3066 Commits

• feat: load ExecPolicyManager from ConfigLayerStack (#8453)

  https://github.com/openai/codex/pull/8354 added support for in-repo
  `.config/` files, so this PR updates the logic for loading `*.rules`
  files to load `*.rules` files from all relevant layers. The main change
  to the business logic is `load_exec_policy()` in
  `codex-rs/core/src/exec_policy.rs`.
  
  Note this adds a `config_folder()` method to `ConfigLayerSource` that
  returns `Option<AbsolutePathBuf>` so that it is straightforward to
  iterate over the sources and get the associated config folder, if any.

  Michael Bolin · 2025-12-22 17:24:17 -08:00
  277babba79
• chore: include User layer in ConfigLayerStack even if config.toml is empty (#8456)

  This is necessary so that `$CODEX_HOME/skills` and `$CODEX_HOME/rules`
  still get loaded even if `$CODEX_HOME/config.toml` does not exist. See
  #8453.
  
  For now, it is possible to omit this layer when creating a dummy
  `ConfigLayerStack` in a test. We can revisit that later, if it turns out
  to be the right thing to do.

  Michael Bolin · 2025-12-22 16:40:26 -08:00
  14dbd0610a
• chore(tui): include tracing targets in file logs (#8418)

  with_target(true) is the default for tracing-subscriber, but we
  previously disabled it for file output.
  
  Keep it enabled so we can selectively enable specific targets/events at
  runtime via RUST_LOG=..., and then grep by target/module in the log file
  during troubleshooting.
  
  before and after:
  
  <img width="629" height="194" alt="image"
  src="https://github.com/user-attachments/assets/33f7df3f-0c5d-4d3f-b7b7-80b03d4acd21"
  />

  Josh McKinney · 2025-12-22 15:59:30 -08:00
  f6275a5142
• fix(tui2): copy transcript selection outside viewport (#8449)

  Copy now operates on the full logical selection range (anchor..head),
  not just the visible viewport, so selections that include offscreen
  lines copy the expected text.
  
  Selection extraction is factored into `transcript_selection` to make the
  logic easier to test and reason about. It reconstructs the wrapped
  visual transcript, renders each wrapped line into a 1-row offscreen
  Buffer, and reads the selected cells. This keeps clipboard text aligned
  with what is rendered (gutter, indentation, wrapping).
  
  Additional behavior:
  - Skip continuation cells for wide glyphs (e.g. CJK) so copied text does
  not include spurious spaces like "コ X".
  - Avoid copying right-margin padding spaces.
  
  Manual tested performed:
  - "tell me a story" a few times
  - scroll up, select text, scroll down, copy text
  - confirm copied text is what you expect

  Josh McKinney · 2025-12-22 15:24:52 -08:00
  7d0c5c7bd5
• feat: open prompt in configured external editor (#7606)

  Add `ctrl+g` shortcut to enable opening current prompt in configured
  editor (`$VISUAL` or `$EDITOR`).
  
  
  - Prompt is updated with editor's content upon editor close.
  - Paste placeholders are automatically expanded when opening the
  external editor, and are not "recompressed" on close
  - They could be preserved in the editor, but it would be hard to prevent
  the user from modifying the placeholder text directly, which would drop
  the mapping to the `pending_paste` value
  - Image placeholders stay as-is
  - `ctrl+g` explanation added to shortcuts menu, snapshot tests updated
  
  
  
  https://github.com/user-attachments/assets/4ee05c81-fa49-4e99-8b07-fc9eef0bbfce

  sayan-oai · 2025-12-22 15:12:23 -08:00
  4673090f73
• chore: add ConfigLayerStack as a field of Config (#8448)

  This should make it easier to load `.codex/skills/` and `.codex/rules/`
  properly throughout.

  Michael Bolin · 2025-12-22 14:16:33 -08:00
  8e900c210c
• remove minimal client version (#8447)

  This isn't needed value by client

  Ahmed Ibrahim · 2025-12-22 12:52:24 -08:00
  6b2ef216f1
• use a junction for the cwd while read ACLs are being applied (#8444)

  The elevated setup synchronously applies read/write ACLs to any
  workspace roots.
  
  However, until we apply *read* permission to the full path, powershell
  cannot use some roots as a cwd as it needs access to all parts of the
  path in order to apply it as the working directory for a command.
  
  The solution is, while the async read-ACL part of setup is running, use
  a "junction" that lives in C:\Users\CodexSandbox{Offline|Online} that
  points to the cwd.
  
  Once the read ACLs are applied, we stop using the junction.
  
  -----
  
  this PR also removes some dead code and overly-verbose logging, and has
  some light refactoring to the ACL-related functions

  iceweasel-oai · 2025-12-22 12:23:13 -08:00
  d65fe38b2c
• Update models.json (#8446)

  Automated update of models.json.
  
  Co-authored-by: aibrahim-oai <219906144+aibrahim-oai@users.noreply.github.com>

  github-actions[bot] · 2025-12-22 12:05:05 -08:00
  7809e36a92
• Handle concatenation nodes in bash command parser for exec policy (#8395)

  The bash command parser in exec_policy was failing to parse commands
  with concatenated flag-value patterns like `-g"*.py"` (no space between
  flag and quoted value). This caused policy rules like
  `prefix_rule(pattern=["rg"])` to not match commands such as `rg -n "foo"
  -g"*.py"`.
  
  When tree-sitter-bash parses `-g"*.py"`, it creates a "concatenation"
  node containing a word (`-g`) and a string (`"*.py"`). The parser
  previously rejected any node type not in the ALLOWED_KINDS list, causing
  the entire command parsing to fail and fall back to matching against the
  wrapped `bash -lc` command instead of the inner command.
  
  This change:
  - Adds "concatenation" to ALLOWED_KINDS in
  try_parse_word_only_commands_sequence
  - Adds handling for concatenation nodes in parse_plain_command_from_node
  that recursively extracts and joins word/string/raw_string children
  - Adds test cases for concatenated flag patterns with double and single
  quotes
  
  Fixes #8394

  Ivan Murashko · 2025-12-22 19:59:27 +00:00
  0237459f71
• feat: add support for project_root_markers in config.toml (#8359)

  - allow configuring `project_root_markers` in `config.toml`
  (user/system/MDM) to control project discovery beyond `.git`
  - honor the markers after merging pre-project layers; default to
  `[".git"]` when unset and skip ancestor walk when set to an empty array
  - document the option and add coverage for alternate markers in config
  loader tests

  Michael Bolin · 2025-12-22 19:45:45 +00:00
  314937fb11
• feat: support in-repo .codex/config.toml entries as sources of config info (#8354)

  - We now support `.codex/config.toml` in repo (from `cwd` up to the
  first `.git` found, if any) as layers in `ConfigLayerStack`. A new
  `ConfigLayerSource::Project` variant was added to support this.
  - In doing this work, I realized that we were resolving relative paths
  in `config.toml` after merging everything into one `toml::Value`, which
  is wrong: paths should be relativized with respect to the folder
  containing the `config.toml` that was deserialized. This PR introduces a
  deserialize/re-serialize strategy to account for this in
  `resolve_config_paths()`. (This is why `Serialize` is added to so many
  types as part of this PR.)
  - Added tests to verify this new behavior.
  
