
  notes are visible.
  - Updated footer hint text in notes-visible state:
    - from: `tab to clear notes | ... | esc to interrupt`
    - to: `tab or esc to clear notes | ...`
  - Hid `esc to interrupt` hint while notes are visible for option
  questions.
  - Kept `esc to interrupt` visible and functional in normal
  option-selection mode.
  - Updated tests to assert the new `Esc` behavior in notes mode.
  - Updated snapshot output for the notes-visible footer row.
  - Updated docs in `docs/tui-request-user-input.md` to reflect
  mode-specific `Esc` behavior.

  Charley Cunningham · 2026-02-03 16:17:06 -08:00
  a9eb766f33
• feat(tui): pace catch-up stream chunking with hysteresis (#10461)

  ## Summary
  - preserve baseline streaming behavior (smooth mode still commits one
  line per 50ms tick)
  - extract adaptive chunking policy and commit-tick orchestration from
  ChatWidget into `streaming/chunking.rs` and `streaming/commit_tick.rs`
  - add hysteresis-based catch-up behavior with bounded batch draining to
  reduce queue lag without bursty single-frame jumps
  - document policy behavior, tuning guidance, and debug flow in rustdoc +
  docs
  
  ## Testing
  - just fmt
  - cargo test -p codex-tui

  Josh McKinney · 2026-02-03 15:01:51 -08:00
  aec58ac29b
• feat: add APIs to list and download public remote skills (#10448)

  Add API to list / download from remote public skills

  xl-openai · 2026-02-03 14:09:37 -08:00
  f38d181795
• Cleanup collaboration mode variants (#10404)

  ## Summary
  
  This PR simplifies collaboration modes to the visible set `default |
  plan`, while preserving backward compatibility for older partners that
  may still send legacy mode
  names.
  
  Specifically:
  - Renames the old Code behavior to **Default**.
  - Keeps **Plan** as-is.
  - Removes **Custom** mode behavior (fallbacks now resolve to Default).
  - Keeps `PairProgramming` and `Execute` internally for compatibility
  plumbing, while removing them from schema/API and UI visibility.
  - Adds legacy input aliasing so older clients can still send old mode
  names.
  
  ## What Changed
  
  1. Mode enum and compatibility
  - `ModeKind` now uses `Plan` + `Default` as active/public modes.
  - `ModeKind::Default` deserialization accepts legacy values:
    - `code`
    - `pair_programming`
    - `execute`
    - `custom`
  - `PairProgramming` and `Execute` variants remain in code but are hidden
  from protocol/schema generation.
  - `Custom` variant is removed; previous custom fallbacks now map to
  `Default`.
  
  2. Collaboration presets and templates
  - Built-in presets now return only:
    - `Plan`
    - `Default`
  - Template rename:
    - `core/templates/collaboration_mode/code.md` -> `default.md`
  - `execute.md` and `pair_programming.md` remain on disk but are not
  surfaced in visible preset lists.
  
  3. TUI updates
  - Updated user-facing naming and prompts from “Code” to “Default”.
  - Updated mode-cycle and indicator behavior to reflect only visible
  `Plan` and `Default`.
  - Updated corresponding tests and snapshots.
  
  4. request_user_input behavior
  - `request_user_input` remains allowed only in `Plan` mode.
  - Rejection messaging now consistently treats non-plan modes as
  `Default`.
  
  5. Schemas
  - Regenerated config and app-server schemas.
  - Public schema types now advertise mode values as:
    - `plan`
    - `default`
  
  ## Backward Compatibility Notes
  
  - Incoming legacy mode names (`code`, `pair_programming`, `execute`,
  `custom`) are accepted and coerced to `default`.
  - Outgoing/public schema surfaces intentionally expose only `plan |
  default`.
  - This allows tolerant ingestion of older partner payloads while
  standardizing new integrations on the reduced mode set.
  
  ## Codex author
  `codex fork 019c1fae-693b-7840-b16e-9ad38ea0bd00`

  Charley Cunningham · 2026-02-03 09:23:53 -08:00
  d509df676b
• chore: nuke chat/completions API (#10157)
  jif-oai · 2026-02-03 11:31:57 +00:00
  d2394a2494
• Restore status after preamble (#10465)
  pakrym-oai · 2026-02-02 20:35:50 -08:00
  bf87468c2b
• [Codex][CLI] Gate image inputs by model modalities (#10271)

  ###### Summary
  
  - Add input_modalities to model metadata so clients can determine
  supported input types.
  - Gate image paste/attach in TUI when the selected model does not
  support images.
  - Block submits that include images for unsupported models and show a
  clear warning.
  - Propagate modality metadata through app-server protocol/model-list
  responses.
    - Update related tests/fixtures.
  
    ###### Rationale
  
    - Models support different input modalities.
  - Clients need an explicit capability signal to prevent unsupported
  requests.
  - Backward-compatible defaults preserve existing behavior when modality
  metadata is absent.
  