  
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/8354).
  * #8359
  * __->__ #8354

  Michael Bolin · 2025-12-22 11:07:36 -08:00
  8ff16a7714
• Add ExecPolicyManager (#8349)

  Move exec policy management into services to keep turn context
  immutable.

  pakrym-oai · 2025-12-22 09:59:32 -08:00
  96fdbdd434
• feat(windows) start powershell in utf-8 mode (#7902)

  ## Summary
  Adds a FeatureFlag to enforce UTF8 encoding in powershell, particularly
  Windows Powershell v5. This should help address issues like #7290.
  
  Notably, this PR does not include the ability to parse `apply_patch`
  invocations within UTF8 shell commands (calls to the freeform tool
  should not be impacted). I am leaving this out of scope for now. We
  should address before this feature becomes Stable, but those cases are
  not the default behavior at this time so we're okay for experimentation
  phase. We should continue cleaning up the `apply_patch::invocation`
  logic and then can handle it more cleanly.
  
  ## Testing
  - [x] Adds additional testing

  Dylan Hurd · 2025-12-22 09:36:44 -08:00
  33e1d0844a
• chore(deps): bump openssl-sys from 0.9.109 to 0.9.111 in /codex-rs (#8416)

  Bumps [openssl-sys](https://github.com/rust-openssl/rust-openssl) from
  0.9.109 to 0.9.111.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/rust-openssl/rust-openssl/releases">openssl-sys's
  releases</a>.</em></p>
  <blockquote>
  <h2>openssl-sys-v0.9.111</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Fix a few typos (most of them found with codespell) by <a
  href="https://github.com/botovq"><code>@​botovq</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2502">rust-openssl/rust-openssl#2502</a></li>
  <li>Use SHA256 test variant instead of SHA1 by <a
  href="https://github.com/abbra"><code>@​abbra</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2504">rust-openssl/rust-openssl#2504</a></li>
  <li>pin home to an older version on MSRV CI by <a
  href="https://github.com/alex"><code>@​alex</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2509">rust-openssl/rust-openssl#2509</a></li>
  <li>Implement set_rsa_oaep_label for AWS-LC/BoringSSL by <a
  href="https://github.com/goffrie"><code>@​goffrie</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2508">rust-openssl/rust-openssl#2508</a></li>
  <li>sys/evp: add EVP_MAC symbols by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2510">rust-openssl/rust-openssl#2510</a></li>
  <li>CI: bump LibreSSL 4.x branches to latest releases by <a
  href="https://github.com/botovq"><code>@​botovq</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2513">rust-openssl/rust-openssl#2513</a></li>
  <li>Fix unsound OCSP find_status handling of optional next_update field
  by <a href="https://github.com/alex"><code>@​alex</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2517">rust-openssl/rust-openssl#2517</a></li>
  <li>Release openssl v0.10.75 and openssl-sys v0.9.111 by <a
  href="https://github.com/alex"><code>@​alex</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2518">rust-openssl/rust-openssl#2518</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/abbra"><code>@​abbra</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2504">rust-openssl/rust-openssl#2504</a></li>
  <li><a href="https://github.com/goffrie"><code>@​goffrie</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2508">rust-openssl/rust-openssl#2508</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/rust-openssl/rust-openssl/compare/openssl-sys-v0.9.110...openssl-sys-v0.9.111">https://github.com/rust-openssl/rust-openssl/compare/openssl-sys-v0.9.110...openssl-sys-v0.9.111</a></p>
  <h2>openssl-sys-v0.9.110</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>[AIX] use /usr to find_openssl_dir by <a
  href="https://github.com/daltenty"><code>@​daltenty</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2401">rust-openssl/rust-openssl#2401</a></li>
  <li>Improve support for OPENSSL_NO_COMP and OPENSSL_NO_SRTP by <a
  href="https://github.com/justsmth"><code>@​justsmth</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2423">rust-openssl/rust-openssl#2423</a></li>
  <li>Add aws-lc-fips feature to allow linking the aws-lc-fips-sys crate
  by <a href="https://github.com/skmcgrail"><code>@​skmcgrail</code></a>
  in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2424">rust-openssl/rust-openssl#2424</a></li>
  <li>variety of fixes for warnings in new rust by <a
  href="https://github.com/alex"><code>@​alex</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2427">rust-openssl/rust-openssl#2427</a></li>
  <li>Some API adjustments for LibreSSL 4.2.0 by <a
  href="https://github.com/botovq"><code>@​botovq</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2426">rust-openssl/rust-openssl#2426</a></li>
  <li>Update OpenSSL documentation URLs to new docs.openssl.org domain by
  <a href="https://github.com/alex"><code>@​alex</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2430">rust-openssl/rust-openssl#2430</a></li>
  <li>pkey_ctx: add ability to generate DSA params &amp; keys by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2432">rust-openssl/rust-openssl#2432</a></li>
  <li>Run tests on windows-11-arm by <a
  href="https://github.com/saschanaz"><code>@​saschanaz</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2407">rust-openssl/rust-openssl#2407</a></li>
  <li>pkey_ctx: add ability to generate EC params &amp; keys by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2434">rust-openssl/rust-openssl#2434</a></li>
  <li>pkey_ctx: add ability to generate DH params &amp; keys by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2433">rust-openssl/rust-openssl#2433</a></li>
  <li>pkey_ctx: add ability to generate RSA keys by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2431">rust-openssl/rust-openssl#2431</a></li>
  <li>expose more verifier flags/errors for libressl by <a
  href="https://github.com/botovq"><code>@​botovq</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2441">rust-openssl/rust-openssl#2441</a></li>
  <li>sys/evp: set/get params bindings by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2436">rust-openssl/rust-openssl#2436</a></li>
  <li>Add support for argon2d and argon2i variants by <a
  href="https://github.com/greateggsgreg"><code>@​greateggsgreg</code></a>
  in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2416">rust-openssl/rust-openssl#2416</a></li>
  <li>Bump actions/checkout from 4 to 5 by <a
  href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
  in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2443">rust-openssl/rust-openssl#2443</a></li>
  <li>Update bindgen; Update MSRV to 1.70 by <a
  href="https://github.com/justsmth"><code>@​justsmth</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2438">rust-openssl/rust-openssl#2438</a></li>
  <li>macros: fully qualify imports by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2445">rust-openssl/rust-openssl#2445</a></li>
  <li>Disable AES-CFB128 ciphers for BoringSSL by <a
  href="https://github.com/alebastr"><code>@​alebastr</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2447">rust-openssl/rust-openssl#2447</a></li>
  <li>Fix missing &quot;__off_t&quot; on NetBSD 10 by <a
  href="https://github.com/alebastr"><code>@​alebastr</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2448">rust-openssl/rust-openssl#2448</a></li>
  <li>ML-KEM/ML-DSA part 1: openssl-sys changes by <a
  href="https://github.com/swenson"><code>@​swenson</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2450">rust-openssl/rust-openssl#2450</a></li>
  <li>sys: add symbols to construct an EVP_PKEY from a param builder by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2453">rust-openssl/rust-openssl#2453</a></li>
  <li>ec-point: add set_affine_coordinates by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2455">rust-openssl/rust-openssl#2455</a></li>
  <li>openssl-sys: add more functions to replace non-deprecated ones by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2457">rust-openssl/rust-openssl#2457</a></li>
  <li>ML-KEM/ML-DSA part 2: param builder by <a
  href="https://github.com/swenson"><code>@​swenson</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2451">rust-openssl/rust-openssl#2451</a></li>
  <li>ML-KEM/ML-DSA part 3: param array locate octet string by <a
  href="https://github.com/swenson"><code>@​swenson</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2458">rust-openssl/rust-openssl#2458</a></li>
  <li>sys: add encoder &amp; decoder symbols by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2454">rust-openssl/rust-openssl#2454</a></li>
  <li>Add bindings for SSL_CIPHER_get_protocol_id by <a
  href="https://github.com/jedenastka"><code>@​jedenastka</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2462">rust-openssl/rust-openssl#2462</a></li>
  <li>sys/evp: add EVP_PKEY_eq and EVP_PKEY_parameters_eq by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2463">rust-openssl/rust-openssl#2463</a></li>
  <li>openssl-sys: make it work without deprecated symbols by <a
  href="https://github.com/huwcbjones"><code>@​huwcbjones</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2452">rust-openssl/rust-openssl#2452</a></li>
  <li>drop old libressl versions by <a
  href="https://github.com/botovq"><code>@​botovq</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2473">rust-openssl/rust-openssl#2473</a></li>
  <li>Remove support for LibreSSL &lt; 2.8 by <a
  href="https://github.com/botovq"><code>@​botovq</code></a> in <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/pull/2475">rust-openssl/rust-openssl#2475</a></li>
  </ul>
  <!-- raw HTML omitted -->
  </blockquote>
  <p>... (truncated)</p>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/09b90d036ec5341deefb7fce86748e176379d01a"><code>09b90d0</code></a>
  Merge pull request <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2518">#2518</a>
  from alex/bump-for-release</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/26533f3027b893c52f1cbc40263900af57db5311"><code>26533f3</code></a>
  Release openssl v0.10.75 and openssl-sys v0.9.111</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/395eccaa49c9f77da27c64ba94c137b9aa27cc64"><code>395ecca</code></a>
  Merge pull request <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2517">#2517</a>
  from alex/claude/fix-ocsp-find-status-011CUqcGFNKeKJ...</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/cc2686771eae1a0dbb8783844aa4553b7f79144a"><code>cc26867</code></a>
  Fix unsound OCSP find_status handling of optional next_update field</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/95aa8e864296ef209ebba037ca6cd826adbda87a"><code>95aa8e8</code></a>
  Merge pull request <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2513">#2513</a>
  from botovq/libressl-stable</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/e735a321ffda5b38475c2c6b15f8737115d2cc98"><code>e735a32</code></a>
  CI: bump LibreSSL 4.x branches to latest releases</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/21ab91de2dda42515293dd69278347339453d824"><code>21ab91d</code></a>
  Merge pull request <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2510">#2510</a>
  from huwcbjones/huw/sys/evp-mac</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/d9161dcac16361ea79766629b45950da13f2c017"><code>d9161dc</code></a>
  sys/evp: add EVP_MAC symbols</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/3fd4bf2c86e23c1953783d1d29996dfd8dab173f"><code>3fd4bf2</code></a>
  Merge pull request <a
  href="https://redirect.github.com/rust-openssl/rust-openssl/issues/2508">#2508</a>
  from goffrie/oaep-label</li>
  <li><a
  href="https://github.com/rust-openssl/rust-openssl/commit/52022fd4725d60e59f68f35e148f47158909bc9c"><code>52022fd</code></a>
  Implement set_rsa_oaep_label for AWS-LC/BoringSSL</li>
  <li>Additional commits viewable in <a
  href="https://github.com/rust-openssl/rust-openssl/compare/openssl-sys-v0.9.109...openssl-sys-v0.9.111">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=openssl-sys&package-manager=cargo&previous-version=0.9.109&new-version=0.9.111)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-12-22 08:40:18 -07:00
  b24b7884c7
• chore(deps): bump clap from 4.5.47 to 4.5.53 in /codex-rs (#8414)

  Bumps [clap](https://github.com/clap-rs/clap) from 4.5.47 to 4.5.53.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/clap-rs/clap/releases">clap's
  releases</a>.</em></p>
  <blockquote>
  <h2>v4.5.53</h2>
  <h2>[4.5.53] - 2025-11-19</h2>
  <h3>Features</h3>
  <ul>
  <li>Add <code>default_values_if</code>,
  <code>default_values_ifs</code></li>
  </ul>
  <h2>v4.5.52</h2>
  <h2>[4.5.52] - 2025-11-17</h2>
  <h3>Fixes</h3>
  <ul>
  <li>Don't panic when <code>args_conflicts_with_subcommands</code>
  conflicts with an <code>ArgGroup</code></li>
  </ul>
  <h2>v4.5.51</h2>
  <h2>[4.5.51] - 2025-10-29</h2>
  <h3>Fixes</h3>
  <ul>
  <li><em>(help)</em> Correctly calculate padding for short flags that
  take a value</li>
  <li><em>(help)</em> Don't panic on short flags using
  <code>ArgAction::Count</code></li>
  </ul>
  <h2>v4.5.50</h2>
  <h2>[4.5.50] - 2025-10-20</h2>
  <h3>Features</h3>
  <ul>
  <li>Accept <code>Cow</code> where <code>String</code> and
  <code>&amp;str</code> are accepted</li>
  </ul>
  <h2>v4.5.48</h2>
  <h2>[4.5.48] - 2025-09-19</h2>
  <h3>Documentation</h3>
  <ul>
  <li>Add a new CLI Concepts document as another way of framing clap</li>
  <li>Expand the <code>typed_derive</code> cookbook entry</li>
  </ul>
  </blockquote>
  </details>
  <details>
  <summary>Changelog</summary>
  <p><em>Sourced from <a
  href="https://github.com/clap-rs/clap/blob/master/CHANGELOG.md">clap's
  changelog</a>.</em></p>
  <blockquote>
  <h2>[4.5.53] - 2025-11-19</h2>
  <h3>Features</h3>
  <ul>
  <li>Add <code>default_values_if</code>,
  <code>default_values_ifs</code></li>
  </ul>
  <h2>[4.5.52] - 2025-11-17</h2>
  <h3>Fixes</h3>
  <ul>
  <li>Don't panic when <code>args_conflicts_with_subcommands</code>
  conflicts with an <code>ArgGroup</code></li>
  </ul>
  <h2>[4.5.51] - 2025-10-29</h2>
  <h3>Fixes</h3>
  <ul>
  <li><em>(help)</em> Correctly calculate padding for short flags that
  take a value</li>
  <li><em>(help)</em> Don't panic on short flags using
  <code>ArgAction::Count</code></li>
  </ul>
  <h2>[4.5.50] - 2025-10-20</h2>
  <h3>Features</h3>
  <ul>
  <li>Accept <code>Cow</code> where <code>String</code> and
  <code>&amp;str</code> are accepted</li>
  </ul>
  <h2>[4.5.49] - 2025-10-13</h2>
  <h3>Fixes</h3>
  <ul>
  <li><em>(help)</em> Correctly wrap when ANSI escape codes are
  present</li>
  </ul>
  <h2>[4.5.48] - 2025-09-19</h2>
  <h3>Documentation</h3>
  <ul>
  <li>Add a new CLI Concepts document as another way of framing clap</li>
  <li>Expand the <code>typed_derive</code> cookbook entry</li>
  </ul>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/clap-rs/clap/commit/3716f9f4289594b43abec42b2538efd1a90ff897"><code>3716f9f</code></a>
  chore: Release</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/613b69a6b7bff729b7a363fa0c91fd03f48d12c3"><code>613b69a</code></a>
  docs: Update changelog</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/d117f7acdeedebaf5fd7847debb15c834423f159"><code>d117f7a</code></a>
  Merge pull request <a
  href="https://redirect.github.com/clap-rs/clap/issues/6028">#6028</a>
  from epage/arg</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/cb8255d2f3c7f12ebf07ec1c55ac98b6848599a9"><code>cb8255d</code></a>
  feat(builder): Allow quoted id's for arg macro</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/1036060f1319412d3d50d821a7b39a0a0122f0f7"><code>1036060</code></a>
  Merge pull request <a
  href="https://redirect.github.com/clap-rs/clap/issues/6025">#6025</a>
  from AldaronLau/typos-in-faq</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/2fcafc0aee6380e1f0c44a3e927cef1bfc88930e"><code>2fcafc0</code></a>
  docs: Fix minor grammar issues in FAQ</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/a380b65fe9eceade90bce8aeb13c205265fcceee"><code>a380b65</code></a>
  Merge pull request <a
  href="https://redirect.github.com/clap-rs/clap/issues/6023">#6023</a>
  from epage/template</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/4d7ab1483cd0f0849668d274aa2fb6358872eca9"><code>4d7ab14</code></a>
  chore: Update from _rust/main template</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/b8a7ea49d973a35bb6b3f43506b8319f340a20a4"><code>b8a7ea4</code></a>
  chore(deps): Update Rust Stable to v1.87 (<a
  href="https://redirect.github.com/clap-rs/clap/issues/18">#18</a>)</li>
  <li><a
  href="https://github.com/clap-rs/clap/commit/f9842b3b3f920ef64c5fc06298b4762018d88809"><code>f9842b3</code></a>
  chore: Avoid MSRV problems out of the box</li>
  <li>Additional commits viewable in <a
  href="https://github.com/clap-rs/clap/compare/clap_complete-v4.5.47...clap_complete-v4.5.53">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=clap&package-manager=cargo&previous-version=4.5.47&new-version=4.5.53)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-12-22 08:39:16 -07:00
  8d5ab97f2b
• chore(deps): bump landlock from 0.4.2 to 0.4.4 in /codex-rs (#8413)