    ###### Scope
  
    - codex-rs/protocol, codex-rs/core, codex-rs/tui
    - codex-rs/app-server-protocol, codex-rs/app-server
    - Generated app-server types / schema fixtures
  
    ###### Trade-offs
  
  - Default behavior assumes text + image when field is absent for
  compatibility.
    - Server-side validation remains the source of truth.
  
    ###### Follow-up
  
  - Non-TUI clients should consume input_modalities to disable unsupported
  attachments.
  - Model catalogs should explicitly set input_modalities for text-only
  models.
  
    ###### Testing
  
    - cargo fmt --all
    - cargo test -p codex-tui
    - env -u GITHUB_APP_KEY cargo test -p codex-core --lib
    - just write-app-server-schema
  - cargo run -p codex-cli --bin codex -- app-server generate-ts --out
  app-server-types
    - test against local backend
    
  <img width="695" height="199" alt="image"
  src="https://github.com/user-attachments/assets/d22dd04f-5eba-4db9-a7c5-a2506f60ec44"
  />
  
  ---------
  
  Co-authored-by: Josh McKinney <joshka@openai.com>

  Colin Young · 2026-02-02 18:56:39 -08:00
  7e07ec8f73
• app tool tip (#10454)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2026-02-03 02:37:01 +00:00
  0999fd82b9
• Hide short worked-for label in final separator (#10452)

  - Hide the "Worked for" label in the final message separator unless
  elapsed time is over one minute.\n- Update/add tests to cover both
  hidden (<60s) and shown (>=61s) behavior.

  Ahmed Ibrahim · 2026-02-03 02:29:20 +00:00
  97ff090104
• Fixed sandbox mode inconsistency if untrusted is selected (#10415)

  This PR addresses #10395
  
  When a user is asked to pick the trust level of a project, the code
  currently reloads the config if they select "trusted". It doesn't reload
  the config in the "untrusted" case but should. This causes the sandbox
  mode to be reported incorrectly in `/status` during the first run (it's
  displayed as `read-only` even though it acts as though it's
  `workspace-write`).

  Eric Traut · 2026-02-03 02:00:35 +00:00
  8dd41e229b
• feat: replace custom mcp-types crate with equivalents from rmcp (#10349)

  We started working with MCP in Codex before
  https://crates.io/crates/rmcp was mature, so we had our own crate for
  MCP types that was generated from the MCP schema:
  
  
  https://github.com/openai/codex/blob/8b95d3e082376f4cb23e92641705a22afb28a9da/codex-rs/mcp-types/README.md
  
  Now that `rmcp` is more mature, it makes more sense to use their MCP
  types in Rust, as they handle details (like the `_meta` field) that our
  custom version ignored. Though one advantage that our custom types had
  is that our generated types implemented `JsonSchema` and `ts_rs::TS`,
  whereas the types in `rmcp` do not. As such, part of the work of this PR
  is leveraging the adapters between `rmcp` types and the serializable
  types that are API for us (app server and MCP) introduced in #10356.
  
  Note this PR results in a number of changes to
  `codex-rs/app-server-protocol/schema`, which merit special attention
  during review. We must ensure that these changes are still
  backwards-compatible, which is possible because we have:
  
  ```diff
  - export type CallToolResult = { content: Array<ContentBlock>, isError?: boolean, structuredContent?: JsonValue, };
  + export type CallToolResult = { content: Array<JsonValue>, structuredContent?: JsonValue, isError?: boolean, _meta?: JsonValue, };
  ```
  
  so `ContentBlock` has been replaced with the more general `JsonValue`.
  Note that `ContentBlock` was defined as:
  
  ```typescript
  export type ContentBlock = TextContent | ImageContent | AudioContent | ResourceLink | EmbeddedResource;
  ```
  
  so the deletion of those individual variants should not be a cause of
  great concern.
  
  Similarly, we have the following change in
  `codex-rs/app-server-protocol/schema/typescript/Tool.ts`:
  
  ```
  - export type Tool = { annotations?: ToolAnnotations, description?: string, inputSchema: ToolInputSchema, name: string, outputSchema?: ToolOutputSchema, title?: string, };
  + export type Tool = { name: string, title?: string, description?: string, inputSchema: JsonValue, outputSchema?: JsonValue, annotations?: JsonValue, icons?: Array<JsonValue>, _meta?: JsonValue, };
  ```
  
  so:
  
  - `annotations?: ToolAnnotations` ➡️ `JsonValue`
  - `inputSchema: ToolInputSchema` ➡️ `JsonValue`
  - `outputSchema?: ToolOutputSchema` ➡️ `JsonValue`
  
  and two new fields: `icons?: Array<JsonValue>, _meta?: JsonValue`
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/10349).
  * #10357
  * __->__ #10349
  * #10356

  Michael Bolin · 2026-02-02 17:41:55 -08:00
  66447d5d2c
• TUI: Render request_user_input results in history and simplify interrupt handling (#10064)

  ## Summary
  This PR improves the TUI experience for `request_user_input` by
  rendering submitted question/answer sets directly in conversation
  history with clear, structured formatting.
  
  It also intentionally simplifies interrupt behavior for now: on `Esc` /
  `Ctrl+C`, the questions overlay interrupts the turn without attempting
  to submit partial answers.
  
  <img width="1344" height="573" alt="Screenshot 2026-02-02 at 4 51 40 PM"
  src="https://github.com/user-attachments/assets/ff752131-7060-44c1-9ded-af061969a533"
  />
  
  ## Scope
  - TUI-only changes.
  - No core/protocol/app-server behavior changes in this PR.
  - Resume reconstruction of interrupted question sets is out of scope for
  this PR.
  
  ## What Changed
  - Added a new history cell: `RequestUserInputResultCell` in
  `codex-rs/tui/src/history_cell.rs`.
  - On normal `request_user_input` submission, TUI now inserts that
  history cell immediately after sending `Op::UserInputAnswer`.
  - Rendering includes a `Questions` header with `answered/total` count.
  - Rendering shows each question as a bullet item.
  - Rendering styles submitted answer lines in cyan.
  - Rendering styles notes (for option questions) as `note:` lines in
  cyan.
  - Rendering styles freeform text (for no-option questions) as `answer:`
  lines in cyan.
  - Rendering dims only the `(unanswered)` suffix.
  - Rendering can include an interrupted suffix and summary text when the
  cell is marked interrupted.
  - Rendering redacts secret questions as `••••••` instead of showing raw
  values.
  - Added `wrap_with_prefix(...)` in `history_cell.rs` for wrapped
  prefixed lines.
  - Added `split_request_user_input_answer(...)` in `history_cell.rs` for
  decoding `"user_note: ..."` entries.
  
  ## Interrupt Behavior (Intentional for this PR)
  - `Esc` / `Ctrl+C` in the questions overlay now performs `Op::Interrupt`
  and exits the overlay.
  - It does **not** submit partial/committed answers on interrupt.
  - Added TODO comments in `request_user_input` overlay interrupt paths
  indicating where interrupted partial result emission should be
  reintroduced once core support is finalized.
  - Queued `request_user_input` overlays are discarded on interrupt in the
  current behavior.
  
  ## Tests Updated
  - Updated/added overlay tests in
  `codex-rs/tui/src/bottom_pane/request_user_input/mod.rs` to reflect
  interrupt-only behavior.
  - Added helper assertion for interrupt-only event expectation.
  - Existing submission-path tests now validate history insertion behavior
  and expected answer maps.
  
  ## Behavior Notes
  - Completed question flows now produce a readable `Questions` block in
  transcript history.
  - Interrupted flows currently do not persist partial answers to
  model-visible tool output.
  
  ## Follow-ups
  - Reintroduce partial-answer-on-interrupt semantics once core can
  persist/sequence interrupted `request_user_input` outputs safely.
  - Optionally add replay/resume rendering for interrupted question sets
  as a separate PR.
  
  ## Codex author
  `codex fork 019bfb8d-2a65-7313-9be2-ea7100d19a61`

  Charley Cunningham · 2026-02-02 17:41:30 -08:00
  8f5edddf71
• Fix plan implementation prompt reappearing after /agent thread switch (#10447)

  ## Summary
  
  This fixes a UX bug (https://github.com/openai/codex/issues/10442) where
  the **"Implement this plan?"** prompt could reappear after switching
  agents with `/agent` and then switching back to the original agent
  during plan execution.
  
  ## Root Cause
  
  On thread switch, the TUI rebuilds `ChatWidget`, replays buffered thread
  events, then drains any queued live events.
  
  In this flow, a `TurnComplete` can be handled twice for the same logical
  turn:
  1. replayed (`from_replay = true`)
  2. then live (`from_replay = false`)
  
  `ChatWidget` used `saw_plan_item_this_turn` to decide whether to show
  the plan implementation prompt, but that flag was only reset on
  `TurnStarted`.
  If duplicate completion events occurred, stale `saw_plan_item_this_turn
  = true` could cause the prompt to re-trigger unexpectedly.
  
  ## Fix
  
  - Clear `saw_plan_item_this_turn` at the end of `on_task_complete`,
  after prompt gating runs.
  - This keeps the flag truly turn-scoped and prevents duplicate
  `TurnComplete` handling from reopening the prompt.

  Charley Cunningham · 2026-02-02 17:40:05 -08:00
  1096d6453c
• emit a separate metric when the user cancels UAT during elevated setup (#10399)

  Currently this shows up as elevated setup failure, which isn't quite
  accurate.

  iceweasel-oai · 2026-02-02 15:31:08 -08:00
  a5066bef78