  Bumps [landlock](https://github.com/landlock-lsm/rust-landlock) from
  0.4.2 to 0.4.4.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/landlock-lsm/rust-landlock/releases">landlock's
  releases</a>.</em></p>
  <blockquote>
  <h2>v0.4.4</h2>
  <p>See <a href="https://crates.io/crates/landlock/0.4.4">crate's
  metadata</a> and related <a
  href="https://docs.rs/landlock/0.4.4/landlock/">documentation</a>.</p>
  <h2>What's Changed</h2>
  <p>See summary in <a
  href="https://github.com/landlock-lsm/rust-landlock/blob/main/CHANGELOG.md#v044">CHANGELOG.md</a></p>
  <ul>
  <li>Bump MSRV to 1.68 by <a
  href="https://github.com/l0kod"><code>@​l0kod</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/112">landlock-lsm/rust-landlock#112</a></li>
  <li>Generate 64-bit and 32-bit bindings by <a
  href="https://github.com/l0kod"><code>@​l0kod</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/111">landlock-lsm/rust-landlock#111</a></li>
  <li>Print hints about Landlock ABI version by <a
  href="https://github.com/l0kod"><code>@​l0kod</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/103">landlock-lsm/rust-landlock#103</a></li>
  <li>Improve LandlockStatus by <a
  href="https://github.com/l0kod"><code>@​l0kod</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/113">landlock-lsm/rust-landlock#113</a></li>
  <li>Bump to v0.4.4 by <a
  href="https://github.com/l0kod"><code>@​l0kod</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/114">landlock-lsm/rust-landlock#114</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/landlock-lsm/rust-landlock/compare/v0.4.3...v0.4.4">https://github.com/landlock-lsm/rust-landlock/compare/v0.4.3...v0.4.4</a></p>
  <h2>v0.4.3</h2>
  <p>See <a href="https://crates.io/crates/landlock/0.4.3">crate's
  metadata</a> and related <a
  href="https://docs.rs/landlock/0.4.3/landlock/">documentation</a>.</p>
  <h2>What's Changed</h2>
  <p>See summary in <a
  href="https://github.com/landlock-lsm/rust-landlock/blob/main/CHANGELOG.md#v043">CHANGELOG.md</a></p>
  <ul>
  <li>tests: add case for AccessFs::from_file by <a
  href="https://github.com/n0toose"><code>@​n0toose</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/92">landlock-lsm/rust-landlock#92</a></li>
  <li>docs: add more background to PathBeneath example by <a
  href="https://github.com/n0toose"><code>@​n0toose</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/94">landlock-lsm/rust-landlock#94</a></li>
  <li>docs: extend CONTRIBUTING.md file by <a
  href="https://github.com/n0toose"><code>@​n0toose</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/95">landlock-lsm/rust-landlock#95</a></li>
  <li>Implement common traits for public types by <a
  href="https://github.com/l0kod"><code>@​l0kod</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/108">landlock-lsm/rust-landlock#108</a></li>
  <li>Bump to v0.4.3 by <a
  href="https://github.com/l0kod"><code>@​l0kod</code></a> in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/109">landlock-lsm/rust-landlock#109</a></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/n0toose"><code>@​n0toose</code></a> made
  their first contribution in <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/92">landlock-lsm/rust-landlock#92</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/landlock-lsm/rust-landlock/compare/v0.4.2...v0.4.3">https://github.com/landlock-lsm/rust-landlock/compare/v0.4.2...v0.4.3</a></p>
  </blockquote>
  </details>
  <details>
  <summary>Changelog</summary>
  <p><em>Sourced from <a
  href="https://github.com/landlock-lsm/rust-landlock/blob/main/CHANGELOG.md">landlock's
  changelog</a>.</em></p>
  <blockquote>
  <h2><a
  href="https://github.com/landlock-lsm/rust-landlock/releases/tag/v0.4.4">v0.4.4</a></h2>
  <h3>New API</h3>
  <ul>
  <li>Added support for all architectures ([PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/111">#111</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/111">landlock-lsm/rust-landlock#111</a>)).</li>
  <li>Added <code>LandlockStatus</code> type to query the running kernel
  and display information about available Landlock features ([PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/103">#103</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/103">landlock-lsm/rust-landlock#103</a>)
  and [PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/113">#113</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/113">landlock-lsm/rust-landlock#113</a>)).</li>
  </ul>
  <h3>Dependencies</h3>
  <ul>
  <li>Bumped MSRV to Rust 1.68 ([PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/112">#112</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/112">landlock-lsm/rust-landlock#112</a>)).</li>
  </ul>
  <h3>Testing</h3>
  <ul>
  <li>Extended CI to build and test on i686 architecture ([PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/111">#111</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/111">landlock-lsm/rust-landlock#111</a>)).</li>
  </ul>
  <h3>Example</h3>
  <ul>
  <li>Enhanced sandboxer example to print helpful hints about Landlock
  status ([PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/103">#103</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/103">landlock-lsm/rust-landlock#103</a>)).</li>
  </ul>
  <h2><a
  href="https://github.com/landlock-lsm/rust-landlock/releases/tag/v0.4.3">v0.4.3</a></h2>
  <h3>New API</h3>
  <ul>
  <li>Implemented common traits (e.g., <code>Debug</code>) for public
  types ([PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/108">#108</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/108">landlock-lsm/rust-landlock#108</a>)).</li>
  </ul>
  <h3>Documentation</h3>
  <ul>
  <li>Extended <a
  href="https://github.com/landlock-lsm/rust-landlock/blob/main/CONTRIBUTING.md">https://github.com/landlock-lsm/rust-landlock/blob/main/CONTRIBUTING.md</a>
  documentation with additional testing and development guidelines ([PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/95">#95</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/95">landlock-lsm/rust-landlock#95</a>)).</li>
  <li>Added more background information to <a
  href="https://landlock.io/rust-landlock/landlock/fn.path_beneath_rules.html"><code>path_beneath_rules()</code></a>
  documentation ([PR <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/94">#94</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/94">landlock-lsm/rust-landlock#94</a>)).</li>
  </ul>
  <h3>Testing</h3>
  <ul>
  <li>Added test case for <code>AccessFs::from_file()</code> method ([PR
  <a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/issues/92">#92</a>](<a
  href="https://redirect.github.com/landlock-lsm/rust-landlock/pull/92">landlock-lsm/rust-landlock#92</a>)).</li>
  </ul>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/89c56e2db04cf0a4d63e192e7b4371af516a1ccc"><code>89c56e2</code></a>
  lib: Bump to v0.4.4</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/4fbfbbc4c7d2e6db2642ec44ef1c8a78e7048479"><code>4fbfbbc</code></a>
  compat: Improve LandlockStatus</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/ec5e00b83bd2c6308967174c8910e86853e6b955"><code>ec5e00b</code></a>
  compat,sandboxer: Add LandlockStatus and print hints</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/f79da1808500110fd71f2b80e7ca81770b6bf2df"><code>f79da18</code></a>
  uapi: Generate bindings for all architectures</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/d29be586a50b0278822aee84a420b0cd22607a5b"><code>d29be58</code></a>
  cargo: Bump MSRV to 1.68</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/229f152d86c37e8881ea37dd6e29668f298d9056"><code>229f152</code></a>
  lib: Bump to v0.4.3</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/19f01a99752607e0f6b1872edf86690982c0e920"><code>19f01a9</code></a>
  compat: Implement common traits for public types</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/cb60a12f9b3d7fe55839863e8746ede6c3c77290"><code>cb60a12</code></a>
  contributing: Extend documentation</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/aa4029d129f5db8519027f15a1618c9d79c2e19b"><code>aa4029d</code></a>
  fs: Add more background to path_beneath_rules() doc</li>
  <li><a
  href="https://github.com/landlock-lsm/rust-landlock/commit/a7c2b3fe37f2d35f2359c4b1b5152258a474dbb1"><code>a7c2b3f</code></a>
  fs: Add test case for AccessFs::from_file</li>
  <li>See full diff in <a
  href="https://github.com/landlock-lsm/rust-landlock/compare/v0.4.2...v0.4.4">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=landlock&package-manager=cargo&previous-version=0.4.2&new-version=0.4.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-12-22 08:35:23 -07:00
  6c8470953f
• chore(deps): bump test-log from 0.2.18 to 0.2.19 in /codex-rs (#8412)

  Bumps [test-log](https://github.com/d-e-s-o/test-log) from 0.2.18 to
  0.2.19.
  <details>
  <summary>Release notes</summary>
  <p><em>Sourced from <a
  href="https://github.com/d-e-s-o/test-log/releases">test-log's
  releases</a>.</em></p>
  <blockquote>
  <h2>v0.2.19</h2>
  <h2>What's Changed</h2>
  <ul>
  <li>Adjusted <code>tracing</code> output to log to
  <code>stderr</code></li>
  </ul>
  <h2>New Contributors</h2>
  <ul>
  <li><a href="https://github.com/dbdr"><code>@​dbdr</code></a> made their
  first contribution in <a
  href="https://redirect.github.com/d-e-s-o/test-log/pull/64">d-e-s-o/test-log#64</a></li>
  </ul>
  <p><strong>Full Changelog</strong>: <a
  href="https://github.com/d-e-s-o/test-log/compare/v0.2.18...v0.2.19">https://github.com/d-e-s-o/test-log/compare/v0.2.18...v0.2.19</a></p>
  </blockquote>
  </details>
  <details>
  <summary>Changelog</summary>
  <p><em>Sourced from <a
  href="https://github.com/d-e-s-o/test-log/blob/main/CHANGELOG.md">test-log's
  changelog</a>.</em></p>
  <blockquote>
  <h2>0.2.19</h2>
  <ul>
  <li>Adjusted <code>tracing</code> output to log to
  <code>stderr</code></li>
  </ul>
  </blockquote>
  </details>
  <details>
  <summary>Commits</summary>
  <ul>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/b4cd4a3ab6cb86ff3729189fd2d7fbc3628943f6"><code>b4cd4a3</code></a>
  Bump version to 0.2.19</li>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/bafe834fe78c71b0472a1ff2f050a1d39f715e20"><code>bafe834</code></a>
  Emit tracing output to stderr</li>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/9e7aafbdcce972b9fd9c9bdb2dcfd4869dfd4a77"><code>9e7aafb</code></a>
  Bump actions/checkout from 5 to 6</li>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/7fc59759d8e27146cf90f8f858c900094c90a509"><code>7fc5975</code></a>
  Suggest using [dev-dependencies] instead of [dependencies] in
  README.md</li>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/25e7c367e6f106fdb92cc1f68d166d2a8bc7aa78"><code>25e7c36</code></a>
  Bump actions/checkout from 4 to 5</li>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/b6339268716592ee65db1cdb549c93b1b28d4404"><code>b633926</code></a>
  Address clippy reported issue</li>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/628feeea5abe02fbed854a6c201b8dfc84613787"><code>628feee</code></a>
  Don't specify patch level for dev-dependencies</li>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/d1a217e2e464905a3cddaa569d2382decf439df8"><code>d1a217e</code></a>
  Update rstest requirement from 0.25.0 to 0.26.1</li>
  <li><a
  href="https://github.com/d-e-s-o/test-log/commit/a2c6ba206eee3ca7d8286b353a70f70318ff824a"><code>a2c6ba2</code></a>
  Document private items in documentation CI job</li>
  <li>See full diff in <a
  href="https://github.com/d-e-s-o/test-log/compare/v0.2.18...v0.2.19">compare
  view</a></li>
  </ul>
  </details>
  <br />
  
  
  [![Dependabot compatibility
  score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=test-log&package-manager=cargo&previous-version=0.2.18&new-version=0.2.19)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
  
  Dependabot will resolve any conflicts with this PR as long as you don't
  alter it yourself. You can also trigger a rebase manually by commenting
  `@dependabot rebase`.
  
  [//]: # (dependabot-automerge-start)
  [//]: # (dependabot-automerge-end)
  
  ---
  
  <details>
  <summary>Dependabot commands and options</summary>
  <br />
  
  You can trigger Dependabot actions by commenting on this PR:
  - `@dependabot rebase` will rebase this PR
  - `@dependabot recreate` will recreate this PR, overwriting any edits
  that have been made to it
  - `@dependabot merge` will merge this PR after your CI passes on it
  - `@dependabot squash and merge` will squash and merge this PR after
  your CI passes on it
  - `@dependabot cancel merge` will cancel a previously requested merge
  and block automerging
  - `@dependabot reopen` will reopen this PR if it is closed
  - `@dependabot close` will close this PR and stop Dependabot recreating
  it. You can achieve the same result by closing it manually
  - `@dependabot show <dependency name> ignore conditions` will show all
  of the ignore conditions of the specified dependency
  - `@dependabot ignore this major version` will close this PR and stop
  Dependabot creating any more for this major version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this minor version` will close this PR and stop
  Dependabot creating any more for this minor version (unless you reopen
  the PR or upgrade to it yourself)
  - `@dependabot ignore this dependency` will close this PR and stop
  Dependabot creating any more for this dependency (unless you reopen the
  PR or upgrade to it yourself)
  
  
  </details>
  
  Signed-off-by: dependabot[bot] <support@github.com>
  Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

  dependabot[bot] · 2025-12-22 08:34:39 -07:00
  334dbe51c6
• chore: drop undo from the docs (#8431)
  jif-oai · 2025-12-22 15:09:48 +00:00
  45727b9ed3
• chore: un-ship undo (#8424)
  jif-oai · 2025-12-22 09:53:03 +01:00
  7a8407bbb6
• fix(tui2): constrain transcript mouse selection bounds (#8419)

  Ignore mouse events outside the transcript region so composer/footer
  interactions do not start or mutate transcript selection state.
  
  A left-click outside the transcript also cancels any active selection.
  Selection changes schedule a redraw because mouse events don't
  inherently trigger a frame.

  Josh McKinney · 2025-12-22 00:11:36 -08:00
  4e6d6cd798
• test(tui2): re-enable ANSI for VT100 tests (#8423)

  Codex Unified Exec injects NO_COLOR=1 (and TERM=dumb) into shell tool
  commands to keep output stable. Crossterm respects NO_COLOR and
  suppresses ANSI escapes, which breaks our VT100-backed tests that assert
  on parsed ANSI color output (they see vt100::Color::Default everywhere).
  
  Force ANSI color output back on in the VT100 test backend by overriding
  crossterm's memoized NO_COLOR setting in VT100Backend::new. This keeps
  Unified Exec behavior unchanged while making the VT100 tests meaningful
  and deterministic under Codex.
  
  > [!WARNING]  
  > it's possible that this might be a race condition problem for this and
  need to be solved a different way. Feel free to revert if it causes the
  opposite problem for other tests that assume NOCOLOR is set. If it does
  then we need to probably add some extra AGENTS.md lines for how to run
  tests when using unified exec.
  
  (this same change was made in tui, so it's probably safe).

  Josh McKinney · 2025-12-22 00:00:32 -08:00
  3c353a3aca
• fix: do not panic on alphas (#8406)

  alphas are used sometimes as stable release

  Ahmed Ibrahim · 2025-12-22 00:20:53 +00:00
  aa83d7da24
• Remove plan from system skills (#8374)

  Removes plan from system skills. It has been rewritten into
  `create-plan` for evaluation and feedback:
  https://github.com/openai/skills/pull/22

  Gav Verma · 2025-12-20 19:42:53 -08:00
  fab1ded484
• Chore: remove rmcp feature and exp flag usages (#8087)

  ### Summary
  With codesigning on Mac, Windows and Linux, we should be able to safely
  remove `features.rmcp_client` and `use_experimental_use_rmcp_client`
  check from the codebase now.

  Shijie Rao · 2025-12-20 14:18:00 -08:00
  987dd7fde3
• feat(tui2): tune scrolling inpu based on (#8357)

  ## TUI2: Normalize Mouse Scroll Input Across Terminals (Wheel +
  Trackpad)
  
  This changes TUI2 scrolling to a stream-based model that normalizes
  terminal scroll event density into consistent wheel behavior (default:
  ~3 transcript lines per physical wheel notch) while keeping trackpad
  input higher fidelity via fractional accumulation.
  
  Primary code: `codex-rs/tui2/src/tui/scrolling/mouse.rs`
  
  Doc of record (model + probe-derived data):
  `codex-rs/tui2/docs/scroll_input_model.md`
  
  ### Why
  
  Terminals encode both mouse wheels and trackpads as discrete scroll
  up/down events with direction but no magnitude, and they vary widely in
  how many raw events they emit per physical wheel notch (commonly 1, 3,
  or 9+). Timing alone doesn’t reliably distinguish wheel vs trackpad, so
  cadence-based heuristics are unstable across terminals/hardware.
  
  This PR treats scroll input as short *streams* separated by silence or
  direction flips, normalizes raw event density into tick-equivalents,
  coalesces redraws for dense streams, and exposes explicit config
  overrides.
  
  ### What Changed
  
  #### Scroll Model (TUI2)
  
  - Stream detection
    - Start a stream on the first scroll event.
    - End a stream on an idle gap (`STREAM_GAP_MS`) or a direction flip.
  - Normalization
  - Convert raw events into tick-equivalents using per-terminal
  `tui.scroll_events_per_tick`.
  - Wheel-like vs trackpad-like behavior
  - Wheel-like: fixed “classic” lines per wheel notch; flush immediately
  for responsiveness.
  - Trackpad-like: fractional accumulation + carry across stream
  boundaries; coalesce flushes to ~60Hz to avoid floods and reduce “stop
  lag / overshoot”.
  - Trackpad divisor is intentionally capped: `min(scroll_events_per_tick,
  3)` so terminals with dense wheel ticks (e.g. 9 events per notch) don’t
  make trackpads feel artificially slow.
  - Auto mode (default)
    - Start conservatively as trackpad-like (avoid overshoot).
  - Promote to wheel-like if the first tick-worth of events arrives
  quickly.
  - Fallback for 1-event-per-tick terminals (no tick-completion timing
  signal).
  
  #### Trackpad Acceleration
  
  Some terminals produce relatively low vertical event density for
  trackpad gestures, which makes large/faster swipes feel sluggish even
  when small motions feel correct. To address that, trackpad-like streams
  apply a bounded multiplier based on event count:
  
  - `multiplier = clamp(1 + abs(events) / scroll_trackpad_accel_events,
  1..scroll_trackpad_accel_max)`
  
  The multiplier is applied to the trackpad stream’s computed line delta
  (including carried fractional remainder). Defaults are conservative and
  bounded.
  
  #### Config Knobs (TUI2)
  
  All keys live under `[tui]`:
  
  - `scroll_wheel_lines`: lines per physical wheel notch (default: 3).
  - `scroll_events_per_tick`: raw vertical scroll events per physical
  wheel notch (terminal-specific default; fallback: 3).
  - Wheel-like per-event contribution: `scroll_wheel_lines /
  scroll_events_per_tick`.
  - `scroll_trackpad_lines`: baseline trackpad sensitivity (default: 1).
  - Trackpad-like per-event contribution: `scroll_trackpad_lines /
  min(scroll_events_per_tick, 3)`.
  - `scroll_trackpad_accel_events` / `scroll_trackpad_accel_max`: bounded
  trackpad acceleration (defaults: 30 / 3).
  - `scroll_mode = auto|wheel|trackpad`: force behavior or use the
  heuristic (default: `auto`).
  - `scroll_wheel_tick_detect_max_ms`: auto-mode promotion threshold (ms).
  - `scroll_wheel_like_max_duration_ms`: auto-mode fallback for
  1-event-per-tick terminals (ms).
  - `scroll_invert`: invert scroll direction (applies to wheel +
  trackpad).
  
  Config docs: `docs/config.md` and field docs in
  `codex-rs/core/src/config/types.rs`.
  
  #### App Integration
  
  - The app schedules follow-up ticks to close idle streams (via
  `ScrollUpdate::next_tick_in` and `schedule_frame_in`) and finalizes
  streams on draw ticks.
    - `codex-rs/tui2/src/app.rs`
  
  #### Docs
  
  - Single doc of record describing the model + preserved probe
  findings/spec:
    - `codex-rs/tui2/docs/scroll_input_model.md`
  
  #### Other (jj-only friendliness)
  
  - `codex-rs/tui2/src/diff_render.rs`: prefer stable cwd-relative paths
  when the file is under the cwd even if there’s no `.git`.
  
  ### Terminal Defaults
  
  Per-terminal defaults are derived from scroll-probe logs (see doc).
  Notable:
  
  - Ghostty currently defaults to `scroll_events_per_tick = 3` even though
  logs measured ~9 in one setup. This is a deliberate stopgap; if your
  Ghostty build emits ~9 events per wheel notch, set:
  
    ```toml
    [tui]
    scroll_events_per_tick = 9
    ```
  
  ### Testing
  
  - `just fmt`
  - `just fix -p codex-core --allow-no-vcs`
  - `cargo test -p codex-core --lib` (pass)
  - `cargo test -p codex-tui2` (scroll tests pass; remaining failures are
  known flaky VT100 color tests in `insert_history`)
  
  ### Review Focus
  
  - Stream finalization + frame scheduling in `codex-rs/tui2/src/app.rs`.
  - Auto-mode promotion thresholds and the 1-event-per-tick fallback
  behavior.
  - Trackpad divisor cap (`min(events_per_tick, 3)`) and acceleration
  defaults.
  - Ghostty default tradeoff (3 vs ~9) and whether we should change it.

  Josh McKinney · 2025-12-20 12:48:12 -08:00
  63942b883c
• chore: enusre the logic that creates ConfigLayerStack has access to cwd (#8353)

  `load_config_layers_state()` should load config from a
  `.codex/config.toml` in any folder between the `cwd` for a thread and
  the project root. Though in order to do that,
  `load_config_layers_state()` needs to know what the `cwd` is, so this PR
  does the work to thread the `cwd` through for existing callsites.
  
  A notable exception is the `/config` endpoint in app server for which a
  `cwd` is not guaranteed to be associated with the query, so the `cwd`
  param is `Option<AbsolutePathBuf>` to account for this case.
  
  The logic to make use of the `cwd` will be done in a follow-up PR.

  Michael Bolin · 2025-12-19 20:11:27 -08:00
  a6974087e5
• Rename OpenAI models to models manager (#8346)

  # External (non-OpenAI) Pull Request Requirements
  
  Before opening this Pull Request, please read the dedicated
  "Contributing" markdown file or your PR may be closed:
  https://github.com/openai/codex/blob/main/docs/contributing.md
  
  If your PR conforms to our contribution guidelines, replace this text
  with a detailed and high quality description of your changes.
  
  Include a link to a bug report or enhancement request.

  Ahmed Ibrahim · 2025-12-19 16:20:05 -08:00
  f0dc6fd3c7
• feat: support allowed_sandbox_modes in requirements.toml (#8298)

  This adds support for `allowed_sandbox_modes` in `requirements.toml` and
  provides legacy support for constraining sandbox modes in
  `managed_config.toml`. This is converted to `Constrained<SandboxPolicy>`
  in `ConfigRequirements` and applied to `Config` such that constraints
  are enforced throughout the harness.
  
  Note that, because `managed_config.toml` is deprecated, we do not add
  support for the new `external-sandbox` variant recently introduced in
  https://github.com/openai/codex/pull/8290. As noted, that variant is not
  supported in `config.toml` today, but can be configured programmatically
  via app server.

  Michael Bolin · 2025-12-19 21:09:20 +00:00
  dc61fc5f50
• feat: move file name derivation into codex-file-search (#8334)

  ## Summary
  
    - centralize file name derivation in codex-file-search
    - reuse the helper in app-server fuzzy search to avoid duplicate logic
    - add unit tests for file_name_from_path
  
    ## Testing
  
    - cargo test -p codex-file-search
    - cargo test -p codex-app-server

  RQfreefly · 2025-12-19 12:50:55 -08:00
  ec3738b47e
• feat(tui2): coalesce transcript scroll redraws (#8295)

  Problem
  - Mouse wheel events were scheduling a redraw on every event, which
  could backlog and create lag during fast scrolling.
  
  Solution
  - Schedule transcript scroll redraws with a short delay (16ms) so the
  frame requester coalesces bursts into fewer draws.
  
  Why
  - Smooths rapid wheel scrolling while keeping the UI responsive.
  
  Testing
  - Manual: Scrolled in iTerm and Ghostty; no lag observed.
  - `cargo clippy --fix --all-features --tests --allow-dirty
  --allow-no-vcs -p codex-tui2`

  Josh McKinney · 2025-12-19 12:19:01 -08:00
  1d4463ba81
• Update models.json (#8168)

  Automated update of models.json.
  
  Co-authored-by: aibrahim-oai <219906144+aibrahim-oai@users.noreply.github.com>

  github-actions[bot] · 2025-12-19 12:06:34 -08:00
  e3d3445748
• fix: enable resume_warning that was missing from mod.rs (#8333)

  This test was introduced in https://github.com/openai/codex/pull/6507,
  but was not included in `mod.rs`. It does not appear that it was getting
  compiled?

  Michael Bolin · 2025-12-19 19:21:47 +00:00
  0a7021de72
• feat: make ConstraintError an enum (#8330)

  This will make it easier to test for expected errors in unit tests since
  we can compare based on the field values rather than the message (which
  might change over time). See https://github.com/openai/codex/pull/8298
  for an example.
  
  It also ensures more consistency in the way a `ConstraintError` is
  constructed.

  Michael Bolin · 2025-12-19 19:03:50 +00:00
  7e5c343ef5
• Fix: /undo destructively interacts with git staging (#8214) (#8303)

  Fixes #8214 by removing the '--staged' flag from the undo git restore
  command. This ensures that while the working tree is reverted to the
  snapshot state, the user's staged changes (index) are preserved,
  preventing data loss. Also adds a regression test.

  GalaxyDetective · 2025-12-19 10:07:41 -08:00
  014235f533
• Update system skills from OSS repo (#8328)

  https://github.com/openai/skills/tree/main/skills/.system

  Gav Verma · 2025-12-19 09:31:04 -08:00
  37071e7e5c
• Revert "Keep skills feature flag default OFF for windows." (#8325)

  Reverts openai/codex#8308

  xl-openai · 2025-12-19 16:22:14 +00:00
  eeda6a5004
• Keep skills feature flag default OFF for windows. (#8308)

  Keep windows OFF first.

  xl-openai · 2025-12-18 21:57:15 -08:00
  6f94a90797
• Fix admin skills. (#8305)

  We were assembling the skill roots in two different places, and the
  admin root was missing in one of them. This change centralizes root
  selection into a helper so both paths stay in sync.

  xl-openai · 2025-12-19 04:10:19 +00:00
  339b052d68
• Add short descriptions to system skills (#8301)
  Gav Verma · 2025-12-19 02:44:53 +00:00
  f4371d2f6c
• Support admin scope skills. (#8296)

  a new scope reads from /etc/codex

  xl-openai · 2025-12-19 02:28:56 +00:00
  8120c8765b
• skills feature default on. (#8297)

  skills default on.

  xl-openai · 2025-12-18 18:26:46 -08:00
  d35337227a
• Fix tests (#8299)

  Fix broken tests.

  xl-openai · 2025-12-19 02:07:23 +00:00
  ba835c3c36
• UI tweaks on skills popup. (#8250)

  Only display the skill name (not the folder), and truncate the skill
  description to a maximum of two lines.

  xl-openai · 2025-12-19 01:16:51 +00:00
  dcc01198e2
• feat: collapse "waiting" of unified_exec (#8257)

  Screenshots here but check the snapshot files to see it better
  <img width="712" height="408" alt="Screenshot 2025-12-18 at 11 58 02"
  src="https://github.com/user-attachments/assets/84a2c410-0767-4870-84d1-ae1c0d4c445e"
  />
  <img width="523" height="352" alt="Screenshot 2025-12-18 at 11 17 41"
  src="https://github.com/user-attachments/assets/d029c7ea-0feb-4493-9dca-af43a0c70c52"
  />

  jif-oai · 2025-12-18 17:03:43 -08:00
  6c76d17713
• feat: introduce ExternalSandbox policy (#8290)

  ## Description
  
  Introduced `ExternalSandbox` policy to cover use case when sandbox
  defined by outside environment, effectively it translates to
  `SandboxMode#DangerFullAccess` for file system (since sandbox configured
  on container level) and configurable `network_access` (either Restricted
  or Enabled by outside environment).
  
  as example you can configure `ExternalSandbox` policy as part of
  `sendUserTurn` v1 app_server API:
  
  ```
   {
              "conversationId": <id>,
              "cwd": <cwd>,
              "approvalPolicy": "never",
              "sandboxPolicy": {
                    "type": ""external-sandbox",
                    "network_access": "enabled"/"restricted"
              },
              "model": <model>,
              "effort": <effort>,
              ....
          }
  ```

  Anton Panasenko · 2025-12-18 17:02:03 -08:00
  3429de21b3
• chore: migrate from Config::load_from_base_config_with_overrides to ConfigBuilder (#8276)

  https://github.com/openai/codex/pull/8235 introduced `ConfigBuilder` and
  this PR updates all call non-test call sites to use it instead of
  `Config::load_from_base_config_with_overrides()`.
  
  This is important because `load_from_base_config_with_overrides()` uses
  an empty `ConfigRequirements`, which is a reasonable default for testing
  so the tests are not influenced by the settings on the host. This method
  is now guarded by `#[cfg(test)]` so it cannot be used by business logic.
  
  Because `ConfigBuilder::build()` is `async`, many of the test methods
  had to be migrated to be `async`, as well. On the bright side, this made
  it possible to eliminate a bunch of `block_on_future()` stuff.

  Michael Bolin · 2025-12-18 16:12:52 -08:00
  3d4ced3ff5
• fix: remove duplicate shell_snapshot FeatureSpec (#8274)

  regression: #8199
  
  Signed-off-by: Koichi Shiraishi <zchee.io@gmail.com>

  Koichi Shiraishi · 2025-12-18 15:55:47 -08:00
  2d9826098e
• fix: change codex/sandbox-state/update from a notification to a request (#8142)

  Historically, `accept_elicitation_for_prompt_rule()` was flaky because
  we were using a notification to update the sandbox followed by a `shell`
  tool request that we expected to be subject to the new sandbox config,
  but because [rmcp](https://crates.io/crates/rmcp) MCP servers delegate
  each incoming message to a new Tokio task, messages are not guaranteed
  to be processed in order, so sometimes the `shell` tool call would run
  before the notification was processed.
  
  Prior to this PR, we relied on a generous `sleep()` between the
  notification and the request to reduce the change of the test flaking
  out.
  
  This PR implements a proper fix, which is to use a _request_ instead of
  a notification for the sandbox update so that we can wait for the
  response to the sandbox request before sending the request to the
  `shell` tool call. Previously, `rmcp` did not support custom requests,
  but I fixed that in
  https://github.com/modelcontextprotocol/rust-sdk/pull/590, which made it
  into the `0.12.0` release (see #8288).
  
  This PR updates `shell-tool-mcp` to expect
  `"codex/sandbox-state/update"` as a _request_ instead of a notification
  and sends the appropriate ack. Note this behavior is tied to our custom
  `codex/sandbox-state` capability, which Codex honors as an MCP client,
  which is why `core/src/mcp_connection_manager.rs` had to be updated as
  part of this PR, as well.
  
  This PR also updates the docs at `shell-tool-mcp/README.md`.

  Michael Bolin · 2025-12-18 15:32:01 -08:00
  46baedd7cb
• Support skills shortDescription. (#8278)

  Allow SKILL.md to specify a more human-readable short description as
  skill metadata.

  xl-openai · 2025-12-18 23:13:18 +00:00
  358a5baba0